Flashing a BIOS chip with Bus Pirate

From DP

Jump to: navigation , search

This article is linked to by Flashing_KB9012_with_Bus_Pirate

Contents

Introduction

Let's assume that your starting conditions are the following:

1) You have a computer with installed GNU/Linux or BSD operating system

2) You want to start flashing the BIOS images to the motherboards of other computers - either to restore their closed source proprietary BIOS after a failed update; or to replace it with a free/open source alternative, which is:

coreboot + SeaBIOS payload. You could check Supported Motherboards list to see if your board is supported or what board it is better to buy

3) You already have a Bus Pirate: version 3 (~$27.15) or version 4 (~$37.15). Alternatively, you could have CH341 (~$2.35) or any other programmer that is compatible with flashrom

This article will help you to set up a working BIOS flashing environment by providing the advanced description of hardware side of the question

.

Getting the right tools

NOTE: although this part could be viewed as a kind of advertisement by some of the readers, it just gives you an example of what tools could be suitable and where you could buy them (and I am giving multiple examples, not focusing at one seller or product!) It is strongly encouraged that you additionally research before making the final purchase decisions, because:

1) the prices could change

2) the seller's rating could drop

3) better tools could appear

Also, this article describes flashing SOIC8 chips as an example. There could be a slightly different method of connectivity to other types of BIOS chips, especially for those types of chips which don't have available-for-purchase test clips and/or whose pins are not physically exposed to a user, so that a user can't connect to them without soldering...

Soldering iron (temperature adjustable)

While trying to reduce the expenses as much as possible I found two great choices:

1) Cheap soldering tool, stand and set of iron tips ($6.56)

2) ATTEN AT-SS-50, true ceramic core, stand and 1 iron tip (~$27.72)

Although 1) is a great cost effective choice, its' "ceramic" core is pseudoceramic in fact - nichrome spiral; that means: slower time to heat, no thermal stabilization (you would need to control a temperature switch constantly to remain near your desired temperature), also it heats a lot after 15-20 mins of usage - uncomfortable for fingers - so need to make a break

2) is the cheapest true ceramic core soldering tool with adjustable temperature that I was able to find. It has a great quality, quick starting time, working temperture stabilization and does not overheat your fingers. But it is more expensive than "1)", so you need to decide if "1)" is enough for your projects or you need a better "2)" tool

Soldering tips

If you feel that the soldering tips which came with a soldering tool are too large, or just not satisfied: Hakko soldering station tips are compatible. 900M-T-0.5C is a great choice for soldering the tiny SMD parts, 1P wires and almost everything else:

[*] 10 pcs of 900M-T-0.5C (~$4.53)

[*] 1 pcs of 900M-T-0.5C (~$1.84)

It is more efficient to buy 10 pcs rather than 1, you could resell the extra or gift to friends. There are also a lot of great sets with the different types of tips, like this (see below), but sadly they do not include 900M-T-0.5C :

[*] 10 pcs soldering tips set for Hakko (~$2.89)

Soldering supplies

The diameter and type of solder, as well as type of flux and width of desoldering wire - are the matter of personal preferences, so feel free to research for yourself. I am using this:

[*] 150g big spool of 0.3mm diameter soldering wire, 60 Sn 40 Pb, 1.2% flux (~$5.24)

[*] 5 pcs of RMA-223 10ml famous flux (~$2.20)

[*] 5 pcs of 1.5mm - 3.5mm width desoldering wires, 1.5m length (~$4.89)

1P wires

Copper has 1.65x times better electrical conductivity than aluminium

Many people are using 1P aluminium wires and are happy with them. But this BIOS flashing is very important task, so why settle for less? Here are some 12 strands pure copper 1P wires:

[*] 40 pcs of 20cm copper wires (~$2.25)

[*] 40 * 10 = 400 pcs of 20cm copper wires (~$13.80)

As you see it is possible to get 400 for a price of 200 by buying at bulk, so if you need a long lasting supply or would like to share with friends - it could be a good idea to consider 400 pcs option.

