- This guide is for those who want libreboot on their ThinkPad X200 - while they still have the original Lenovo BIOS present. This guide - can also be followed (adapted) if you brick your X200, to know how - to recover. -

- The X200S is also briefly covered (image showing soldering joints, wired up - to a BBB). Note, not all X200S or X200 Tablet configurations are supported yet - (see ../hcl/x200.html#x200s -

- Before following this section, please make sure to setup your libreboot ROM properly first. - Although ROM images are provided pre-built in libreboot, there are some modifications that - you need to make to the one you chose before flashing. (instructions referenced later in - this guide) -

+ This guide is for those who want libreboot on their ThinkPad X200 + while they still have the original Lenovo BIOS present. This guide + can also be followed (adapted) if you brick your X200, to know how + to recover. +

+ The X200S is also briefly covered (image showing soldering joints, wired up + to a BBB). Note, not all X200S or X200 Tablet configurations are supported yet + (see ../hcl/x200.html#x200s +

+ Before following this section, please make sure to setup your libreboot ROM properly first. + Although ROM images are provided pre-built in libreboot, there are some modifications that + you need to make to the one you chose before flashing. (instructions referenced later in + this guide) +

Flash chips

- -

- There are two possible flash chip sizes for the X200: 4MiB - (32Mbit) or 8MiB (64Mbit). This can be identified by the type - of flash chip below the palmrest: 4MiB is SOIC-8 (8 pins), 8MiB - is SOIC-16 (16 pins). The X200S uses a WSON package and has the same - pinout as SOIC-8 (covered briefly later on in this guide) but - the chip is on the underside of the board (disassembly required). -

- -

- Back to top of page. -

Flash chips

+ +

+ There are two possible flash chip sizes for the X200: 4MiB + (32Mbit) or 8MiB (64Mbit). This can be identified by the type + of flash chip below the palmrest: 4MiB is SOIC-8 (8 pins), 8MiB + is SOIC-16 (16 pins). The X200S uses a WSON package and has the same + pinout as SOIC-8 (covered briefly later on in this guide) but + the chip is on the underside of the board (disassembly required). +

+ Back to top of page. +

+ +

Initial BBB setup

- -

- Refer to bbb_setup.html for how to - setup the BBB for flashing. -

Initial BBB setup

+ +

+ Refer to bbb_setup.html for how to + setup the BBB for flashing. +

- The following shows how to connect clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252): -

+ The following shows how to connect clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252): +

 POMONA 5252 (correlate with the BBB guide)
 ===  front (display) on your X200 ====
@@ -83,9 +82,9 @@ POMONA 5252 (correlate with the BBB guide)
 ===  back (palmrest) on your X200 ===
 This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

- The following shows how to connect clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250): -

+ The following shows how to connect clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250): +

 POMONA 5250 (correlate with the BBB guide)
 ===  front (display) on your X200 ====
@@ -96,34 +95,34 @@ POMONA 5250 (correlate with the BBB guide)
 ===  back (palmrest) on your X200 ===
 This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

- On the X200S the flash chip is underneath the board, in a WSON package. - The pinout is very much the same as a SOIC-8, except you need to solder (there are no clips available). - images/x200/wson_soldered.jpg (image copyright (C) 2014 Steve Shenton under CC-BY-SA 4.0 - or higher, same license that this document uses) shows it wired (soldered) and - connected to a BBB. -

- -

- Connect Pomona 5252/5250 to the X200 flash chip, and dump/flash -

- images/x200/x200_pomona.jpg - shows everything connected. In this picture, the X200 is being flashed - with the BBB. -

- Remove the battery from your X200, then remove all the screws on - the bottom (underside) of the machine. Then remove the keyboard and palmrest. - The flash chip is below the palm rest. Lift back the tape that goes over it, - and then connect your 5252/5250 (make sure to get it the right way round). - Then connect the 3.3v PSU wire (red one) and make sure that everything else is connected. -

- I did (SSH'd into the BBB):
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
- In my case, the output was: + On the X200S the flash chip is underneath the board, in a WSON package. + The pinout is very much the same as a SOIC-8, except you need to solder (there are no clips available). + images/x200/wson_soldered.jpg (image copyright (C) 2014 Steve Shenton under CC-BY-SA 4.0 + or higher, same license that this document uses) shows it wired (soldered) and + connected to a BBB.

