---
title: Installing Retroboot onto ThinkPad X200 that has Lenovo BIOS
x-toc-enable: true
...

Flash the same ROM whether it's X200, X200S or X200 Tablet.

NOTE: this guide does NOT work for ThinkPad X200S or X200Tablet. For those,
please refer to [index.md#x200st](index.md#x200st).

This guide is for those who want Retroboot on their ThinkPad X200 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your X200, to know how to recover.

X200/X200S/X200Tablet laptops with libreboot/retroboot pre-installed
=========================================

If you don't want to install Retroboot/Libreboot yourself, companies exist that
sell these laptops with libreboot or retroboot pre-installed, along with a free
GNU+Linux distribution (and they may also provide BSD installs).

Refer to these links:

<https://retroboot.org/suppliers.html>

<https://libreboot.org/suppliers.html>

Flash chip size
===============

Run this command on x200 to find out flash chip model and its size:

    sudo flashrom -p internal

If you have a `Macronix` flash chip (chip name beginning with `MX`), please
note that `flashrom` as supplied by Libreboot or Retroboot will be unreliable
on certain flashers such as Raspberry Pi.

For those Macronix chips, use this modified version of Flashrom:

<https://vimuser.org/hackrom.tar.xz>

This is based on Flashrom version 0.9.9 and contains a special patch. A binary
is supplied in that tar archive, which will work on Raspberry Pi and it is
compiled from the included source code.

If using this version, on a Macronix flash chip, pass the following argument
to your flashrom command: `--workaround-mx`

Sometimes, the flash chip won't even be detected (if Macronix) without passing
this argument, so as a general rule you should try with and without it.

MAC address
===========

The MAC address for your Intel GbE NIC is encoded into the GbE region of the
boot flash. To modify it, please consult the following document:

[ich9utils.md#ich9gen](ich9utils.md#ich9gen)

The procedure
-------------

This section is for the X200. This does not apply to the X200S or X200
Tablet (for those systems, you have to remove the motherboard
completely, since the flash chip is on the other side of the board).

Remove these screws:\
![](images/x200/disassembly/0003.jpg)

Gently push the keyboard towards the screen, then lift it off, and optionally
disconnect it from the board:\
![](images/x200/disassembly/0004.jpg)
![](images/x200/disassembly/0005.jpg)

Disconnect the cable of the fingerpring reader, and then pull up the palm rest,
lifting up the left and right side of it:\
![](images/x200/disassembly/0006.1.jpg)
![](images/x200/disassembly/0006.jpg)

This shows the location of the flash chip, for both SOIC-8 and SOIC-16:\
![](images/x200/x200_soic16.jpg)
![](images/x200/x200_soic8.jpg)

Lift back the tape that covers a part of the flash chip, and then
connect the clip:\
![](images/x200/disassembly/0008.jpg)

Make sure GND (ground) is hooked up before your 3.3v is hooked up.
![](images/x200/disassembly/0009.jpg)
![](images/x200/disassembly/0010.jpg)

Connect the 3.3V DC supply from your flashor or lab PSU to the flash chip
(via the clip). DO NOT connect 3.3v until your clip is connected to the chip:\
![](images/x200/disassembly/0011.jpg)
![](images/x200/disassembly/0012.jpg)

Now, you should be ready to install Retroboot.

Flashrom is included in the Retroboot build system, in the git repository,
which you can by doing:

    ./download flashrom
    ./build module flashrom

For build dependencies, a script is supplied that works on Ubuntu 20.04 and
similar distributions, which you can run by doing:

    ./build dependencies ubuntu2004

NOTE: If using Raspberry Pi, use the `hackrom` version of flashrom linked
above.

Use the above picture of the flash chip (whether SOIC8 or SOIC16) and, based
on that, wire up your SPI flasher. Currently, Retroboot only documents how to
use the Raspberry Pi for this purpose:

[How to program 25XX NOR flash using SPI header on Raspberry Pi](rpi_setup.md)

Test that flashrom works:

    # ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768

NOTE: `spispeed=32768` should work, just keep your wires within 10cm and all
at the same length. However, you can try lower speeds down to 4096 or so if
you need to, for stability.

