Board:lenovo/x200

Status

Thanks for your interest in Lenovo X200 port. Works:

• USB
• Audio (internal speakers, internal mic, headphones, external mic)
• WLAN (first minipcie slot)
• WWAN (second minipcie slot)
• UWB (third minipcie slot)
• SD card slot
• LAN
• Battery and AC indicator
• Thermal
• EEPROM
• Linux (through GRUB-as-payload)
• trackpoint
• keyboard
• Bluetooth
• LID
• Video (internal panel and VGA)
• Hotkeys
• Fingerprint reader.
• Windows (through GRUB-as-payload loading SeaBIOS image from disk; you have to use extracted VGA blob, dumped from memory isn't good enough)
• suspend to RAM (S3)
• Expresscard slot (including hotplug)
• Wake on LID, wake on Fn.
• Dock

Untested:

• Modem (probably works)
• digitizer on x200t variant (probably doesn't work)

proprietary components status

• CPU microcode updates (optional)
• VGA option rom (optional): you need it if you want graphics in SeaBIOS but most payloads should work without it (text mode or corebootfb mode)
• ME(Management Engine) (optional) => can be removed by modifying the flash descriptor.
• EC(Embedded Controller) => you do not have to touch it(just leave it where it is)

Flashing

First flashing needs to be external. I use buspirate and pomona clip (SOIC-16)

Flash in X200 is divided roughly in 4 parts:

• Descriptor (12K)
• ME firmware (6M-12K)
• Rewriteable flash (2M-128K)
• Locked bootblock (128K)

• 
• 
• 

Descriptor and bootblock are read-only. ME firmware is not readable. Rewriteable region can be rewritten easily with flashrom.

For coreboot we need to preserve descriptor and ME firmware while overwriting rewriteable region and bootblock. To achieve this there are 2 ways:

• External flasher.
• Unlock bootblock

For the first one proceeds as follows:

• Turn off your laptop, remove battery and AC adapter.
• Remove the keyboard.
• Connect your external SPI flasher to the SPI chip which is under palmrest,

around the position of trackpoint under protective layer.

I recommend using SOIC-16 clip. Depending on the flasher you use, you may have to use separate 3.3V source. Make sure not to feed more than 3.3V ot the chip. I used buspirate as flasher and 3.3V power lines from ATX PSU. The pinout is as follows, the colors are buspirate colors

 ===  front (display) ====
 NC              -       - MISO (black)
 ground (brown)  -       - CS (white)
 NC              -       - NC
 NC              -       - NC
 NC              -       - NC
 NC              -       - NC
 MOSI (gray)     -       - 3.3V (red)
 violet (SCLK)   -       - NC
 ===  back (palmrest) ===

• I wasn't able to eliminate interference in my setup (you may have better luck), so it worked only on 30kHz. Adding battery increased quality somewhat. Read the flash. Twice. Compare the files to be sure. Save a copy of it on

external media. Due to interference I reread it 10 times, 2 were corrupted.

flashrom -p <yourprogrammer> -r flash.bin
flashrom -p <yourprogrammer> -r flash2.bin
diff flash.bin flash2.bin

See also In-System Programming

• Recover descriptor and me firmare:

 dd if=flash.bin of=descriptor_me.bin count=6 bs=1M

• Compile coreboot
• Put descriptor and me back:

 dd if=descriptor_me.bin of=build/coreboot.rom bs=1M conv=notrunc

• Flash the resulting build/coreboot.rom. If it fails due to interference, try again, and again. It took me ~10 times.