Flashing Bios/IPMI with HW flasher

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
So I corrupted the IPMI firmware on one of my SM x10 boards (x10sri) (stupidly had 2 open windows and logged out of the second which invalidated the session on the flashing one).

While the board has warranty I bought it used and so have no reseller that could send it in for me.
I was thinking about getting a HW flasher and reflash the IPMI chip myself but have no experience whatsoever re this. Not even sure if its possible/easy (will need to check socketed vs soldered).

Just wanted to hear whether anyone has experience with this?
Doable/not worth the effort etc pp.

The board is working fine, just IPMI is affected. I dont *need* it but o/c its convineant...
 

pricklypunter

Well-Known Member
Nov 10, 2015
1,668
492
83
Canada
That will almost certainly be stored in the BMC flash. Depending on which chip, it may be doable, but definitely will be a pain the rear. You're best bet would be to try the various CLI commands to reset it, or perhaps contact SM and see if they have a recovery boot disk for it. How far into the procedure did you get? Did it make far enough to erase the Flash? SM may also be able to fix it for you as a fixed price service, so maybe worth asking them?
 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Tried resetting, contacted SM and they said RMA. Maybe I can get a preflashed chip from them, checking that atm :)
 

nthu9280

Well-Known Member
Feb 3, 2016
1,627
468
83
San Antonio, TX
SM RMA/Tech support can check the warranty for you. If you have local SM you ship the board and they fix/provide a replacement and ship it back to you.

I recently did RMA for a X10SRA-F board that had valid warranty. They could not fix the Video issue so sent me a replacement (Refurb) board.
Here in US you are responsible for the cost of shipping it to SM. They absorb the return.

Sent from my Nexus 6 using Tapatalk
 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Officially here in Europe only a registered reseller is 'allowed' to ship to them (that's what I have been told over and over again).

But RMA teams at least seems willing to talk. Lets see what happens:)
 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Good news and bad news -
good one is that Supermicro RMA overnighted me a new BIOS chip free of charge - great service !

Bad news is - its soldered not socketed :(
Not sure my soldering skills are up to that ...
upload_2017-12-29_13-51-14.png
 
Last edited:

istamov

New Member
Jul 31, 2015
15
5
3
If you are willing to wait a few more days (or rather a week or two) I can try to confirm if it is possible to program the original chip while still soldered and provide the steps for flashing the IPMI using RPi if this method works (and anyway you will need to carefully solder a few wires or use some SOIC clip like Pomona 5252).

I am actually waiting for the very same MXIC MX25L25635FMI-10G chip to arrive from China as I have CSE-PTJBOD-CB3 board which for some reason does not accept any known username/password combination, even after resetting it do factory defaults. Supermicro support was very helpful until the moment all their procedures did not help and they told me to RMA, but the board is out of warranty (I think, it is actually bought used from a fellow STH member and I believe it broke during the transit or security scan, etc).

I was actually able to dump the IC using Raspberry Pi + flashrom (confirmed, multiple dumps with matching checksums), but I am not sure if it will be possible to program it "in circuit" (as it is soldered on the board). Currently I have lifted at least pin 2, which is Vcc (power), everything else is still soldered to the PCB.

If you decide to proceed before that, good luck!
 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Interesting... I have no dire need to get it to run, so happy to wait for a less risky solution:)
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,524
2,698
113
31
fohdeesha.com
if you're feeling adventurous and do have a soldering iron, it's not horrible to replace those. One way for newbies is use an exacto knife to cut each leg to cleanly lift the old chip off, then once it's off remove each pin remnant from its pad with your soldering iron and maybe some needle nose pliers. Then you can place your new flash IC on, and solder each pin by itself, or it's much easier to just get some solder on your irons tip and drag it across the pins, it should stay on each pad and not in between on the solder mask

this is a great guide vid for basically that exact chip package:

 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Right, forgot about that sliding technique... too much dabbling with servers, too little soldering 'copters in the last years:p

Thanks :)
 

istamov

New Member
Jul 31, 2015
15
5
3
While still waiting for the replacement chips to arrive from China I decided to flash my board (either way it is not working, so nothing to lose :) ).
You can review the information provided at The technique for Gamesharing on PS4 - G3ar (at least for the hardware connections), for the flash I used flashrom and here are the steps:

1. Install Raspbian on the Raspberry Pi (I am using the Debian Stretch Lite release)

2. Put a file named "ssh" in the "boot" directory in order to activate SSH access, then login into the RPi via SSH

3. Start the "raspi-config" utility and activate SPI
(Advanced Options -> SPI -> Yes -> OK -> Finish)
While at it, you can also expand the filesystem to use the full SD card storage space.
$ sudo raspi-config
4. Install the needed dependancies and compile "flashrom" from source (support for MX25L256 chip family was added just recently):
$ sudo apt-get install pciutils libftdi-dev libpci-dev libusb-1.0 libusb-dev git
$ git clone https:// github.com/flashrom/flashrom.git
$ cd flashrom/
$ make CONFIG_ENABLE_LIBUSB0_PROGRAMMERS=no CONFIG_ENABLE_LIBUSB1_PROGRAMMERS=no CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no
$ sudo make install CONFIG_ENABLE_LIBUSB0_PROGRAMMERS=no CONFIG_ENABLE_LIBUSB1_PROGRAMMERS=no CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no
5. Connect the chip to the RPi (image taken from the link above, The technique for Gamesharing on PS4 - G3ar):


