[coreboot] Re: Help locating BIOS flash IC on a not yet supported mini PC board

[Petr Cvek]

lol I've found it :-D it's not a chip, it's actually a socket

right of wifi https://pasteboard.co/JJknICr.jpg "BIOS ROM" on PCB

Petr

Dne 12. 01. 21 v 19:14 Peter Mueller napsal(a):
> Yes, I have removed all strips, ram and extension cards, so I have seen all SOIC8 chips on the board.
> But this is what I do not understand, I find no more then I showed in the pics. I will
> send some more/better pics, so you could see more details. I removed all strips and extensions, where any
> SOIC like chip is located, the other strips and extensions I put back before making the pictures.
>
> Here are all images in high res, that I have made.
>
> https://pasteboard.co/JJklNqI.jpg
> https://pasteboard.co/JJknICr.jpg
> https://pasteboard.co/JJkovSn.jpg
> https://pasteboard.co/JJkoX3I.jpg
> https://pasteboard.co/JJkpubK.jpg
> https://pasteboard.co/JJkpYwS.jpg
> https://pasteboard.co/JJkqp7Ai.jpg
> https://pasteboard.co/JJkqYgH.jpg
> https://pasteboard.co/JJkrSsC.png
> https://pasteboard.co/JJksajd.jpg
>
> It puzzles me, that I could not even find out where the fw image is stored. This will probably mean that
> there will be no secure (extern) flashing process, if no core boot, not even disable ME, if I did not miss
> something..
>
> I have seen that some coreboot tutorial ( I think for a thinkpad x220, but not shure ) mentioned that the
> 12 MB firmware of the system was physically joined by 2 chips (8+4MB) to a virtual flash chip.
>
> Is it possible that
>
> a) the 8MB  flash is assembled by part of the 12 pieces of M B07 N03 EKH 1409 ?
> b) or it is stored in another non SOIC 8 format ?
> c) or even part of the intel cpu /chipset ?
>
> Sorry for asking maybe not sensible questions, I have yet too few knowledge on these
> bios hardware concepts.
>
> Am 12.01.21 um 17:45 schrieb Petr Cvek:
> > Did you looked under black isolation stripes?
> >
> > There is one soic-8 at the top of this photo
> >
> > https://pasteboard.co/JJjRjLU.jpg
>
> This is one more "unmarked" of the smaller SOIC8 I labeled with "b"
> b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
> > next to superio U49. There can be more chips under expansion cards.
> >
> > BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
> >
> > Petr
> >
> > Dne 12. 01. 21 v 17:25 [e-mail] napsal(a):
> > > Hello coreboot community,
> > >
> > > as an open source fan I recently get to know coreboot and really like the idea behind.
> > > Sadly I bought my computer HW before learning more on libre friendly hardware that
> > > respects your freedom. Now I try to figure out if I could do one or both of
> > > a) installing coreboot , b) remove /disable ME from my zotac mini PC,
> > > or I had to look out for already supported HW to do so.
> > >
> > > I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel
> > > UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
> > >
> > > In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC
> > > storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and
> > > internal programmer.
> > >
> > > While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem."
> > > and gave the warning "SPI configuration lockdown activated".  The programmer
> > > flashchip was reported as "Opaque flash chip" 8192kB.
> > > At least ME Cleaner worked with not errors on the captured fw image.
> > >
> > > Problem: I want to flash the modified image back to the IC using a raspberry 4b
> > > with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct
> > > IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature
> > > and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully
> > > read with raspberry spi setup. However, it contains only 256k data. strings showed
> > > me lots of HDMI related stuff.
> > >
> > > I have created a list of chips I found while disassembling and some pics.
> > > I hope that someone more experienced could explain me how the 8MB fw is
> > > stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or
> > > dangerous, as beginner I will stick with new hardware from already supported
> > > hw list.
> > >
> > > The "promising" IC chips I found were
> > > a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the
> > >      GigaDevice GD25Q20C(2M-bit)I found on web.  this chip I managed to read out..
> > > b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
> > > c - 1 piece of Issi  IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module)
> > > d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator?
> > > e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET?
> > > f  - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
> > >
> > > Pics of the mainboard front and back are here:
> > > https://pasteboard.co/JJjQqQO.jpg
> > > https://pasteboard.co/JJjRjLU.jpg
> > > https://pasteboard.co/JJjRCDt.jpg
> > >
> > > Any suggestion how to go on or stop it anyway would be appreciated.
> > >
> > > kind regards,
> > >
> > > Peter Mueller
> > > _______________________________________________
> > > coreboot mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
>
> coreboot mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]