|
|
| Line 1: |
Line 1: |
| Modern mainboards store the BIOS in a '''reprogrammable flash chip'''. There are hundreds of different flash (EEPROM) chips, with variables such as memory size, speed, communication bus (Parallel, LPC, FWH, SPI) and packaging to name just a few.
| | {{#externalredirect: https://www.flashrom.org/user_docs/overview.html }} |
| | |
| == Packaging/housing/form factor ==
| |
| | |
| Probably the only property of flash chips which is completely irrelevant to flashrom. The BIOS copyright holders often place a fancy sticker on the BIOS chip showing a name or logo, BIOS version, serial number and copyright notice (all of which is also irrelevant for flashrom).
| |
| | |
| === DIP32: Dual In-line Package, 32 pins ===
| |
| | |
| <gallery>
| |
| File:Dip32 chip.jpg|<small>DIP32 top</small>
| |
| File:Dip32 chip back.jpg|<small>DIP32 bottom</small>
| |
| File:Dip32 in socket.jpg|<small>DIP32 in a socket</small>
| |
| File:Empty dip32 socket.jpg|<small>DIP32 socket</small>
| |
| File:Dip tool.jpg|<small>DIP32 extractor tool</small>
| |
| </gallery>
| |
| | |
| A rectangular black plastic block with 16 pins along each of the two longer sides of the package (32 pins in total). DIP32 chips can be '''socketed''' which means they are detachable from the mainboard using physical force. If they haven't been moved in and out of the socket very much, they can appear to be quite difficult to release from the socket. One way to remove a DIP32 chip from a socket is by prying a '''thin screwdriver''' in between the plastic package and the socket, along the shorter sides where there are no pins, and then gently bending the screwdriver to push the chip upwards, away from the mainboard. Alternate between the two sides to avoid bending the pins, and don't touch any of the pins with the screwdriver (see FAQ about ESD, electro-static discharge). If the chip is '''soldered directly to the mainboard''', it has to be desoldered in order to be reprogrammed outside the mainboard. If you do this, it's a good idea to [http://www.coreboot.org/Soldering_a_socket_on_your_board solder a socket to the mainboard] instead, to ease any future experiments.
| |
| | |
| === PLCC32: Plastic Leaded Chip Carrier, 32 pins ===
| |
| | |
| <gallery>
| |
| File:Plcc32 chip.jpg|<small>PLCC32 top</small>
| |
| File:Plcc32 chip back.jpg|<small>PLCC32 bottom</small>
| |
| File:Plcc32 in socket.jpg|<small>PLCC32 in a socket</small>
| |
| File:Empty plcc32 socket.jpg|<small>PLCC32 socket</small>
| |
| File:Soldered plcc32.jpg|<small>Soldered PLCC32</small>
| |
| File:Dual_plcc32_soldered.jpg|<small>Two soldered PLCC32</small>
| |
| File:Bios savior.jpg|<small>PLCC32 Bios Savior</small>
| |
| File:Top hat flash.JPG|<small>PLCC32 Top-Hat-Flash adapter</small>
| |
| File:Pushpin roms 2.jpg|<small>PLCC32 pushpin trick</small>
| |
| File:Plcc_tool.jpg|<small>PLCC extractor tool</small>
| |
| </gallery>
| |
| | |
| Black plastic block again, but this one is much more square. PLCC32 was becoming the standard for mainboards after DIP32 chips because of its smaller physical size. PLCC can also be '''socketed''' or '''soldered directly to the mainboard'''. Socketed PLCC32 chips can be removed using a special '''PLCC removal tool''', or using a '''piece of nylon line''' tied in a loop around the chip and pulled swiftly straight up, or bending/prying using small screwdrivers if one is careful. PLCC32 sockets are often fragile so the '''screwdriver approach is not recommended'''. While the nylon line method sounds strange it works well. Desoldering PLCC32 chips and soldering on a socket [http://www.coreboot.org/Soldering_a_socket_on_your_board can be done] using either a desoldering station or even just a heat gun. You can also cut the chip with a sharp knife, but it will be destroyed in the process, of course.
