I bought a broken MSI X470 motherboard to take a stab at fixing it. It stopped working all of the sudden the seller claimed. The symptoms upon firing it up are: no post and a red EZ debug LED. This is a writeup of how the board was successfully un-bricked using a BusPirate, a cheap 1.8v SPI adapter and the open-source flashing software flashrom.

The how

First step was to check the board for physically damaged components. I undid the heatsink screws and the shroud and took a couple of close-up looks at the usual suspects: capacitors, transistors and fuses. Nothing exploded violently on the board. All the caps look like they are solid state, meaning they probably didn’t leak. VRMs seem fine and don’t heat up uncontrollably. CPU heats up so it definitely gets power.

With no obvious physical damage I took a closer look at the BIOS chip on the board. This one has a nice SPI header that is unlabeled but populated. The BIOS IC has the part number MX25U12873F, a 16 MB (128 Mbit) 1.8v SPI flash. The chip size happens to match the BIOS images from MSI’s homepage (not always the case in the age of UEFI). I have a lot of weird stuff for reading and writing SPI but apparently nothing that does 1.8v, so while the adapter was on the way from a random shop in Germany, I took a stab at probing the sucker with my scope.

If the motherboard is completely dead it won’t read the BIOS, at least that is my totally unfounded hypothesis. This means that there should be some data on the data pins and on the clock pin. I put the probe on the clock pin, turned on the power and… I got an aliased waveform that is out of range of my scope. Looking at the datasheet for the chip in question, it reads a max clock well over 100 MHz. I suspect MSI is using a fast chip to not waste any time during boot.

The 1.8v adapter arrived in my mailbox and I soon attached it to my BusPirate and attempted to read the chip. A forum user on the EEVBlog forums, tocsa120ls, wrote an interesting post on flashing an MSI B350M Mortar with the exact same chip. His excellent writeup describes a couple of pitfalls mainly that pin 9 of the unlabeled SPI header needs to be grounded when flashing. Had I had fewer white russians I may have actually read the details of his post, but instead I fumbled through a night of attempting to read 16MB off a chip.

My initial attempt was using a clip to attach to the flash chip. The clip I used is the cheapest one on AliExpress which translates to an extremely brittle connection. A seemingly unrelated wind gust in Africa could make the clip release its grip and fly away from the chip with a distinct, loud click followed by the sound of a man from the Balkans cussing in his native tongue. I fired up the Hakko and soldered 8 pieces of wire to the chip and clicked the wires in the 1.8v adapter.

Wiring

If you are uncomfortable soldering to the chip you can just use the SPI header. If you have a clip that can actually grasp the bios chip, by all means use that instead.

The pinout for the SPI header, courtesy of EEVBlog forums:

And on the other end you have the BusPirate:

  1.8v Adapter pin numbers
    BusPirate pin names

    CS +--1----8--+ 3.3v
          |    |
  MISO +--2    7--+ 3.3v
          |    |
  3.3v +--3    6--+ CLK
          |    |
   GND +--4----5--+ MOSI

Reading/writing

I plugged the board in a PSU, grounded pin 9 on the SPI header and turned on the motherboard without CPU or RAM. Since flashrom does not support MX25U12873F directly (since it’s a 3.3v flasher), it detects the 3.3v cousin the MX25U12835F:

$ flashrom -p "buspirate_spi:dev=/dev/ttyUSB0" -r x470.read.bin
[omittted]
Found Macronix flash chip "MX25U12835F" (16384 kB, SPI) on buspirate_spi.
Reading flash... done.

To my utter amazement the chip was read succesfully. It took a couple of minutes. I read it again to ensure it read correctly. I then downloaded a bios from MSI’s website and extracted it.

Writing the bios was as simple as:

flashrom -p "buspirate_spi:dev=/dev/ttyUSB0" -n -w E7B78AMS.2E0 -c MX25U12835F

This took a lot longer than reading, maybe 15 minutes. I unplugged the programmer, added a CPU, some RAM and the motherboard actually booted!

A couple of photos of the actual wiring:

Conclusion

This was a very fun project that resulted in a nice, working high-ish end AM4 motherboard that will replace my old B350 board.

Thanks for reading if you made it this far. Happy hacking.

/J

2021-11-04 Update: Fixed links.
2023-11-29 Update: This board has been my primary NAS & router for two years.

References:

• BusPirate page on flashrom.org
• BusPirate pinout
• Official MX25U12873F datasheet