How to restore BIOS after bad flash.

I was playing around this morning and decided to update my BIOS. Being lazy I figured I should just remote in and update via the Windows based flash tools.

Well, it crashed and I was stuck with a half written flash. Having an ASUS P5Q Pro motherboard with it's crashfree BIOS, I figured "oh I'll just restart and recover". Well that didn't go so good and the crashfree feature well, didn't even work. I tried the normal tricks, from PCI graphics card, removing everything but one stick of RAM and CPU, changing the CPU to even trying to follow beep tones that ASUS documents to aid you though crashfree (there was no tones). The board was cactus and out of warranty...

Lucky this board has a DIP socket which allows you to remove the flash IC which stores the BIOS:


Click to view full size!

Mind you, even if it is soldered to the board, you can desolder and try the following technique, but you might kill the IC if you don't have the right removal tools. There are places that will supply you with a replacement chip if you do kill it and you can just solder back on.

Removing the IC reveals that this is a Macronix MX25L8005PC, an SPI based 8mbit flash:


Click to view full size!

Having played with the DP Bus Pirate a bit I knew I could interface with the flash quite easily without having to build anything fancy so I opted for this approach.

Looking at the datasheet it was found that the Bus Pirate should be interfaced with the IC like so:

Code:

Bus Pirate 	MX25L8005PC - Pin#
CS 	        CS   - 1
MISO 	        SO   - 2
V+ 3.3v	        WP   - 3
GND 	        GND  - 4
MOSI 	        SI   - 5
CLK 	        SCK  - 6
V+ 3.3v	        HOLD - 7
V+ 3.3v 	VCC  - 8
Vpullup 	VCC  - 8

Flashrom is a fantastic unix based tool for flashing all types of ROMs. It has also been ported to Windows particularly for use with the Bus Pirate. Looking at the hardware support for the MX25L8005 shows that it is indeed supported:


Click to view full size!

It is important that you have the latest firmware for the Bus Pirate flashed to the device, otherwise reflashing the BIOS will take a VERY VERY long time. Please make sure you follow the instructions on how to flash and what order to flash (on the Bus Pirate website). I have the following installed on mine:


Click to view full size!

It is also important to get the latest version of flashrom (to support the faster flash/erase speed of the Bus Pirate). I got the latest Windows version from the first post in this thread.

You aren't limited to Windows for this, the latest release of flashrom for unix also supports the Bus Pirate and there are prebuilt binaries for the major distros (there is even a live CD).

Hook up the Bus Pirate to the flash and plug it in to a usb port:


Click to view full size!

Check which com port the Bus Pirate is on in device manager:


Click to view full size!

Now place the ROM file you want to write back to the flash and the flashrom.exe file in the same directory and browse to that directory in a command prompt. Then run the following:

flashrom.exe -p buspirate_spi:dev=COM13 -w P5QPRO.ROM -V

To view all of the options run flashrom.exe -h. One option is to specify which chip you use for faster detection (-c MX25L8005).

The Bus Pirate will light up and usb light will start blinking:


Click to view full size!

If you used the "-V" (verbose) option you should see lots of text on the screen along the lines of:

Code:

flashrom v0.9.2-r1182 on unknown machine, built with GCC 3.4.5 (mingw-vista special r3), little endian
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OS timer resolution is 2500 usecs, 772M loops per second, 10 myus = 0 us, 100 myus = 0 us, 1000 myus = 0 us, 10000 myus = 10000 us, 10000 myus = 10000 us, OK.
Initializing buspirate_spi programmer
SPI speed is 8MHz
ReadFile returns 1
ReadFile read 5 bytes
Raw bitbang mode version 1
ReadFile returns 1
ReadFile read 4 bytes
Raw SPI mode version 1
ReadFile returns 1
ReadFile read 1 bytes
ReadFile returns 1
...
ReadFile read 1 bytes
Using SPI command set v2.
Probing for Macronix MX25L8005, 1024 KB: ReadFile returns 1
ReadFile read 4 bytes
probe_spi_rdid_generic: id1 0xc2, id2 0x2014
ReadFile returns 1
ReadFile read 3 bytes
Chip status register is 00
Chip status register: Status Register Write Disable (SRWD) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 / Block Protect 3 (BP3) is not set
Chip status register: Bit 4 / Block Protect 2 (BP2) is not set
Chip status register: Bit 3 / Block Protect 1 (BP1) is not set
Chip status register: Bit 2 / Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Found chip "Macronix MX25L8005" (1024 KB, SPI) at physical address 0xfff00000.
ReadFile returns 1
ReadFile read 3 bytes
Writing flash chip... Erasing flash before programming... Erasing flash chip... Looking at blockwise erase function 0... trying... 0x000000-0x000fff, ReadFile returns 1
ReadFile read 1 bytes
ReadFile returns 1
ReadFile read 1 bytes
ReadFile returns 1
ReadFile read 3 bytes
...
ReadFile read 129 bytes
ReadFile returns 1
ReadFile read 129 bytes

SUCCESS.
done.
Programming flash... ReadFile returns 1
ReadFile read 1 bytes
ReadFile returns 1
...
ReadFile returns 1
ReadFile read 129 bytes
VERIFIED.          
ReadFile returns 1
ReadFile read 5 bytes
Raw bitbang mode version 1
Bus Pirate shutdown completed.

