ASRock B650M PRO RS - BIOS CHIP 25Q256JW BLOCKED BY STATUS REGISTERS

[DynaxSC]

Hi

I have a very strange issue with the BIOS SPI chip of an ASRock B650M PRO RS motherboard.
The SPI chip is an Winbond 25Q256JWEQ model (1V8).
The motherbaord doas not POST - it lits only CPU and DRAM EZ Debug Leds, and stays that way forever.
The Flashback function of the motherbaord is also not working, despite all instructions followed correctly - I'm 100% sure of this.

I have then desoldered the chip, backupped the contents, and tried to earease the chip in order to program stock image, but the chip is locked by status registers SREG2 (TB) and SREG6 (BP0) - Status register value is 44. Tried to unlock the chip, but CH341/Neoprogrammer/ASProgrammer/Flashrom, seems not to be able to change the values of the status registers. After resetting the registers and writing them, they remain still set - so no change is done.

I have taken a new SPI chip, programmed it with a stock BIOS and soldered it to the board.
The motherboard started to work, and POST's normally, however the image is missing the original DMI data.

So tried to program the DMI data with DMI Edit, but it fails to write the chip.
Tried to reflash the chip with Flashback button, but it still does not work.

Desoldered the chip and put it into CH341 programmed, and "f...k" the status registers are set again like in the original bios chip.
Tried to unlock the chip, but to no avail.
Tried to erease the chip under linux with newest flashrom 1.7 and CH341 - does not work, flashrom is also not able to reset these status registers.

Seems this bloody motherboard bios does something strange with the SPI chip, and blocks it so, that it is not possible to erease or reprogram the chip even with HW programmer.
Tried to reflash the chip in the board with BIOS function, and here it works, I can reflash the chip with bios function without any problem.

I need to reprogram the chips with an altered stock image which has the DMI data transferred from the original bios image, but can't do it with CH341.
I have no more of these chips available, ordered some, but this will take time, and also would not like to throw away a working chip.

I never before faced such an issue with programming SPI chip with CH341.
Tried also different ASProgrammer/NeoProgrammer versions, but to no avail.
Tried also to flash the NVRAM from AFUWINGUI - but ends up with an error.

Anybody a hint what to do to erease this chip ?
Any better programmer to use ?

[m1ch43lzm]

You also have the "read-only" SRL bit set

Attached W25Q256JW datasheet, check page 18, if SRL is set to 1 you can't modify the status register


As you have both TB and BP0 set, you can't program the first 64KB (0000h - FFFFh), the chip will ignore writes to that specific area

[stj]

some flashchips are pre-programmed to 4bit "quad" mode.
a CH341 cant work with those because it uses single-bit mode.
so thats another problem to watch out for.

[DynaxSC]

Thanks guys for your hints.

I have now received a new commercial programmer, the chinese Xgecu T48.
Tried to unprotect and reflash the chip with this commercial programmer, which also works in 4bit quad mode, but to no avail.
Here some screenshots from the process:



The chips does not allow to chage the proctection registers.
I tried to unlock also the SRL register, but it seems completely no register can be changed, whatever I do.
Also measured pin 3 /WP during programming and it is correct level, i.e. high, so the HW protection is disbaled.
Tried all autodetected spi chip models, as well as several *256* chips from other vendors, but no luck, no way to unlock the chip.

The erasing process is much too short, only 0,4 sec. Normally it takes about a minut at least to erase such a chip - I tested it with a new chip. So the "Success" message of the programmer is wrong, as it even does not start to erase the chip.
The SRL register, equal to SRP1 (SR8) on the Xgpro programming software screenshots, can't be changed, also not by a Power Down/Up cycle of the chip.
Here what happens when I try to reset the status registers:



Still there must be some magic done with this chip by the BIOS of the motherboard, but what exactly I have no idea.

Let me know if you have any new ideas.

[m1ch43lzm]

Looks like the second condition for SRL=1 is true i'm afraid

One Time Program (2)
Status Register is permanently protected and cannot be written to.
2. Please contact Winbond for details regarding the special instruction sequence.

That means you can't write/erase the first 0xFFFF of the flash, the rest you should be able to erase/program, uncheck "Blank check" and set Addr range from 0x10000 to 0x01FFFFFF
That specific flash chip will only work on the same motherboard/another board of the same model

Try this, clear buffer in the main Xgpro window, should be full of FF FF FF..., write that to the chip, settings as following picture:

Uncheck "Blank check" and "Skip blank"
select Addr range from 0x10000
If it tails, also uncheck "Unprotect before programming"





Verify will fail, now read the chip, the first 0xFFFF should still be preserved, the rest should be full of FF FF FF
Now flash the BIOS with the same settings
Not ideal, but what can you do

Checked the BIOS updates from ASRock, from 1.24 to 3.30, the first 0x81000 are the same, if the DMI area falls in the first 0xFFFF you're out of luck