Branch: master
Find file History
merge x230: increase rpi's spispeed
While I think I have initially used 128 from some libreboot docs and never
had problems with it, I don't really see anybody use less than 512 right
Latest commit c20203d Feb 5, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore x230: improve the build script Jan 18, 2019
LICENSE refactor to make the project hold any other devices too Apr 21, 2018
NEWS x230: increase rpi's spispeed Feb 11, 2019 x230: README: avoid confusion in our 8M external flashing docs Feb 8, 2019
bootsplash.jpg x230: update the bootsplash image and add an XCF version Jan 15, 2019
bootsplash.xcf x230: update the bootsplash image and add an XCF version Jan 15, 2019 feat(x230): update to use defconfigs Feb 2, 2019
ch341a.jpg add copyright notice to copied scripts Jun 18, 2018 x230: increase rpi's spispeed Feb 11, 2019 x230: increase rpi's spispeed Feb 11, 2019
free-defconfig-cd97982e2e feat(x230): replace configs with defconfigs Feb 2, 2019
front.jpg x230: replace the front photo with one of the splashscreen logo Jan 18, 2019
nonfree-defconfig-cd97982e2e feat(x230): replace configs with defconfigs Feb 2, 2019
pci8086,0166.rom refactor to make the project hold any other devices too Apr 21, 2018 x230: add a second image to the release package Nov 23, 2018
rpi_clip.jpg move x230 images to x230 Apr 21, 2018 x230: warn if running build or upgrade as root Jul 12, 2018 x230: upgrade: detect development version if version higher than release Jul 23, 2018 x230: skip ram voltage check Jan 9, 2019 x230: add skulls_common script for functions Jul 12, 2018 x230: improve the documentation of the different release images / con… Jan 17, 2019

Skulls - Thinkpad X230 and X230T


Latest release

Get it from our release page

  • coreboot: We take coreboot's master branch at the time we build a release image.
  • microcode update: revision 20 from 2018-04-10 (includes mitigations for Spectre Variant 3a and 4)
  • SeaBIOS: version 1.12.0 from 2018-11-17

release images to choose from

We release multiple different, but very similar images you can choose from. They all should work on all versions of the X230/X230T. These are the differences; (xxxxxxxxxx stands for random characters in the filename):

  • x230_coreboot_seabios_xxxxxxxxxx_top.rom includes the proprietary VGA BIOS from Intel which is non-free software. It is executed in "secure" mode.
  • x230_coreboot_seabios_free_xxxxxxxxxx_top.rom includes the VGA BIOS SeaVGABIOS which is free software. While technically more interesting, visually this is currently not as beautiful:

table of contents


  1. run sudo ./ on your current X230 Linux system
  2. Power down, remove the battery. Remove the keyboard and palmrest. Connect a hardware flasher to an external PC (or a Raspberry Pi with a SPI 8-pin chip clip can directly be used), and run sudo ./ on the lower chip and sudo ./ on the top chip of the two.
  3. For updating later, run ./ No need to disassemble.

And always use the latest released package. This will be tested. The git master branch is not meant to be stable. Use it for testing only.

First-time installation

before you begin

Before starting, run Linux on your X230, install dmidecode and run sudo ./ It simply prints system information and helps you to be up to date. Also make sure you have the latest skulls-x230 package release by running ./

original BIOS update / EC firmware (optional)

Before flashing coreboot, consider doing one original Lenovo upgrade process in case you're not running the latest version. This is not supported anymore, once you're running coreboot (You'd have to manually flash back your backup images first, see later chapters).

Also, this updates the BIOS and Embedded Controller (EC) firmware. The EC is not updated anymore, when running coreboot. The latest EC version is 1.14 and that's unlikely to change.

In case you're not running the latest BIOS version, either

  • use the latest original CD and burn it, or

  • use the same, only with a patched EC firmware that allows using any aftermarket-battery: By default, only original Lenovo batteries are allowed. Thanks to this project we can use Lenovo's bootable upgrade image, change it and create a bootable USB image, with an EC update that allows us to use any 3rd party aftermarket battery:

      sudo apt-get install build-essential git mtools libssl-dev
      git clone && cd thinkpad-ec
      make patch_disable_keyboard clean
      make patch_enable_battery clean
      make patched.x230.img

That's it. You can create a bootable USB stick: sudo dd if=patched.x230.img of=/dev/sdx and boot from it. Alternatively, burn patched.x230.iso to a CD. And make sure you have "legacy" boot set, not "UEFI" boot.

preparation: required hardware

open up the X230

Remove the 7 screws of your X230 to remove the keyboard (by pushing it towards the screen before lifting) and the palmrest. You'll find the chips using the photo below. This is how the SPI connection looks like on both of the X230's chips:

	Screen (furthest from you)
	  MOSI  5 --|      |-- 4  GND
	   CLK  6 --|      |-- 3  N/C
	   N/C  7 --|      |-- 2  MISO
	   VCC  8 --|______|-- 1  CS

	   Edge (closest to you)

... choose one of the following supported flashing hardware examples:

Hardware Example: Raspberry Pi 3

A Raspberry Pi can directly be a flasher through it's I/O pins, see below. Use a test clip or hooks, see required hardware.

