[flashrom] In situ Thinkpad E420 Sandy Bridge/Cougar Point PCH

awokd awokd at danwin1210.me
Sat Mar 24 13:49:57 CET 2018

Having trouble getting a good read from a Macronix MX25L3206E in situ
Thinkpad E420 Sandy Bridge/Cougar Point PCH. Don't believe it's a
programmer problem because I used the same programmer and pinouts to
successfully flash a Winbond W25Q32.V in a different system.

I found the Wistron LLW-1/LGG-1 schematic and matched the flash chip up
with the silk-screened label. Tried it in system with system power. I've
pulled the board and RAM. Also tried removing CPU. Symptoms of the problem

- On system power, doesn't detect chip.
- Using an external PS, when I restrict the current to the point there's a
vdroop to ~3.0v-3.2v, flashrom detects the chip. If I give it more current
(at 3.3v), the chip disappears and flashrom no longer sees it.
- Occasionally it acts like a successful read, WRSR updates correctly but
resulting file is mostly FF with a section of pages of 00 and some with
alternating bit patterns. Oddly, the file is consistent over multiple runs
and diff reports no differences, but there is nothing in it that looks
like actual data and ifdtool says there's no descriptor.

Suspect the issue is as described on https://www.flashrom.org/ISP- that ME
is getting powered and locking/hiding the chip. It suggests connecting the
reset line to CS. Searching the schematic for RST results in numerous
pages. How can I identify the right place to accomplish this, preferably
without soldering?

Alternatively, I see in the SPI programming guide there might be a couple
other ways to disable ME?

1. Temporarily disable the Intel® ME through the MEBX. Power off or cold
reset. - This option is only applicable to non-Intel ME Ignition firmware.
2. HDA_SDO(Manufacturing mode jumper or Flash descriptor override jumper)
asserted HIGH on the rising edge of PWROK.  Power off or cold reset. 
Note: this is only valid as long as you do not specifically set the
variable Flash Descriptor Overrride Pin-Strap Ignore in the Flash Image
Tool to false.

I found #2 on the schematic with a not installed resistor (what does "DY"
stand for anyways, "Damn You"?) but can't find the label for it on the
motherboard and it looked like it would also need soldering beyond my

Any suggestions?

More information about the flashrom mailing list