1========== 2Overview 3========== 4 5Modern mainboards store the BIOS in a reprogrammable flash chip. 6There are hundreds of different flash (`EEPROM <https://en.wikipedia.org/wiki/EEPROM>`_) chips, 7with variables such as memory size, speed, communication bus (Parallel, LPC, FWH, SPI) and packaging to name just a few. 8 9Packaging/housing/form factor 10============================= 11 12DIP32: Dual In-line Package, 32 pins 13------------------------------------ 14 15DIP32 top 16 17.. image:: Dip32_chip.jpg 18 :alt: DIP32 top 19 20DIP32 bottom 21 22.. image:: Dip32_chip_back.jpg 23 :alt: DIP32 bottom 24 25DIP32 in a socket 26 27.. image:: Dip32_in_socket.jpg 28 :alt: DIP32 in a socket 29 30DIP32 socket 31 32.. image:: Empty_dip32_socket.jpg 33 :alt: DIP32 socket 34 35DIP32 extractor tool 36 37.. image:: Dip_tool.jpg 38 :alt: DIP32 extractor tool 39 40A rectangular black plastic block with 16 pins along each of the two longer sides of the package 41(32 pins in total). DIP32 chips can be socketed which means they are detachable from the mainboard 42using physical force. If they haven't been moved in and out of the socket very much, 43they can appear to be quite difficult to release from the socket. One way to remove a DIP32 chip 44from a socket is by prying a **thin screwdriver** in between the plastic package and the socket, 45along the shorter sides where there are no pins, and then gently bending the screwdriver to push 46the chip upwards, away from the mainboard. Alternate between the two sides to avoid bending the pins, 47and don't touch any of the pins with the screwdriver (search about ESD, electro-static discharge). 48If the chip is **soldered directly to the mainboard**, it has to be desoldered in order to be 49reprogrammed outside the mainboard. If you do this, it's a good idea to 50`solder a socket to the mainboard <http://www.coreboot.org/Soldering_a_socket_on_your_board>`_ instead, 51to ease any future experiments. 52 53PLCC32: Plastic Leaded Chip Carrier, 32 pins 54-------------------------------------------- 55 56PLCC32 top 57 58 .. image:: Plcc32_chip.jpg 59 :alt: PLCC32 top 60 61PLCC32 botto 62 63 .. image:: Plcc32_chip_back.jpg 64 :alt: PLCC32 bottom 65 66PLCC32 socket 67 68 .. image:: Plcc32_in_socket.jpg 69 :alt: PLCC32 socket 70 71PLCC32 in a socket 72 73 .. image:: Empty_plcc32_socket.jpg 74 :alt: PLCC32 in a socket 75 76Soldered PLCC3 77 78 .. image:: Soldered_plcc32.jpg 79 :alt: Soldered PLCC32 80 81Two soldered PLCC32 82 83 .. image:: Dual_plcc32_soldered.jpg 84 :alt: Two soldered PLCC32 85 86PLCC32 Bios Savior 87 88 .. image:: Bios_savior.jpg 89 :alt: PLCC32 Bios Savior 90 91PLCC32 Top-Hat-Flash adapte 92 93 .. image:: Top_hat_flash.jpeg 94 :alt: PLCC32 Top-Hat-Flash adapter 95 96PLCC32 pushpin trick 97 98 .. image:: Pushpin_roms_2.jpg 99 :alt: PLCC32 pushpin trick 100 101PLCC extractor tool 102 103 .. image:: Plcc_tool.jpg 104 :alt: PLCC extractor tool 105 106Black plastic block again, but this one is much more square. 107PLCC32 was becoming the standard for mainboards after DIP32 chips because of its smaller physical size. 108PLCC can also be **socketed** or **soldered directly to the mainboard**. 109Socketed PLCC32 chips can be removed using a special PLCC removal tool, 110or using a piece of nylon line tied in a loop around the chip and pulled swiftly straight up, 111or bending/prying using small screwdrivers if one is careful. PLCC32 sockets are often fragile 112so the screwdriver approach is not recommended. While the nylon line method sounds strange it works well. 113Desoldering PLCC32 chips and soldering on a socket can be done using either a desoldering station 114or even just a heat gun. You can also cut the chip with a sharp knife, **but it will be destroyed in the process, of course**. 115 116DIP8: Dual In-line Package, 8 pins 117---------------------------------- 118 119DIP8 top 120 121 .. image:: Dip8_chip.jpg 122 :alt: DIP8 top 123 124DIP8 bottom 125 126 .. image:: Dip8_chip_back.jpg 127 :alt: DIP8 bottom 128 129DIP8 in a socket 130 131 .. image:: Dip8_in_socket.jpg 132 :alt: DIP8 in a socket 133 134DIP8 socket 135 136 .. image:: Empty_dip8_socket.jpg 137 :alt: DIP8 socket 138 139Most recent boards use DIP8 chips (which always employ the SPI protocol) or SO8/SOIC8 chips (see below). 140DIP8 chips are always **socketed**, and can thus be easily removed (and hot-swapped), 141for example using a small screwdriver. This allows for relatively simple recovery in case of an incorrectly flashed chip. 142 143SO8/SOIC8: Small-Outline Integrated Circuit, 8 pins 144--------------------------------------------------- 145 146Soldered SOIC8 147 148 .. image:: Soic8_chip.jpg 149 :alt: Soldered SOIC8 150 151SOIC8 socket, front, closed 152 153 .. image:: Soic8_socket_front_closed.jpg 154 :alt: SOIC8 socket, front, closed 155 156SOIC8 socket, half open 157 158 .. image:: Soic8_socket_half_opened.jpg 159 :alt: SOIC8 socket, half open 160 161SOIC8 socket, open 162 163 .. image:: Soic8_socket_open.jpg 164 :alt: SOIC8 socket, open 165 166SOIC8 socket, back 167 168 .. image:: Soic8_socket_back.jpg 169 :alt: SOIC8 socket, back 170 171SOIC8 socket, chip nearby 172 173 .. image:: Soic8_socket_with_chip.jpg 174 :alt: SOIC8 socket, chip nearby 175 176SOIC8 socket, chip inserted 177 178 .. image:: Soic8_socket_with_chip_inserted.jpg 179 :alt: SOIC8 socket, chip inserted 180 181Another type of SOIC8 adapter 182 183 .. image:: Spi-socket-dscn2913-1024x768.jpg 184 :alt: Another type of SOIC8 adapter 185 186Similarly to the DIP8 chips, these always use the SPI protocol. 