<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<style type="text/css">
body {
background:#fff;
color:#000;
font-family:sans-serif;
font-size:1em;
}
</style>
<title>Libreboot documentation: Unbricking the ThinkPad X60 Tablet</title>
</head>
<body>
<header>
<h1>Unbricking the ThinkPad X60</h1>
<aside>This guide will show you how to recover from a bad flash that prevents your ThinkPad X60 Tablet from booting.</aside>
</header>
<p>Or go <a href="../index.html">back to main index</a></p>
<h2>Table of Contents</h2>
<ul>
<li><a href="#hardware_requirements">Hardware Requirements</a></li>
<li><a href="#software_requirements">Software Requirements</a></li>
<li>
Types of brick:
<ul>
<li><a href="#bucts_brick">Brick type 1: bucts not reset</a></li>
<li><a href="#recovery">Brick type 2: bad rom (or user error), machine won't boot</a></li>
</ul>
</li>
</ul>
<h1 id="hardware_requirements">Hardware requirements</h1>
<ul>
<li>a 2nd computer (maybe another X60 Tablet. any computer will do)</li>
<li>external flashrom-compatible programmer (I'm using the "bus pirate")
<li>SOIC-8 IC clip (I'm using the Pomona 5250)</li>
<li>Cable (programmer<>clip) - mine came with the bus pirate.</li>
<li>USB mini a to b cable (for buspirate<>computer connection).</li>
</ul>
<h1 id="software_requirements">Software requirements</h1>
<ul>
<li>GNU/Linux (on the 2nd computer)</li>
<li>flashrom software (on the 2nd computer): <a href="http://flashrom.org/" target="_blank">http://flashrom.org/</a>
</ul>
<h1 id="bucts_brick">Brick type 1: bucts not reset.</h1>
<p>
You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and
the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.<br/><br/>
In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:<br/>
<img src="x60t_unbrick/0008.JPG" alt="" /><br/><br/>
*Those dd commands should be applied to all newly compiled X60 ROM's (the ROM's in libreboot binary archives already have this applied!):<br/>
dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k<br/>
dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump<br/>
dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc<br/>
(doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running,
using those instructions: <a href="http://www.coreboot.org/Board:lenovo/x60/Installation" target="_blank">http://www.coreboot.org/Board:lenovo/x60/Installation</a>.
</p>
<h1 id="recovery">bad rom (or user error), machine won't boot</h1>
<p>
In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from
booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all.
</p>
<p>
"Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides).
</p>
<p>
<img src="x60t_unbrick/0000.JPG" alt="" />
</p>
<p>
Remove those screws:<br/>
<img src="x60t_unbrick/0001.JPG" alt="" />
</p>
<p>
Remove the HDD:<br/>
<img src="x60t_unbrick/0002.JPG" alt="" />
</p>
<p>
Push keyboard forward to loosen it:<br/>
<img src="x60t_unbrick/0003.JPG" alt="" />
</p>
<p>
Lift:<br/>
<img src="x60t_unbrick/0004.JPG" alt="" />
</p>
<p>
Remove those:<br/>
<img src="x60t_unbrick/0005.JPG" alt="" />
</p>
<p>
<img src="x60t_unbrick/0006.JPG" alt="" />
</p>
<p>
Also remove that (marked) and unroute the antenna cables:<br/>
<img src="x60t_unbrick/0007.JPG" alt="" />
</p>
<p>
Some X60T's you have to unroute those too:<br/>
<img src="x60t_unbrick/0010.JPG" alt="" />
</p>
<p>
Remove the LCD extend board screws. Also remove those screws (see blue marks) and remove/unroute the cables and remove the metal plate:<br/>
<img src="x60t_unbrick/0008.JPG" alt="" />
</p>
<p>
Remove that screw and then remove the board:<br/>
<img src="x60t_unbrick/0009.JPG" alt="" />
</p>
<p>
At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):<br/>
<a href="http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts" target="_blank">http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts</a>.<br/>
Correlating with the following information, I was able to wire up my pirate correctly:<br/>
<a href="http://flashrom.org/Bus_Pirate#Connections" target="_blank">http://flashrom.org/Bus_Pirate#Connections</a><br/>
And by following that advice:<br/>
<a href="http://www.coreboot.org/Board:lenovo/x60/Installation#Howto" target="_blank">http://www.coreboot.org/Board:lenovo/x60/Installation#Howto</a>.<br/>
Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.<br/>
Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the
AC adapter (without powering on the board).<br/>
Note: I ignored that advice, and wired up all 8 pins. And it worked.<br/>
Here is the pinout (correlate it with your programmer's documentation):<br/>
<img src="x60t_unbrick/0011.JPG" alt="" /><br/>
(SPI chip here is on the bottom of the board)
</p>
<p>
Bus pirate:<br/>
<img src="x60_unbrick/0019.jpg" alt="" />
</p>
<p>
Pomona 5250:<br/>
<img src="x60_unbrick/0020.jpg" alt="" />
</p>
<p>
Connect pomona:<br/>
<img src="x60_unbrick/0022.jpg" alt="" />
</p>
<p>
Connect pirate to USB on 2nd computer:<br/>
<img src="x60_unbrick/0024.jpg" alt="" />
</p>
<p>
Pirate is active:<br/>
<img src="x60_unbrick/0023.jpg" alt="" />
</p>
<p>
<img src="x60_unbrick/0025.jpg" alt="" />
</p>
<p>
On the 2nd machine, I did: <b>flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60t/libreboot_ukqwerty.rom</b>
</p>
<pre>
flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
flashrom is free software, get the source code at http://www.flashrom.org
Calibrating delay loop... delay loop is unreliable, trying to continue OK.
Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.
</pre>
<p>
At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means that you can put your X60T back together. So let's do that now.
</p>
<p>
Reverse the steps to re-assemble your machine.
</p>
<hr/>
<p>
Copyright © 2014 Francis Rowe <info@gluglug.org.uk><br/>
This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
A copy of the license can be found at <a href="../license.txt">../license.txt</a>.
</p>
<p>
This document is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information.
</p>
</body>
</html>