x230 keyboard give up and a smile

I’ve no time to continue, I just bought a second hand x220 and will use it instead of the x230.

I have another second hand docstation for the x230 and I will use an external keyboard with it as if it were not a laptop.

This keyboard hacking journey was ok go get into shape and remember things I had forgotten (not all) but I’ve remembered enough. Now it is time to think what I want to do with my time and to use it for more usefull things like learning Chinese and passing exams while coding a bit just as an exercise but not as a goal. I don’t even care about the Chinese but it helps being focused at a task like hacking does and the examns are not usefull at all but I’ve to pass them.

In 3 months I will be bankrupt if I don’t find a job but it is being difficult to find honest companies to work for and that is a requirement because I can not control what my code will be used for.

x230 where to start looking

I found this tip online. it is worth a look


Well it doesn’t seem to be true for the 2.55 version. In the FL1 file there is nothing there and in  the FL2 file something does begin there indeed at 80:0000h but 192Kb is 30000h and nothing ends at 83000h

Lenovo used the codename LenovoNozomi3 to create the x230 BIOS bundle, the EFI part, and nozomi3 was the codename of the Lenvo T420 laptop (second core-i generation) I found some references to it on the internet as:

That means Lenovo does recycle common tools for several laptops.

I was not able to spot the EC code yet but the EC code is not a PE file like all the rest of the code. EFI files are PE files, similar to windows executables and there should be a 192Kb chunk somewhere without a PE header so hope is not lost.

I found something similar. On the fl2 file beginning at 500000h I have 30000h of data that can be something but I am too tired and too upset to look at it now.

The info under this line inside this post is not true at least for the 2.55 bios version for the x230.

PostPosted: Thu Aug 22, 2013 6:33 pm

Joined: Fri Aug 06, 2004 10:23 pm
Posts: 21
Location: Kyunggido,South korea.

you should modify embedded controller firmware (*.fl1) for 7 row keyboard. The size of embedded controller firmware is a 192KB. Start address of EC firmware is a 800000h.

x230 Lenovo and Microchip

So Lenovo didn’t choose Microchip (but according to their electric schematics they were going to)

New York, May 2, 2012 Microchip acquires SMSC.


Lenovo announced the x230 on December 2011 and released it in 2012



In the end the Lenovo x230 ended up having an EC (Embedded Controller) from Microchip as initially planned but it wasn’t using that EC in the initial electronic wiring.

I wonder who has the code for the embedded controller. Lenovo, WKS/Winstron, Microchip? I wonder what is the relationship betweeen the EC and the intel ME and if there is a backdoor there playing with certs but this is only paranoia. After all intel ME itself is a backdoor but only to USA/NSA, the rest of the governments “need” to put them somewhere else.


x220 and x230 Official datasheets and manuals

Just to have them easy to find because I had to change some things related to intel AMT and I didn’t have them at hand.
User Guide: ThinkPad X230 and x230i

Hardware Maintenance Manual ThinkPad X230 and X230i

Unnofficial Electric schematics (Dasher2):

Beware of the EC controller it seems they ended up using a different one (based on 8051 instead of ARC)
I suspect they used the SMSC FDC37N972:

Intel Ivy followed Sandy and I found nothing new related to EC:



There is nothing of interest on those documents. Appart from:

“This 3rd generation Intel Core processor
family and Intel® 7 Series chipsets are
pin and package compatible with the 2nd
generation Intel Core processor family
and Intel® 6 Series chipsets, allowing
developers to mix and match processors
and chipsets to better suit their design

So basically Lenovo _did_ innovate (sarcasm) and didn’t follow previous IBM designs or intel and went to a cheaper embedded controller but in order to be cheap they probably recycled a lot of code from somewhere else. They might even have ignored Phoenix but that is unlikely. x220:
User Guide ThinkPad x220,X220i,X220Tablet, and x220i Tablet

ThinkPad x220 and X220i Hardware Maintenance Manual

Oficial Electric schematics (Dasher1):

Intel recomended way of connecting things (uses a Renesas H8S/2117 as a Embedded Controller)


keyboard links for myself

Just not to forget, some usefull links or developers.

  • General info from intel


  • old style x220 style keyboard controller:

Serial Interface
I2C-bus        H8S/2117 Common KBC Board
RET05B0004-0110     DEC.11.09


  • reverse engineered x220 style keyboard controller



  • Phoenix Multikey 42i.pdf

MultiKey/42i Developer’s Technical Reference Keyboard Controller Firmware With An Embedded 8042 Microcontroller for a Super I/O Chipset


i think the SMSC one doesn’t follow the Phoenix Multikey system but it is good to know how things were donde before.

See how coreboot handles it:


Well it seems it handles it like a normal keyboard and the code related to it is really really small.