It is recommended that the wires used for BIOS flashing are less than 20 cm length. But 20 cm copper wire would be the same electrical conductivity as 20/1.65 = 12 cm aluminium wire, good enough; and if you still have some problems while flashing - you wouldn't need to shorten a copper wire as much as you would have needed to shorten an aluminium wire

1P pins

Better to buy 800 pins - that is cheaper per pin and would be enough for a long time ;)

[*] 800 pins, gold plated (?) (~$4.34)

[*] 800 pins, copper plated (~$3.70)

Gold is more resistant to corrosion, but copper has 1.4x times better electrical conductivity. Also, these items could be both copper in fact, so you might go for a cheaper option

SOIC8 test clip

There are at least five types of possible options for SOIC8 test clip:

[*] Standard type 1 - clamp only (~$2.15)

[*] Standard type 2 - "cheap and good" (~$2.60)

[*] Standard type 3 - "updated version, updated quality" (~$3.85)

[*] Standard type 4 - "wider gold plated needle" (~$6.00)

[*] Advanced type - high quality with bent 1.27mm 1P pins (~$9.00)

Standard types 2/3/4 already have the long and thin aluminium wires soldered to them - not good enough for BIOS flashing. "Advanced type" is more expensive, but it has 1.27mm 1P pins that you could easily connect copper wires to, while for the standard types you will have to solder them.

You could just buy a clamp (standard type 1) if your soldering skills are good - but these pins are too close to each other so it's inconvenient to solder. If not advanced type, it is better to get a standard type 2/3/4 then you cut these aluminium wires leaving about 2 cm part that is soldered to a test clip, then you remove the insulation and solder a copper wire to each of the aluminium wires individually

Shrinking tubes

If you encountered some problems while flashing and want to shorten your 20 cm copper wires to 10cm (by cutting the wire in 3 parts: 6cm + 8cm + 6cm, and soldering two 6cm parts together) electrical insulation is a good idea to prevent a possibility that a soldering joint in the middle of your wire could touch a motherboard (possibly causing a hardware damage by shortening) or a soldering joint of another wire (causing a failed BIOS flashing)

328 pcs packs (5 colors, 8 sizes) are quite a cost effective solution:

[*] 328 pcs of shrinking tubes - 1st example (~$3.51, Malaysian post, slower than Chinese post)

[*] 328 pcs of shrinking tubes - 2nd example (~$3.80, Chinese post)

Multimeter

Multimeter could be useful to test if you soldered good (e.g. copper wires to a test clip) or not. You test this by placing the multimeter probes at the ends (e.g. one probe at the end of 1P wire, another probe at the corresponding pin at SOIC8 test clip) and measuring the resistance - if it is infinity or very high, you need to re-solder. Probably all the multimeters have this function, so you might go for the cheapest options. Price ranges from about ~$2.5 to ~$5 :

[*] Black (~$2.69) or Yellow (~$2.64) DT-830B

[*] DT-832 (~$3.47)

[*] DT-838 (~$4.48)

Multimeter probes

Those probes included with the multimeters are bad quality and also too large - making it difficult to probe the small pins without shortening the neighbour pins. It is advised that you additionally get these high precision probes:

[*] Slightly worse high precision probes (~$1.89)

[*] Slightly better high precision probes (~$2.10)

POST card

In the cases of BIOS failure or a minor hardware malfunction, POST codes could be really helpful to find out why your computer is not booting, at what booting stage it is stuck. You could write down these codes and look them up online or ask knowledgeable people.

Example: incomplete list of coreboot POST codes . Other codes could be found by running

cd ./coreboot/
find . -type f -print0 | xargs -0 grep "post_code"


Many desktop motherboards have a POST display for these codes, but probably there are no laptops with it. If you have a laptop and would like to see its' POST codes, you need to buy a special POST card like this:

[*] Compal POST diagnostic card - example 1 (~$15.18)

[*] Compal POST diagnostic card - example 2 (~$16.44)

This card could be inserted to MiniPCI-E port of laptop's motherboard instead of WiFi adapter, or connected to a special header with included wires. According to my research, this card is compatible with at least 68% laptop motherboards' MiniPCI-E port

More information here! - Compal_POST_diagnostic_card (right mouse click --> open in a new browser tab)

CH341A programmer

In a case you would have some problems with Bus Pirate, it is a good idea to have Plan B :

[*] CH341A programmer (~$2.35)

CH341A programmer is very cheap and supported by flashrom since 0.9.9 version

Total expenses

.