| |
| | |
| === DIP8: Dual In-line Package, 8 pins ===
| |
| | |
| <gallery>
| |
| File:Dip8 chip.jpg|<small>DIP8 top</small>
| |
| File:Dip8 chip back.jpg|<small>DIP8 bottom</small>
| |
| File:Dip8 in socket.jpg|<small>DIP8 in a socket</small>
| |
| File:Empty dip8 socket.jpg|<small>DIP8 socket</small>
| |
| </gallery>
| |
| | |
| Most recent boards use DIP8 chips (which always employ the SPI protocol) or SO8/SOIC8 chips (see below). DIP8 chips are always '''socketed''', and can thus be easily removed (and hot-swapped), for example using a small screwdriver. This allows for relatively simple recovery in case of an incorrectly flashed chip.
| |
| | |
| === SO8/SOIC8: Small-Outline Integrated Circuit, 8 pins ===
| |
| | |
| <gallery>
| |
| File:Soic8_chip.jpg|<small>Soldered SOIC8</small>
| |
| File:Soic8 socket front closed.jpg|<small>SOIC8 socket, front, closed</small>
| |
| File:Soic8 socket half opened.jpg|<small>SOIC8 socket, half open</small>
| |
| File:Soic8 socket open.jpg|<small>SOIC8 socket, open</small>
| |
| File:Soic8 socket back.jpg|<small>SOIC8 socket, back</small>
| |
| File:Soic8 socket with chip.jpg|<small>SOIC8 socket, chip nearby</small>
| |
| File:Soic8 socket with chip inserted.jpg|<small>SOIC8 socket, chip inserted</small>
| |
| File:Spi-socket-dscn2913-1024x768.jpg|<small>Another type of SOIC8 adapter</small>
| |
| </gallery>
| |
| | |
| Similarly to the DIP8 chips, these always use the SPI protocol. However, SO8/SOIC8 chips are most often soldered onto the board directly without a socket. In that case a few boards have a header to allow [[ISP|in-system programming]]. You can also desolder a soldered SO8 chip and solder an SO8 socket/adapter in its place, or build a [http://blogs.coreboot.org/blog/2013/07/16/gsoc-2013-flashrom-week-4/ SOIC-to-DIP adapter]. The cheapest SOIC ZIF sockets I could find are made by [http://www.wieson.com/go/en/wieson/product_ctocshow.php?subSerialNum=205&SerialNum=3&TypeName=Connectors&subTypeName=SPI%20Socket Wieson]. They have 3 models available - G6179-10(0000), G6179-20(0000) and a 16 pin version named G6179-07(0000). They are available for example from [http://bios-repair.co.uk/Products/SMD-Sockets.html bios-repair.co.uk], [http://siliconkit.com/ocart/index.php?route=product/product&product_id=81 siliconkit] and [http://www.dediprog.com/search?choice=&no=SOK-SPI Dediprog], as well as [http://alibaba.com alibaba]. For the usual "BIOS" flash chips you want the G6179-10 model (look also for G6179-100000, somebody seems to be confused about model numbers... ;).
| |
| [http://www.dediprog.com Dediprog] usually has [http://www.dediprog.com/pd/smt-sockets/SOK-SPI-8W them] or [http://www.dediprog.com/pd/smt-sockets/SOK-SPI-8W-1 similar ones] as well but has steep shipping costs and an unpractical minimum order quantity.
| |
| | |
| === TSOP: Thin Small-Outline Package, 32, 40, or 48 pins ===
| |
| | |
| <gallery>
| |
| File:Amd am29f010 tsop32.jpg|<small>Soldered TSOP32</small>
| |
| File:Sst 39vf040 tsop32.jpg|<small>Soldered TSOP32</small>
| |
| File:Soldered tsop40.jpg|<small>Soldered TSOP40</small>
| |
| File:Soldered tsop48.jpg|<small>Soldered TSOP48</small>
| |
| </gallery>
| |
| | |
| TSOPs are often used in embedded systems where size is important and there is no need for replacement in the field. It is possible to (de)solder TSOPs by hand, but it's not trivial and a reasonable amount of soldering skills are required.
