diff options
Diffstat (limited to 'docs/install/x200_external.html')
| -rw-r--r-- | docs/install/x200_external.html | 176 |
1 files changed, 116 insertions, 60 deletions
diff --git a/docs/install/x200_external.html b/docs/install/x200_external.html index b3de46b..c424966 100644 --- a/docs/install/x200_external.html +++ b/docs/install/x200_external.html @@ -22,17 +22,6 @@ can also be followed (adapted) if you brick your X200, to know how to recover. </p> - <p> - The X200S is also briefly covered (image showing soldering joints, wired up - to a BBB). Note, not all X200S or X200 Tablet configurations are supported yet - (see <a href="../hcl/x200.html#x200s">../hcl/x200.html#x200s</a></b> - </p> - <p> - Before following this section, please make sure to setup your libreboot ROM properly first. - Although ROM images are provided pre-built in libreboot, there are some modifications that - you need to make to the one you chose before flashing. (instructions referenced later in - this guide) - </p> <p><a href="index.html">Back to main index</a></p> </div> @@ -40,14 +29,17 @@ <div class="section"> <h1 id="flashchips">Flash chips</h1> - + <p> - There are two possible flash chip sizes for the X200: 4MiB - (32Mbit) or 8MiB (64Mbit). This can be identified by the type - of flash chip below the palmrest: 4MiB is SOIC-8 (8 pins), 8MiB - is SOIC-16 (16 pins). The X200S uses a WSON package and has the same - pinout as SOIC-8 (covered briefly later on in this guide) but - the chip is on the underside of the board (disassembly required). + The X200 will use an 8MiB or 64Mb SOIC-16 chip (rare models + will use a 4MiB or 32Mb SOIC-8 chip), below the palm rest. + </p> + + <p> + The X200S and X200 Tablet will use a WSON-8 flash chip, on the + bottom of the motherboard (this requires removal of the + motherboard). <b>Not all X200S/X200T are supported; + see <a href="../hcl/x200.html#x200s">../hcl/x200.html#x200s</a>.</b> </p> <p> @@ -55,18 +47,41 @@ </p> </div> + + <div class="section"> + + <h1 id="macaddress">MAC address</h1> + + <p> + On the X200/X200S/X200T, the MAC address for the onboard + gigabit ethernet chipset is stored inside the flash chip, + along with other configuration data. + </p> + <p> + Keep a note of the MAC address before disassembly; this is + very important, because you will need to insert this into + the libreboot ROM image before flashing it. + It will be written in one of these locations: + </p> + + <p> + <img src="images/x200/disassembly/0002.jpg" alt="" /> + <img src="images/x200/disassembly/0001.jpg" alt="" /> + </p> + + </div> <div class="section"> - <h1>Initial BBB setup</h1> + <h1 id="clip">Initial BBB configuration</h1> <p> Refer to <a href="bbb_setup.html">bbb_setup.html</a> for how to - setup the BBB for flashing. + set up the BBB for flashing. </p> <p> - The following shows how to connect clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252): + The following shows how to connect the clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252): </p> <pre> POMONA 5252 (correlate with the BBB guide) @@ -81,9 +96,11 @@ POMONA 5252 (correlate with the BBB guide) 22 - - NC - this is pin 1 on the flash chip === back (palmrest) on your X200 === <i>This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.</i> +Here is a photo of the SOIC-16 flash chip. Pins are labelled:<br/> +<img src="images/x200/x200_pomona.jpg" alt="" /> </pre> <p> - The following shows how to connect clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250): + The following shows how to connect the clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250): </p> <pre> POMONA 5250 (correlate with the BBB guide) @@ -94,7 +111,7 @@ POMONA 5250 (correlate with the BBB guide) 3.3V PSU RED - - 17 - this is pin 1 on the flash chip. in front of it is the screen. === right side of the X200 (where the audio jacks are) === <i>This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.</i> -Here is a photo of the SOIC-8 flash chip:<br/> +Here is a photo of the SOIC-8 flash chip. The pins are labelled:<br/> <img title="Copyright 2015 Patrick "P. J." McDermott <pj@pehjota.net>, CC BY-SA 3.0 or later" src="images/x200/soic8.jpg" alt="freenode IRC #libreboot 01:42 UK/London timezone February 8th 2015: pehjota: fchmmr: Here are two photos in the camera's configured resolution; resize them as you wish: http://www.pehjota.net/~pj/x200/soic-8/. License: CC BY-SA 3.0 or later. If you want other angles or anything, let me know." alt="" /> Look at the pads in that photo, on the left and right. Those are for SOIC-16. Would it be possible to remove the SOIC-8 and solder a SOIC-16 @@ -115,27 +132,74 @@ chip on those pins? </p> <h2> - Connect Pomona 5252/5250 to the X200 flash chip, and dump/flash + The procedure </h2> <p> - The following photo shows an X200 flashed using the BBB:<br/> - <img src="images/x200/x200_pomona.jpg" alt="" /> + This section is for the X200. This does not apply to the X200S or X200 Tablet + (for those machines, you have to remove the motherboard completely, since + the flash chip is on the other side of the board). + </p> + <p> + Remove these screws:<br/> + <img src="images/x200/disassembly/0003.jpg" alt="" /> + </p> + <p> + Push the keyboard forward, gently, then lift it off and + disconnect it from the board:<br/> + <img src="images/x200/disassembly/0004.jpg" alt="" /> + <img src="images/x200/disassembly/0005.jpg" alt="" /> + </p> + <p> + Pull the palm rest off, lifting from the left and right side at the back of the + palm rest:<br/> + <img src="images/x200/disassembly/0006.jpg" alt="" /> + </p> + <p> + Lift back the tape that covers a part of the flash chip, and + then connect the clip:<br/> + <img src="images/x200/disassembly/0007.jpg" alt="" /> + <img src="images/x200/disassembly/0008.jpg" alt="" /> + </p> + <p> + On pin 2 of the