6. Create dump of the current chip content:
$ sudo /usr/local/sbin/flashrom -c "MX25L25635F/MX25L25645E/MX25L25665E" -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -V -r backup_original_rom.bin
7. Erase/blank the chip:
$ sudo /usr/local/sbin/flashrom -c "MX25L25635F/MX25L25645E/MX25L25665E" -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -V -E
8. Write the new firmware (you will have to replace "SMT_X10_CB3_120.bin" with the correct bin image for your motherboard BIOS):
$ sudo /usr/local/sbin/flashrom -c "MX25L25635F/MX25L25645E/MX25L25665E" -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -V -w SMT_X10_CB3_120.bin
------------------------

This is the output of the flash procedure in my case, the checksum of the original file and the one downloaded from the chip after the flash are a match, but anyway my board is still not working :) I will need to find more time to troubleshoot it, but the flash procedure itself seems to be working correctly, so it might help in your case.
And the usual disclaimer to please follow the steps with caution and double check them for your needs - you can mess up the chip pretty badly so do it at your own risk.
pi@raspberrypi:~ $ sudo /usr/local/sbin/flashrom -c "MX25L25635F/MX25L25645E/MX25L25665E" -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -V -w SMT_X10_CB3_120.bin
flashrom v0.9.9-90-g22f2dc5 on Linux 4.9.65-v7+ (armv7l)
flashrom is free software, get the source code at flashrom

flashrom was built with GCC 6.3.0 20170516, little endian
Command line (7 args): /usr/local/sbin/flashrom -c MX25L25635F/MX25L25645E/MX25L25665E -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -V -w SMT_X10_CB3_120.bin
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing linux_spi programmer
Using device /dev/spidev0.0
Using 8000 kHz clock
The following protocols are supported: SPI.
Probing for Macronix MX25L25635F/MX25L25645E/MX25L25665E, 32768 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2019
Found Macronix flash chip "MX25L25635F/MX25L25645E/MX25L25665E" (32768 kB, SPI) on linux_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:W, 0x001000-0x001fff:W, 0x002000-0x002fff:W, 0x003000-0x003fff:W, 0x004000-0x004fff:W,
...
0x1ffc000-0x1ffcfff:W, 0x1ffd000-0x1ffdfff:W, 0x1ffe000-0x1ffefff:W, 0x1fff000-0x1ffffff:W
Erase/write done.
Verifying flash... VERIFIED.

pi@raspberrypi:~ $ sha1sum SMT_X10_CB3_120.bin
12ff540d06d9f1c5fa1122c7946cf420bfe29079 SMT_X10_CB3_120.bin

pi@raspberrypi:~ $ sha1sum new_rom_flashed.bin
12ff540d06d9f1c5fa1122c7946cf420bfe29079 new_rom_flashed.bin
Good luck! :)
 

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Thanks:)
1. This is main board bios not ipmi right? Would that be different?

2. Is lifting of pin2 required or will it work connected to the board?
 

istamov

New Member
Jul 31, 2015
15
5
3
Ahh, yes, sorry about that:

1. In my case it is IPMI bios (the control board is CSE-PTJBOD-CB3 so it is basically IPMI only). There shouldn't be any difference apart from the different ROM image, the chip is the same.

2. I think that it might work with pin2 still connected to the board, but cannot confirm this for sure. Anyway I would still remove any kind of RTC/backup battery from the board to make sure it is powered from the RPi only.
I am awaiting for Pomona 5252 SOIC clip, then can give it a try again with pin2 soldered back to the board.

Once again, I am not very experienced with this, so if someone else can confirm or correct these steps it would be great.
 

SenH

New Member
Mar 28, 2017
6
1
1
I can confirm that istamov method worked succesfully to flash a bricked IPMI on an A1SRi-2558F.

I used Pomona 5252 SOIC clip, bus pirate programmer (v3.5 with FW v7.0) and flashrom compiled from source (supports MX25L25635F flash chip).

Flashrom write command reads, erases, writes & verifies in a single step:
Code:
sudo ./flashrom -VV --chip "MX25L25635F" --programmer buspirate_spi:dev=/dev/ttyUSB0 --write ../REDFISH_X10_369/REDFISH_X10_369.bin
* Flashrom didn't work reliably for me running in a VM.
* Disconnect PSU and battery from the MB before flashing!
* The writing step takes a long time (+30 minutes).
* After flashing I had to reset BMC and set MAC address
Code:
ipmicfg.exe -fde
ipmicfg.exe -a XX:XX:XX:XX:XX:XX

ipmicfg.exe -m
ipmicfg.exe -ver
 
Last edited:

Rand__

Well-Known Member
Mar 6, 2014
6,134
1,499
113
Great to hear - thats a flashing only solution, right, no soldering involved?
 

SenH

New Member
Mar 28, 2017
6
1
1
No soldering involved, only wire up the Pomona SOIC clip for the MX25L25635 chip as described in the image above). I also checked on an X11 motherboard and you see that SM always leaves a bit of space around these flash chips so the SOIC clip fits perfectly. I guess it's the method they also use when you send in a board for RMA.
 
Last edited:
  • Like
Reactions: gahabana