x230 internal flashing guide

site/docs/install/index.md

@@ -615,8 +615,12 @@ Refer to the following laptop:\
 TARGET: Thinkpad X230
 ---------------------
 
+NOTE: Internal flashing is also possible, on this machine, from vendor firmware,
+but it's still recommended to use a clip and a SPI flasher. However, follow
+[internal X230 flashing from Lenovo firmware](ivy_internal.md) if you wish.
+
 Refer to the [ivybridge/haswell common guide.](ivy_has_common.md) for how to
-make the rom image usable for external flashing.
+make the rom image usable for external flashing (with a clip).
 
 Read [board documentation](/docs/install/x230_external.html) for disassembly.
 

site/docs/install/ivy_has_common.md

@@ -28,6 +28,18 @@ Neither of these blobs are redistributable, so roms for these boards must be bui
 If you're planning to flash a release rom to your board then you need only patch the existing rom.
 Alternatively, you can attempt to build a rom from source for your board.
 
+Internal flashing
+-----------------
+
+For ivybridge specifically (e.g. thinkpad X230, T430) on Lenovo ThinkPads,
+it is possible to flash from vendor firmware to Libreboot, without using a
+clip, but some disassembly is still required. This can be beneficial if you
+want to save money by not buying external flashing equipment. All you need is
+a pain of metal tweezers or something similar that can be used to create
+a short circuit between two conductors.
+
+See: [ivybridge internal flashing](ivy_internal.md)
+
 Obtaining Binary Blobs
 ----------------------
 

site/docs/install/ivy_internal.md

@@ -0,0 +1,62 @@
+---
+title: Ivybridge internal flashing
+x-toc-enable: true
+...
+
+External flashing still recommended
+-----------------------------------
+
+Internal flashing is quite complex, from a software and hardware
+perspective, when switching from Lenovo firmware to Libreboot.
+If you already have Libreboot, then you likely have the entire
+flash unlocked so you can refer to generic flashing instructions.
+
+Internal flashing from Lenovo firmware is more time consuming, but basically
+costs less money, because there's less equipment that you need for it.
+
+This method is also more risky, because one of the steps involves shorting
+two pins on the HDA (audio) chip, and if you do it wrong you could short
+the wrong thing by mistake; consequences could be blown fuses and/or fire,
+or just a dead ThinkPad. Proceed at your own risk!
+
+If you prefer external flashing, see: [external flashing](x230_external.md)
+
+Internal flashing from vendor firmware (ThinkPads only)
+----------------------------------------
+
+IVYBRIDGE ONLY:
+
+Refer to this coreboot guide:
+<https://doc.coreboot.org/mainboard/lenovo/ivb_internal_flashing.html?highlight=x230>
+
+With this guide, you can exploit a vulnerability in Lenovo firmware, to flash
+just the BIOS region without disassembling your machine.
+
+You will have to flash just the BIOS region, on upstream coreboot. Just compile
+upstream coreboot from scratch. Coreboot instructions here:
+<https://doc.coreboot.org/tutorial/index.html>
+
+You can then strap HDA\_SDO (soft descriptor override), which will disable
+flash protections set in the Intel Flash Descriptor.
+
+On ivybridge platforms specifically, coreboot supports what's called
+the *ME Soft Temporary Disable*, which disables the ME after BringUp, similar
+to `me_cleaner`. You can do this by setting `me_state=Disabled` in nvmramtool.
+
+Now boot with HDA\_SDO strapped. On the HDA (audio) chip, there is a pin that
+you can short, to disable IFD-based flash protections. You simply HOLD it in
+the shorted state, while booting up the machine, and if successful, you will
+then have the flash unlocked. This, combined with ME Soft Temporary Disable,
+and the internal flashing guide linked above (from coreboot.org), you'll get
+to a state where you can simply flash all regions. You can then flash the
+truncated+neutered images from Libreboot, after building the ROMs in lbmk; see
+[Libreboot build instructions](../build/).
+
+The following photo shows what to short on the ThinkPad X230. You'll have to
+look for it. X230 is easy because you don't have to directly touch the pins,
+instead you can use alt points that have continuity. They are marked on this
+photo:
+
+<img tabindex=1 src="https://av.libreboot.org/x230/hda_sdo.jpg" /><span class="f"><img src="https://av.libreboot.org/x230/hda_sdo.jpg" /></span>
+
+TODO: Document other ivybridge thinkpads (just show pics)

site/docs/install/x230_external.md

@@ -3,7 +3,11 @@ title: ThinkPad X230/X230T external flashing
 x-toc-enable: true
 ...
 
-Read the [Ivybridge/Haswell common guide](/docs/install/ivy_has_common.html) if you want more information.
+NOTE: Internal flashing (from vendor firmware) to Libreboot is possible, on
+this board, but the steps are a bit more complex than using an external flasher.
+See: [internal ivybridge flashing](ivy_internal.md)
+
+Read the [Ivybridge/Haswell common guide](ivy_has_common.md) if you want more information.
 All of the following instructions assume that you've cloned lbmk and are operating from the
 root of that project. To do so, run