Print

Register Now!

To Get More Info and Daily Reward.

• Login
• Register

Please login or register.

[mahmutd]

Recover from failed BIOS flash using Raspberry PI

Example MSI B350 TOMAHAWK Bios : winbond w25q128fw 


An update regarding the JSPI1 header on MSI motherboards is available at the end of this guide.

What is a Raspberry PI? http://www.raspberrypi.org

Using a Raspberry PI to reprogram a SPI BIOS Chip, this is a relatively simple and inexpensive way to recover from almost any failed BIOS flash, including bad ME FW update.

The Rasperry PI costs about 25$, you also need a SDHC card for OS minimum 2GB.

Before starting, make sure that:

The chip is not electrically damaged, is 3.3V, (Check the datasheet for your chip) 



The chip is supported by the free software "Flashrom" (>LINK<). It has worked with all the chips i've tried so far. Note: It's not recommended to use another SPI chip of different vendor or model. Same model in different case will work fine. (Failed ME Update) The chipset on the motherboard is new enough to have the ME firmware in the BIOS, some older chipsets use a seperate chip and that will be more complicated.

https://www.msi.com/Motherboard/support/B350-TOMAHAWK.html

You will need: A Raspberry PI this guide is made with a Model B, Works fine with Raspberry PI 2 also. A soldering iron is recomended.

On your Raspberry, download Flashrom http://www.flashrom.org i use the latest source and compile it for best chip support, to compile, open a terminal run:

$ modprobe spi_bcm2835

$ modprobe spidev

$ svn co https://code.coreboot.org/svn/flashrom/trunk flashrom

$ cd flashrom

Copy 2 file ( flashchips.c, flashchips.h) to your Raspberry, i usually use filezilla /flashrom

https://www.mrme.net/download/flashchips.c

https://www.mrme.net/download/flashchips.h

$ make

$ sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0

Copy E7A34AMS.160 to your Raspberry, i usually just put it in /tmp

On Linux what you type in a teminal is case sensitive.

$ md5sum /tmp/E7A34AMS.160

To erase the chip (not needed on most chips) run:

$ sudo ./flashrom -E -p linux_spi:dev=/dev/spidev0.0

$ sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0 -w /tmp/E7A34AMS.160 -V

if it still doesn't work, check all the connections, make sure it's supported by "flashrom".

When it's finished flashing and verifying: flashed.jpg18782 hits

Close the terminal, shutdown the Raspberry and remove the chip carefully from the DIL socket, put it back in the motherboard, and power up.

[darkhawk]

Thanks! This is actually a pretty nice guide. 
The only problem is that the Winbond w25Q128FW is NOT a 3.3V chip....See : https://www.winbond.com/resource-files/w25q128fw_rev_g_feb1714.pdf
It's only rated for up to 1.95 + 0.6V, or 2.55V maximum, well below the 3.3V outputs of the Raspberry Pi.

You could very well burn out your flash chip and need to completely replaced it using this method, without using some logic level converter.

This might work well with a Z170/Z270 chipset, since those use a 3.3V flash chip though.

But this is part of the reason I haven't created a guide quite yet for the AM4 platform....they all use a 1.8V flash chip.

[eduardofg]

Hi, nice to see this topic.

I don't want to mess up more the things in my case...

1. According to this guide, I must just wire the Raspberry's GPIO pins to the JSPI1 header in my motherboard right? (because at the end of the guide you say 'remove the chip and return it to your motherboard...')

2. My Chip uses 1.8v, and according to your guide I must wire from my 1.8v power supply to pins (JSPI1) 1, 2 and 11?

3. I use md5sum /home/pi/.../<biosfilename.160>       and the result was a large hexadecimal number... now what?

Thank you

[darkhawk]

I really would not use this guide if you have a 1.8V FLASH.....you could damage your flash by doing so. The Raspberry Pi outputs 3.3V logic, and this chip is not tolerant of that high of a voltage for logic. You'll probably kill your flash if you try to do this with it.

[eduardofg]

But I have an independant 1.8v power supply, i wasn't clear in point number 1 and 2, sorry (connect GPIO to JSPI1 EXCEPT 3.3v pin).

[darkhawk]

But I have an independant 1.8v power supply, i wasn't clear in point number 1 and 2, sorry (connect GPIO to JSPI1 EXCEPT 3.3v pin).

