How to Recover BIOS After Bad Flash Update

I was playing around this morning and decided to update my BIOS. Being lazy I figured I should just remote in and update via the Windows based flash tools.

Well, it crashed and I was stuck with a half written flash. Having an ASUS P5Q Pro motherboard with it's crashfree BIOS, I figured "oh I'll just restart and recover". Well that didn't go so good and the crashfree feature well, didn't even work. I tried the normal tricks, from PCI graphics card, removing everything but one stick of RAM and CPU, changing the CPU to even trying to follow beep tones that ASUS documents to aid you though crashfree (there was no tones). The board was cactus and out of warranty...

Lucky this board has a DIP socket which allows you to remove the flash IC which stores the BIOS:



Mind you, even if it is soldered to the board, you can desolder and try the following technique, but you might kill the IC if you don't have the right removal tools. There are places that will supply you with a replacement chip if you do kill it and you can just solder back on.

Removing the IC reveals that this is a Macronix MX25L8005PC, an SPI based 8mbit flash:



Having played with the DP Bus Pirate a bit I knew I could interface with the flash quite easily without having to build anything fancy so I opted for this approach.

Looking at the datasheet it was found that the Bus Pirate should be interfaced with the IC like so:


Bus Pirate     MX25L8005PC - Pin#
CS             CS   - 1
MISO           SO   - 2
V+ 3.3v        WP   - 3
GND            GND  - 4
MOSI           SI   - 5
CLK            SCK  - 6
V+ 3.3v        HOLD - 7
V+ 3.3v        VCC  - 8
Vpullup        VCC  - 8

Flashrom is a fantastic unix based tool for flashing all types of ROMs. It has also been ported to Windows particularly for use with the Bus Pirate. Looking at the hardware support for the MX25L8005 shows that it is indeed supported:



It is important that you have the latest firmware for the Bus Pirate flashed to the device, otherwise reflashing the BIOS will take a VERY VERY long time. Please make sure you follow the instructions on how to flash and what order to flash (on the Bus Pirate website). I have the following installed on mine:



It is also important to get the latest version of flashrom (to support the faster flash/erase speed of the Bus Pirate). I got the latest Windows version from the first post in this thread.

You aren't limited to Windows for this, the latest release of flashrom for unix also supports the Bus Pirate and there are prebuilt binaries for the major distros (there is even a live CD).

Hook up the Bus Pirate to the flash and plug it in to a usb port:



Check which com port the Bus Pirate is on in device manager:



Now place the ROM file you want to write back to the flash and the flashrom.exe file in the same directory and browse to that directory in a command prompt. Then run the following:

flashrom.exe -p buspirate_spi:dev=COM13 -w P5QPRO.ROM -V

To view all of the options run flashrom.exe -h. One option is to specify which chip you use for faster detection (-c MX25L8005).

The Bus Pirate will light up and usb light will start blinking:



If you used the "-V" (verbose) option you should see lots of text on the screen along the lines of:
flashrom v0.9.2-r1182 on unknown machine, built with GCC 3.4.5 (mingw-vista special r3), little endian

flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OS timer resolution is 2500 usecs, 772M loops per second, 10 myus = 0 us, 100 myus = 0 us, 1000 myus = 0 us, 10000 myus = 10000 us, 10000 myus = 10000 us, OK.

Initializing buspirate_spi programmer

SPI speed is 8MHz

ReadFile returns 1

ReadFile read 5 bytes

Raw bitbang mode version 1

ReadFile returns 1

ReadFile read 4 bytes

Raw SPI mode version 1

ReadFile returns 1

ReadFile read 1 bytes

ReadFile returns 1

...

ReadFile read 1 bytes

Using SPI command set v2.

Probing for Macronix MX25L8005, 1024 KB: ReadFile returns 1

ReadFile read 4 bytes

probe_spi_rdid_generic: id1 0xc2, id2 0x2014

ReadFile returns 1

ReadFile read 3 bytes

Chip status register is 00

Chip status register: Status Register Write Disable (SRWD) is not set

Chip status register: Bit 6 is not set

Chip status register: Bit 5 / Block Protect 3 (BP3) is not set

Chip status register: Bit 4 / Block Protect 2 (BP2) is not set

Chip status register: Bit 3 / Block Protect 1 (BP1) is not set

Chip status register: Bit 2 / Block Protect 0 (BP0) is not set

Chip status register: Write Enable Latch (WEL) is not set

Chip status register: Write In Progress (WIP/BUSY) is not set

Found chip "Macronix MX25L8005" (1024 KB, SPI) at physical address 0xfff00000.

ReadFile returns 1

ReadFile read 3 bytes

Writing flash chip... Erasing flash before programming... Erasing flash chip... Looking at blockwise erase function 0... trying... 0x000000-0x000fff, ReadFile returns 1

ReadFile read 1 bytes

ReadFile returns 1

ReadFile read 1 bytes

ReadFile returns 1

ReadFile read 3 bytes

...

ReadFile read 129 bytes

ReadFile returns 1

ReadFile read 129 bytes

SUCCESS.

done.

Programming flash... ReadFile returns 1

ReadFile read 1 bytes

ReadFile returns 1

...

ReadFile returns 1

ReadFile read 129 bytes

VERIFIED.         

ReadFile returns 1

ReadFile read 5 bytes

Raw bitbang mode version 1

Bus Pirate shutdown completed.

As you can see it has detected the flash "Found chip "Macronix MX25L8005" (1024 KB, SPI) at physical address 0xfff00000" and then it continues to erase and flash/verify (it verifies as it writes).

Once completed, the USB light on the Bus Pirate will stop blinking and flashrom should output "VERIFIED" and "Bus Pirate shutdown completed". This process, depending on the chip size should take about 15minutes. If you use an older version of flashrom or the Bus Pirate firmware, this can take up to about 10hrs.

Place the chip back in (making sure to place it back the right way), clear the CMOS and boot:



Success :)!

Please note, this method has been detailed specifically to flash SPI based flash chips. If you have something different, for example a parallel EEPROM, you will need the correct hardware to interface with it. If you are using something different, I advise that you check the flashrom website to see if the chip is supported, and then see what hardware it supports for you to flash it. Newer motherboards though (from circa 2006 onwards), should mostly have SPI based flash, all you need to do is check the datasheet for the correct pinout.

Another thing to add. Flashrom can also flash your BIOS while it is sitting in your motherboard if the chip is supported. If you do have a mishap with a Windows based flash tool, it is most certainly worth giving flashrom a shot before restarting instead of trusting crashfree or equivalent to work.