Dell XPS-15 (9520) Mostly Bricked after common BIOS-Firmware upgrade - Full Repair Log

[Tesla]

1. That should work,

2. if I remember correctly the options get reset every time you click on load

1. Cool.

2. If I start XgPro, then immediately click the LOAD button ... those are the default-settings pre-selected and pictured above.

[Tesla]

My first-ever chip Programming (chip Write of new BIN file) with T76 and pogo-tool.

Says it worked and Verified 100% good.

[Tesla]

It took me about 3 hours to re-install the motherboard and rebuild the laptop (fully). I didn't see any other way to test it. I was very careful (no way I was going to mess-it-up after all the work we have all put into trying to fix it).

It did not seem to work:

https://www.badcaps.net/forum/troubl...15#post3844415

[m1ch43lzm]

Noticed that version 1.6.0 removed CPU microcodes for some CPUs (since your unit is a prototype it may also have an ES CPU), I uploaded my attempt at a BIOS downgrade to 1.5.0 (last version that includes ucode for CPUID 90671, 906A0, 906A2), original ME region since it's the same version 16.0.15.1810
ES CPUs usually show as Genuine Intel(R) CPU 0000 on System information
Test by plugging in the bare minimum: keyboard, screen, power button, 1 RAM stick

[Tesla]

Noticed that version 1.6.0 removed CPU microcodes for some CPUs (since your unit is a prototype it may also have an ES CPU), I uploaded my attempt at a BIOS downgrade to 1.5.0 (last version that includes ucode for CPUID 90671, 906A0, 906A2), original ME region since it's the same version 16.0.15.1810
ES CPUs usually show as Genuine Intel(R) CPU 0000 on System information

Hmm.
I don't have a saved msinfo32, but I think I would have noticed that.

I do have a screenshot of Settings/System/About and it shows correctly there.

And I have this:



Can you tell by looking at top of chip?

[m1ch43lzm]

It's etched on a corner, QYY4 (barely could tell)

EDIT: Retail CPU would have SRMAU or SRLD1 for i7 12700H

[Tesla]

> Look at Spec code on the CPU, on ES is 4 characters and looks like this: Qxxx
> Retail CPUs have 5 characters: Sxxxx

Is that it in the corner ... Even on hi-res master can't quite make it out ... is it QYY4 or maybe QYX4 ?
You gotta be kidding me. Please tell me that's not it.

[m1ch43lzm]

See above, I edited my previous post, refresh the page, looks like QYY4 indeed
Not sure about microcode compatibility, info on ES CPUs is not easy to find

[m1ch43lzm]

Found this on a russian website (translated):
Intel - QYY4 I7-12700H Q07G SRLD1 SRMAU Core i7 Mobile Alder Lake-H CPUID 906A3 BGA1744
Engineering version with name in the system, BIOS edits are not required!

It could be a later revision close to retail, hope that's the case
Try the 1.6.0 BIOS I uploaded (original "unclean" ME region) https://www.badcaps.net/forum/troubl...88#post3844488

[Tesla]

Let's talk in this thread, since it's apparently particular to my prototype with an Intel ES-CPU:

> 1. It depends how Dell implemented the anti-downgrade policy
> 3. You can leave Secure Boot disabled on that case
> 4. Look at Spec code on the CPU, on ES is 4 characters and looks like this: Qxxx
> Retail CPUs have 5 characters: Sxxxx
> 5. That W25Q16JW chip is GPU VBIOS, don't touch it

5. So that's how they do a GPU-VBIOS huh, cool. Gotcha.

1. Not sure what that means. Whatever you think. You think it will stop us from going back to v1.5.0 ? Not sure they can stop us since we inject it in.
3. Acknowledged
4. So now we know. (I hate tech-mysteries). So now, we can confidently move forward again. You are smart!

Whatever you think. Please let me know early-tomorrow which one you think has best chance of working.

Seems to me, we should just stay away from v1.6.0 since it doesn't have the MicroCode to run my ES-CPU.
Personally, I like your original idea about v1.5.0 ... it's new enough and still has the required MicroCode. At this point, I'm happy to aim for the solution that has best chance of working on my lame motherboard. Heck, at this point, I would even accept getting v1.4.0 back on there ... but sounds like v1.5.0 is about the same.
But it's still a nice computer. In this config, they sold for like $2300 here, just a few years ago.

I'm just junior-technician. Think about it Mr. Master-Technician and eventually let me know. I still have to re-pull the motherboard ... starting tomorrow morning.

