ThinkPad X60 Recovery guide

This section documents how to recover from a bad flash that prevents your ThinkPad X60 from booting.

ROM images for this machine are well-tested in Libreboot, so bricks are rare. The most common cause of a brick is operator error, when flashing a ROM image. In most cases, the cause will be that there is no bootblock, or an invalid one.

Brick type 1: bucts not reset.

You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and the ROM wasn’t dd’d.* or if Lenovo BIOS was present and libreboot wasn’t flashed.

There are 2 64KiB bootblocks possible, in the upper part of the ROM image. By default (bucts set to 0), the top one is used. If bucts is set to 1, the lower one (the one before the top one) is used. This bootblock is the first code that executes, during romstage as per coreboot hardware initialization.

BUC is short for Backup Control and TS is short for Top Swap. This is a special register on Intel platforms. Lenovo BIOS sets PRx registers, preventing software re-flashing, but there is a bug in the protection, allowing everything except the upper 64KiB from being flashed. By default, coreboot only puts a bootblock in the upper region. If you flash such a ROM, while bucts is set to 1, the system won’t boot because there’s not a valid bootblock; this is common if you’re re-flashing when coreboot is already installed, and you didn’t set bucts back to 0.

When you install on X60/T60 the first time, you set this bucts bit to 1, then you re-flash a second time and set it back to 0.

In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it’s a battery) and putting it back after a minute or two:

*Those dd commands should be applied to all newly compiled X60 ROM images (the ROM images in libreboot binary archives already have this applied!):

dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc

(doing this makes the ROM suitable for use when flashing a system that still has Lenovo BIOS running, using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation.

Brick type 2: bad ROM image

In this instance, you might have flashed a ROM without the top bootblock copied to the lower 64KiB section in the ROM, and you flashed the ROM for the first time (from Lenovo BIOS), in which case there is not a valid bootblock.

In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your system from booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your system is bricked and will not boot at all.

“Unbricking” means flashing a known-good (working) ROM. The problem: you can’t boot the system, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides).

Remove those screws:

Push the keyboard forward (carefully):

Lift the keyboard up and disconnect it from the board:

Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:

You should now have this:

Disconnect the wifi antenna cables, the modem cable and the speaker:

Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand side:

Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape that holds it into place:

Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:

Remove the screw that is highlighted (do NOT remove the other one; it holds part of the heatsink (other side) into place):

Remove those screws:

Carefully remove the plate, like so:

Remove the SATA connector:

Now remove the motherboard (gently) and cast the lcd/chassis aside:

Lift back that tape and hold it with something. Highlighted is the SPI flash chip:

Here is another photo, with the numbers of the pins written:

This photo shows an SPI flasher used, with SOIC8 test clip:

Refer to the following guide:
Externally rewrite 25xx NOR flash via SPI protocol

NOTE: Do not use the 3.3v rail from your raspberry pi. Leave that disconnected. For 3.3v, plug your charger into the mainboard (but do not power on the mainboard) when the clip is connected. Before removing the clip, disconnect the charger. This will provide adequate 3.3v DC at correct current levels. The SPI flash on an X60 shares a common 3.3V rail with many other components on the mainboard, which all draw a lot of current, more than your programmer can provide.

Example RPi command:

sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=4096 -w libreboot.rom -V

If flashrom complains about multiple flash chips detected, just pass the -c option as it suggests, and pick any of the chips it lists. spispeed=4096 or lower (e.g. spispeed=512) is recommended on this board. The flashing becomes unstable, on this machine, when you use higher speeds.

Reverse the steps to re-assemble your system, after you’ve flashed the chip.

It should be Verifying flash... VERIFIED at the end. If flashrom complains about multiple flash chip definitions detected, then choose one of them following the instructions in the output.

Remove the programmer and put it away somewhere. Put back the tape and press firmly over it:

Your empty chassis:

Put the motherboard back in:

Reconnect SATA:

Put the plate back and re-insert those screws:

Re-route that antenna cable around the fan and apply the tape:

Route the cable here and then (not shown, due to error on my part) reconnect the monitor cable to the motherboard and re-insert the screws:

Re-insert that screw:

Route the black antenna cable like so:

Tuck it in neatly like so:

Route the modem cable like so:

Connect modem cable to board and tuck it in neatly like so:

Route the power connection and connect it to the board like so:

Route the antenna and modem cables neatly like so:

Connect the wifi antenna cables. At the start of the tutorial, this system had an Intel wifi chip. Here you see I’ve replaced it with an Atheros AR5B95 (supports 802.11n and can be used without blobs):