On the RPi we run Raspbian and have the following setup:

  • Connect to the console: Either

  • in the SD Cards's /boot/config.txt file enable_uart=1 and dtparam=spi=on

  • For flashrom we put spi_bcm2835 and spidev in /etc/modules

  • Connect to a wifi or ethernet to sudo apt-get install flashrom

  • connect the Clip to the Raspberry Pi 3 (there are prettier images too):

         Edge of pi (furthest from you)
       L           GND TX  RX                           CS
       E            |   |   |                           |
       F +---------------------------------------------------------------------------------+
       T |  x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x  |
         |  x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x  |
       E +----------------------------------^---^---^---^-------------------------------^--+
       D                                    |   |   |   |                               |
       G                                   3.3V MOSIMISO|                              GND
       E                                 (VCC)         CLK
         Body of Pi (closest to you)

Raspberry Pi at work

Now copy the Skulls release tarball over to the Rasperry Pi and continue on the Pi.

We flash at low speeds. Unlocking the bottom chip with its two reads, one write and one verify step usually takes approximately one hour in total.

Hardware Example: CH341A based

The CH341A from Winchiphead, a USB interface chip, is used by some cheap memory programmers. The one we describe can be bought at aliexpress, but it's available elsewhere too. Also, we don't use the included 3,3V power output (provides too little power), but a separate power supply. If you don't have any, consider getting a AMS1117 based supply for a second USB port (like this or this).

  • Leave the P/S Jumper connected (programmer mode, 1a86:5512 USB device)
  • Connect 3,3V from your external supply to the Pomona clip's (or hook) VCC
  • Connect GND from your external supply to GND on your CH341A programmer
  • Connect your clip or hooks to the rest of the programmer's SPI pins
  • Connect the programmer (and power supply, if USB) to your PC's USB port

ch341a programmer with extra USB power supply

unpack the Skulls release archive

tar -xf skulls-x230-<version>.tar.xz
cd skulls-x230-<version>

ifd unlock and me_cleaner: the 8MB chip

Flashing the bottom chip (closer to you) is optional. It has the same pinout than the upper chip. This allows you to enable/disable in-system flashing (without disassembling the Thinkpad) and/or to neuter the the Intel Management Engine for security reasons.

sudo ./ -m -k <backup-file-to-create>

That's it. Keep the backup safe. Here are the options (just so you know):

  • The -m option applies me_cleaner -S before flashing back, see me_cleaner.
  • The -l option will (re-)lock your flash ROM, in case you want to force yourself (and others) to hardware-flashing, see updating.

BIOS: the 4MB chip

sudo ./ -k <backup-file-to-create>

Select the image to flash and that's it. Keep the backup safe, assemble and turn on the X230. coreboot will do hardware init and start SeaBIOS.


If you have locked your flash (i.e. ./external_install_bottom -l) you can flash externally using just like the first time, see above. Only the "upper" 4MB chip has to be written.

It is recommended to do the the update directly on your X230 using Linux though. This is considered more safe for your hardware and is very convenient - just install the "flashrom" program and run ./, see below.

  1. boot Linux with the iomem=relaxed boot parameter (for example in /etc/default/grub GRUB_CMDLINE_LINUX_DEFAULT)
  2. download the latest Skulls release tarball and unpack it
  3. run sudo ./ and choose the image to flash.

Hint: In case your Linux distribution's GRUB bootloader doesn't use the full screen, put the line GRUB_GFXMODE=1366x768x32 in your /etc/default/grub file (and run update_grub).

Moving to Heads

Heads is an alternative BIOS system with advanced security features. It's more complicated to use though. When having Skulls installed, installing Heads is as easy as updating Skulls. You can directly start using it:

  • build Heads
  • boot Linux with the iomem=relaxed boot parameter
  • copy Heads' 12M image file build/x230/coreboot.rom to Skulls' x230 directory
  • run sudo ./

That's it. Heads is a completely different project. Please read the documentation for how to use it and report bugs over there

Switching back to Skulls is the same as updating. Just run ./

Why does this work?

On the X230, there are 2 physical "BIOS" chips. The "upper" 4MB one holds the actual bios we can generate using coreboot, and the "lower" 8MB one holds the rest that you can modify yourself once, if you like, but strictly speaking, you don't need to touch it at all. What's this "rest"? Mainly a tiny binary used by the Ethernet card and the Intel Management Engine. Read the coreboot documentation for more details.

how to reproduce the release images

  • git clone
  • git checkout <VERSION> for the release you want to build
  • cd skulls/x230
  • ./ and choose the configuration you want to build