Flashrom: Difference between revisions
Hailfinger (talk | contribs) (→Download & installation: Add direct download location for tarballs.) |
Hailfinger (talk | contribs) (Mention USB programmers as well) |
||
| Line 9: | Line 9: | ||
<small> | <small> | ||
* Supports more than 195 flash chips, 75 chipsets, 130 mainboards, and | * Supports more than 195 flash chips, 75 chipsets, 130 mainboards, and 17 devices (PCI or USB) which can be used as external programmers. | ||
* Supports parallel, LPC, FWH and SPI flash interfaces and various chip packages (DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32, TSOP40, TSOP48, and more) | * Supports parallel, LPC, FWH and SPI flash interfaces and various chip packages (DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32, TSOP40, TSOP48, and more) | ||
* No physical access needed, root access is sufficient. | * No physical access needed, root access is sufficient. | ||
Revision as of 20:47, 15 October 2009
flashrom is a utility for identifying, reading, writing, verifying and erasing flash chips. It's often used to flash BIOS/EFI/coreboot/firmware images.
- Supports more than 195 flash chips, 75 chipsets, 130 mainboards, and 17 devices (PCI or USB) which can be used as external programmers.
- Supports parallel, LPC, FWH and SPI flash interfaces and various chip packages (DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32, TSOP40, TSOP48, and more)
- No physical access needed, root access is sufficient.
- No bootable floppy disk, bootable CD-ROM or other media needed.
- No keyboard or monitor needed. Simply reflash remotely via SSH.
- No instant reboot needed. Reflash your chip in a running system, verify it, be happy. The new firmware will be present next time you boot.
- Crossflashing and hotflashing is possible as long as the flash chips are electrically and logically compatible (same protocol). Great for recovery.
- Scriptability. Reflash a whole pool of identical machines at the same time from the command line. It is recommended to check flashrom output and error codes.
- Speed. flashrom is often much faster than most vendor flash tools.
- Portability. Supports Linux, FreeBSD, DragonFly BSD, Solaris, Mac OS X, and other Unix-like OSes.
Emergency help
IMPORTANT: If something went wrong during flashing, do NOT turn off/reboot your computer. Instead, let us help you recover. We can be contacted via IRC (#flashrom on irc.freenode.net) or email. Please allow for a few hours until someone responds on IRC, we're all volunteers.
Supported devices
Last update: 2020-12-07T23:34:14Z (generated by flashrom v1.2-158-g8fa792f)
The tables below are generated from flashrom's source by copying the output of flashrom -z.
A short explanation of the cells representing the support state follows:
| OK | The feature was tested and should work in general unless there is a bug in flashrom or another component in the system prohibits some functionality. |
| Dep | Configuration-dependent. The feature was tested and should work in general but there are common configurations that drastically limit flashrom's capabilities or make it completely stop working. |
| ? | The feature is untested but believed to be working. |
| N/A | The feature is not applicable in this configuration (e.g. write operations on ROM chips). |
| No | The feature is known to not work. Don't bother testing (nor reporting. Patches welcome! ;). |
Supported flash chips
The list below contains all chips that have some kind of explicit support added to flashrom and their last known test status. Newer SPI flash chips might work even without explicit support if they implement SFDP (Serial Flash Discoverable Parameters - JESD216). Flashrom will detect this automatically and inform you about it.
The names used below are designed to be as concise as possible and hence contain only the characters describing properties that are relevant to flashrom. Irrelevant characters specify attributes flashrom can not use or even detect by itself (e.g. the physical package) and have no effect on flashrom's operation. They are replaced by dots ('.') functioning as wildcards (like in Regular Expressions) or are completely omitted at the end of a name.
Total amount of supported chips: 561
|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Supported chipsets
Total amount of supported chipsets: 368
|
|
|
Supported mainboards
In general, it is very likely that flashrom works out of the box even if your mainboard is not listed below.
This is a list of mainboards where we have verified that they either do or do not need any special initialization to make flashrom work (given flashrom supports the respective chipset and flash chip), or that they do not yet work at all. If they do not work, support may or may not be added later.
Mainboards (or individual revisions) which don't appear in the list may or may not work (we don't know, someone has to give it a try). Please report any further verified mainboards on the mailing list.
