This guide is for those who want libreboot on their ThinkPad X200 while they still have the original Lenovo BIOS present. This guide can also be followed (adapted) if you brick your X200, to know how to recover.
The X200S is also briefly covered (image showing soldering joints, wired up to a BBB). Note, not all X200S or X200 Tablet configurations are supported yet (see ../hcl/x200.html#x200s
Before following this section, please make sure to setup your libreboot ROM properly first. Although ROM images are provided pre-built in libreboot, there are some modifications that you need to make to the one you chose before flashing. (instructions referenced later in this guide)
Or go back to main index
There are two possible flash chip sizes for the X200: 4MiB (32Mbit) or 8MiB (64Mbit). This can be identified by the type of flash chip below the palmrest: 4MiB is SOIC-8 (8 pins), 8MiB is SOIC-16 (16 pins). The X200S uses a WSON package and has the same pinout as SOIC-8 (covered briefly later on in this guide) but the chip is on the underside of the board (disassembly required).
Shopping list (pictures of this hardware is shown later):
With my PSU, first I had wire up the mains power cable. Any clover or kettle lead will do. Cut the end off (not the one that goes in the wall, but the kettle/clover connector). Strip the protection away by a decent length, then strip the wires inside so that a decent amount of copper is shown. Then wire up earth/live/neutral. This will vary according to what country you live in and/or the colour codes that your cable uses inside. Make sure to get this right, as a botched job could result in extreme damage to you and your surroundings. Here's what mine looks like after wiring up the power cable: images/x200/psu_power.jpg - also, make sure that the plug (for the wall) has the correct fuse. In my case I had a 240V wall socket, and the device says that it accepts 1.5A at that voltage, so I used the smallest fuse available (3A). For 110-120V the device says it needs 2.8A. Also, if yours looks like in the image linked above, make sure to wrap electrical tape (lots) around it for safety. (otherwise, don't touch the terminals while the PSU is plugged in).
Now take a red and black 20cm female-female jumper lead, and cut one of the ends off. Strip away the bare copper by about 1 or 1.5cm so you get this: images/x200/stripped_jumper_lead.jpg.
Black goes on -V, red goes on +V. In my case, I removed those screws from my PSU like this: images/x200/psu_screws_removed.jpg. Then,
Then I twisted the exposed copper on the jumper leads (so that they don't fray), and wrapped each to one of the screws each, around it near the head. I then screwed them in: images/x200/psu_jumper_leads.jpg.
If you are using a different PSU, then the steps will change from those above. Anyway, once you are satisfied, continue reading...
Since it's a bare board (no case) and you are also touching inside your X200, you should be earthed/grounded. images/x200/strap.jpg shows how I earthed myself. This is to prevent you from causing any ESD damage. The surface that you place components on should also be earthed/grounded. (for this, I used a shielded ESD bag with a wire, copper exposed, attached from the bag to the exposed metal part on a radiator, which was earthed - not professional, but it should work. see images/x200/mat.jpg). Most people ignore this advice and don't ground/earth themselves, at their own risk. You should also store the BBB in a shielded anti-static bag when you are finished with it. (the principles above apply to any computer components, since they are extremely sensitive te ESD).
These instructions may or may not work for you. They are simply the steps that this author took.
setting up SPIDEV on the BBB: http://elinux.org/BeagleBone_Black_Enable_SPIDEV#SPI0 - If you only setup SPI0, you don't have to disable the HDMI out. (you only need one). That guide is for seting up the device overlay for SPIDEV, last part is to make it persist across reboots. Needed to turn the BBB into an SPI flasher.
Don't bother modifying uEnv.txt. it won't work; use the workaround here instead: http://elinux.org/Beagleboard:BeagleBoneBlack_Debian#Loading_custom_capes.
Follow the instructions at http://elinux.org/BeagleBone_Black_Enable_SPIDEV#SPI0 up to (and excluding) the point where it tells you to modify uEnv.txt
You need to update the software on the BBB first. Before being able to use apt-get,
I had to use the workaround defined here:
- Replace the contents of /etc/init.d/led_aging.sh with:
#!/bin/sh -e
### BEGIN INIT INFO
# Provides: led_aging.sh
# Required-Start: $local_fs
# Required-Stop: $local_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start LED aging
# Description: Starts LED aging (whatever that is)
### END INIT INFO
x=$(/bin/ps -ef | /bin/grep "[l]ed_acc")
if [ ! -n "$x" -a -x /usr/bin/led_acc ]; then
/usr/bin/led_acc &
fi
Run apt-get update and apt-get upgrade then reboot the BBB, before continuing.
