title: Flashing the X200 Tablet with a Beaglebone Black x-toc-enable: true ...

This guide is for those who want Libreboot on their ThinkPad X200 Tablet (X200T), while they still have the original Lenovo BIOS present. This guide can also be followed (adapted) if you brick your X200T, to know how to recover. Note that not all X200T are supported; see the hardware page.

The X200 tablet comes with a WSON-8 flash chip, with a size of 8 MiB (8192 kB); it is located underneath the board, which means you have to completely disassemble the laptop to access it.

The pinout is the same as a SOIC-8 (often found on the X200), but such a package makes it impossible to flash using a clip (e.g., Pomona 5252 or 5250). You are able to install Libreboot by soldering the pin headers to to each pin of the chip, but the far easier way is to change the chip from a WSON-8 to a SOIC-8, which will be discussed in this guide.

Required Equipment

Installing Libreboot onto an X200 tablet is a much more involved process than its brother, the X200, and will require several additional pieces of equipment:

A hot air rework station, soldering station, and "knife" K-Tip soldering tip
- The 862D+ 2-in-1 SMD Soldering Iron and Hot Air Rework Station works well, is relatively inexpensive, and includes the kind of tip you need.
Magnification (e.g., a magnifier loupe, visor, or helping hands with magnifier)
Flux (a flux pen is easiest)
A pair of tweezers (both fine point slanted and regular fine point)
A SOIC-8 flash chip
- Check the list of flashrom-supported SOIC-8 flash chips at the Flashrom website: List of supported flash chips.
- Any 25XX series SPI NOR Flash in 8/16MiB sizes will work fine with Libreboot.
Kapton tape or alumimum foil (for heat shielding)

Alternative X200T Installation Options

If you don't want to try installing Libreboot yourself, companies exist that sell these laptops with Libreboot pre-installed (plus a free GNU+Linux distribution), or offer an installation service, if you send in your own device. See here.

MAC Address

On the X200T, the MAC address for the onboard gigabit Ethernet chipset is stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very important, because you will need to insert this into the Libreboot ROM image before flashing it. It will be written in one of these locations:\

Make sure to record it somewhere (e.g., a text document on a separate computer, or on a sheet of paper):

How to Disassemble the X200T

Remove all these screws on the base cover:\

Remove the hard drive:\

Gently push the keyboard towards the screen, then lift it off, and disconnect it from the board:\

Gently pull up the palm rest, lifting up the left and right side of it, until it clicks free:\

Unplug the Bluetooth adapter (if present):\

Disconnect the USB/microphone/headphone board on the right side of the laptop. There is a small plastic latch that must be lifted first, and then it can easily be pulled free:\

Remove the two screws in the wireless WLAN card:

Carefully remove the two antennae for the wireless WLAN card, making sure not to damage the cables or connectors; then, remove the card itself:\

Remove the three screws holding in the ExpressCard slot:\

Remove all the screws in the Extension cable card assembly, as well as two of the screws for the top shielding assembly:\

Remove the pieces of tape holding down the wireless/WWAN antennae:\

Move the wireless/WWAN antennae out of the way, and remove the top shielding screw in the right corner:\

Remove the screw in the bottom-right corner of the motherboard:\

Remove the top screw for the keyboard bezel assembly:\

Gently unplug the ribbon cable for the USB sub card assembly:\

Gently remove the LCD board connector, by lifting it up, disconnecting it from the screen:\

Rotate the LCD screen to the right, putting it at roughly a 90 degree angle with the base assembly. Then, gently lift up the ends of the keyboard bezel to disconnect it from the base, and pull it forward:\

Remove the top shielding by lifting it up, making sure to disconnect the tape connecting it to the base at the top-right, near the screen:\

Gently lift the board up by the right side, pulling it to the right a little to loosen it from the base:\

Flip the motherboard over, towards the LCD screen:\

Carefully unplug the digitizer pen switch connector, and the power connector:\

Completely remove the motherboard from the base enclosure; the flash chip will be on the underside, located underneath the black shielding (you can simply lift this up, and tape it out of the way), adjacent to the two RAM slots:\

To reassemble the device, simply reverse these steps, or see the official Lenovo Hardware Maintenance Manual for this model.

Now you are ready to remove the WSON-8 chip.

Removing the WSON-8 Flash Chip

Because the temperatures needed to remove the chip from the motherboard can cause damaged if applied for too long, we need to protect it as much as possible.

To accomplish this, we will need to shield all the parts of the board surrounding the chip; this can be accomplished using either kapton (heat-resistant) tape or aluminum foil, leaving just enough space to see the chip and all its pins:\

Next, we need to make sure that we have the right nozzle for the job; too wide, and we risk removing other components on the board; too narrow, and we will be unable to sufficiently heat all the pads simultaneously, so as to allow us to successfully remove the chip. I recommend a nozzle between 6-8mm in diameter.

