Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
X60 T60 Hardware Flashing
If the motherboard is bricked or has a Supervisor password on it, you must use a hardware flasher to install Coreboot/Libreboot on it.
The Bus Pirate is the all purpose EEPROM flashing utility.
What to Buy
- $30 - Bus Pirate
- $20 - Pomona SOIC-8 Clip
- Usually comes with a convenient F-F interface cable.
- $4 + $3 shipping (Optional) - Seeed Studio Bus Pirate F-F Interface Cable - Just for convenience's sake; or if you didn't get an F-F interface cable bundled.
- $7 -
Bus Pirate Configuration
Below is a diagram, with colors based on the Seeed Studio pinout. Your cable colors may differ (such as the Sparkfun layout).
8765 ---- | | ---- 1234
|Pin #||SPI Pin Name||Seeed Studio Color|
|3||not used||not used|
|7||not used||not used|
Warning - If you are using a Macronix chip, DO NOT CONNECT PIN #8. You will fry the pin; or worse, the Bus Pirate. Use an AC Adapter to supply power to the board instead.
Make sure the pinouts are correct; otherwise, Bus Pirate will fail to detect a chip, or it will "detect" an
0x0 chip. Finally, make sure that the Pomona clip makes contact with the metal wires of the chip. It can be a challenge, but keep trying.
How to supply power to the flashchip
There are two ways to supply power to the chip: plugging in an AC adapter (without turning it on), and using the 8th 3.3v pin.
I have found that the SST chips work best with the 8th pin, while the Macronix chips require an AC Adapter to power up.
Warning - NEVER connect both the 8th pin and the AC adapter at the same time. You will fry the Bus Pirate.
Your results may vary.
Upgrade Bus Pirate to Firmware 6.2 (Linux)
You'll probably want to upgrade the Bus Pirate firmware to a special beta version, which will read/write at 8MHz instead of just 2MHz. Otherwise, the flash could take a very, very long time (almost 20 minutes to complete the process for me...). This guide is designed for Linux.
Download and extract the special beta bootloader.
Download and extract the latest Bus Pirate package (which contains flashing tools for you to use).
Identify whether your Bus Pirate is hardware revision v3 or v4. Most Bus Pirates on the market are v3, since v4 is still experimental.
Once you know which one is yours, go into either
BPv4-firmware(extracted from the Bus Pirate Package zip). Copy the
.hexfiles extracted from the special beta version into this folder.
From a Linux terminal, use GNU Screen to make contact with the Bus Pirate console.
screen /dev/ttyUSB0 115200 8N1
Press Enter, and a HiZ prompt should appear. Type
$and press Enter to send the Bus Pirate into Bootloader mode.
The console will ask
Are you sure?Type
yand press Enter. Bus Pirate will enter Bootloader Mode.
Are you sure? y BOOTLOADER
Once this is done, we need to quit the
screensession and free up the port for
PirateLoader. Open up another terminal to check which
screensessions are active:
The following output will be displayed. From this, we see that the socket ID is
8803(yours will differ).
There is a screen on: 8803.pts-7.ThinkPad-X60 (09/04/2014 09:42:27 PM) (Attached) 1 Socket in /var/run/screen/S-trisquel.
Run the following command to quit that screen session (Replace
8803with your own socket):
screen -X -S 8803 quit
Navigate the terminal to the
BPv3-firmwarefolder, and make
chmod +x pirate-loader_lnx
PirateLoaderto install the special beta bootloader.
./pirate-loader_lnx --dev=/dev/ttyUSB0 --hex=bpv3-spifix.hex
- Source: Flashrom - Bus Pirate
Disassembling the ThinkPad
Follow the [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] to disassemble the laptop, until you can access the BIOS chip.
- On the X60, the BIOS chip is on the bottom of the motherboard, under a layer of protective black tape.
- On the T60, the BIOS chip is just under the palmrest, but blocked by a magnesium frame (which you will have to remove).
Reading the Flashchip with Bus Pirate
First, visually inspect (with a magnifying glass) the type of flashchip on the motherboard.
Next, download and extract the Libreboot binaries, and enter the
cd libreboot_bin cd flashrom
If it is an SST, run this command:
sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom
If it is a Macronix, run this command:
sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom
Next, check the md5sum of the dump:
flashrom command again to make a second dump. Then, check the md5sum of the second dump:
If the md5sums match after three tries,
flashrom has managed to read the flashchip precisely (but not always accurately). You may try and flash Libreboot now.
Flashing Libreboot with Bus Pirate
/path/to/libreboot.romwith the location of your chosen ROM, such as
If your chip is SST, run this command:
sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom
If your chip is Macronix, run this command:
sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom
Once that command outputs the following, the flash has completed successfully. If not, just flash again.
Reading old flash chip contents... done. Erasing and writing flash chip... Erase/write done. Verifying flash... VERIFIED.