BBB, where you have the ground (GND), connect the + ground to your PSU:<br/> + <img src="images/x200/disassembly/0009.jpg" alt="" /> + <img src="images/x200/disassembly/0010.jpg" alt="" /> + </p> + <p> + Connect the 3.3V supply from your PSU to the flash chip (via + the clip):<br/> + <img src="images/x200/disassembly/0011.jpg" alt="" /> + <img src="images/x200/disassembly/0012.jpg" alt="" /> + </p> + <p> + Of course, make sure that your PSU is also plugged in and + turn on:<br/> + <img src="images/x200/disassembly/0013.jpg" alt="" /> </p> <p> - Remove the battery from your X200, then remove all the screws on - the bottom (underside) of the machine. Then remove the keyboard and palmrest. - The flash chip is below the palm rest. Lift back the tape that goes over it, - and then connect your 5252/5250 (make sure to get it the right way round). - Then connect the 3.3v PSU wire (red one) and make sure that everything else is connected. + This tutorial tells you to use an ATX PSU, for the 3.3V DC + supply. The PSU used when taking these photos is actually + not an ATX PSU, but a PSU that is designed specifically + for providing 3.3V DC (an ATX PSU will also work):<br/> + <img src="images/x200/disassembly/0014.jpg" alt="" /> + </p> + <p> + Now, you should be ready to install libreboot. </p> <p> Flashrom binaries for ARM (tested on a BBB) are distributed in libreboot_util. Alternatively, libreboot also distributes flashrom source code which can be built. </p> <p> - I did (SSH'd into the BBB):<br/> + Log in as root on your BBB, using the instructions in + <a href="bbb_setup.html#bbb_access">bbb_setup.html#bbb_access</a>. + </p> + + <p> + Test that flashrom works:<br/> # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512</b><br/> - In my case, the output was: + In this case, the output was: </p> <pre> flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) @@ -148,46 +212,38 @@ Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)&q Please specify which chip definition to use with the -c <chipname> option. </pre> <p> - This is just to test that it's working. In my case, I had to define which chip to use, like so (in your case - it may be different, depending on what flash chip you have):<br/> - # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)"</b> - </p> - <p> - At this point, you need to create a copy of the original lenovo firmware that is currently flashed. - This is so that you can extract the gbe (gigabit ethernet) and flash descriptor regions for use in libreboot. <b>These - are not blobs, they only contain non-functional data (configuration details, fully readable) which is fully documented in public datasheets.</b> - The descriptor will need to be modified - to disable the ME (also disable AMT) so that you can flash a ROM that excludes it. - </p> - <p> How to backup factory.rom (change the -c option as neeed, for your flash chip):<br/> - # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory.rom</b><br/> - # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory1.rom</b><br/> - # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory2.rom</b><br/> + # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory.rom</b><br/> + # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory1.rom</b><br/> + # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory2.rom</b><br/> + Note: the <b>-c</b> option is not required in libreboot's patched flashrom, because + the redundant flash chip definitions in <i>flashchips.c</i> have been removed.<br/> Now compare the 3 images:<br/> # <b>sha512sum factory*.rom</b><br/> If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not - the BBB). You will need it later for part of the deblobbing. + the BBB). This is useful for reverse engineering work, if there is a desirable behaviour in the original firmware + that could be replicated in coreboot and libreboot. + </p> + <p> + Follow the instructions at <a href="../hcl/gm45_remove_me.html#ich9gen">../hcl/gm45_remove_me.html#ich9gen</a> + to change the MAC address inside the libreboot ROM image, before flashing it. + Although there is a default MAC address inside the ROM image, this is not what you want. <b>Make sure + to always change the MAC address to one that is correct for your system.</b> </p> <p> - Information about the descriptor, gbe regions and how the ME was removed can be found in the notes linked at - <a href="../hcl/gm45_remove_me.html">../hcl/gm45_remove_me.html</a>. Libreboot ROM images now include - the 12KiB descriptor+gbe by default, generated using ich9gen; - <b>however, do note that the MAC address in the Gbe region is generic. Follow the instructions at - <a href="../hcl/gm45_remove_me.html#ich9gen">../hcl/gm45_remove_me.html#ich9gen</a> and do what it says to change the MAC address - inside your X200 ROM image, before flashing it.</b> + Now flash it:<br/> + # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w path/to/libreboot/rom/image.rom -V</b> </p> <p> - Assuming that your libreboot ROM image is properly setup (modified descriptor plus gbe region included in the ROM), - then you can flash (assuming that the filename is <b>libreboot.rom</b>) for example I had to do:<br/> - # <b>./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -w libreboot.rom</b> + <img src="images/x200/disassembly/0015.jpg" alt="" /> </p> <p> You might see errors, but if it says <b>Verifying flash... VERIFIED</b> at the end, then it's flashed and should boot. - Test it! (boot your X200) + If you see errors, try again (and again, and again); the message <b>Chip content is identical to the requested image</b> + is also an indication of a successful installation. </p> <p> - My output when running the command above: + Example output from running the command (see above): </p> <pre> flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) |