Adventures in Home Computing

The BIOS Repair Wizard™ is a tiny, disposable circuit that allows you to quickly and easily repair the BIOS on a badly flashed computer system. This device is no longer being manufactured.

Summary

1. The first step in recovering from a botched flash is to build the EEPROM programming hardware.
2. Fetch a copy of SPIPGM2 from here and CWSDPMI from here.
3. Run SPIPGM2.EXE in a DOS environment.

To flash the bios I use the following parameters:
– CWSDPMI
– SPIPGM2 /i to make sure that the program can read my chipset and the cable is ok.
– SPIPGM2 /u to unlock the bios.
– SPIPGM2 /e to erase the bios.
– SPIPGM2 /s p5b.rom to flash the new bios (spipgm2 /p for most other motherboards).

The first step in recovering a botched flash is to build the EEPROM programming hardware.

I chose a simple design based on parts I had available. It was really tempting to rush through the assembly because the circuit is so simple. Even so, I can’t believe how many times I wired the wrong signals to the ribbon cable.

Using a continuity meter to verify each signal path, thrice, resulted in a circuit that matched the schematic.

External power is supplied by an HP Pavilion A6207C using its 4-Pin Molex hard drive connector which provides 5.2 volts (red wire) with no load. The SST25VF080B is able to write, program and erase, with a single supply of 2.7 – 3.6V. Microchip has a handy guide for performing the needed 5V to 2.7 – 3.6V conversion. The simplest approach is to drop the voltage across a series of diodes. Three 1N4148 high-speed diodes in series with a 4.7K load measured 3.3V. As expected each diode dropped the voltage by approximately 0.65V. Adding a fourth diode dropped the voltage to 2.8V. Three or four series diodes drop the source 5.2V enough to meet the requirements for this device.

A 1000uF capacitor levels the 3.3V power rail in the event of a heavy current draw from the SST25VF080B. The 22pF capacitor shunts high frequency noise in the power rail to ground. Finally, a bunch of 470 ohm resistors buffer the printer port against any short circuits caused by improper installation of the ribbon header.

Some have reported better success with 220 ohm resistors instead of 470 ohm. The value of these resistors is not critical. Their purpose is to protect the host controller hub from improper wiring. A short circuit will permanently damage the Southbridge so extreme care is needed. Not much to the circuit since all of the smarts are in the EEPROM programming software.

Next step is to run SPIPGM in a DOS environment.

The easiest way to launch DOS is to use a Bootable USB Key. The SPI flash program, DOS Protected Mode Interface (DPMI), UnZip, ASUS P5B BIOS, and binary compare CMP are all copied onto the USB Key. These applications and the original archive files take no more than 2.5MB.

Booting the USB flash-drive reveals the Windows Millennium OS!!! Ahhhhhhhh! I just had a horrible flashback where DOS 4 and and Windows 3.1 were the best Microsoft could offer. Extracting  UnZip, SPI, and DPMI then running SPIPGM results in partial success. SPIPGM recognizes the  SST25VF080B! Yay! Unfortunately, it fails to program the EEPROM

A more detailed analysis reveals that SPIPGM reads the JEDEC ID, and the status register. It can also unlock the Block-Protection bits in the status register. Finally, it can erase the device once the block protection bits are cleared (by default they are set upon power-up). The first byte of memory is programmed and other bytes here and there but not consistently. Changing the SPIPGM clock duty cycle using the /d option makes no difference. More research is needed.

Enhanced SPIPGM is required to support SST25VF080B (the following code is already included in SPIPGM2.EXE).

Perusing the SST site for application notes uncovered a driver document. The SPIPGM source was located at CoreBoot! Comparing the source code identifies a significant difference. Operation code 0×02 is used by SPIPGM to program a page. The SST25VF080B driver code uses the same operation to program one data byte at a time. Adding a new function to program the EEPROM one byte at a time was fairly easy given the very modular code already in SPIPGM.C

int spi_slow_program( char *filename ) {
  DWord address = 0L;
  FILE *fr=fopen(filename,"rb");         // otevri soubor pro cteni
 