Total amount of known good mainboards: 526; Untested (e.g. user vanished before testing new code): 11; Not yet supported (i.e. known-bad): 83.
|
|
1. ↑ Reported by deejkuba@aol.com to flashrom@coreboot.org, no public archive. Missing board enable and/or M50FW040 unlocking. May work now.
2. ↑ This is an OEM board used by IBM in e.g. Aptiva 2170-G
3. ↑ Used in Acer Aspire T180 and E380. Seems to be an OEM variant of abit's NF-M2S.
4. ↑ Mainboard model is 0RV30W. Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
5. ↑ This is (also?) an OEM board from FSC (used in e.g. ESPRIMO Q5010 with designation D2544-B1).
6. ↑ Used in EZ18 barebones
7. ↑ Used in the IGEL WinNET III thin client.
8. ↑ W39V040FB
9. ↑ While flashrom is working correctly, there might be problems with the firmware images themselves. Please see https://flashrom.org/pipermail/flashrom/2012-July/009600.html for details.
10. ↑ Used in ION 330HT(-BD) barebones.
11. ↑ Vendor firmware writes to flash at shutdown. This probably corrupts the flash in case you write coreboot while running the vendor firmware. Simply updating the vendor firmware should be fine.
12. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
13. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
14. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
15. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
16. ↑ No chip found, probably due to flash translation. https://flashrom.org/pipermail/flashrom/2009-August/000393.html
17. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
18. ↑ This is an OEM board from HP, the HP name is NodusM3-GL8E.
19. ↑ This is an OEM board from HP, the HP name is Nagami-GL8E.
20. ↑ Should work out of the box since r1593.
21. ↑ See http://www.coreboot.org/pipermail/coreboot/2007-October/026496.html
22. ↑ The MAC address of the onboard network card is stored in flash.
23. ↑ The image provided by ASUS is only 256 kB big and has to be written to the upper 256 kB of the 512 kB chip.
24. ↑ UEFI builds v6404 and above disable access to some parts of the flash, cf. http://www.coreboot.org/ASUS_F2A85-M#UEFI_builds_that_allow_flash_chip_access
25. ↑ If the machine doesn't come up again after flashing, try resetting the NVRAM(CMOS). The MAC address of the onboard network card will change to the value stored in the new image, so backup the old address first. See https://flashrom.org/pipermail/flashrom/2009-November/000879.html
26. ↑ The MAC address of the onboard LAN NIC is stored in flash, hence overwritten by flashrom; see https://flashrom.org/pipermail/flashrom/2012-May/009200.html
27. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
28. ↑ No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now.
29. ↑ No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now.
30. ↑ Untested board enable.
31. ↑ Owned by Uwe Hermann <uwe@hermann-uwe.de>.
32. ↑ Part of ASUS Terminator P4 533 barebone system
33. ↑ Reported by Bernhard M. Wiedemann <bernhard@uml12d.zq1.de> to flashrom@coreboot.org, no public archive. Missing board enable and/or SST49LF008A unlocking. May work now.
34. ↑ Used in RS120-E5/PA2 servers.
35. ↑ This is an OEM board from FSC. Although flashrom supports it and can probably not distinguish it from the P5GD1-VM, please note that the P5GD1-VM BIOS does not support the FSC variants completely.
36. ↑ Untested board enable.
37. ↑ Untested board enable.
38. ↑ Found in V3-P5G31.
39. ↑ Found in ASUS Vintage-PH2 barebones.
40. ↑ This is an OEM board from HP.
41. ↑ This is an OEM board from Epson (e.g. Endeavor MT7700).
42. ↑ This designation is used for OEM boards from HP, Epson and maybe others. The HP names vary and not all of them have been tested yet. Please report any success or failure, thanks.
43. ↑ Untested board enable.
44. ↑ The MAC address of the onboard LAN NIC is stored in flash, hence overwritten by flashrom; see https://flashrom.org/pipermail/flashrom/2012-March/009014.html
45. ↑ flashrom works correctly, but GbE LAN is nonworking (probably due to a missing/bogus MAC address; see https://flashrom.org/pipermail/flashrom/2011-July/007432.html and http://ubuntuforums.org/showthread.php?t=1534389 for a possible workaround)
46. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
47. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
48. ↑ Probing works (2x 8192 kB via hwseq), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
49. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
50. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
51. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
52. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
53. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
54. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
55. ↑ Warning: MAC address of LOM is stored at 0x1000 - 0x1005 of the image.
56. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
57. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
58. ↑ Warning: MAC address of LOM is stored at 0x1000 - 0x1005 of the image.
59. ↑ The MAC address of the onboard network card is stored in flash.
60. ↑ Untested board enable.
61. ↑ Used in the IGEL-316 thin client.
62. ↑ Probing works (Eon EN25Q32(A/B), 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
63. ↑ Probing works (Eon EN25Q32(A/B), 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
64. ↑ No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now.
65. ↑ Reported by Mark Robinson <mark@zl2tod.net> to flashrom@coreboot.org, no public archive. Missing board enable and/or F29C51002T unlocking. May work now.
66. ↑ Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
67. ↑ Mainboard model is 0KRC95. Probing works (Hardware Sequencing 4 + 8MB), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
68. ↑ Mainboard model is 0HYFFG. Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked (and there are even overlapping PRs).
69. ↑ Mainboard model is 0Y2MRG. Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
70. ↑ Probably needs a board enable. http://www.coreboot.org/pipermail/coreboot/2009-May/048549.html
71. ↑ Untested board enable.
72. ↑ Missing board enable (W83627HF/F/HG/G), see https://flashrom.org/pipermail/flashrom/2012-April/009043.html
73. ↑ No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. Seems the PCI subsystem IDs are identical with the Tekram P6Pro-A5. May work now.
74. ↑ Needs the MFG jumper to be set correctly before flashing to enable the Flash Descriptor Override Strap.
75. ↑ Probing works (Hardware sequencing, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
76. ↑ Used in ESPRIMO E5625.
77. ↑ Used in ESPRIMO P2560, contains an Atmel AT26DF081A.
78. ↑ Mainboard model is D3062-A1. Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
79. ↑ Mainboard model is D2312-A2.
80. ↑ Works fine if you remove jumper JP9 on the board and disable the flash protection BIOS option.
81. ↑ This is an OEM board used by Fujitsu.
82. ↑ Primary flash chip is a Macronix MX25L3206E.
83. ↑ 8 MB (ME) + 1 MB (BIOS) flash chips - hardware sequencing required.
84. ↑ Does only work with -p internal:ich_spi_mode=hwseq due to an evil twin of MX25L6405 and ICH SPI lockdown.
85. ↑ Contains a Macronix MX25L6406E.
86. ↑ Uses MX25L6436E and requires a small patch (but works flawlessly with that).
87. ↑ SPI lock down, PR, read-only descriptor, locked ME region.
88. ↑ Found in HP Pavilion Slimline s5220f.
89. ↑ ICH9DO with SPI lock down, BIOS lock, PR, read-only descriptor, locked ME region.
90. ↑ ICH7 with SPI lock down, BIOS lock, flash block detection (SST25VF080B); see http://paste.flashrom.org/view.php?id=686
91. ↑ No chip found, see https://flashrom.org/pipermail/flashrom/2012-March/009006.html
92. ↑ Missing board enable, see https://flashrom.org/pipermail/flashrom/2012-March/008885.html
93. ↑ Boot block is write protected unless the solder points next to F2 are shorted.
94. ↑ ICH10R with BIOS lock enable and a protected range PRBAD, see https://flashrom.org/pipermail/flashrom/2012-June/009350.html
95. ↑ SMM protection enabled
96. ↑ NM10 with SPI lock down, BIOS lock, see https://flashrom.org/pipermail/flashrom/2012-January/008600.html
97. ↑ ICH5 with BIOS lock enable, see http://paste.flashrom.org/view.php?id=775
98. ↑ Probing works (Winbond W25x32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked.
99. ↑ Probing enables Hardware Sequencing (behind that hides a SST SST25VF016B, 2048 kB). Parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked (and the platform data region seems to be bogus).
100. ↑ Probing enables Hardware Sequencing (behind that hides a SST SST25VF080B, 1024 kB). Parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked (and the platform data region seems to be bogus).
101. ↑ H61 with BIOS lock enable and locked ME region, see https://flashrom.org/pipermail/flashrom/2012-June/009417.html
102. ↑ H67 with BIOS lock enable and locked ME region, see https://flashrom.org/pipermail/flashrom/2011-September/007789.html
103. ↑ H67 with BIOS lock enable and locked ME region, see https://flashrom.org/pipermail/flashrom/2012-November/010112.html
104. ↑ BIOS locked via BIOS_CNTL.
105. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
106. ↑ Q77 with BIOS lock enable and locked ME region, see http://paste.flashrom.org/view.php?id=1603
107. ↑ Intel reference board.
108. ↑ Intel reference board.
109. ↑ Probably won't work, see http://www.coreboot.org/pipermail/flashrom/2010-July/003952.html
110. ↑ Used in ThinkCentre M75e.
111. ↑ Immediately powers off if you try to hot-plug the chip. However, this does '''not''' happen if you use coreboot. Owned by Uwe Hermann <uwe@hermann-uwe.de>.
112. ↑ This is an OEM board from HP, the HP name is Xenon.
113. ↑ Write protection must be disabled in the BIOS setup.
114. ↑ Interestingly flashrom does not work when the vendor BIOS is booted, but it ''does'' work flawlessly when the machine is booted with coreboot. Owned by Uwe Hermann <uwe@hermann-uwe.de>.
115. ↑ Uses Fintek F71882F/F71883F/F71887 SPI-to-LPC translation.
116. ↑ Some non-essential DMI data (e.g. serial numbers) is overwritten when using flashrom. This is an OEM board used by HP (e.g. dx2300 Microtower).
117. ↑ This is an OEM board used by Acer in e.g. Aspire M5640/M3640.
118. ↑ This is an OEM board used by Medion in e.g. Medion MD8833.
119. ↑ Missing board enable/SIO support (Fintek F71889), see https://flashrom.org/pipermail/flashrom/2012-March/008956.html
120. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
121. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
122. ↑ Seems to work fine basically, but user reported (hopefully unrelated) buggy behavior of the board after a firmware upgrade. See https://flashrom.org/pipermail/flashrom/2012-January/008547.html
123. ↑ Probably manufactured by ASUS
124. ↑ Used in SB61G2 systems.
125. ↑ No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now.
126. ↑ No public report found. May work now.
127. ↑ No public report found. May work now.
128. ↑ No public report found. May work now.
129. ↑ No public report found. May work now.
130. ↑ Probing works (Winbond W25Q128, 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked; SMM protection enabled.
131. ↑ Used in Dell C6100 servers.
132. ↑ Probing works (Atmel AT25DF321A, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
133. ↑ Requires unlocking the ME although the registers are set up correctly by the descriptor/BIOS already (tested with swseq and hwseq).
134. ↑ Probing works (Numonyx N25Q128 (supported by SFDP only atm), 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
135. ↑ Probing works (Numonyx N25Q128 (supported by SFDP only atm), 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
136. ↑ Probing works (Numonyx N25Q128 (supported by SFDP only atm), 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked; SMM protection enabled.
137. ↑ Probing works (Numonyx N25Q128 (supported by SFDP only atm), 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
138. ↑ Probing works (Macronix MX25L12805, 16384 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked; SMM protection enabled.
139. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
140. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
141. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
142. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
143. ↑ Both S5376G2NR and S5376WAG2NR should work.
144. ↑ Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
145. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
146. ↑ Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
Supported mobile devices (laptops, tablets etc.)
In general, flashing mobile devices is more difficult because they
- often use the flash chip for stuff besides the BIOS,
- often have special protection stuff which has to be handled by flashrom,
- often use flash translation circuits which need drivers in flashrom.
IMPORTANT: At this point we recommend to not use flashrom on untested mobile devices unless you have a means to recover from a flashing that goes wrong (a working backup flash chip and/or good soldering skills).
Total amount of known good mobile devices: 9; Untested (e.g. user vanished before testing new code): 1; Not yet supported (i.e. known-bad): 15.
|
1. ↑ http://www.coreboot.org/pipermail/coreboot/2009-May/048041.html
2. ↑ It seems the chip (25X40) is behind some SPI flash translation layer (likely in the EC, the ENE KB3310).
3. ↑ Untested board enable.
4. ↑ Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked.
5. ↑ The laptop immediately powers off if you try to hot-swap the chip. It's not yet tested if write/erase would work on this laptop.
6. ↑ Locked ME, see https://flashrom.org/pipermail/flashrom/2012-May/009197.html.
7. ↑ Locked ME, see https://flashrom.org/pipermail/flashrom/2012-June/009420.html.
8. ↑ Bootsector is locked and needs to be skipped with a layout file (writeable address range is 00000000:0003bfff).
