x200_external.md 11 KB
title: Installing Retroboot onto ThinkPad X200 that has Lenovo BIOS x-toc-enable: true ...
Flash the same ROM whether it's X200, X200S or X200 Tablet.
NOTE: this guide does NOT work for ThinkPad X200S or X200Tablet. For those, please refer to index.md#x200st.
This guide is for those who want Retroboot on their ThinkPad X200 while they still have the original Lenovo BIOS present. This guide can also be followed (adapted) if you brick your X200, to know how to recover.
X200/X200S/X200Tablet laptops with libreboot/retroboot pre-installed
If you don't want to install Retroboot/Libreboot yourself, companies exist that sell these laptops with libreboot or retroboot pre-installed, along with a free GNU+Linux distribution (and they may also provide BSD installs).
Refer to these links:
https://retroboot.org/suppliers.html
https://libreboot.org/suppliers.html
Flash chip size
Run this command on x200 to find out flash chip model and its size:
sudo flashrom -p internal
If you have a Macronix flash chip (chip name beginning with MX), please
note that flashrom as supplied by Libreboot or Retroboot will be unreliable
on certain flashers such as Raspberry Pi.
For those Macronix chips, use this modified version of Flashrom:
https://vimuser.org/hackrom.tar.xz
This is based on Flashrom version 0.9.9 and contains a special patch. A binary is supplied in that tar archive, which will work on Raspberry Pi and it is compiled from the included source code.
If using this version, on a Macronix flash chip, pass the following argument
to your flashrom command: --workaround-mx
Sometimes, the flash chip won't even be detected (if Macronix) without passing this argument, so as a general rule you should try with and without it.
MAC address
The MAC address for your Intel GbE NIC is encoded into the GbE region of the boot flash. To modify it, please consult the following document:
The procedure
This section is for the X200. This does not apply to the X200S or X200 Tablet (for those systems, you have to remove the motherboard completely, since the flash chip is on the other side of the board).
Remove these screws:\
Gently push the keyboard towards the screen, then lift it off, and optionally
disconnect it from the board:\
Disconnect the cable of the fingerpring reader, and then pull up the palm rest,
lifting up the left and right side of it:\
This shows the location of the flash chip, for both SOIC-8 and SOIC-16:\
Lift back the tape that covers a part of the flash chip, and then
connect the clip:\
Make sure GND (ground) is hooked up before your 3.3v is hooked up.
Connect the 3.3V DC supply from your flashor or lab PSU to the flash chip
(via the clip). DO NOT connect 3.3v until your clip is connected to the chip:\
Now, you should be ready to install Retroboot.
Flashrom is included in the Retroboot build system, in the git repository, which you can by doing:
./download flashrom
./build module flashrom
For build dependencies, a script is supplied that works on Ubuntu 20.04 and similar distributions, which you can run by doing:
./build dependencies ubuntu2004
NOTE: If using Raspberry Pi, use the hackrom version of flashrom linked
above.
Use the above picture of the flash chip (whether SOIC8 or SOIC16) and, based on that, wire up your SPI flasher. Currently, Retroboot only documents how to use the Raspberry Pi for this purpose:
How to program 25XX NOR flash using SPI header on Raspberry Pi
Test that flashrom works:
# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768
NOTE: spispeed=32768 should work, just keep your wires within 10cm and all
at the same length. However, you can try lower speeds down to 4096 or so if
you need to, for stability.
Do not connect the 3.3v power rail until the test clip is connected. When you're done, disconnect the 3.3v power rail before removing the test clip.
If you see something like this, where flashrom detects multiple chips:
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
flashrom is free software, get the source code at http://www.flashrom.org
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
Please specify which chip definition to use with the -c <chipname> option.
If you see the above, pass this argument in flashrom: -c "MX25L6405(D)"
Here is how to backup factory.rom:
sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r factory.rom
sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r factory1.rom
Now compare the two images:
sha512sum factory*.rom
If the hashes match and if hex editor (like dhex) shows that
they have valid contents (eg. it's not filled entirely with 0x00/0xFF),
then just copy one of them (the factory.rom) to a
safe place, backed up on several storage mediums. This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot.
Follow the instructions at ich9utils.md#ich9gen to change the MAC address inside the Retroboot ROM image, before flashing it. Although there is a default MAC address inside the ROM image, this is not what you want. Make sure to always change the MAC address to one that is correct for your system.
Technically, any valid MAC address is OK but if you have multiple machines with the same MAC address on the same network then you will get MAC address conflicts that interfere with networking protocols.
You might see errors, but if it says Verifying flash... VERIFIED at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message Chip content is identical to
the requested image is also an indication of a successful
installation.
Example output from running the command (see above):
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
flashrom is free software, get the source code at http://www.flashrom.org
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Erase/write done.
Verifying flash... VERIFIED.
Wifi
The X200 typically comes with an Intel wifi chipset, which does not work without proprietary software. For a list of wifi chipsets that work without proprietary software, see ../hardware/#recommended_wifi.
Some X200 laptops come with an Atheros chipset, but this is 802.11g only.
It is recommended that you install a new wifi chipset. This can only be done after installation, because the original firmware has a whitelist of approved chips, and it will refuse to boot if you use an 'unauthorized' wifi card.
The following photos show an Atheros AR5B95 being installed, to replace the Intel chip that this X200 came with:
WWAN
If you have a WWAN/3G card and/or sim card reader, remove them permanently. The WWAN-3G card has proprietary firmware inside; the technology is identical to what is used in mobile phones, so it can also track your movements.
Not to be confused with wifi (wifi is fine).
Intel Turbo Memory
Some X200 devices were sold with Intel Turbo Memory installed in the top-most mini PCI-e slot. This has been shown to be ineffective at disk caching or battery saving in most use cases. While there are Linux drivers available, it is blacklisted in at least GNU+Trisquel, and possibly other free operating systems. It should probably be removed.
Memory
You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs (speed/size). Non-matching pairs won't work. You can also install a single module (meaning, one of the slots will be empty) in slot 0.
NOTE: according to users repors, non matching pairs (e.g. 1+2 GiB) might work in some cases.
Make sure that the RAM you buy is the 2Rx8 density.
In this photo, 8GiB of RAM (2x4GiB) is installed:
Boot it!
Now install GNU+Linux.
Other operating systems may also work, but they are untested.
X200S and X200 Tablet users: GPIO33 trick will not work.
sgsit found out about a pin called GPIO33, which can be grounded to disable the flashing protections by the descriptor and stop the ME from starting (which itself interferes with flashing attempts). The theory was proven correct; however, it is still useless in practise.
Look just above the 7 in TP37 (that's GPIO33):
By default we would see this in lenovobios, when trying flashrom -p internal -w rom.rom:
FREG0: Warning: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG2: Warning: Management Engine region (0x00001000-0x005f5fff) is locked.
With GPIO33 grounded during boot, this disabled the flash protections as set by descriptor, and stopped the ME from starting. The output changed to:
The Flash Descriptor Override Strap-Pin is set. Restrictions implied by
the Master Section of the flash descriptor are NOT in effect. Please note
that Protected Range (PR) restrictions still apply.
The part in bold is what got us. This was still observed:
PR0: Warning: 0x007e0000-0x01ffffff is read-only.
PR4: Warning: 0x005f8000-0x005fffff is locked.
It is actually possible to disable these protections. Lenovobios does, when updating the BIOS (proprietary one). One possible way to go about this would be to debug the BIOS update utility from Lenovo, to find out how it's disabling these protections. Some more research is available here: http://www.coreboot.org/Board:lenovo/x200/internal_flashing_research