That doesn't matter.
The data input pins can only be taken to VCC + 0.3V.
1.8V + 0.3V is only 2.1V maximum.
Putting 3.3V into them will surely damage the chip, and is not recommended (along with this method) because the Raspberry Pi outputs 3.3V data logic.

To do this properly, you need a logic converter that converts the logic from 3.3V logic to 1.8V logic.

Or a proper programmer that handles 1.8V logic.

[eduardofg]

So if i make a variable power supply to receive 5v and output 1.8v (using a LM317T chip and a 10K pot)... then can I connect the pins 1, 2 and 11 to this power source?

[darkhawk]

So if i make a variable power supply to receive 5v and output 1.8v (using a LM317T chip and a 10K pot)... then can I connect the pins 1, 2 and 11 to this power source?

That has nothing to do with it.

THE DATA COMING OUT OF THE RASPBERRY PI IS AT 3.3V. The FLASH DATA PINS only accept up to VCC + 0.6V. This means that the chip will handle up to 2.4V on any pin. The raspberry pi outputs at 3.3V. 
3.3 volts is HIGHER than 2.4V. Using the raspberry pi will most likely blow up the flash chip and make your board unusable until you replace it and flash it with a proper usage.

See : https://www.winbond.com/resource-files/w25q128fw_rev_g_feb1714.pdf
Go to page 79 and look at the maximum electrical ratings....

By all means, give this a try if you want to be in worse condition. But don't expect to get much support. You need a logic converter  in order to flash this board with a raspberry pi.

[eduardofg]

Thanks for the patience.

To clarify (Im a little ignorant about electronic). When you mention a logic converter... your are talking about devices like usb eeprom and spi programmers, pirate something, etc.?

[darkhawk]

Thanks for the patience.

To clarify (Im a little ignorant about electronic). When you mention a logic converter... your are talking about devices like usb eeprom and spi programmers, pirate something, etc.?

The signals coming out of the raspberry pi are 3.3V signals.
The FLASH CHIP is 1.8V signals.
You need a device that converts from 3.3V signals to 1.8V signals. The device is called a logic converter. Otherwise your flash chip will be no good.

I cannot put it any simpler than that. Google it if you don't understand. http://bfy.tw/CzjE

[eduardofg]

If I buy this LLC

How I must wire the power supply....:
From raspberry pi gpio's pin 3.3v and GND i must to connect LLC's pin VB and GND, then from pin VA I get 1.8v and it is connected to pin 1,2 and 11 in JSPI1 on the mobo, and where do a I get 1.8's ground onto the LLC? (OE pin maybe or the same GND of the VB side?). The others pins from raspberry (10, 12, 13, and 14) goes to B1, B2, B3, and B4 on LLC, and then A1, A2, A3, and A4 goes to (3, 4, 5, and 6) on JSPI1.

Is it correct? this LLC don't need two power supplies, like one is raspberry pi with 3.3v connected to side B on LLC and in the side A of LLC i can get 1.8v directly from pin VA? If this last is correct, GND to JSPI1 is taken from side B on LLC?

note: vendor do not provide documentation on this.

[darkhawk]

You still need 2 power supplies.
1 from the raspberry pi (3.3V from the 3.3V pin on the header)
1 for powering the flash rom (1.8V), which also needs to go to the logic level converter.

But honestly, you should read up and understand what you're doing prior to trying it. Throwing this together is a sure way to mess things up.....

[eduardofg]

.... so you don't know how to wire the 1.8v power supply to that especific LLC.

But, you have directed me in the correct way, and this thread was one of my several readings/investigations. Now I will get another LLC with grounded pin market in both sides.

Thank you.

[r.sarwar87]

speaking from experience, a 1.8v standard will have a max of 2.55v. and it will not go up in flames if you connect it to 3.3v signal pins. It will degrade the chip over prolonged exposure to 3.3 volts (years), but nothing that will break it within the 5-10min it takes to flash BIOS. The current in the data pins is in the range of micro amps.

the HIGH/LOW tolerance levels from 1.8v and 3.3v standard GPIO interface will still allow slave chip with 1.8v standard (BIOS) to interpret incoming signals from 3.3v master (raspberry pi). It may however not work properly the other way around, but that depends on the tolerance levels of the slave device. Figure 3 in http://www.ti.com/lit/an/scea030a/scea030a.pdf

I write from experience of making a TTL system with 5v standard that I feed into an FPGA system that accepts 3.3 v. it runs 24/7, not issues over the last 3 months. But I do expect the chip to degrade over time.