9. ↑ SPI lock down, SMM protection, PR in BIOS region, read-only descriptor, locked ME region.
10. ↑ Shuts down when probing for a chip. https://flashrom.org/pipermail/flashrom/2010-May/003321.html
11. ↑ Hangs upon '''flashrom -V''' (needs hard power-cycle then).
12. ↑ Probing works (Winbond W25X64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block).
13. ↑ Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block).
14. ↑ Probing works (ST M25PX64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block).
15. ↑ Works fine but only with coreboot (due to locked regions and additional PR restrictions).
16. ↑ Seems to (partially) work at first, but one block/sector cannot be written which then leaves you with a bricked laptop. Maybe this can be investigated and fixed in software later.
PCI Devices
Total amount of supported PCI devices flashrom can use as a programmer: 85
| Programmer | Vendor | Device | IDs | Status |
|---|---|---|---|---|
| nic3com | 3COM | 3C90xB: PCI 10/100 Mbps; shared 10BASE-T/100BASE-TX | 10b7:9055 | OK |
| 3COM | 3C90xB: PCI 10/100 Mbps; shared 10BASE-T/100BASE-T4 | 10b7:9001 | ? | |
| 3COM | 3C90xB: PCI 10BASE-T (TPO) | 10b7:9004 | OK | |
| 3COM | 3C90xB: PCI 10BASE-T/10BASE2/AUI (COMBO) | 10b7:9005 | ? | |
| 3COM | 3C90xB: PCI 10BASE-T/10BASE2 (TPC) | 10b7:9006 | ? | |
| 3COM | 3C90xB: PCI 10BASE-FL | 10b7:900a | ? | |
| 3COM | 3C90xB: PCI 10BASE-FX | 10b7:905a | ? | |
| 3COM | 3C905B: Cyclone 10/100/BNC | 10b7:9058 | OK | |
| 3COM | 3C905C: EtherLink 10/100 PCI (TX) | 10b7:9200 | OK | |
| 3COM | 3C980C: EtherLink Server 10/100 PCI (TX) | 10b7:9805 | ? | |
| nicrealtek | Realtek | RTL8139/8139C/8139C+ | 10ec:8139 | OK |
| Realtek | RTL8169 | 10ec:8169 | ? | |
| SMC | 1211TX | 1113:1211 | OK | |
| gfxnvidia | NVIDIA | Mutara V08 [NV2] | 10de:0010 | ? |
| NVIDIA | RIVA 128 | 10de:0018 | ? | |
| NVIDIA | RIVA TNT | 10de:0020 | ? | |
| NVIDIA | RIVA TNT2/TNT2 Pro | 10de:0028 | ? | |
| NVIDIA | RIVA TNT2 Ultra | 10de:0029 | ? | |
| NVIDIA | Vanta/Vanta LT | 10de:002c | ? | |
| NVIDIA | RIVA TNT2 Model 64/Model 64 Pro | 10de:002d | OK | |
| NVIDIA | Aladdin TNT2 | 10de:00a0 | ? | |
| NVIDIA | GeForce 256 | 10de:0100 | ? | |
| NVIDIA | GeForce DDR | 10de:0101 | ? | |
| NVIDIA | Quadro | 10de:0103 | ? | |
| NVIDIA | GeForce2 MX | 10de:0110 | ? | |
| NVIDIA | GeForce2 MX | 10de:0111 | ? | |
| NVIDIA | GeForce2 GO | 10de:0112 | ? | |
| NVIDIA | Quadro2 MXR | 10de:0113 | ? | |
| NVIDIA | GeForce2 GTS/Pro | 10de:0150 | ? | |
| NVIDIA | GeForce2 GTS | 10de:0151 | ? | |
| NVIDIA | GeForce2 Ultra | 10de:0152 | ? | |
| NVIDIA | Quadro2 Pro | 10de:0153 | ? | |
| NVIDIA | GeForce 3 nFX | 10de:0200 | ? | |
| NVIDIA | GeForce 3 nFX | 10de:0201 | ? | |
| NVIDIA | GeForce 3 nFX Ultra | 10de:0202 | ? | |
| NVIDIA | Quadro 3 DDC | 10de:0203 | ? | |
| drkaiser | Dr. Kaiser | PC-Waechter (Actel FPGA) | 1803:5057 | OK |
| satasii | Silicon Image | PCI0680 Ultra ATA-133 Host Ctrl | 1095:0680 | OK |
| Silicon Image | SiI 3112 [SATALink/SATARaid] SATA Ctrl | 1095:3112 | OK | |
| Silicon Image | SiI 3114 [SATALink/SATARaid] SATA Ctrl | 1095:3114 | OK | |
| Silicon Image | SiI 3124 PCI-X SATA Ctrl | 1095:3124 | OK | |
| Silicon Image | SiI 3132 SATA Raid II Ctrl | 1095:3132 | OK | |
| Silicon Image | SiI 3512 [SATALink/SATARaid] SATA Ctrl | 1095:3512 | OK | |