As you can see it has detected the flash "Found chip "Macronix MX25L8005" (1024 KB, SPI) at physical address 0xfff00000" and then it continues to erase and flash/verify (it verifies as it writes).

Once completed, the USB light on the Bus Pirate will stop blinking and flashrom should output "VERIFIED" and "Bus Pirate shutdown completed". This process, depending on the chip size should take about 15minutes. If you use an older version of flashrom or the Bus Pirate firmware, this can take up to about 10hrs.

Place the chip back in (making sure to place it back the right way), clear the CMOS and boot:


Click to view full size!

Success !

Please note, this method has been detailed specifically to flash SPI based flash chips. If you have something different, for example a parallel EEPROM, you will need the correct hardware to interface with it. If you are using something different, I advise that you check the flashrom website to see if the chip is supported, and then see what hardware it supports for you to flash it. Newer motherboards though (from circa 2006 onwards), should mostly have SPI based flash, all you need to do is check the datasheet for the correct pinout.

 

And this is why I tell people NOT to flash via windows. Nice write up

 

Haha yeah I usually know better. Kept me busy on my day off at least for a couple of hours.

 

very cute, heres hoping its info I never need to use

 

one word, hardcore.

i prefer ot use the floppy + hold a key technique if boot blocks arent dead yet myself

every current bios syste in use for pc mobos has some form of recovery which involves either floppy or usb and holding a key down during boot or pressing it really fast like youre playing a sports game on an 8 bit console.

 

Awsome job

 

Nice work dude! If anyone could turn a bios flash into a mission it's you

 

Haha just having a bit of a nerd out before you come to Melbourne.

 

Another thing to add. Flashrom can also flash your BIOS while it is sitting in your motherboard if the chip is supported. If you do have a mishap with a Windows based flash tool, it is most certainly worth giving flashrom a shot before restarting instead of trusting crashfree or equivalent to work.

 

Bah, wussy.

Hotflashing is where its at

 

Nice write up
I also hope i never have to use it

 

hey there mate.. great write up.

i'm in a similar boat. i went to use the Asus EZ Flash on my P5W DH Deluxe, it started off erasing the bios and froze about half way through. Haven't been able to get it to work since.

i've tried hot swapping the bios chip into another machine but have had zero luck. does that flasher thingy you have there do these types of chips? Mine looks the same as below but with a model number W39V080FAPZ



i'm running out of steam.. ive been trying to restore this thing for 3 days

 

You DO know that the machine you are using to host your old bios chip has to be booted and running. This is why it is called a hot swap.

You can just take the host machine to the bios boot screen. Take out the bios chip from that machine and swap it with yours. Then flash as per usual with the files on a USB drive.

I have never had this method fail.

 

im aware of how it works.. i worked in a pc shop for a few years and had to do this all the time.

the problem is getting an identical board (or similar board that has the same socket AND same size (logical) bios).

there's a couple of problems im having:
- the board im using to hotswap only has a 512KB flash and this one is a 1MB flash. when i load up the bios flash utility, it says "INCORRECT FILE SIZE FOR ROM".
- i loaded up ubuntu and tried FLASHROM but doesn't detect the chip.

if i had an identical board to mine it would be fine..

 

Unfortunately that has an FWH communication interface so this method wont work for you, but on the plus side if you find something that can fit the chip physically and electronically flashrom does indeed fully support it.

Although your best bet would indeed be to hotswap. Create yourself a bootable disk with the supported flash utility on it (rather than use the quick flash method usually supported by pressing Alt+F2 or something at boot). Then use it's force option from the command line of the boot disk to push it to to the different flash chip.

EDIT: if you cannot flash it in ubuntu, check the Programmer Specific Info on the man page and also check the FAQ.

 

i have a welliem programmer that should help i'm in melbourne too but just moving house ATM so might be able to help in a week or two.

 

thanks for your help guys..

i have an Asus P5P800-MX motherboard out in my garage which i have been playing around with. I boot up the p5p as usual and start DOS. i then take out the p5p bios and stick in the faulty bios from the P5W DH... i grabbed an engineering version of afudos.exe and set the force flash switches but it comes back with an error about the size of the flash being incorrect.

I'm assuming this is because the P5P bios is only 512KB and the P5W DH bios is 1MB.

As for ubuntu.. if i run flashrom before swapping the bios chips around, it detects the working chip. The faulty chip is not detected - which now im guessing is because of what bleckers mentioned.. the FWH interface?

i am a bit of a noob with linux so besides installing it, doing an apt-get install flashrom and running flashrom - i'm out of ideas.

Thanks again for you help though guys.. very much appreciated.

edit: and 3stars, thanks very much for the offer. if im still stuck in a week or two, i might drop you a PM and fix you up with something for the favour!

 

This is pretty likely. You may have to use a much more recent board as the hotflash host. The P5P might be a 775 platform, but its 865 chipset which is what? six? seven? years old.

 

I prefer to walk on the wild, slightly lazier, side. Flashing from Windows ftw!

 

NERD ALERT!!