  if( fr == NULL ) {                     // pokud chyba, tak skonci
    printf( "ERROR: cannot open file %s\n", filename );
    return( -1 );
  }
  printf( "Programming with %s\n", filename );
  while ( fread( spi_do_buffer, 1, 1, fr ) == 1 ) {
    if( ( address % 32768 ) == 0 )
      printf("\n%08lx ", address );
    if( ( address % 1024 ) == 0 )
      printf( "." );
    spi_rw_byte(SPI_FLASH_WREN);
    SPI_CLR_CS;
    spi_rw_byte_no_cs(SPI_FLASH_PAGEPGM);
    spi_rw_byte_no_cs(((address & 0xffffff) >> 16));
    spi_rw_byte_no_cs(((address & 0xffff) >> 8));
    spi_rw_byte_no_cs(address & 0xff);
    spi_rw_byte_no_cs((Byte) *spi_do_buffer);
    SPI_SET_CS;
    spi_rw_byte(SPI_FLASH_WRDIS);
    udelay(1000);
    address++;
  }
  printf( "\n" );
  fclose(fr);                            // zavri soubor
  return(0);
}

Compiling the code is straightforward using DJGPP. Fullly modified source can be found here.

Copyright (c) 2009 by R. Burke

The BIOS Repair Wizard™ is a tiny, disposable circuit that allows you to quickly and easily repair the BIOS on a badly flashed computer system. This device is no longer being manufactured.

Fortunately I noticed a maintenance port next to the failed chip. Hmmmm … gears start to turn as I ruminate . And when you look up ruminate in the dictionary – no I was not chewing anything, especially not cud. Apparently the maintenance port can be used to fix the computer but the Taiwanese manufacturer keeps all the details secret. Oh well, time to put my electronics background to good use (after 20+ years counting) and reverse engineer the circuitry.

By hacking up a program from some Czechoslovakian dude I managed to transfer a new brain into the system. I had to use an on-line Czech to English translator. It came up with helpful gems like “Due to tomu, that to with SMD material spare ten within unauthorized reprint, altogether sink under expenses within making plus manaže?i nowmají several $ within superiors motorcars plus whore .” I like how on-line computer translators decode the swear words.

Google searching tells me that other people have had the same problem and some have not found a solution. It would be cool to build a cheap EEPROM programmer to sell on eBay for this situation.

Copyright (c) 2009 by R. Burke

The BIOS Repair Wizard™ is a tiny, disposable circuit that allows you to quickly and easily repair the BIOS on a badly flashed computer system. This device is no longer being manufactured.

Normally there is a sense of anticipation just after power is applied and the few seconds before the POST “beep” and then joyful relief when the BIOS shows the results of its hardware enumeration. For this occasion the CPU fan started but nothing else happened. Crap. Luckily this BIOS has a two digit LED POST. It indicated the startup sequence failed when trying to initialize  the CPU. 

Posting goes as follows:

» post code C1 (Memory Presence / Base memory detect)

» post code C3 (Extend Memory / Turn on extended memory, cache initialization)

and lastly

» post code 18 (InitCPU / CPU ID and Initialize L1/L2 Cache) ** It gets hung here **

Hmmmmmm. This XFX 680i SLI motherboard had previously booted fine with a Conroe E6850. It appears the BIOS can’t handle the newer Wolfdale E8400 CPU.

A fateful choice: I decided to swap the  Wolfdale for a slightly less powerful, and older Conroe from a home office computer. Checking the BIOS version on the office ASUS P5B Deluxe showed that an update was required. No problem. I downloaded the BIOS file and used the ASUS Flash utility … well it failed.

After my computer rebooted, I had fans, and lights, but no POST, video, or BIOS screen. I removed the battery for a bit and reset the CMOS, but that didn’t change anything. Reading many posts on technical forums categorically advocate to “Never flash your BIOS from within windows!!!”. Lesson learned the hard way.

ASUS support reports the following to nosnhoj

More than likely you have blanked the bios chip. There isn’t anything you can do except send us the bios chip, which is removable, and send it to us to have it re-flashed. You can send the chip to:

Attn:Bios Dept
7100 Intermodal Dr, Suite A
Louisville, KY 40258

Please be sure to include a piece of paper with your return address, motherboard model number, which version of bios that you would like flashed, and a check  or money order made payable to ASUS in the amount of $5.00. If this is fine for you, then please send us the chip, we will receive the chip, update it, and send it back to you. From the time we receive the chip, and ship it back, it should take about 2-5 business days. It will shipped out FedEx Ground. If you need the chip faster, then please call us here at the helpdesk, 502-995-0883. Thank you!

Nice. But the P5B Deluxe BIOS is soldered to the motherboard. Sending the board back to the service depot for RMA requires payment for shipping and a lot of time.  Options?

Copyright (c) 2009 by R. Burke