Chapter Item (right mouse click --> open in a new browser tab) Minimal preparations Advanced preparations
1 Soldering iron Cheap soldering tool, stand and set of iron tips $6.56 X
1 Soldering iron ATTEN AT-SS-50, true ceramic core, stand and 1 iron tip X $27.72
2 Soldering tips 10 pcs of 900M-T-0.5C X $4.53
2 Soldering tips 1 pcs of 900M-T-0.5C $1.84 X
2 Soldering tips 10 pcs soldering tips set for Hakko X $2.89
3 Soldering supplies 150g big spool of 0.3mm diameter soldering wire, 60 Sn 40 Pb, 1.2% flux $5.24 $5.24
3 Soldering supplies 5 pcs of RMA-223 10ml famous flux $2.20 $2.20
3 Soldering supplies 5 pcs of 1.5mm - 3.5mm width desoldering wires, 1.5m length X $4.89
4 1P wires 40 pcs of 20cm copper wires $2.25 X
4 1P wires 40 * 10 = 400 pcs of 20cm copper wires X $13.80
5 1P pins 800 pins, gold plated (?) ($4.34) X X
5 1P pins 800 pins, copper plated $3.70 $3.70
6 SOIC8 test clip Standard type 1 - clamp only ($2.15) X X
6 SOIC8 test clip Standard type 2 - "cheap and good" ($2.60) X X
6 SOIC8 test clip Standard type 3 - "updated version, updated quality" $3.85 X
6 SOIC8 test clip Standard type 4 - "wider gold plated needle" ($6.00) X X
6 SOIC8 test clip Advanced type - high quality with bent 1.27mm 1P pins X $9.00
Chapter Item (right mouse click --> open in a new browser tab) Minimal preparations Advanced preparations
7 Shrinking tubes 328 pcs of shrinking tubes - 1st example (Malaysian post, slower) $3.51 X
7 Shrinking tubes 328 pcs of shrinking tubes - 2nd example (Chinese post) X $3.80
8 Multimeter Black ($2.69) or Yellow ($2.64) DT-830B $2.64 X
8 Multimeter DT-832 ($3.47) X X
8 Multimeter DT-838 X $4.48
9 Multimeter probes Slightly worse high precision probes $1.89 X
9 Multimeter probes Slightly better high precision probes X $2.10
10 POST card Compal POST diagnostic card - example 1 X $15.18
10 POST card Compal POST diagnostic card - example 2 ($16.44) X X
11 CH341A programmer CH341A programmer ($2.35) ($2.35) ($2.35)
12 - Total expenses X $33.68 ($36.03) $99.53 ($101.88)

It will cost you between ~$35 - ~$100 to prepare, or less if you already have some of this stuff

.

Crafting the interface

In addition to the stuff mentioned above, you will need the following items, could be bought locally:

1) Stainless steel high quality scissors

2) Ruler - to measure the length of wire

3) Permanent marker - to mark the cut points

4) A4 paper sheets - to use as disposable surface

5) Lighter - better with a hole to refill it later

6) Toilet paper roll - for technical use only ;)

Advanced SOIC8 clip

If you got the advanced type SOIC8 test clip at the previous step, either you don't need to solder anything at all, or - if a quality of signal would be insufficient / shorter wires are more convenient to you - repeat this manual eight times to reduce the length of eight 1P copper wires from 20 cm to 10 cm:

[*] Wire_soldering (right mouse click --> open in a new browser tab)

Soic8 test clip advanced type.png

Advanced type SOIC8 clip with not-so-convenient wires length (just 5 cm!)

Standard SOIC8 clip

If you got a cheaper, standard type 2/3/4 SOIC8 test clip: they have the long and thin aluminium wires soldered to them - not good enough for BIOS flashing. Replace these wires with a good copper ones by following the instructions:

1) Read a Wire_soldering article to understand some great methods of soldering a single wire

Soic8 clip change wires 01.png

2) Cut these aluminium wires, leaving about 2 cm black insulation part that is soldered to a test clip. Inside this part: pins of a test clip + about 1 cm of the aluminium wires

3) Remove the insulation and solder a copper wire to each of the aluminium wires individually (use the shrinking tubes for insulation)

Soic8 test clip standard type fix.png

After the couple of hours of soldering you could get this nice clip ^^^

1P to 3P adapter

If you are going to flash a BIOS chips at the laptop's board that is:

[*] powered by a power adapter and/or battery - DO NOT connect the VCC ( / WP ? / HOLD ?) pins to 3.3V , it could cause overvoltage and physical damage to BIOS chip

[*] board not powered - you need to connect the VCC, and usually WP / HOLD pins to 3.3V (read a datasheet of your BIOS chip to clarify). If it is indeed necessary to connect these three pins VCC / WP / HOLD to 3.3V power supply of Bus Pirate: because it has only one 3.3V pin, you will need to craft a 1P to 3P adapter. The instructions are similar to Wire_soldering, but you need to solder them together 4 ends at once and then cover (almost) everything by insulation

1P to 3P adapter image 1.png

I intentionally left a small not-covered part of wire near 1P end - for the flexibility

Then you remove the black plastic ends from "3P" ends of adapter by pressing on the center of black parts, install the 1P pins to them (short end of 1P pin should be inserted) and then cover by insulation as displayed below:

1P to 3P adapter image 2.png

NOTE 1: alternatively you could try crafting this tiny adapters below, but it is much harder and difficult to insulate with a shrinking tube

1P to 3P adapter image 3.png

NOTE 2: Instead of soldering this adapter you do the following:

1) take two of 20cm copper 1P wires

2) cut them in half to get four of 10cm one-sided 1P wires

3) remove the insulation from their not-covered-by-plastic ends

4) twist these ends and tie them together in a knot

5) wrap the electrical insulation tape around this knot

but this setup is physically less reliable

.

