X60 T60 Hardware Flashing

If the motherboard is bricked or has a Supervisor password on it, you must use a hardware flasher to install Coreboot/Libreboot on it.

Bus Pirate

The Bus Pirate is the all purpose EEPROM flashing utility.

What to Buy

• $30 - Bus Pirate
  • Adafruit
  • Sparkfun
  • Sandbox Electronics -Bus Pirate Clone with free probes
• $20 - Pomona SOIC-8 Clip
  • Usually comes with a convenient F-F interface cable.
• $4 + $3 shipping (Optional) - Seeed Studio Bus Pirate F-F Interface Cable - Just for convenience's sake; or if you didn't get an F-F interface cable bundled.
  • $7 -

Bus Pirate Configuration

Below is a diagram, with colors based on the Seeed Studio pinout. Your cable colors may differ (such as the Sparkfun layout).

8765
----
|  |
----
1234

1. CS (white)
2. MISO (black)
3. not used
4. GND (brown)
5. MOSI (gray)
6. CLK (purple)
7. not used
8. 3.3V (red) - Depends on chip

Make sure the pinouts are correct; otherwise, Bus Pirate will fail to detect a chip, or it will "detect" an 0x0 chip. Finally, make sure that the Pomona clip makes contact with the metal wires of the chip. It can be a challenge, but keep trying.

How to supply power to the flashchip

There are two ways to supply power to the chip: plugging in an AC adapter (without turning it on), and using the 8th 3.3v pin.

I have found that the SST chips work best with the 8th pin, while the Macronix chips require an AC Adapter to power up.

Your results may vary.

Upgrade Bus Pirate to Firmware 6.2 (Linux)

You'll probably want to upgrade the Bus Pirate firmware to a special beta version, which will read/write at 8MHz instead of just 2MHz. Otherwise, the flash could take a very, very long time (almost 20 minutes to complete the process for me...). This guide is designed for Linux.

1. Download and extract the special beta bootloader.

2. Download and extract the latest Bus Pirate package (which contains flashing tools for you to use).

3. Identify whether your Bus Pirate is hardware revision v3 or v4. Most Bus Pirates on the market are v3, since v4 is still experimental.

4. Once you know which one is yours, go into either BPv3-firmware or BPv4-firmware (extracted from the Bus Pirate Package zip). Copy the .hex files extracted from the special beta version into this folder.

5. From a Linux terminal, use GNU Screen to make contact with the Bus Pirate console.

    screen /dev/ttyUSB0 115200 8N1
   

6. Press Enter, and a HiZ prompt should appear. Type $ and press Enter to send the Bus Pirate into Bootloader mode.

    HiZ> $
   

7. The console will ask Are you sure? Type y and press Enter. Bus Pirate will enter Bootloader Mode.

    Are you sure? y
    BOOTLOADER
   

8. Once this is done, we need to quit the screen session and free up the port for PirateLoader. Open up another terminal to check which screen sessions are active:

    screen -ls
   

9. The following output will be displayed. From this, we see that the socket ID is 8803 (yours will differ).

    There is a screen on:
       8803.pts-7.ThinkPad-X60 (09/04/2014 09:42:27 PM)        (Attached)
    1 Socket in /var/run/screen/S-trisquel.
   

10. Run the following command to quit that screen session (Replace 8803 with your own socket):

     screen -X -S 8803 quit
    

11. Navigate the terminal to the BPv3-firmware folder, and make pirate-loader_lnx executable with chmod:

     chmod +x pirate-loader_lnx
    

12. Now use PirateLoader to install the special beta bootloader.

     ./pirate-loader_lnx --dev=/dev/ttyUSB0 --hex=bpv3-spifix.hex
    

• Source: Flashrom - Bus Pirate

Disassembling the ThinkPad

Follow the [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] to disassemble the laptop, until you can access the BIOS chip.

(photos needed)

• On the X60, the BIOS chip is on the bottom of the motherboard, under a layer of protective black tape.
• On the T60, the BIOS chip is just under the palmrest, but blocked by a magnesium frame (which you will have to remove).

Reading the Flashchip with Bus Pirate

First, visually inspect (with a magnifying glass) the type of flashchip on the motherboard.

Next, download and extract the Libreboot binaries, and enter the libreboot_bin/flashrom folder.

cd libreboot_bin
cd flashrom

If it is an SST, run this command:

sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom

If it is a Macronix, run this command:

sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom

Next, check the md5sum of the dump:

md5sum test.rom

Run the flashrom command again to make a second dump. Then, check the md5sum of the second dump:

md5sum test.rom

If the md5sums match after three tries, flashrom has managed to read the flashchip precisely (but not always accurately). You may try and flash Libreboot now.

Flashing Libreboot with Bus Pirate

Note: replace /path/to/libreboot.rom with the location of your chosen ROM, such as ../bin/x60/libreboot_usqwerty.rom):

If your chip is SST, run this command:

sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom

If your chip is Macronix, run this command:

sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom

Once that command outputs the following, the flash has completed successfully. If not, just flash again.

Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

Raspberry Pi

Note: This method is under construction, and has not been tested with the X60; the images below are of an Acer C720 Chromebook.

The Raspberry Pi (a multipurpose $25 Linux computer) can be used as a BIOS flashing tool, thanks to it's GPIO pins and SPI support.

What you need

• $25 - Raspberry Pi Model B (Rev.2 or higher)
• $10-20 - SOIC-8 Pomona Clip
  • Usually comes bundled with nice, color-colored female to female wires

Raspberry Pi Pinouts

GPIO Pinouts:

*Diagram made by "Pacman" from Win-Raid Forums*

SOIC Pinouts:

Plugging in the SOIC Clip

We have to connect the Raspberry Pi to the SOIC Clip as shown in the below diagram (using the f-f wires usually included with the Pomona clip).

(C720 Only?) The diagram depicts a "bridged" connection. You will need to fashion one with some copper wire:

Plug in the wires to the clip as shown below:

Plug in the other end of the wires to the Raspberry Pi as shown below:

(C720 only?) Plug in the "bridged" wires as shown below:

Finally, put the Pomona SOIC clip on the chip:

Flashrom

Once it's all set up, flashrom works out of the box.

Sources

• Pomona SOIC Clip flashing
  • Arch Linux Wiki - Installing Arch Linux on Chromebook
  • Google Drive - Raspberry Pi SOIC Clip connection
  • rPI with Flashrom and SOIC Clip Powerpoint
  • Tnhh - Unbricking Chromebook with Beaglebone
• Use a DIY DIP System to flash an desoldered BIOS chip
  • Viktak - How to recover laptop after failed BIOS flash
  • Win-Raid - Recover from Failed BIOS Flashing using Raspberry Pi