The physics involved in this is the same which we see in CPU overvolting and why an OCed CPU degrades over time, and not just burn itself out. BUT over time (i.e. years of overvolting) it will degrade and require more and more voltage to operate stably.  For example, a ryzen chip should not operate over 1.45v max according to AMD, however ryzen based overclock records that are made with liquid nitrogen are operated with 1.8-1.85v. at such higher voltages on a 24/7 system, the CPU will probably have a lifetime in months, but it will not fry if operated for a short period.

My point is, it is not recommended, but if I had to recover a BIOS and was not able to RMA my board because I modified the board (which I did), I would not hesitate to do something like this.

[r.sarwar87]

.... so you don't know how to wire the 1.8v power supply to that especific LLC.

But, you have directed me in the correct way, and this thread was one of my several readings/investigations. Now I will get another LLC with grounded pin market in both sides.

Thank you.

I am sure you know this, but I would recommend sticking the output from the raspberry and the converter to an oscilloscope to ensure that they are synced.

the data is serialized in SPI communication, and you want the slave to interprete the data correctly otherwise the "bitstream" will not correctly be detected. 

[darkhawk]

speaking from experience, a 1.8v standard will have a max of 2.55v. and it will not go up in flames if you connect it to 3.3v signal pins. It will degrade the chip over prolonged exposure to 3.3 volts (years), but nothing that will break it within the 5-10min it takes to flash BIOS. The current in the data pins is in the range of micro amps.

the HIGH/LOW tolerance levels from 1.8v and 3.3v standard GPIO interface will still allow slave chip with 1.8v standard (BIOS) to interpret incoming signals from 3.3v master (raspberry pi). It may however not work properly the other way around, but that depends on the tolerance levels of the slave device. Figure 3 in http://www.ti.com/lit/an/scea030a/scea030a.pdf

I write from experience of making a TTL system with 5v standard that I feed into an FPGA system that accepts 3.3 v. it runs 24/7, not issues over the last 3 months. But I do expect the chip to degrade over time.

The physics involved in this is the same which we see in CPU overvolting and why an OCed CPU degrades over time, and not just burn itself out. BUT over time (i.e. years of overvolting) it will degrade and require more and more voltage to operate stably.  For example, a ryzen chip should not operate over 1.45v max according to AMD, however ryzen based overclock records that are made with liquid nitrogen are operated with 1.8-1.85v. at such higher voltages on a 24/7 system, the CPU will probably have a lifetime in months, but it will not fry if operated for a short period.

My point is, it is not recommended, but if I had to recover a BIOS and was not able to RMA my board because I modified the board (which I did), I would not hesitate to do something like this.

My entire point, is this flash chip doesn't have 3.3V tolerant inputs. Period. The datasheet even confirms that.
Your FPGA may well have 5V tolerant inputs (many do, depending on who makes it).

I work with this stuff, for a living, and live and breathe it constantly, from both a component level, to a system level in complex machines.

This is absolutely nothing like a CPU. It's not overvolting it, not at all. You know what it is like? Setting your DRAM levels to 2.5V knowing the CPU can only handle a maximum of 1.8V. Guess what? The I/O in your CPU blows and suddenly it stops working. Yes, it might only be microamps, but guess what? It only takes microamps at a higher voltage to burn through the depletion layer of the FET internal to the chip. Bye bye chip, bye bye flash.

If you want to do this, get a proper programmer.

https://www.amazon.com/gp/product/B013Q5P3ES/ref=oh_aui_detailpage_o07_s00?ie=UTF8&psc=1
https://www.amazon.com/gp/product/B015W4PKR6/ref=oh_aui_detailpage_o07_s00?ie=UTF8&psc=1
https://www.amazon.com/gp/product/B072KYK2DR/ref=oh_aui_detailpage_o05_s00?ie=UTF8&psc=1

With all that, you can flash pretty much any board made within the past 5 years, be it AM4 or x99 or z170 or z97 or z270 or x299.

And it's a MUCH quicker than using a raspberry pi (1 minute or less, compared to 10 to 15 minutes using the RPi).