| atavia | VIA | VT6421A | 1106:3249 | Dep |
| it8212 | ITE | 8212F PATA RAID | 1283:8212 | ? |
| nicintel | Intel | 8255xER/82551IT Fast Ethernet Controller | 8086:1209 | ? |
| Intel | 82557/8/9/0/1 Ethernet Pro 100 | 8086:1229 | OK | |
| nicintel_spi | Intel | 82571EB Gigabit Ethernet Controller | 8086:105e | OK |
| Intel | 82541GI Gigabit Ethernet Controller | 8086:1076 | OK | |
| Intel | 82541PI Gigabit Ethernet Controller | 8086:107c | OK | |
| Intel | 82572EI Gigabit Ethernet Controller | 8086:10b9 | OK | |
| Intel | 82574L Gigabit Ethernet Controller | 8086:10d3 | OK | |
| Intel | 82599 10 Gigabit Unprogrammed Network Controller | 8086:10d8 | ? | |
| Intel | 82599 10 Gigabit KX4 Dual Port Network Controller | 8086:10f7 | ? | |
| Intel | 82599 10 Gigabit Dual Port Backplane Controller | 8086:10f8 | ? | |
| Intel | 82599 10 Gigabit CX4 Dual Port Network Controller | 8086:10f9 | ? | |
| Intel | 82599 10-Gigabit SFI/SFP+ Network Controller | 8086:10fb | ? | |
| Intel | 82599 10 Gigabit XAUI/BX4 Dual Port Network Controller | 8086:10fc | OK | |
| Intel | 82599 10 Gigabit KR Network Controller | 8086:1517 | ? | |
| Intel | 82599 10 Gigabit TN Network Controller | 8086:151c | ? | |
| Intel | 82599 10 Gigabit Dual Port Network Controller with FCoE | 8086:1529 | ? | |
| Intel | 82599 10 Gigabit Dual Port Backplane Controller with FCoE | 8086:152a | ? | |
| Intel | 82599 10 Gigabit SFI Network Controller | 8086:1557 | ? | |
| Intel | I210 Gigabit Network Connection Unprogrammed | 8086:1531 | OK | |
| Intel | I211 Gigabit Network Connection Unprogrammed | 8086:1532 | ? | |
| Intel | I210 Gigabit Network Connection | 8086:1533 | ? | |
| Intel | I210 Gigabit Network Connection SERDES Fiber | 8086:1536 | ? | |
| Intel | I210 Gigabit Network Connection SERDES Backplane | 8086:1537 | ? | |
| Intel | I210 Gigabit Network Connection SGMII | 8086:1538 | ? | |
| Intel | I211 Gigabit Network Connection | 8086:1539 | ? | |
| nicintel_eeprom | Intel | 82580 Quad Gigabit Ethernet Controller (Copper) | 8086:150e | OK |
| Intel | 82580 Quad Gigabit Ethernet Controller (Fiber) | 8086:150f | ? | |
| Intel | 82580 Quad Gigabit Ethernet Controller (Backplane) | 8086:1510 | ? | |
| Intel | 82580 Quad Gigabit Ethernet Controller (Ext. PHY) | 8086:1511 | ? | |
| Intel | 82580 Dual Gigabit Ethernet Controller (Copper) | 8086:1511 | ? | |
| Intel | Unprogrammed 82580 Quad/Dual Gigabit Ethernet Controller | 8086:1509 | OK | |
| Intel | I210 Gigabit Network Connection Unprogrammed | 8086:1531 | ? | |
| Intel | I211 Gigabit Network Connection Unprogrammed | 8086:1532 | ? | |
| Intel | I210 Gigabit Network Connection | 8086:1533 | OK | |
| Intel | I210 Gigabit Network Connection SERDES Fiber | 8086:1536 | ? | |
| Intel | I210 Gigabit Network Connection SERDES Backplane | 8086:1537 | ? | |
| Intel | I210 Gigabit Network Connection SGMII | 8086:1538 | ? | |
| Intel | I211 Gigabit Network Connection | 8086:1539 | ? | |
| ogp_spi | Open Graphics Project | Development Board OGD1 | 1227:0000 | OK |
| satamv | Marvell | 88SX7042 PCI-e 4-port SATA-II | 11ab:7042 | OK |
USB Devices
Total amount of supported USB devices flashrom can use as a programmer: 6
| Programmer | Vendor | Device | IDs | Status |
|---|---|---|---|---|
| dediprog | Dediprog | SF100/SF200/SF600 | 0483:dada | OK |