My problem is that the embedded controller won’t send the keys to the BIOS. It has to be changed before. but At least I have a place where I can debug it.



#define FDC37N972_KBDC 0x07 /* Keyboard */

#define FDC37N972_MBX  0x09 /* Mailbox register */

case FDC37N972_KBDC:

23    #include <device/device.h>
24    #include <pc80/keyboard.h>
25    #include <uart8250.h>
27    extern struct chip_operations superio_smsc_fdc37n972_ops;
29    struct superio_smsc_fdc37n972_config {
31            struct pc_keyboard keyboard;
32    };
34    #endif

but then coreboot doesn’t support it like the rest of the SMSC superio controllers

something changed from FDC37M????? to FDC37N?????


28    #define FDC37B80X       0x42    /* Same ID: FDC37M70X (a.k.a. FDC37M707) */
49    #define FDC37B78X       0x44
50    #define FDC37B72X       0x4c
51    #define FDC37M81X       0x4d
52    #define FDC37M60X       0x47

144    /**
145     * Enter the configuration state by writing 0x55 to the config port.
146     *
147     * The Super I/O configuration registers can only be modified when the chip
148     * is in the configuration state. Thus, to program the registers you have
149     * to a) enter config mode, b) program the registers, c) exit config mode.
150     *


Pumpkin soup

Since I am not coding, I am learning how to cook basic things.


  • 600 to 800 grams of pumpkin
  • 4 orange carrots
  • 2 potatoes
  • Salt
  • Pepper
  • Milk (400 to 500mL)
  • Water (400 to 500mL)
  • Any herbs you like
  • Optional: Grated cheese.

Note: As lon as you stay in the quantities it does not matter if you put one or three portatoes, two or three carrots, six or seven or eight hundred grams of pumpkin. The soup will work and will be nice, of course if there is more carrots, it will taste more of carrots… you get the idea.

pumpking soup

Procedure / Program 😉

  1. Peel the carrots and the potatoes (and the pumpkin)

2. Cut carrots, potatoes and pumpkin in cubes. /* Note: you can cut them small or big but make sure that they’re all more or less the same size, otherwise the smaller one will be ready before the big one (The carrot puts the lower limit usually). The smaller, the quicker it will be ready */

3. Put all the pieces together in a pot. Add water and milk /* Note: If you have smaller quantities, for example 600gr of pumpking, two carrots and one potato, you won’t need as much water and milk. Just make sure you’ve enough to cover the vegetables */

4. Turn the stove or heating element on. /* Note: if the fire temperature is very high it will take less but you will also need to make sure that the water doesn’t boil and overflow. If you are not going to look at the soup it is advisable not to put a lid.

5. To find out if the vegetables are ready use a fork and peek some pieces, like one of each. /* If they break easily and they’re soft, turn the stove, fire, heating element off. If not leave it and check it in a few minutes. */

6. Once the heating element is off use a blender to make it a soup /* Note: First take some water out if you still have too much, it should be a creamy soup, not a watery soup. */

7. Once it is liquid, add a bit of pepper (3 turns in my bottle, not sure how much but not much). and add herbs you like.

8. Taste it and add salt if necessary. /* Note: Don’t put too much salt if you’re not sure it is better to add it later if someone wants it, the same applies to the herbs and te pepper too a lesser degree. */

9. Serve, and if you like it add grated cheese /* Note: this is an extra ingredient. the ones that go well are Parmesan or the Roncal cheese for example */

10. Time to cook, 15 to 20 minutes but it can be less depending on the heating element. those 20 minutes are using just a stove and a pot without a lid so in general it can be done fast or faster.pure-calabaza-blog2

bout the x230 keyboard, what works, what doesn’t

update: Basically what it says here, http://www.thinkwiki.org/wiki/Install_Classic_Keyboard_on_xx30_Series_ThinkPads

but with the spanish keyboards and some non working keys are different. I still choose to use the old keyboard because those keys are not used with VIM.

Before giving up, I used an external X220 style spanish keyboard with the X230 and it works without any modifications. some keys are not correctly mapped. I’ll put how to deal with those ones by software by now.

I needed a keyboard I could find comfortable with and I don’t have 250 euros for a second hand x220 computer so this will have to do it.

The official Lenoo BIOS checks something on the keyboard. I could turn on the computer with an english layout x220 keyboard but then it didn’t even show anything on the screen. With the spanish x220 keyboard it didn’t complain.

All the Fn keys are like in the X230 and the numeric keypad doesn’t work. The Supr, home, end, pgup, pgdown don’t work as expected. in general it works but it has issues that should be resolved using the embedded controller or using coreboot. I haven’t tried yet because the english/usa layour keyboards gave me problems.

So far it seems nothing security related has to be done and this could be easier that whitelisting wifi cards (but changing the bios for coreboot).