[r.sarwar87]

jesus! not need to take it personally. we can agree to disagree like a pair of civil mates you know! I was merely referring to statement where it said, which is not factually backed:

"You could very well burn out your flash chip and need to completely replaced it using this method, without using some logic level converter.

regarding ip/op tolerance
for slave -> master communication- V_IH from raspberry pi is 1.8 v while V_IL is less than .4 v. that is within the i/o tolerance level of the slave output.
for master -> slave communication- that should definitely not be an issue! as it is being over bolted.

What if I cannot get access to one to them SPI flasher because I live in a place where there is no amazon?

If you want I can buy one of them chip and test it out for you!

[darkhawk]

Quote from: r.sarwar87for slave -> master communication- V_IH from raspberry pi is 1.8 v while V_IL is less than .4 v. that is within the i/o tolerance level of the slave output.
for master -> slave communication- that should definitely not be an issue! as it is being over bolted.

slave to master (flashrom to pi) may not operate properly because the specification for the raspberry pi ranges for it to get a 'high' signal is >2.0V for the ARM1176 SOC (See : http://www.mosaic-industries.com/embedded-systems/microcontroller-projects/raspberry-pi/gpio-pin-electrical-specifications ). The flashrom won't have the voltage necessary to pull the line high for the raspberry pi to see it as a high state.
Master to slave (ie Pi to Flashrom) is being over voltaged, and will most likely burn out the I/O inputs on the flash rom. Because you're putting too much voltage (and quite possibly too much current, see the link above, it could source just under 50 mA), it will most likely blow out the logic inputs on the flashrom and render it useless.

You can argue it all you want, ignore the specifications all you want as well (and the warnings they include, as well as good general engineering practices....), at the end of the day, there is a reason they make logic converters. Spouting non-sense and poor engineering practices on a public forum is just bad form, and only encouraging users to do it, and break their boards. Something that WE here do not condone them doing. 

We've asked you to stop. We've provided reasons, sound logical reasons built upon engineering practices. 
See : >>Please read and comply with the Forum Rules.<<

As far as getting parts, I've provided links to parts that can be obtained through many different means. Ebay, aliexpress, or even local retailers (there's part numbers and information on what each one is in the links above....). You can properly flash using that equipment. And I'm sure there's other means of doing it as well (FTDI/SPI cables should work, as long as their either are meant for 1.8V logic, or have a logic converter attached to them). But using good engineering practices is paramount to not screwing it up something even more.

[r.sarwar87]

who ever said it was a good practice? I did say this is a last resort!!!

who said MSI/you "condone them"?


please let me know where you asked me to stop? and let me know which rule i not complying.

i will not be replying to this kind of abuse from moderators.

[darkhawk]

This resides on MSI's boards. 
They (obviously) don't want users doing something that they themselves do not condone (they don't condone what you've discussed....I only know this because I've discussed it at length with them....).
What you describe is what they do NOT want users doing. Even as a 'last resort' (it's not....last resort is RMA).

[kiwiturkey]

@darkhawk, I really need help with the SPI programming thing. I've been looking around the forums and have seen people doing SPI programmers to flash BIOS (assuming this is how factory motherboards are flashed). I broke my motherboard by flashing the bios through windows with an incompatible BIOS updater (I was stupid and forgot that every BIOS should be done in the UEFI bios through M.Flash). Now this is my last resort because I'm pretty sure my motherboard's BIOS is corrupt. I've reset the CMOS several times as well as removing the GPU and trying the Flash BIOS USB drive method but my computer still won't POST. Can you PM me the steps to flash using the SPI programmer. These are the materials I'm getting but I need a step by step tutorial for a beginner. I would owe you a big one if you could reply. I'm deciding whether or not to RMA or do this myself since I'm heading back to college in 6 days and won't be with my gaming rig until 2 months later.

https://www.amazon.com/gp/product/B013Q5P3ES/ref=ox_sc_act_title_1?smid=A2OCOGC9B25845&psc=1
https://www.amazon.com/gp/product/B00V9QNAC4/ref=ox_sc_act_title_1?smid=A3H7GPL9U124TQ&psc=1
https://www.amazon.com/gp/product/B072KYK2DR/ref=ox_sc_act_title_2?smid=A26ATEC08S9EFM&psc=1