| developerbox | Silicon Labs | CP2102N USB to UART Bridge Controller | 10c4:ea60 | OK |
| pickit2_spi | Microchip | PICkit 2 | 04d8:0033 | OK |
| ch341a_spi | Winchiphead (WCH) | CH341A | 1a86:5512 | OK |
| digilent_spi | Digilent | Development board JTAG | 1443:0007 | OK |
| stlinkv3_spi | STMicroelectronics | STLINK-V3 | 0483:374f | OK |
Other programmers
| Programmer | Note |
|---|---|
| dummy | Dummy device, does nothing and logs all accesses |
| mec1308 | Microchip MEC1308 Embedded Controller. |
| serprog | All programmer devices speaking the serprog protocol |
| buspirate_spi | Dangerous Prototypes Bus Pirate |
| ene_lpc | ENE LPC interface keyboard controller |
| rayer_spi | RayeR parallel port programmer |
| pony_spi | Programmers compatible with SI-Prog, serbang or AJAWe |
| linux_mtd | Device files /dev/mtd* |
| linux_spi | Device files /dev/spidev*.* |
Download & installation
You can browse the flashrom source code online, or download and install flashrom as explained below.
Requirements:
- pciutils development package (pciutils-dev/libpci-dev/pciutils-devel, depending on OS/distribution)
- zlib development package (zlib1g-dev/zlib-devel, depending on OS/distribution)
- libftdi development package (libftdi-dev), optional support for the external FT2232SPI flasher.
- subversion (if you checkout the source and build manually)
Manual installation from source:
If you just want to use the latest release, download flashrom 0.9.1 (source) here (sig).
If you want the latest source code (for developers), check out our code from subversion:
$ svn co svn://coreboot.org/flashrom/trunk flashrom $ cd flashrom $ make $ sudo make install
Binary packages:
- Debian: sudo aptitude install flashrom
- Ubuntu: sudo aptitude install flashrom
- Fedora: sudo yum install flashrom
- Gentoo: emerge flashrom
- Mandriva: urpmi flashrom
- openSUSE: yast -i coreboot-utils
- For distributions older than openSUSE Factory (11.0) you find "backports" in the openSUSE Build Service.
- T2 SDE
- Installation from source: Emerge-Pkg flashrom
- Installation of binaries: mine -i flashrom-0.9.0.tar.bz2
- FreeBSD: cd /usr/ports/sysutils/flashrom && make install clean
- Windows: There is a Windows port of the flashrom utility. Download the latest version: DarmawanMappatutu_Salihun.tar.gz.
Releases:
FAQ / Troubleshooting
Q: flashrom doesn't seem to work on my board, what can I do?
- First of all, check if your chipset, ROM chip, and mainboard are supported (see tables above, or use flashrom -L).
- If your board has a jumper for BIOS flash protection (check the manual), disable it.
- Should your BIOS menu have a BIOS flash protection option, disable it.
- If you run flashrom on a Linux system with kernels >= 2.6.27 there are two issues you have to check:
- TODO: X86_PAT and nopat
- TODO: CONFIG_STRICT_DEVMEM
- See this page for instructions on how to test flashrom support properly (this may be risky, make sure you have a working backup flash chip).
Q: How do I use flashrom?
Please see the flashrom(8) manpage.
Q: Is there a flashrom Live CD?
See Flashrom/Live CD.
Flash chip overview
Modern mainboards store the BIOS in a reprogrammable flash chip. There are hundreds of different flash (EEPROM) chips, with variables such as memory size, speed, communication bus (Parallel, LPC, FWH, SPI) and packaging to name just a few.
