While I was trying to boot a vanilla linux kernel on the Teclast X98 Air 3G I messed up a bit with the UEFI firmware settings: the battery was not recognized anymore, the tablet was rebooting right after showing the UEFI firmware boot screen, and USB-host was not working either; so no keyboard for accessing the firmware menu to restore the default settings, and no ADB for running flashrom or the Intel FPT to reflash the firmware with.
I decided to open the tablet and try to reprogram the flash chip In-System. In order to open the tablet without damaging it I started from the top of the device like shown in the video, and used something like these plastic opening tools.
The SPI flash chip used for the firmware is a Winbond W25Q64FW in a SOIC-8 package, I first tried to reflash it with a TUMPA, and then with a Beaglebone Black, but I failed, and I even managed to brick the device: the boot screen was not even displayed anymore.
Guess why... it was because I was trying to flash at 3.3V while the chip is supposed to work at 1.8V.
These are the FAILS which tech you a lesson the hard way:
Read the datasheet cover to cover (and maybe even understand it).
The indication about 1.8V was on the very first page...
OK, so I had a bricked device, how would I unbrick it?
There were several scenarios ahead:
- The flash chip was just erased, not damaged. Try to flash the chip at 1.8V.
- The flash chip was damaged. Unsolder it with a cheap Hot Air station (which I got anyway), and replace the chip with a new one found on AliExpress.
Goto 1. - Operating at 3.3V damaged some other components. Get another tablet and use this one for spare parts.
Luckily 1 was the case.
In order to flash at 1.8V I used this Logic Level Converter board from Sparkfun, and attached it to the BeagleBone Black like shown in the pictures below, I followed the indications from How to Access Chips Over the SPI on BeagleBone Black; the BBB kindly supplies 1.8V at pin 32 on the P9 header, so I used that as a reference for the lower voltage for the level converter.
The software side was pretty easy as I had flashrom already working on the BBB, and I had a backup of the flash contents:
root@arm:~/flashrom# echo BB-SPIDEV0 > /sys/devices/bone_capemgr.*/slots root@arm:~/flashrom# ./flashrom -V -p linux_spi:dev=/dev/spidev1.0 -w ../Teclast_X98_Air_3G_IFWI_flashrom_dump.rom
And the tablet was working again.
Now back to try running vanilla kernels on it.
UPDATE:
Cosimo Orlando published an article about Unbricking a Teclast X98 BIOS with Bus Pirate 4 and Flashrom.
