I just went through the odyssey of unbricking an S8030 32MB BMC version and thought I'd add my experience to the public record.
After attempting an upgrade to a version that was too new for my board (4.07 which had a 32mb install image so I thought I was ok...missed the warning at the bottom of the page) and ending up with it in an unbootable state (upgrade from the BMC web tool went a very long time, restarting itself a large number of times and then failed), I tried a number of things to try to get back to a usable state with minimal cost or effort.
I initially figured I'd make the best of a bad situation and opened a case with TYAN (now MiTAC) to send it in for a 64MB BMC chip upgrade, but since I'm in Canada they wouldn't take it directly and using a US remailing service added many hundreds to the estimated cost. If I'd been in the US I probably would have taken this route since they were willing to do it for $100+shipping.
The MiTAC tech said that the only way to unbrick in the field was to desolder the entire chip with a hot air station and reflash. I didn't have a hot-air station and didn't trust myself to manage it properly even if I did, not being something I'd ever done before.
So I first tried to connect to the BMC TTL level serial header (4 pins on the board) via a raspberry pi GPIO. This was pretty easy to accomplish and I managed to get into the still-alive u-boot.
This seemed extremely promising, so I tried to flash the firmware image from the prompt, but even after being able to load the image into memory from a remote system, the pre-flash erase step froze mid-erase and the BMC instantly went dead. I'm not sure if it was a watchdog reboot that got me or if I overwrote the running system or what, but it absolutely bricked the BMC so that I got no blinky led on the board and zero serial output any more. Before u-boot died I could have rolled the dice and tried a flash without erase but didn't want to deal with a bunch of potential crazy flipped bits in the chip.
Anyways, now out of options i was comfortable with, I tried the path I'd seen a few other take with mixed success: a programmer and a SOP16 clip.
I'd seen lots of people saying that it either refused to write correctly, wouldn't see the pins/bad mating with the clip or having to do extreme stuff like lift pins 1/2 etc. Well, extreme for me, anyways. I'm not much of a hardware hacker.
It still seemed like the best course of action, so I went for it and ordered an XGECU T48 (TL866-3G) programmer and a SOP16 clip (SOP16 IC Test Clip to DIP16 - Universal Body Non-Dismantling Programming Clamp for 25 Series Chips (Cable and Adapter Board Included)). I also grabbed a pack of new very fine tips for my weller iron as well, just in case.
Once it arrived, I tried the id/read procedure with an older supermicro board I had that had a 16MB SOP16 flash chip just to try to get a feel for how it would work. I put the chip model in xgecu (despite bad silkscreening) and oriented the pin 1 (blue on my clip) to the circular indent that represents pin 1 on the chip side. Clipping in backwards apparently fries the chip.
Connecting the clip was relatively easy, but everything after that was extremely frustrating and I was unable to get anywhere, apparently due to the system immediately setting some of the pins high when power was applied, but the reader not working at all when the motherboard was unpowered. Cleaning everything with isopropyl alcohol didn't change anything.
I gave up on that and figured that at least since I hadn't outright _killed_ the chip by using the flasher to read it that I would see how the S8030 worked out. Maybe I'd be luckier?
I set up and tried to get an id read on the TYAN Winbond W25Q512JV chip (the one between the ASPEED chip and 4-pin serial header) and found the chip's circular indent pointing to the outside side of the motherboard (despite a white paint dot being on the inside...glad I double-checked!). Getting clipped on was really challenging due to the slot on one side and case on the other (I did this with the MB still installed in the case), and I kept getting id errors in the xgecu utilty.
I messed around with the board a bunch more, trying to get an ID without firing up the soldering iron and lifting pins. What I _think_ worked (since I'm absolutely not about to try to redo anything on this setup!) is to move the FP RESET jumper position to BMC reset and put a spare jumper cap (from the supermicro board, actually lol) over the FP header reset pins so that the BMC was in a continual reset state.
Once I had done that and powered on the system (set to stay powered off on AC restore so it wouldn't try to auto-start), and after I reseated the clip a few more times I finally got a good id reading of "EF 40 19". After a bit of googling, it turned out that this was the expected ID, so I was in business!
I started by trying to do a read, which gave an ID error. It turned out I'd selected a subtly wrong version of the chip from the xgecu software and it was saving my butt. I found the right one and did a read.
I made sure I did a read first for a few reasons: 1) I wanted to verify it was the BMC chip and wasn't the BIOS chip since the manual was ambiguous and 2) if there was any board-specific info in the image I wanted to make sure I had a copy of whatever was left.
I found the first 12MB or so was all "FF", which satisfied me that it was the partially wiped chip I'd messed up from the uboot prompt. Then I saved the image and continued to the next phase.
I was able to do an erase no problem, but the BMC image (v3.00, last working one for the 32MB chip) would finish too quickly and then fail on verify.
Heck. I didn't want to try booting after a bad write, so I kept going (specs show you can do 100k+ erase/write cycles on this chip, so I could do this all day : )
I realized after a bunch of failed erase/write/verify cycles that I had the xgecu speed set too high for the clip (it defaults to a speed suited to socketed mode). I moved down from 30mhz to the slowest setting of 4mhz. I was still getting bad verify, but it was making it farther now.
After a half-dozen attempts, I finally had a good verify step!
Time to disconnect the clip (Don't run with it on!) and try.
I switched off power at the PSU to kill all power to the board, disconnected the clip, took off the reset jumper and then turned the PSU back on.
I saw the BMC light up and then start blinking! Success!
I'd read that it needed 5 minutes or so to reinitialize by unpacking stuff and preparing the image on first boot after a full rewipe, so I gave it 10 minutes and then tried powering on.
I had the lovely TYAN weave splash screen. The board was again fully functional!
I found the BMC had a mac address assigned and I was able to give it an IP via ipmitool and had to reset the password from root/changeme but otherwise everything seemed to be basically as good as new.
It was the longest, most circuitous method to go from BMC firmware 1.0 to 3.0 ever, but at least it worked.
Hopefully this helps someone else out who's found themselves in the same situation.