According to the manufacturer instructions, turn on your hot air rework station, and set the temperature to between 380 and 400 degrees Celsius; the high temperatures are intended to both to melt the solder connecting the pins to the pads, and to minimize the risk of heat-damage to the board, by subjecting it to the hot air for as little time as possible.

Make sure that the fan speed is on the lowest available setting (you don't want too much air, which could accidentally blow off other components on the motherboard).

Start from about six inches away from the chip, and slowly move closer to the chip, until you are about half an inch or so above it. Move the nozzle around the chip in a circular motion, making sure not to leave it on any part for too long. You might actually see the solder start to bubble on the pads:\

At these temperatures, this process should take no more than 2-3 minutes. As you are applying the hot air, periodically check the looseness of the chip, using your angled tweezers; firmly grasp the sides of the chip, and attempt to wiggle it; if the chip doesn't move, you need to keep applying the hot air; if it starts to move a little, remove the tweezers while continuing to apply more heat/air, and then try to wiggle it again. Eventually, when the chip is sufficiently heated, you will be able to pull it right off.\

The best way to remove it is to lift it straight up off the board; if you trying removing it by sliding, you run the risk of accidentally knocking off some other soldered components.

Now that the old chip has been removed, you can put on the replacement.

Soldering the SOIC-8 Chip onto the Motherboard

The easiest way to put this chip on the board is just by using the solder already on the board/pads, but to make sure that we get the best connection, we are going to apply some flux to them. Flux destroys oxidants, which prevent a good electrical connection between the pins and the pads.

The easiest way to do this by using a flux pen, and applying it like you were painting the pads in flux.

Make sure that the chip is oriented correctly. On the motherboard, pin one is identified by the triangle in the bottom corner of the pads; on the chip, pin one is identified by the circular divot on the chip itself.

Make sure that each pin of the chip is aligned precisely with the pads on the board; this is easiest when using magnification. It is also helpful to use the straight-end fine-point tweezers to hold the chip while attempting to align it, which allow for more control over the chip's movements.

Once the chip is aligned correctly onto the pads, you're going to solder one of the corners; this is so that if you make an error in alignment, it can be easily correct by only having to modify the position of one pin; if you were to try to solder multiple pins at once, and found that the alignment was poor, you would have to desolder all of them, and start over.

While holding the chip firmly in place with the tweezers, place the tip of the soldering iron on the pad (not the chip's pin), for 3-4 seconds, until you can see the solder become molten (sometimes this is difficult to see). Make sure that the chip is flush on all the pads, then remove the iron; the solder should solidify within 1-2 seconds.

Attempt to move the chip slightly, to make sure that it has been successfully soldered to the board, and then do the same with the opposite corner. Once both corners are soldered, the chip should not move at all. Ensure again that they are aligned precisely, and if so, proceed to apply the iron to the rest of the pins, waiting until you see the solder become molten and adhere to the pads, before removing them (about 3-4 seconds).

Now you are ready to flash the chip.

Installing Libreboot

Congratulations! The hardest part of the process is over; now all you need to do is connect the clip, and flash Libreboot. For these instructions, refer to this document.

X200T and X200S - GPIO33 trick will not work.

sgsit found out about a pin called GPIO33, which can be grounded to disable the flashing protections by the descriptor and stop the ME from starting (which itself interferes with flashing attempts). The theory was proven correct; however, it is still useless in practise.

Look just above the 7 in TP37 (that's GPIO33):

By default we would see this in lenovobios, when trying flashrom -p internal -w rom.rom:

FREG0: Warning: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG2: Warning: Management Engine region (0x00001000-0x005f5fff) is locked.

With GPIO33 grounded during boot, this disabled the flash protections as set by descriptor, and stopped the ME from starting. The output changed to:

The Flash Descriptor Override Strap-Pin is set. Restrictions implied by
the Master Section of the flash descriptor are NOT in effect. Please note
that Protected Range (PR) restrictions still apply.

The part in bold is what got us. This was still observed:

PR0: Warning: 0x007e0000-0x01ffffff is read-only.
PR4: Warning: 0x005f8000-0x005fffff is locked.

It is actually possible to disable these protections. Lenovobios does, when updating the BIOS (proprietary one). One possible way to go about this would be to debug the BIOS update utility from Lenovo, to find out how it's disabling these protections. Some more research is available here: http://www.coreboot.org/Board:lenovo/x200/internal_flashing_research

On a related note, Libreboot has a utility that could help with investigating this: ../hardware/gm45_remove_me.html#demefactory

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License Version 1.3 or any later version published by the Free Software Foundation with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts. A copy of this license is found in ../fdl-1.3.md

x200tablet_external.md 14 KB History Raw