Connecting and flashing

Connecting

Because the pinout table is printed at another side of Bus Pirate, the order of table columns is different than if to look from the front side. This is very inconvenient... Here is a Bus Pirate v4 front pinout with the columns order already corrected:

BPv4 front pinout.png

NOTE: For Bus Pirate v3 there are different pinouts depending on its' hardware revision, so it is more reliable if you look by yourself

MISO = DO
MOSI = DI


Now, you need to find the BIOS chip at your laptop's board - to read a model of BIOS chip and look for a datasheet:

Soic8 clip connecting 2.png

NOTE: Circle or dot near one pin marks the 1st pin - usually it is CS (Chip Select)

Find a datasheet and quickly look through it for BIOS chip pinout. Example:

             _______
. . . CS# <--|*1  8|--> VCC
 (DQ1) DO <--|2   7|--> HOLD# (DQ3)
(DQ2) WP# <--|3   6|--> CLK
. . . VSS <--|4   5|--> DI (DQ0)
             ```````
Pin name Symbol N N Symbol Pin name
Chip Select CS# *1 8 VCC Supply voltage (2.7-3.6V)
Serial Data Output (Data IO 1) (DQ1) DO = MISO 2 7 HOLD# (DQ3) HOLD# pin (Data IO 3)
(Data IO 2) Write Protect (DQ2) WP# 3 6 CLK Serial clock input
Ground VSS 4 5 DI (DQ0) = MOSI (Data IO 0) Serial Data Input

NOTE: Data IO = DQ = Data Input/Output. DQ0 and DQ1 are used for both dual and quad instructions, DQ2 and DQ3 - only for quad instructions.

The more advanced descriptions of signals could be found at e.g. page 5 of EN25QH32 datasheet, if you need it. Now, after you got both Bus Pirate and chip pinouts, make sure to connect SOIC8 clip in a correct way so that you will be able to attach it to BIOS chip with matching pinouts.

If you are going to flash a BIOS chips at the laptop's board that is:

[*] powered by a power adapter and/or battery - DO NOT connect the VCC ( / WP ? / HOLD ?) pins to 3.3V , it could cause overvoltage and physical damage to BIOS chip

[*] board not powered - you need to connect the VCC, and usually WP / HOLD pins to 3.3V (read a datasheet of your BIOS chip to clarify) - using a recently crafted 1P to 3P adapter! Example of this connection could be seen below:

Soic8 clip connecting 1.png

Now, attach SOIC8 clip to a BIOS chip carefully:

Soic8 clip connecting 3.png

Then connect Bus Pirate to your working PC carefully (so that SOIC8 clip doesn't go out of its' place) and go to the next step - flashing!

.

Flashing

You must have a working PC with Linux to get and install the flashrom - using the instructions from here: http://www.flashrom.org/Downloads#Installation_from_source (or just boot from a LiveCD, but it "installs" temporary to your RAM so you will need to get it again each time)

After that, you could do any operation listed below and some others:

1) receive a flashrom help

sudo ./flashrom --help


2) erase a flash chip

sudo ./flashrom -p buspirate_spi:dev=/dev/ttyACM0,spispeed=1M -E -V


3) read from a flash chip

sudo ./flashrom -p buspirate_spi:dev=/dev/ttyACM0,spispeed=1M -r dump.bin -V


4) write to a flash chip

sudo ./flashrom -p buspirate_spi:dev=/dev/ttyACM0,spispeed=1M -w 4flash.bin -V


5) verify a flash chip against the file

sudo ./flashrom -p buspirate_spi:dev=/dev/ttyACM0,spispeed=1M -v 4check.bin -V


NOTE: there are similar commands for other programmers, e.g. for ch341a:

sudo ./flashrom -p ch341a_spi ...


After the successful flashing, carefully disconnect the programmer and then a clip. If your BIOS image was correct, your laptop's board will be able to boot. Congratulations!

This article is linked to by Flashing_KB9012_with_Bus_Pirate