Lenovo V570 (V560 series) KBC flash

Don't ask how to hack password. (BIOS Passwords)
Post Reply
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

Bought this notebook a couple days ago to fix and keep for myself, or maybe resell, we'll see.

Trouble: No power absolutely. No LEDs no nothing. Not even battery charging LED. I have confirmed the presence of 3.3v and 5v standby, there is 3.3v on the power button as well, but when pressing power nothing happens.

I don't have a schematic for this mainboard (Wistron LA56). However, i found a schematic for a LA46, which is the same in many areas, except the PWM controller for the 5v and 3.3v main rails. I've also found on a Polish forum that the flash for the KBC frequently goes bad on this model. I downloaded two dump files from there, from two different configurations of this mainboard, Lenovo B560/G560 with integrated graphics (like mine is) and V560 with discrete nVidia GPU. The content is the same and the CRCs match, and the place i got it from says the dumps are tested. So i'm fairly sure the content of the KBC flash is the same on all versions of this mainboard, and they are going to work in my V570 as well.

Judging by the amount of stuff that the "keyboard controller" is actually responsible for as the LA46 board schematic shows, no wonder it doesn't power up at all if its flash is bad. On this mainboard, not even the main BIOS receives power right now (it's on the main 3v3 which is controlled by the KBC), so no way in hell is this going to boot.

Trouble is, i don't have anything to program the SPI EEPROM with. I phoned a friend who said he can borrow me his Bus Pirate, i think that will work. I'll first dump the contents of the existing EEPROM and compare with the dumps i downloaded, to see if it is truly corrupted. Then i'll reflash (swap in another EEPROM if necessary). If that doesn't fix it, i'll be ordering a KBC as they are available on ebay for $7. No luck on the datasheet for that either, so i'm lucky i got the schematic of the LA46 board, which has the pinout of this particular KBC (Nuvoton NPCE781EA0).
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

Seeing you mark this as a common problem and having a possible solution, we would greatly appreciate to hear from you if you succeed. Thank you so far.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

So far i have managed to confirm that the flash chip is indeed flaky. After getting accustomed to the Bus Pirate and flashrom, and reading/wiping/rewriting other chips successfully, i pulled the PMC Pm25LD010 from the Lenovo.

I had to hack the flashrom sources to support it, as the Pm25LD010 appeared as unknown, and didn't let me do anything to it. The IDs it reported didn't even match the datasheet! After recompiling flashrom, i managed to read the chip. It definitely does NOT contain what it should, it's all corrupted. I tried to rewrite it but it always fails a few bytes, either at the erase phase, or at the verification. It's shot.

Now to see where i can source a compatible chip. Going by the LA46 mainboard schematic, i can also use the Macronix MX25L1005, which is confirmed working with flashrom so no more hacks would be required. A quick compare of the datasheet shows that the two chips are indeed the same.

I'll get back to you once i have a replacement chip in my hands. :)

Edit: I think i'll be off to buy me some DDR3 tomorrow... :mrgreen: (I got this laptop with no RAM). I noticed that it failed verification, but if i retried verification, it would fail at a different address, most of the time AFTER the first failure. This didn't make sense - how did it go past the first address it found bad, did it magically heal itself? I started to read at those addresses manually using the Bus Pirate, and it returned fine... So i thought maybe the read function in flashrom doesn't like this chip, and there's a chance it actually flashed properly.

So i soldered the flash back in. And what do you know... i got a blink code. I put the CPU back in, hit the power button, and TADA! Solid power light and fan spins. Put the battery in and it charges. Unplugged the DC jack and it keeps running off battery. IT'S ALIVE!!! :D I'll buy RAM tomorrow and see if it boots.
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

There's no way of finding out anymore but could this have been a bad solder joint where the board simply was not able to read that chip properly in the first place? How is the soldering quality of this thing in general?
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

A bad solder joint can be ruled out. When i first read the chip it was all gibberish compared to the bin that was supposed to be in it, any sequence longer than 3 bytes didn't match between the two.

Soldering looks good in general. There were other more sensitive parts than the SOIC-8 flash that would have suffered if the soldering was crap. What i wasn't happy with was the general lack of bypass capacitors on this board, and it's likely that the flash went corrupt because it didn't have one, so i added my own. And yes... that is a 0402 and i did it by hand.

ImageImage

Should be going to get the RAM later, i'll let you know how it turns out.
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

Old-school skills rock :-) it's a pity I need to move house so I cleared out several cubic meters of stuff, I used to tinker/solder whatever a lot...
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

I got the RAM. Report: SUCCESS!!! :mrgreen: There are a few oddities reported by the BIOS such as the wrong model number and the invalid serial number. I think these are the proofs of a previous bad/incomplete BIOS flash.

The guy who sold me the laptop said he sold it as working and it came back 2 days later. The buyer told him he left it on the desk doing Windows updates and left for work. The laptop was dead when he came back, and indeed, pending updates were found on the HDD so the buyer wasn't lying, and he was refunded.

I wonder how could a BIOS update slip thru among Windows updates, AND fail at that. :?: But, everything's possible. Other than those serial number oddities, the machine works great.

ImageImage

And here it is booting from flash drive the very Ubuntu live system that was used to bring it back to life. You can see the two bin files i got from elvikom.pl (both are the same, just the names differ), and flashrom on the left. Next up is installing a hard drive and putting Windows 7 on it, and it should be up and running.

Image
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

I just hope it still has some sort of serial number sticker on the casing... Other than that, congrats on a job well done.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

Thanks. Yes there is a serial number on the back. I've googled a bit more and the serial number thing has to do with the main BIOS. There is a BIOS update available. However, i'm unable to flash the BIOS with either Windows or DOS utilities, it reports "unsupported ROM". Ahh well, i might just flash that with the Bus Pirate as well.

I'm gonna have to take this thing apart again anyway, because i'm not happy with load temperatures when stress testing, the CPU reaches 85+ deg C and throttles down (maximum allowed temperature for this chip is 90C). It does not do it during any normal usage, but i can easily see how it could happen during a demanding job such as video encoding. It could just be poor fan management tho, when i start the stress test i can hear the fan rev up to the max, then it goes down a couple steps while temps keep rising and the CPU reaches throttling temperature.

The fan spits out warm air all the time, even when it spins slowly and reported core temps are in the 40-50C range, so the paste has likely set well, and the cooling system is just undersized (as usual). However, there's something physical i can do to help it - half the intake area doesn't have holes drilled on this model, but the pattern is there. I think i'll take my mini drill to the case, just like i did with my HP DV5. :P

Btw, Windows 7 installed and working great. I did have to hunt for drivers for a bit - out of all places, the only driver that worked for the Intel Management Engine Interface was from HP. :lol: Lenovo's driver department is sleeping on the job.
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

As far as I remember, HP is the only one having a windows 7 driver for that on this chipset. Been going around for that a while ago. If you search really well there's a generic one on the Intel website as well. If you want I can try to dig it up.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

Oh, i forgot to attach the dumps, haven't i? Here's both of them just to be safe, they are the same.
Attachments
lenovo 560 kbc.rar
lenovo 560 series wistron la-56 kbc flash file
(52.58 KiB) Downloaded 976 times
Th3_uN1Qu3
BIOS Rookie
Posts: 32
Joined: Tue Mar 20, 2007 2:47 am
Location: Bucharest, Romania
Contact:

Just a follow-up: I ended up buying a replacement fan from ebay, which solved all my thermal worries. The original fan was a bit wobbly and didn't rev up to the maximum speed. Still have the laptop, posting from it right now. Working great. :)

And it's actually a V560, dunno why i was under the impression that it's a V570.
Post Reply