I’ve been attempting to figure out who to run my own firmware on IPMI controllers. The built in firmware has some bugs, and getting them fixed is very difficult. The first step here (well, after blindly trying to flash some modified firmware and bricking the controller) is to figure out how I can write to the flash chip without the IPMI controllers cooperation. The IPMI controller on this board is a Nuvoton (aka Winbond) WPCM450RA0BX. There’s no real documentation for this that I can find, and none of the chip companies have been willing to provide me with spec sheets. I’ve managed to determine that it’s connected to some SPI flash, specifically a MX25L25635F SPI flash chip.

My first attempt at this involves a mysterious header on the board labeled ‘SPI Programming (internal use)’ (this is labeled J31). I was hoping that this was connected to the IPMI flash chip, but that doesn’t seem to be the case. This header is directly connected to the BIOS flash chip, and is only useful for flashing that. It wasn’t a complete waste of time though, getting this working has let me validate that my programmer (a Bus Pirate) is working correctly, and has taught me a bit about how the process should work. I haven’t yet reprogrammed the BIOS, but I may throw Coreboot on it in the future.

There appears to be no standard for SPI headers, so I had to figure it all out with a multimeter. I’ve documented in below, the picture assumes you’re holding the motherboard with the PCI slots on top, and the BIOS chip and SPI header on the bottom.

There is also a jumper (J29) next to the BIOS flash chip. I believe this disconnects VCC from the rest of the board. This allows programming without having to desolder the chip. I didn’t really see any difference with this open or closed, so it may not be that useful. I should note that the board won’t actually boot if this is removed, it will spin the fan up for half a second, then shut it off, and repeat indefinitely.

Once everything is connected, it’s pretty easy to read the BIOS. I’m using flashrom, as it appears to be the only real software to do this.

# time flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=8M  -r ../bios
flashrom v0.9.7-r1764 on Linux 3.11.0-15-generic (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on buspirate_spi.
Reading flash... done.

real    13m42.823s
user    0m4.811s
sys     0m27.361s

This takes a fairly long time, so I’ve purchased a Bus Blaster instead in the hopes of speeding it up. A 15 minute program cycle isn’t really going to make development easy.

Overall, I’m pretty happy with the progress I’ve made. I’ve figured out how to program SPI chips, and have something I can fall back on if I suspect weird programming issues in the future. Still waiting on some hardware before I can begin investigating the IPMI chip (I don’t really want to have to desolder the flash chip to program it).