X60 T60 Hardware Flashing

If the motherboard is bricked or has a Supervisor password on it, you must use a hardware flasher to install Coreboot/Libreboot on it.

Bus Pirate

The Bus Pirate is the all purpose EEPROM flashing utility.

What to Buy

• $30 - Bus Pirate
  • Adafruit
  • Sparkfun
  • Sandbox Electronics -Bus Pirate Clone with free probes
• $20 - Pomona SOIC-8 Clip
  • Usually comes with a convenient F-F interface cable.
• $4 + $3 shipping (Optional) - Seeed Studio Bus Pirate F-F Interface Cable - Just for convenience's sake; or if you didn't get an F-F interface cable bundled.
  • $7 -

Bus Pirate Configuration

Below is a diagram, with colors based on the Seeed Studio pinout. Your cable colors may differ (such as the Sparkfun layout).

8765
----
|  |
----
1234

Pin #	SPI Pin Name	Seeed Studio Color
1	CS	White
2	MISO	Black
3	not used	not used
4	GND	Brown
5	MOSI	Gray
6	CLK	Purple
7	not used	not used
8	3.3V	red

Warning - If you are using a Macronix chip, DO NOT CONNECT PIN #8. You will fry the pin; or worse, the Bus Pirate. Use an AC Adapter to supply power to the board instead.

Make sure the pinouts are correct; otherwise, Bus Pirate will fail to detect a chip, or it will "detect" an 0x0 chip. Finally, make sure that the Pomona clip makes contact with the metal wires of the chip. It can be a challenge, but keep trying.

How to supply power to the flashchip

There are two ways to supply power to the chip: plugging in an AC adapter (without turning it on), and using the 8th 3.3v pin.

I have found that the SST chips work best with the 8th pin, while the Macronix chips require an AC Adapter to power up.

Warning - NEVER connect both the 8th pin and the AC adapter at the same time. You will fry the Bus Pirate.

Your results may vary.

Upgrade Bus Pirate to Firmware 6.2 (Linux)

You'll probably want to upgrade the Bus Pirate firmware to a special beta version, which will read/write at 8MHz instead of just 2MHz. Otherwise, the flash could take a very, very long time (almost 20 minutes to complete the process for me...). This guide is designed for Linux.

1. Download and extract the special beta bootloader.

2. Download and extract the latest Bus Pirate package (which contains flashing tools for you to use).

3. Identify whether your Bus Pirate is hardware revision v3 or v4. Most Bus Pirates on the market are v3, since v4 is still experimental.

4. Once you know which one is yours, go into either BPv3-firmware or BPv4-firmware (extracted from the Bus Pirate Package zip). Copy the .hex files extracted from the special beta version into this folder.

5. From a Linux terminal, use GNU Screen to make contact with the Bus Pirate console.

    screen /dev/ttyUSB0 115200 8N1
   

6. Press Enter, and a HiZ prompt should appear. Type $ and press Enter to send the Bus Pirate into Bootloader mode.

    HiZ> $
   

7. The console will ask Are you sure? Type y and press Enter. Bus Pirate will enter Bootloader Mode.

    Are you sure? y
    BOOTLOADER
   

8. Once this is done, we need to quit the screen session and free up the port for PirateLoader. Open up another terminal to check which screen sessions are active:

    screen -ls
   

9. The following output will be displayed. From this, we see that the socket ID is 8803 (yours will differ).

    There is a screen on:
       8803.pts-7.ThinkPad-X60 (09/04/2014 09:42:27 PM)        (Attached)
    1 Socket in /var/run/screen/S-trisquel.
   

10. Run the following command to quit that screen session (Replace 8803 with your own socket):

     screen -X -S 8803 quit
    

11. Navigate the terminal to the BPv3-firmware folder, and make pirate-loader_lnx executable with chmod:

     chmod +x pirate-loader_lnx
    

12. Now use PirateLoader to install the special beta bootloader.

     ./pirate-loader_lnx --dev=/dev/ttyUSB0 --hex=bpv3-spifix.hex
    

• Source: Flashrom - Bus Pirate

Disassembling the ThinkPad

Follow the [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] to disassemble the laptop, until you can access the BIOS chip.

(photos needed)

• On the X60, the BIOS chip is on the bottom of the motherboard, under a layer of protective black tape.
• On the T60, the BIOS chip is just under the palmrest, but blocked by a magnesium frame (which you will have to remove).

Reading the Flashchip with Bus Pirate

First, visually inspect (with a magnifying glass) the type of flashchip on the motherboard.

Next, download and extract the Libreboot binaries, and enter the libreboot_bin/flashrom folder.

cd libreboot_bin
cd flashrom

If it is an SST, run this command:

sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom

If it is a Macronix, run this command:

sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom

Next, check the md5sum of the dump:

md5sum test.rom

Run the flashrom command again to make a second dump. Then, check the md5sum of the second dump:

md5sum test.rom

If the md5sums match after three tries, flashrom has managed to read the flashchip precisely (but not always accurately). You may try and flash Libreboot now.

Flashing Libreboot with Bus Pirate

Note: replace /path/to/libreboot.rom with the location of your chosen ROM, such as ../bin/x60/libreboot_usqwerty.rom):

If your chip is SST, run this command:

sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom

If your chip is Macronix, run this command:

sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom

Once that command outputs the following, the flash has completed successfully. If not, just flash again.

Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.