*Do not* connect the 3.3v power rail until the test clip is connected. When
you're done, disconnect the 3.3v power rail before removing the test clip.

If you see something like this, where `flashrom` detects multiple chips:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

If you see the above, pass this argument in flashrom: `-c "MX25L6405(D)"`

Here is how to backup factory.rom:

    sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r factory.rom
    sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r factory1.rom

Now compare the two images:

    sha512sum factory*.rom

If the hashes match and if hex editor (like `dhex`) shows that
they have valid contents (eg. it's not filled entirely with `0x00`/`0xFF`),
then just copy one of them (the factory.rom) to a
safe place, backed up on several storage mediums. This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot.

Follow the instructions at
[ich9utils.md\#ich9gen](ich9utils.md#ich9gen)
to change the MAC address inside the Retroboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. Make sure to always change the MAC
address to one that is correct for your system.

Technically, any valid MAC address is OK but if you have multiple machines with
the same MAC address on the same network then you will get MAC address conflicts
that interfere with networking protocols.

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says `Verifying flash... VERIFIED` at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message `Chip content is identical to
the requested image` is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Wifi
====

The X200 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hardware/\#recommended\_wifi](../hardware/#recommended_wifi).

Some X200 laptops come with an Atheros chipset, but this is 802.11g
only.

It is recommended that you install a new wifi chipset. This can only be
done after installation, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this X200 came with:

![](images/x200/disassembly/0016.jpg)
![](images/x200/disassembly/0017.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements.

Not to be confused with wifi (wifi is fine).

Intel Turbo Memory
==================

Some X200 devices were sold with Intel Turbo Memory installed in the top-most
mini PCI-e slot. This has been [shown to be
ineffective](http://www.anandtech.com/show/2252) at disk caching or battery
saving in most use cases. While there are [Linux
drivers](https://github.com/yarrick/turbomem) available, it is blacklisted in
at least GNU+Trisquel, and possibly other free operating systems. It should
probably be removed.

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

NOTE: according to users repors, non matching pairs (e.g. 1+2 GiB) might
work in some cases.

Make sure that the RAM you buy is the 2Rx8 density.

In this photo, 8GiB of RAM (2x4GiB) is installed:

![](images/x200/disassembly/0018.jpg)

Boot it!
--------

Now [install GNU+Linux](../gnulinux/).

[Or BSD](../bsd/)

Other operating systems may also work, but they are untested.

X200S and X200 Tablet users: GPIO33 trick will not work.
--------------------------------------------------------

sgsit found out about a pin called GPIO33, which can be grounded to
disable the flashing protections by the descriptor and stop the ME from
starting (which itself interferes with flashing attempts). The theory
was proven correct; however, it is still useless in practise.

Look just above the 7 in TP37 (that's GPIO33):

![](../hardware/images/x200/gpio33_location.jpg)

By default we would see this in lenovobios, when trying flashrom -p
internal -w rom.rom:

    FREG0: Warning: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
    FREG2: Warning: Management Engine region (0x00001000-0x005f5fff) is locked.

With GPIO33 grounded during boot, this disabled the flash protections as
set by descriptor, and stopped the ME from starting. The output changed
to:

    The Flash Descriptor Override Strap-Pin is set. Restrictions implied by
    the Master Section of the flash descriptor are NOT in effect. Please note
    that Protected Range (PR) restrictions still apply.

The part in bold is what got us. This was still observed:

    PR0: Warning: 0x007e0000-0x01ffffff is read-only.
    PR4: Warning: 0x005f8000-0x005fffff is locked.

It is actually possible to disable these protections. Lenovobios does,
when updating the BIOS (proprietary one). One possible way to go about
this would be to debug the BIOS update utility from Lenovo, to find out
how it's disabling these protections. Some more research is available
here:
<http://www.coreboot.org/Board:lenovo/x200/internal_flashing_research>