+ +

+ Connect Pomona 5252/5250 to the X200 flash chip, and dump/flash +

+ images/x200/x200_pomona.jpg + shows everything connected. In this picture, the X200 is being flashed + with the BBB. +

+ Remove the battery from your X200, then remove all the screws on + the bottom (underside) of the machine. Then remove the keyboard and palmrest. + The flash chip is below the palm rest. Lift back the tape that goes over it, + and then connect your 5252/5250 (make sure to get it the right way round). + Then connect the 3.3v PSU wire (red one) and make sure that everything else is connected. +

+ I did (SSH'd into the BBB):
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
+ In my case, the output was: +

 flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
 flashrom is free software, get the source code at http://www.flashrom.org
@@ -134,48 +133,48 @@ Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on li
 Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
 Please specify which chip definition to use with the -c <chipname> option.

- This is just to test that it's working. In my case, I had to define which chip to use, like so (in your case - it may be different, depending on what flash chip you have):
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -

- At this point, you need to create a copy of the original lenovo firmware that is currently flashed. - This is so that you can extract the gbe (gigabit ethernet) and flash descriptor regions for use in libreboot. These - are not blobs, they only contain non-functional data (configuration details, fully readable) which is fully documented in public datasheets. - The descriptor will need to be modified - to disable the ME (also disable AMT) so that you can flash a ROM that excludes it. -

- How to backup factory.rom (change the -c option as neeed, for your flash chip):
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory.rom
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory1.rom
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory2.rom
- Now compare the 3 images:
- # sha512sum factory*.rom
- If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not - the BBB). You will need it later for part of the deblobbing. -

- Information about the descriptor, gbe regions and how the ME was removed can be found in the notes linked at - ../hcl/x200_remove_me.html. Libreboot ROM images now include - the 12KiB descriptor+gbe by default, generated using ich9gen; - however, do note that the MAC address in the Gbe region is generic. Follow the instructions at - ../hcl/x200_remove_me.html#ich9gen and do what it says to change the MAC address - inside your X200 ROM image, before flashing it. -

- Assuming that your libreboot ROM image is properly setup (modified descriptor plus gbe region included in the ROM), - then you can flash (assuming that the filename is libreboot.rom) for example I had to do:
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -w libreboot.rom -

- You might see errors, but if it says Verifying flash... VERIFIED at the end, then it's flashed and should boot. - Test it! (boot your X200) -

- My output when running the command above: -

+ This is just to test that it's working. In my case, I had to define which chip to use, like so (in your case + it may be different, depending on what flash chip you have):
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" +

+ At this point, you need to create a copy of the original lenovo firmware that is currently flashed. + This is so that you can extract the gbe (gigabit ethernet) and flash descriptor regions for use in libreboot. These + are not blobs, they only contain non-functional data (configuration details, fully readable) which is fully documented in public datasheets. + The descriptor will need to be modified + to disable the ME (also disable AMT) so that you can flash a ROM that excludes it. +

+ How to backup factory.rom (change the -c option as neeed, for your flash chip):
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory1.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory2.rom
+ Now compare the 3 images:
+ # sha512sum factory*.rom
+ If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not + the BBB). You will need it later for part of the deblobbing. +

+ Information about the descriptor, gbe regions and how the ME was removed can be found in the notes linked at + ../hcl/x200_remove_me.html. Libreboot ROM images now include + the 12KiB descriptor+gbe by default, generated using ich9gen; + however, do note that the MAC address in the Gbe region is generic. Follow the instructions at + ../hcl/x200_remove_me.html#ich9gen and do what it says to change the MAC address + inside your X200 ROM image, before flashing it. +

+ Assuming that your libreboot ROM image is properly setup (modified descriptor plus gbe region included in the ROM), + then you can flash (assuming that the filename is libreboot.rom) for example I had to do:
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -w libreboot.rom +

+ You might see errors, but if it says Verifying flash... VERIFIED at the end, then it's flashed and should boot. + Test it! (boot your X200) +

+ My output when running the command above: +

 flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
 flashrom is free software, get the source code at http://www.flashrom.org
@@ -188,24 +187,28 @@ Reading current flash chip contents... done. Looking for another erase function.
 Erase/write done.
 Verifying flash... VERIFIED.

+ +

+ Back to top of page. +

- Back to top of page. -