Hi guys,
while trying to mod my ThinkPad X1 Nano (model 20UN) I got too impatient to hold the wires pressed to the SPI Flash contacts, so I soldered wires to it, but wasn't paying attention when connecting my programmer and, stupidly, swapped VCC and GND. Thus I fried the main SPI Flash, and I only have an incomplete/corrupt dump (u49_incomplete.bin). The secondary SPI flash on the board (W25Q256JVEIQ) seems to hold two redundant copies of the EC firmware (at 0x1000 and 0xc0000) as well as a redundant BIOS copy. I am fairly confident that the secondary Flash dump is correct (dumped 3 times with the same checksum).
I replaced the main Flash with another of the same type and tried to reconstruct the BIOS region using the image extracted from the BIOS update, however the laptop still won't turn on. The power LED flashes when I plug in the power adapter (meaning the EC firmware is loaded successfully), but when the power button is pressed, there is no visible reaction (no power LED, no fan, no keyboard backlight).
After hooking a logic analyzer to both SPI Flashes simultaneously, I see that the platform is trying to boot, but seems to fail at some point. This is what happens when power is applied and the power button is pressed:
Having done some research on the Intel boot process, but realizing I still don't know enough about it, I am turning to the experts as a last resort before giving up and buying a replacement mainboard. From what I can see, it seems that the process doesn't fail because of Boot Guard, because it doesn't even get far enough to validate anything. Nothing is read from the primary Flash apart from the Flash descriptor region, which matches with a BIOS dump of the X1 Nano I found online, so I'm pretty sure this is not the problem.
I would be very grateful for any help with reviving this laptop.
while trying to mod my ThinkPad X1 Nano (model 20UN) I got too impatient to hold the wires pressed to the SPI Flash contacts, so I soldered wires to it, but wasn't paying attention when connecting my programmer and, stupidly, swapped VCC and GND. Thus I fried the main SPI Flash, and I only have an incomplete/corrupt dump (u49_incomplete.bin). The secondary SPI flash on the board (W25Q256JVEIQ) seems to hold two redundant copies of the EC firmware (at 0x1000 and 0xc0000) as well as a redundant BIOS copy. I am fairly confident that the secondary Flash dump is correct (dumped 3 times with the same checksum).
I replaced the main Flash with another of the same type and tried to reconstruct the BIOS region using the image extracted from the BIOS update, however the laptop still won't turn on. The power LED flashes when I plug in the power adapter (meaning the EC firmware is loaded successfully), but when the power button is pressed, there is no visible reaction (no power LED, no fan, no keyboard backlight).
After hooking a logic analyzer to both SPI Flashes simultaneously, I see that the platform is trying to boot, but seems to fail at some point. This is what happens when power is applied and the power button is pressed:
- SFDP is read from the secondary Flash (u89.bin)
- EC FW is read from the secondary Flash at 0x1000
- SFDP is read from the primary Flash (u49_incomplete.bin)
- Flash descriptor region is read from the primary Flash (4k at 0x0)
- Weirdly, the Flash descriptor region is erased and reprogrammed with the exact same data (confirmed by dumping the Flash again afterwards and comparing)
- No more accesses on either SPI Flash. After a while, if power was applied from battery, the platform turns off. If AC power is connected, the laptop stays on indefinitely.
Having done some research on the Intel boot process, but realizing I still don't know enough about it, I am turning to the experts as a last resort before giving up and buying a replacement mainboard. From what I can see, it seems that the process doesn't fail because of Boot Guard, because it doesn't even get far enough to validate anything. Nothing is read from the primary Flash apart from the Flash descriptor region, which matches with a BIOS dump of the X1 Nano I found online, so I'm pretty sure this is not the problem.
I would be very grateful for any help with reviving this laptop.
Comment