187However, SO8/SOIC8 chips are most often soldered onto the board directly without a socket. 188In that case a few boards have a header to allow :doc:`in_system`. You can also desolder 189a soldered SO8 chip and solder an SO8 socket/adapter in its place, or build 190a `SOIC-to-DIP adapter <http://blogs.coreboot.org/blog/2013/07/16/gsoc-2013-flashrom-week-4/>`_. 191Some of the cheapest SOIC ZIF sockets are made by `Wieson <https://www.wieson.com/go/en/wieson/index.php?lang=en>`_. 192They have 3 models available - G6179-10(0000), G6179-20(0000) and a 16 pin version named G6179-07(0000). 193They are available for example from `siliconkit <https://siliconkit.com/oc3/>`_, 194`Dediprog <https://www.dediprog.com/>`_, as well as `alibaba <http://alibaba.com/>`_. 195For the usual "BIOS" flash chips you want the G6179-10 model (look also for G6179-100000). 196Dediprog usually has them or similar ones as well but has steep shipping costs and an unpractical minimum order quantity. 197 198TSOP: Thin Small-Outline Package, 32, 40, or 48 pins 199---------------------------------------------------- 200 201Soldered TSOP32 202 203 .. image:: Amd_am29f010_tsop32.jpg 204 :alt: Soldered TSOP32 205 206Soldered TSOP32 207 208 .. image:: Sst_39vf040_tsop32.jpg 209 :alt: Soldered TSOP32 210 211Soldered TSOP40 212 213 .. image:: Soldered_tsop40.jpg 214 :alt: Soldered TSOP40 215 216Soldered TSOP48 217 218 .. image:: Soldered_tsop48.jpg 219 :alt: Soldered TSOP48 220 221TSOPs are often used in embedded systems where size is important and there is no need 222for replacement in the field. It is possible to (de)solder TSOPs by hand, 223but it's not trivial and a reasonable amount of soldering skills are required. 224 225BGA: Ball Grid Array 226-------------------- 227 228BGA package flash 229 230 .. image:: Flash-BGA.jpg 231 :alt: BGA package flash 232 233BGAs are often used in embedded systems where size is important and there is no need 234for replacement in the field. It is not easily possible to (de)solder BGA by hand. 235 236Communication bus protocol 237========================== 238 239There are four major communication bus protocols for flash chips, 240each with multiple subtle variants in the command set: 241 242* **SPI**: Serial Peripheral Interface, introduced ca. 2006. 243* **Parallel**: The oldest flash bus, phased out on mainboards around 2002. 244* **LPC**: Low Pin Count, a standard introduced ca. 1998. 245* **FWH**: Firmware Hub, a variant of the LPC standard introduced at the same time. 246 FWH is a special case variant of LPC with one bit set differently in the memory read/write commands. 247 That means some data sheets mention the chips speak LPC although 248 they will not respond to regular LPC read/write cycles. 249 250Here's an attempt to create a marketing language -> chip type mapping: 251 252* JEDEC Flash -> Parallel (well, mostly) 253* FWH -> FWH 254* Firmware Hub -> FWH 255* LPC Firmware -> FWH 256* Firmware Memory -> FWH 257* Low Pin Count (if Firmware/FWH is not mentioned) -> LPC 258* LPC (if Firmware is not mentioned) -> LPC 259* Serial Flash -> SPI 260 261SST data sheets have the following conventions: 262 263* LPC Memory Read -> LPC 264* Firmware Memory Read -> FWH 265 266If both are mentioned, the chip supports both. 267 268If you're not sure about whether a device is LPC or FWH, look at the read/write cycle definitions. 269 270FWH 271 272=========== ========== ============== ========================================================== 273Clock Cycle Field Name Field contents Comments 274=========== ========== ============== ========================================================== 2751 START 1101/1110 1101 for READ, 1110 for WRITE. 2762 IDSEL 0000 to 1111 IDSEL value to be shifted out to the chip. 2773-9 IMADDR YYYY The address to be read/written. 7 cycles total == 28 bits. 27810+ ... ... ... 279=========== ========== ============== ========================================================== 280 281LPC 282 283=========== =================== ============== ========================================================== 284Clock Cycle Field Name Field contents Comments 285=========== =================== ============== ========================================================== 2861 START 0000 ... 2872 CYCLETYPE+DIRECTION 010X/011X 010X for READ, 011X for WRITE. X means "reserved". 2883-10 ADDRESS YYYY The address to be read/written. 8 cycles total == 32 bits. 28911+ ... ... ... 290=========== =================== ============== ========================================================== 291 292Generally, a parallel flash chip will not speak any other protocols. 293SPI flash chips also don't speak any other protocols. 294LPC flash chips sometimes speak FWH as well and vice versa, 295but they will not speak any protocols besides LPC/FWH. 296 297Hardware Redundancy 298=================== 299Gigabyte's DualBios: http://www.google.com/patents/US6892323 300 301ASUS: http://www.google.com/patents/US8015449 302