[Tesla]

1. Found this on a russian website (translated):
Intel - QYY4 I7-12700H Q07G SRLD1 SRMAU Core i7 Mobile Alder Lake-H CPUID 906A3 BGA1744

2. Engineering version with name in the system, BIOS edits are not required!

3. It could be a later revision close to retail, hope that's the case

4. Try the 1.6.0 BIOS I uploaded (original "unclean" ME region) https://www.badcaps.net/forum/troubl...88#post3844488

1. I'm trying to understand the relivance.

That QYY4 is a real ES-Chip name? Gotcha.
That it's an Engineering version ... (but obviously "good enough" for prototypes)? Gotcha .

2. "name in the system" ? Does that translate to "MicroCode in BIOS" ?

3. Yeah, they have to be like perfect as they build the motherboards and BIOS revisions using their operation as only available example. QYY4 might be "early" but it also has to be "final" because that is what Dell and Compal needs to build (and BIOS program a working MB).

These laptops with early X-experimental BIOSes ... they were pretty rickety. I started telling Dell, it's fine to send me machines that way, but I must have access to (and be able to firmware-flash) the updated versions (beta's up to v1.0 and even beyond) if they want my help. I can't evaluate and report on a machine that is obviously broken.

4. I don't understand why v1.6.0 ... I thought we were going to try v1.5.0 ?
I just know ... seems like any time v1.6.0 gets on there (normal way or injected with pogo) ... motherboard is soft-bricked.
I don't understand these terms (or ramifications of each)
... like "UnTouched ME-region" or "extracted from update + your original ME region"

However, "THIS" Intel-ME talk I understand (just barely)
- ME version is the same 16.0.15.1810 for BIOS v1.4.0 , v1.5.0 , and v1.6.0
- original ME region since it's the same version 16.0.15.1810
I just try to respect and co-exist with Intel-ME. Not fight against it.

[m1ch43lzm]

2. CPUID 906A3 and the second part "bios edits are not required", in theory it should work
you can find those ES CPUs for sale in China...
Maybe that particular version has "12th Gen Intel(R) Core(TM) i7-12700H" as the processor name reported by software, I don't know for sure

4. Long explanation here: https://winraid.level1techs.com/t/gu...lization/31277
https://winraid.level1techs.com/t/in...or-me-16/89959

Engine Firmware Configuration (CODE/DATA):

The Engine Firmware Regions (RGN/EXTR) consist of two sections: CODE and DATA. CODE is the actual Engine firmware whereas DATA is where all the system-specific settings are stored, as configured by the OEM at the factory via Intel Flash Image Tool. The Engine firmware is not static as it holds system-specific configuration and can additionally be configured by the Engine co-processor itself while the system is running in order to provide the proper support and functionality. Any such changes are written into the DATA section of the Engine Region and the firmware is considered Initialized. That means that the DATA section can be in one of three states: Unconfigured, Configured or Initialized. Unconfigured means that the Engine firmware image is the stock one Intel provides and not configured by the OEM at all (RGN). Configured means that the OEM has applied model specific settings and the Engine region is ready for deployment (EXTR). Initialized means that the Engine region comes from a system which was already running and thus the Engine co-processor has further configured the DATA section to suit that particular system better (system specific or dirty EXTR).

Short version: your ME region is initialized to your specific board/PCH, if you copy that BIOS as is to another board (exact same laptop model), it will have issues (really long boot times, SSD not detected, firmware TPM not working, sometimes audio not working), that's why a "clean ME" (configured) region is required, to allow the PCH to "initialize" the ME region

What I've done is replacing BIOS region only (extracted from the Dell BIOS update), that works if the ME region didn't get corrupted

https://github.com/LongSoft/UEFITool/releases
Click on "Show all 17 assets" and download UEFITool_NE_A73_(OS version), open your BIOS file with it, you'll see what I mean

* Additional note: Dell doesn't provide full BIOS images ready for SPI flash, instead they package a BIOS region + ME region update separately (among other firmware if needed)

But as an example: HP does provide full BIOS images for their consumer models when extracted from updateS (complete with Descriptor, ME region, BIOS region), not so for the business class laptops

[Tesla]

> Maybe that particular version has "12th Gen Intel(R) Core(TM) i7-12700H" as the processor name reported by software, I don't know for sure

Yeah, that's exactly how it is displayed in that old (Settings/system/About) screenshot I mentioned

Good info. Man, they make it so complicated.
I sure hope Intel-ME does some helpful things because it has certainly complicated things lately. I remember when it did not exist (and computers still ran fine).

I'll try to get UEFI-Tool DLed from GitHub, so I can see what yall are talking about.

I'm going to grab some breakfast and then start disassembling the laptop again.

