X230 Coreboot Compatibility & Flashing

Hello! Welcome to the third module of our course on building your secure ThinkPad.

In the previous modules, we laid the theoretical groundwork, defining threat models and analyzing the security risks of proprietary firmware. Now, we move from theory to practice. This module, "Coreboot: Preparation and Build," is where we get our hands dirty and start creating our custom firmware.

This first lesson is all about reconnaissance. Before we can build or flash Coreboot, we must become experts on the specific hardware of your x230. Think of it as the "measure twice, cut once" principle of firmware surgery.

Lesson Outline

Today, you will learn to:

• Research the specific hardware components of your x230.
• Confirm Coreboot compatibility.
• Identify the correct external flashing procedure.

This involves identifying the necessary tools, locating the physical BIOS chips on the motherboard, determining their exact models, and understanding how to establish a connection to them for reading and writing.

Estimated time to complete: 60 minutes.

---

1. Pre-flight Check: Updating Your Current BIOS

Before we replace the proprietary BIOS, it's a best practice to ensure it and the Embedded Controller (EC) firmware are updated to the latest official versions from Lenovo. The EC is a separate microcontroller on the motherboard that handles tasks like power management, battery charging, and the keyboard. Its firmware is updated via the BIOS, but Coreboot cannot update it. Getting it to the latest stable version now prevents potential compatibility issues later.

This is a crucial first step in the flashing procedure.

> **📖 Reading (5 mins)** > > Please read the first section, "Update the x230 BIOS," in the following blog post. This explains the rationale and provides a direct link to the necessary update utility from Lenovo. You should bookmark this link for when you are ready to perform the update. > > [How to install coreboot on a Lenovo x230 - stafwag Blog (Update the x230 BIOS)](https://stafwag.github.io/blog/blog/2022/01/21/install_coreboot_on_x230/)

2. Assembling Your Toolkit: The Hardware for Flashing

The firmware on the x230's BIOS chips is protected against software-based modification. This is a security feature to prevent malware from maliciously overwriting the BIOS. To install Coreboot, we must bypass this protection by physically connecting directly to the BIOS chips. This process is called external flashing.

This requires a specific set of tools. You don't need to purchase them just yet, but you must understand what they are and what role they play.

> **📖 Reading (5 mins)** > > Read the "Necessary Equipment" section of this article. It provides a clear list and description of the tools you'll need. Pay attention to the function of the **SPI Flash Programmer** (the Raspberry Pi), the **SOIC-8 Clip**, and the jumper wires. > > [Coreboot for x230 - Kenny Ballou (Necessary Equipment)](https://kennyballou.com/blog/2017/01/coreboot-x230/)
> **📺 Viewing (2 mins)** > > To see what these tools look like in action, watch the beginning of this video. The presenter shows the Raspberry Pi, the SOIC8 clip, and the jumper cables and gives a brief overview of how they connect. > > *Note: The video is for an x220, but the tools and general process are identical.* > > @@ytvideo[hERguULT7Vo]{00:00:53-00:04:43}

3. The Treasure Hunt: Locating and Identifying the BIOS Chips

Now that you know what tools you need, the next step is to find what you'll be using them on. The x230's firmware is stored across two separate flash memory chips on the motherboard. Your main research task is to locate and precisely identify these chips.

3.1. Physical Location

First, you need to access the motherboard. For the x230, this is fortunately quite simple and only requires removing the battery, keyboard, and palm rest.

📖 Reading (5 mins)

Read the "Disassembly and BIOS Access" section of the article below. It describes the minimal disassembly needed and includes a clear photograph showing the location of the two BIOS chips under a protective film.

Coreboot for x230 - Kenny Ballou (Disassembly and BIOS Access)

A Note on ESD: When you eventually perform this disassembly, you'll be handling sensitive electronics. You must take precautions against Electrostatic Discharge (ESD), which can permanently damage components. This involves working on a non-conductive surface and grounding yourself, for example, by wearing an anti-static wrist strap. We will cover this in more detail in the next module before you perform the actual "surgery."

3.2. The Two-Chip Architecture

As you saw in the photo, the x230 has two chips. This is a key architectural detail.

• The bottom chip (closer to the trackpad) is 8MB and holds the Intel Management Engine (ME), Gigabit Ethernet firmware, and other data.
• The top chip (closer to the screen) is 4MB and holds the main BIOS/UEFI code.

This separation is different from the older x220, and it has important implications for the Coreboot process.

📺 Viewing (1 min)

Watch this short segment. The presenter clearly explains the difference between the single-chip x220 and the two-chip x230, and why this architecture actually simplifies the Coreboot installation process for the x230.

