Protip: Take pictures of screw placements and antenna cable routing.
### What I tried before removing the chip
The first thing I tried was to solder way too big wires to the exposed
little solder blobs. Thereby, I destroyed the solder blobs and now the
board is throwing CMOS errors upon boot. I probably should've unplugged
the CMOS battery. It still measures 3.10V though, which was slightly
worrying as I thought I had damaged the board. As it turns out I didn't.
Still, it was not a smart idea, so *disconnect your CMOS battery before
soldering*
Also, the bios didn't boot after I reassembled the Laptop. Reheating the
"destroyed" joints seems to have fixed this. Meaning that the BIOS chip
was not broken at this point. So I finally decided to remove it from the
board. As I didn't have a heat gun at the time, I finally ordered one.
## Preparing the board
We will heat the board up quite massively, as the WSON chip is connected
to the big ground plains via a rather big pad under the chip. There are
really small components around our chip which would be desoldered long
before the chip if we heat them up. Also, as we don't want them flying around, we'll tape them
off with our heat resistant tape. I used Kapton-Tape for this, which is
not optimal as it is only made to withstand up to 280°C. If you have
access to actual heat shielding tape made of aluminium or another metal,
go for it. Just make sure to take your time and fit it tightly to the
board. In my personal experience, the Kapton-tape is good enough that
you don't even desolder the small components. Well, at least they don't move if they do and resolder fine.
*Board covered in Kapton tape -- notice the dodgy solder balls around the chip*
## Desoldering the chip
Now that you have prepared the board it's time to take your heat gun.
You cannot use a soldering iron as there is a large pad below the chip.
I set mine to around 350°C (\~660°F) and a medium airflow. Make sure to
blow the air straight at the board and not at an angle to avoid
desoldering and blowing away those tiny resistors. Cycle over the chip
and use your tweezers to test if it came loose and finally remove the
chip. Even if you never used a heat gun before, it's not that hard. Just
don't pull on the chip while there is still solder holding it down.
Remove the Kapton-Tape from the board when you're done unless you want
to use the heat gun to solder the replacement into place. Don't throw
the old one away, we'll need it later.
*The chip finally came off the board without lifting any pads. --- the Kapton-Tape has darkened a bit.*
## Soldering the new chip
Your replacement chip is a SOIC8 package. If you soldered SMD parts
before then you should have no problem. In case you haven't: Make sure
you align the indent on the chip with the white mark on the board. The
indent tells you where PIN-1 is and the mark on the board shows you
where it should be soldered to. If there is still a rather big amount of
solder on the pads consider removing it using some solder wick. Align
the chip on the board and solder one pin to the board so it doesn't move
anymore. Then take your time soldering the other seven.
*The new chip is soldered to the board, you can clearly see the alignment of the chip in the picture.*
## Extracting the original firmware
At this point, we have a blank chip in our Thinkpad, so it won't boot.
To fix this and to be able to prepare coreboot we need to extract the
original from the chip we desoldered. To achieve this I used a Raspberry
Pi, jumper wires and some really tiny copper wire. I cut one side of the
jumper wire off and attached the tiny copper wires. then I soldered
those to our old chip. To relieve stress I used the tape to hold it
down.
*Wires soldered to the chip, make sure you know where Pin 1 is before you tape it down. Later I spaced the wires on the left side out a bit more to prevent a short.*
flashrom v0.9.9-r1954 on Linux 4.9.80-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org
Calibrating delay loop... OK.
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on linux_spi.
Reading flash... done.
{{</highlight>}}
repeat this step at least another time, change "1.rom" to "2.rom" etc.
then compare the checksums
{{<highlightbash>}}
pi@raspberrypi:~/rom $ md5sum *.rom
ee8d5c6b4cb60fff9dbb2a359626dd96 1.rom
ee8d5c6b4cb60fff9dbb2a359626dd96 2.rom
ee8d5c6b4cb60fff9dbb2a359626dd96 3.rom
{{</highlight>}}
Looks fine :) make sure to store one of those somewhere save! You'll need
it if you ever want to update the Embedded Controller or don't want
to use Coreboot anymore.
## Flashing and testing our new chip
Before we create a coreboot image, we'll flash our original bios to our
new chip. This way we make sure that we soldered everything correctly
and our new chip works. First, you wire up your SOIC8-clip. The wiring
is the same as in the table above. Then you clip it onto the chip on the
board, make sure that there is no battery attached to the board!
On our Raspberry Pi, we now verify that the chip gets recognized and
[^spi]: You can use any other SPI programmer which is supported by flashrom, or even write your own program and use unsupported programmers. The protocol is not that complex.