As asked in: https://www.badcaps.net/forum/troubl...25#post3844525

... please let me know which file I should Program/Write this time. I'll need your expert opinion/final-answer in about 3 hours.

[Tesla]

Now that I know what is under the large CPU/GPU heatsink,
- and I already know and got pics of what is underneath
- and it's allowed as per the Service Manual
... I left it install on the motherboard this time.

From fully-assembled, I have MB removal time down to 45-mins. Motherboard is (once-again) on my desk, ready to re-write BIOS-Rom.

[Tesla]

So, what says you Mr. m1ch43lzm ?

Can you think of any reason why the XPS-9520 v1.5.0 rom you posted is not the best one to try next?

Here are my amateur thoughts ...
a. It's before v1.6.0, so ES-CPU MicroCode should still be allowed (like it was in v1.4.0 for all those years)
b. Intel-ME version is the same v16.0.15.1810 for firmwares v1.4.0, v1.5.0, and v1.6.0
c. It's "new enough" for my purposes.
d. I don't need any Keys from old-BIOS (Windows-Key, BitLocker-Key, etc.) I'm fine without those.
e. You said it had "Original (untouched) ME region" . Hopefully, that means it will "allow the PCH to Initialize the ME region" ... or otherwise work and not be a problem.

I'm getting ready to Erase the rom again now. If possible, I sure would like to get your final-OK before I re-write it. I'll definitely need your approval before I (fully) re-install the MB for testing again.

[m1ch43lzm]

Try 1.6.0 first, QYY4 should have 906A3 CPUID (in theory according to what I found) and that microcode is included
If it fails, try 1.5.0

d. Win license key not found, Bitlocker key is stored in TPM
e. It's already "initialized" for your system; a "configured" ME region will become "initialized" after first boot

[Tesla]

If it fails, try 1.5.0

By the time you had a chance to answer, I already had the new v1.5.0 BIN-file written, and the motherboard was almost fully re-installed. I have MB re-install time down to about 60 minutes (still being very careful, still using all screws and fully tightened ... in case it works it will be done).

Another successful Programming/Write. Only my second one, again with the pogo-tool at 16-Mhz. It worked the first time I tried after Erasing. Verified itself as good-write.

Still not working. No Display. Same symptoms as the first v1.6.0-file that Sparo built for me. I wonder what we are missing?

[Tesla]

We have talked about XGecu-T76 operation ... Reading with Verify, Saving, Erasing, Blank-Check, Loading, Programming (Writing), and Verifying. I've also posted screenshots. However, unless you see something wrong with any of that, we should be able to assume it was done properly ... more onto the next possible cause of the failures.

[m1ch43lzm]

Strangely, out of no-where ... the T76 freaked-out and started complaining about too-many Vcc amps or a short (on all functions, even READ-ing). First time that happened... I thought my chip/mb got fried somehow.
Simply power-cycling the T76 fixed it. I almost had a heart-attack.

...

Maybe we're overlooking this
Or, since you tried the clip, maybe UC32/RC209 got damaged?
Also measure voltage at pin 8 of BIOS chip, should have 3.3V or so when the charger is plugged in

That's why you always make a good backup, it should return to the state it was previously

[Tesla]

Some facts to recall ...

This prototype XPS-15 (9520) Laptop worked perfectly on Windows-11 Pro (64bit) for like 3-years on BIOS-Firmware v1.4.0 and SecureBoot enabled. It's even had a BitLocked boot-SSD for the last year-or-so. While it might have an ES-CPU, you would never know it (it's been fast, stable, and normal). It wasn't until I tried to upgrade the BIOS-Firmware with the Dell-Updater to v1.6.0 that it soft-bricked itself (only a Dell-Logo and not fully-posting).

[Tesla]

1. Maybe we're overlooking this

2. Or, since you tried the clip, maybe UC32/RC209 got damaged?

3. Also measure voltage at pin 8 of BIOS chip, should have 3.3V or so when the charger is plugged in

4. That's why you always make a good backup, it should return to the state it was previously

2. The supplied clip is only plastic. It's pins were a good 0.5-1.0 mm away from even touching anything electronic

1. Seems to be just this new model-charger getting a bit confused sometimes after it has been online with XgPro for a while. It won't allow itself to work when that error appears. Unless you are saying it is defective? Lately, I just turn-it on when I need to actually use it for something and it has been fine.

3. Hmm. Well, that is on the back and I've never had this motherboard powered-up while not fully installed. In general, I've never done that with any laptop ever really, so I'm not really comfortable doing that.

4. I did with the pogo-tool. All my reads and writes verify-properly the first time I do them. You think my original back-up is bad or corrupt? The one I sent you?