| |
| | |
| === BGA: Ball Grid Array ===
| |
| | |
| <gallery>
| |
| File:Flash-BGA.jpg|<small>BGA package flash</small>
| |
| </gallery>
| |
| | |
| BGAs are often used in embedded systems where size is important and there is no need for replacement in the field. It is not easily possible to (de)solder BGA by hand.
| |
| | |
| <!--
| |
| === WSON: Very Very Thin Small Outline No Lead ===
| |
| | |
| <gallery>
| |
| File:Flash-WSON.jpg|<small>WSON package flash</small>
| |
| </gallery>
| |
| | |
| WSON flash chips are increasingly popular in laptops since about 2010.
| |
| -->
| |
| == Communication bus protocol ==
| |
| | |
| There are four major communication bus protocols for flash chips, each with multiple subtle variants in the command set:
| |
| | |
| * '''Parallel:''' The oldest flash bus, phased out on mainboards around 2002.
| |
| * '''LPC:''' Low Pin Count, a standard introduced ca. 1998.
| |
| * '''FWH:''' Firmware Hub, a variant of the LPC standard introduced at the same time. FWH is a special case variant of LPC with one bit set differently in the memory read/write commands. That means some data sheets mention the chips speak LPC although they will not respond to regular LPC read/write cycles.
| |
| * '''SPI:''' Serial Peripheral Interface, introduced ca. 2006.
| |
| | |
| Here's an attempt to create a marketing language -> chip type mapping:
| |
| | |
| * JEDEC Flash -> Parallel (well, mostly)
| |
| * FWH -> FWH
| |
| * Firmware Hub -> FWH
| |
| * LPC Firmware -> FWH
| |
| * Firmware Memory -> FWH
| |
| * Low Pin Count (if Firmware/FWH is not mentioned) -> LPC
| |
| * LPC (if Firmware is not mentioned) -> LPC
| |
| * Serial Flash -> SPI
| |
| | |
| SST data sheets have the following conventions:
| |
| | |
| * LPC Memory Read -> LPC
| |
| * Firmware Memory Read -> FWH
| |
| | |
| If both are mentioned, the chip supports both.
| |
| | |
| If you're not sure about whether a device is LPC or FWH, look at the read/write cycle definitions.
| |
| | |
| {| border="0" style="font-size: smaller"
| |
| |- bgcolor="#6699ff"
| |
| |+ '''FWH'''
| |
| !Clock Cycle !! Field Name !! Field contents !! Comments
| |
| |- bgcolor="#eeeeee"
| |
| | 1 || START || 1101/1110 || 1101 for READ, 1110 for WRITE.
| |
| |- bgcolor="#eeeeee"
| |
| | 2 || IDSEL || 0000 to 1111 || IDSEL value to be shifted out to the chip.
| |
| |- bgcolor="#eeeeee"
| |
| | 3-9 || IMADDR || YYYY || The address to be read/written. 7 cycles total == 28 bits.
| |
| |- bgcolor="#eeeeee"
| |
| | 10+ || ... || ... || ...
| |
| |}
| |
| | |
| {| border="0" style="font-size: smaller"
| |
| |- bgcolor="#6699ff"
| |
| |+ '''LPC'''
| |
| !Clock Cycle !! Field Name !! Field contents !! Comments
| |
| |- bgcolor="#eeeeee"
| |
| | 1 || START || 0000 || ...
| |
| |- bgcolor="#eeeeee"
| |
| | 2 || CYCLETYPE+DIRECTION || 010X/011X || 010X for READ, 011X for WRITE. X means "reserved".
| |
| |- bgcolor="#eeeeee"
| |
| | 3-10 || ADDRESS || YYYY || The address to be read/written. 8 cycles total == 32 bits.
| |
| |- bgcolor="#eeeeee"
| |
| | 11+ || ... || ... || ...
| |
| |}
| |
| | |
| Generally, a parallel flash chip will not speak any other protocols. SPI flash chips also don't speak any other protocols. LPC flash chips sometimes speak FWH as well and vice versa, but they will not speak any protocols besides LPC/FWH.
| |
| | |
| == Hardware Redundancy ==
| |
| Gigabyte's DualBios: http://www.google.com/patents/US6892323, http://stuge.se/m57sli/
| |
| | |
| ASUS: http://www.google.com/patents/US8015449
| |