Run those commands:
# echo BB-SPI0-01 > /sys/devices/bone_capemgr.*/slots
Then I did:
# ls -al /dev/spidev0.*
ls: cannot access /dev/spidev0.*: No such file or directory
Then I rebooted and did:
# cat /sys/devices/bone_capemgr.*/slots
Output:
0: 54:PF--- 1: 55:PF--- 2: 56:PF--- 3: 57:PF--- 4: ff:P-O-L Bone-LT-eMMC-2G,00A0,Texas Instrument,BB-BONE-EMMC-2G 5: ff:P-O-L Bone-Black-HDMI,00A0,Texas Instrument,BB-BONELT-HDMI
And then:
# ls /lib/firmware/BB-SPI0-01-00A0.*
Output:
/lib/firmware/BB-SPI0-01-00A0.dtbo
Then:
# echo BB-SPI0-01 > /sys/devices/bone_capemgr.*/slots
# cat /sys/devices/bone_capemgr.*/slots
Output:
0: 54:PF--- 1: 55:PF--- 2: 56:PF--- 3: 57:PF--- 4: ff:P-O-L Bone-LT-eMMC-2G,00A0,Texas Instrument,BB-BONE-EMMC-2G 5: ff:P-O-L Bone-Black-HDMI,00A0,Texas Instrument,BB-BONELT-HDMI 7: ff:P-O-L Override Board Name,00A0,Override Manuf,BB-SPI0-01
Then check if the device exists:
# ls -al /dev/spidev0.*
Output:
ls: cannot access /dev/spidev0.*: No such file or directory
It didn't exist under that name, but I then did:
# ls -al /dev/spid*
Output:
crw-rw---T 1 root spi 153, 0 Nov 19 21:07 /dev/spidev1.0
Now the BBB is ready to be used for flashing. Make this persist
across reboots:
In /etc/default/capemgr add CAPE=BB-SPI0-01 at the end
(or change the existing CAPE= entry to say that, if an
entry already exists.
Now you will download and build flashrom on the BBB.
# apt-get install libpci-dev pciutils zlib1g-dev libftdi-dev build-essential subversion
# svn co svn://flashrom.org/flashrom/trunk flashrom
# cd flashrom/
# make
Now test flashrom:
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
Output:
Calibrating delay loop... OK. No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically.
This means that it's working (the clip isn't connected to any flash chip, so the error is fine).
Use this image for reference when connecting the pomona to the BBB: http://beagleboard.org/Support/bone101#headers (D0 = MISO or connects to MISO).
The following shows how to connect clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252):
=== front (display) ==== NC - - 21 1 - - 17 NC - - NC NC - - NC NC - - NC NC - - NC 18 - - 3.3V PSU RED 22 - - NC - this is pin 1 on the flash chip === back (palmrest) === This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.
The following shows how to connect clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250):
=== front (display) ==== 18 - - 1 22 - - NC NC - - 21 3.3V PSU RED - - 17 - this is pin 1 on the flash chip === back (palmrest) === This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.
On the X200S the flash chip is underneath the board, in a WSON package. The pinout is very much the same as a SOIC-8, except you need to solder (there are no clips available). images/x200/wson_soldered.jpg (image copyright (C) 2014 Steve Shenton under CC-BY-SA 4.0 or higher, same license that this document uses) shows it wired (soldered) and connected to a BBB.
NC = no connection
DO NOT connect 3.3V PSU RED yet. ONLY connect this once the pomona is connected to the flash chip.
You also need to connect the BLACK wire from the 3.3V PSU to pin 2 on the BBB (P9 header). It is safe to install this now.
if you need to extend the 3.3v psu leads, just use the same colour M-F leads, but keep all other leads short (10cm or less)
images/x200/5252_bbb0.jpg and images/x200/5252_bbb1.jpg shows a properly wired up BBB with Pomona 5252 before being connected to the flash chip on the X200.
images/x200/x200_pomona.jpg shows everything connected. In this picture, the X200 is being flashed with the BBB.
Remove the battery from your X200, then remove all the screws on the bottom (underside) of the machine. Then remove the keyboard and palmrest. The flash chip is below the palm rest. Lift back the tape that goes over it, and then connect your 5252/5250 (make sure to get it the right way round). Then connect the 3.3v PSU wire (red one) and make sure that everything else is connected.
I did:
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
In my case, the output was:
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi. Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E" Please specify which chip definition to use with the -c <chipname> option.
This is just to test that it's working. In my case, I had to define which chip to use, like so (in your case
it may be different, depending on what flash chip you have):
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)"
At this point, you need to create a copy of the original lenovo firmware that is currently flashed. This is so that you can extract the gbe (gigabit ethernet) and flash descriptor regions for use in libreboot. These are not blobs, they only contain non-functional data (configuration details, fully readable) which is fully documented in public datasheets. The descriptor will need to be modified to disable the ME (also disable AMT) so that you can flash a ROM that excludes it.
How to backup factory.rom (change the -c option as neeed, for your flash chip):
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory.rom
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory1.rom
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory2.rom
Now compare the 3 images:
# sha512sum factory*.rom
If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not
the BBB). You will need it later for part of the deblobbing.
Information about the descriptor and gbe can be found in the notes linked at ../hcl/x200_remove_me.html - also shows how to modify them to disable and remove the ME/AMT blob. MAKE SURE TO FOLLOW THE GUIDE IN THIS LINK, BEFORE CONTINUING. FAILURE TO DO SO WILL RESULT IN A BRICKED MACHINE.
Assuming that your libreboot ROM image is properly setup (modified descriptor plus gbe region included in the ROM),
then you can flash (assuming that the filename is libreboot.rom) for example I had to do:
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -w libreboot.rom
You might see errors, but if it says Verifying flash... VERIFIED at the end, then it's flashed and should boot. Test it! (boot your X200)
My output when running the command above:
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi. Reading old flash chip contents... done. Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716 ERASE FAILED! Reading current flash chip contents... done. Looking for another erase function. Erase/write done. Verifying flash... VERIFIED.
Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
A copy of the license can be found at ../license.txt.
This document is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information.