3.3. Chip Identification

While many x230s use the same chips, variations exist. For a successful and recoverable flash, you must confirm the exact model of the chips in your specific machine. The model number is printed directly on the chip's surface, but it is incredibly small.

• As the "Coreboot for x230" article emphasizes, using a magnifying lens is essential for this step.
• The "stafwag Blog" provides the most common chip models found in the x230, which you can use as a reference.

📖 Reading (5 mins)

Read the "Get the chip types" section of the stafwag blog. Note down the common chip models for the top and bottom ROMs. This is the information you will be trying to verify on your own machine.

How to install coreboot on a Lenovo x230 - stafwag Blog (Identify BIOS Chip Types and Backup)

This physical inspection is the most critical piece of hardware research you will perform. In the next step, we'll see how to verify this digitally.

4. The Flashing Procedure: Theory and Verification

Identifying the procedure means understanding how to connect your tools to the chips and how to use software to communicate with them.

4.1. The Physical Connection: Pinouts

The heart of the procedure is connecting the Raspberry Pi's General Purpose Input/Output (GPIO) pins to the correct pins on the SOIC8 clip, which then attaches to the BIOS chip. A pinout is a diagram or table that describes this mapping.

Each pin on the BIOS chip has a specific function (e.g., Clock, Data In, Data Out, Chip Select). You must connect each of these to a corresponding SPI (Serial Peripheral Interface) pin on the Raspberry Pi.

📖 Reading (10 mins)

The two articles below provide wiring diagrams. Study them both.

1. How to install coreboot on a Lenovo x230 - stafwag Blog (Open the Laptop and Wiring)
   • This gives a clean table mapping the chip's pin number to the Raspberry Pi's physical pin number. It also includes a crucial tip about providing a stable 3.3V power source.
2. Coreboot for x230 - Kenny Ballou (Connecting the Raspberry Pi to the SOIC Clip)
   • This guide describes the same connections but references the GPIO numbers (e.g., GPIO 26) instead of the physical pin numbers. It's a good exercise to cross-reference this with a Raspberry Pi GPIO diagram to see that it maps to the same physical pins as the other guide.

Your goal here is not to memorize the pinout, but to understand that a precise, well-documented mapping is required.

4.2. The Digital Handshake: flashrom

Once the hardware is connected, you use a command-line utility called flashrom to interact with the chip. Your first use of flashrom isn't to write anything, but simply to read from the chip to verify two things:

1. That your physical connection is correct and stable.
2. That you have correctly identified the chip model.

flashrom will probe the chip and report the model(s) it detects.

📖 Reading (10 mins)

Read the following sections to understand how flashrom is used for this verification step. Pay close attention to the commands and the expected output.

1. Coreboot for x230 - Kenny Ballou (Using the Raspberry Pi (Reading the ROM))
   • This section shows the initial flashrom command and its output when it detects multiple possible chip definitions. It then shows how to specify the chip with the -c flag.
2. How to install coreboot on a Lenovo x230 - stafwag Blog (Test Connection to Flash Chip)
   • This section provides similar examples and introduces a very useful troubleshooting tip: using the spispeed parameter to establish a more reliable initial connection.

The key command structure you'll see is:
flashrom -p linux_spi:dev=/dev/spidev0.0 -c "CHIP_MODEL"

• -p specifies the programmer, in this case the Linux SPI interface on the Pi.
• -c specifies the chip model you identified, which helps flashrom communicate correctly.

If flashrom successfully identifies your chip and reports its size (e.g., "4096 kB" for the top chip), you have successfully completed your research and identified the correct flashing procedure.

---

Conclusion

Excellent work. This lesson was a deep dive into the preparatory research that underpins the entire Coreboot process. You haven't modified your laptop yet, but you have built the essential "map" you'll need to navigate the next steps safely.

Key Takeaways:

• Pre-flight Check: Updating the proprietary BIOS/EC firmware is a critical first step to ensure maximum compatibility.
• External Flashing Tools: A Raspberry Pi, SOIC8 clip, and jumper wires are required to bypass software locks and physically access the BIOS chips.
• x230 Hardware: The x230 uses a two-chip system: a 4MB top chip for the BIOS and an 8MB bottom chip for the Intel ME and other data.
• Identification is Key: You must physically locate the chips, identify their exact model numbers with a magnifier, and then digitally verify this information using flashrom.
• The Flashing Procedure: The procedure consists of connecting the Pi to the chip using a specific pinout and using the flashrom utility to communicate with it.

Next Up

In the next lesson, we will build on this knowledge. You will learn how to use the tools and procedures identified today to create multiple, verified backups of your original firmware—an absolutely critical step before we attempt to write anything new. We will also identify and prepare the other tools needed for the process, such as the me_cleaner script.