Packaging/housing/form factor
Probably the only property of flash chips which is completely irrelevant to flashrom. The BIOS copyright holders often place a fancy sticker on the BIOS chip showing a name or logo, BIOS version, serial number and copyright notice (all of which is also irrelevant for flashrom).
DIP32: Dual In-line Package, 32 pins
-
DIP32 top
-
DIP32 bottom
-
DIP32 in a socket
-
DIP32 socket
-
DIP32 extractor tool
A rectangular black plastic block with 16 pins along each of the two longer sides of the package (32 pins in total). DIP32 chips can be socketed which means they are detachable from the mainboard using physical force. Since they haven't been moved in and out of the socket very much (yet, hehe) they can appear to be quite difficult to release from the socket. One way to remove a DIP32 chip from a socket is by prying a thin screwdriver in between the plastic package and the socket, along the shorter sides where there are no pins, and then gently bending the screwdriver to push the chip upwards, away from the mainboard. Alternate between the two sides to avoid bending the pins, and don't touch any of the pins with the screwdriver (see FAQ about ESD, electro-static discharge). If the chip is soldered directly to the mainboard, it has to be desoldered in order to be reprogrammed outside the mainboard. If you do this, it's a good idea to solder a socket to the mainboard instead, to ease any future experiments.
PLCC32: Plastic Leaded Chip Carrier, 32 pins
-
PLCC32 top
-
PLCC32 bottom
-
PLCC32 in a socket
-
PLCC32 socket
-
Soldered PLCC32
-
Two soldered PLCC32
-
PLCC32 Bios Savior
-
PLCC32 Top-Hat-Flash adapter
-
PLCC32 pushpin trick
-
PLCC extractor tool
Black plastic block again, but this one is much more square. PLCC32 was becoming the standard for mainboards after DIP32 chips because of its smaller physical size. PLCC can also be socketed or soldered directly to the mainboard. Socketed PLCC32 chips can be removed using a special PLCC removal tool, or using a piece of nylon line tied in a loop around the chip and pulled swiftly straight up, or bending/prying using small screwdrivers if one is careful. PLCC32 sockets are often fragile so the screwdriver approach is not recommended. While the nylon line method sounds strange it works well. Desoldering PLCC32 chips and soldering on a socket can be done using either a desoldering station or even just a heat gun. You can also cut the chip with a sharp knife, but it will be destroyed in the process, of course.
DIP8: Dual In-line Package, 8 pins
-
DIP8 top
-
DIP8 bottom
-
DIP8 in a socket
-
DIP8 socket
Most recent boards use DIP8 chips (which always employ the SPI protocol) or SO8/SOIC8 chips (see below). DIP8 chips are always socketed, and can thus be easily removed (and hot-swapped), for example using a small screwdriver. This allows for relatively simple recovery in case of an incorrectly flashed chip.
SO8/SOIC8: Small-Outline Integrated Circuit, 8 pins
-
Soldered SOIC8
-
SOIC8 adapter
Similarly to the DIP8 chips, these are always use the SPI protocol. However, SO8/SOIC8 chips are always soldered onto the board directly.
TSOP: Thin Small-Outline Package, 32, 40, or 48 pins
-
Soldered TSOP40
-
Soldered TSOP48
TSOPs are often used in embedded systems where size is important and there is no need for replacement in the field. It is possible to (de)solder TSOPs by hand, but it's not trivial and a reasonable amount of soldering skills are required.
Communication bus protocol
There are four major communication bus protocols for flash chips, each with multiple subtle variants in the command set:
- Parallel: The oldest flash bus, phased out on mainboards around 2002.
- LPC: Low Pin Count, a standard introduced ca. 1998.
- FWH: Firmware Hub, a variant of the LPC standard introduced at the same time. FWH is a special case variant of LPC with one bit set differently in the memory read/write commands. That means some data sheets mention the chips speak LPC although they will not respond to regular LPC read/write cycles.
- SPI: Serial Peripheral Interface, introduced ca. 2006.
Here's an attempt to create a marketing language -> chip type mapping:
- JEDEC Flash -> Parallel (well, mostly)
- FWH -> FWH
- Firmware Hub -> FWH
- LPC Firmware -> FWH
- Firmware Memory -> FWH
- Low Pin Count (if Firmware/FWH is not mentioned) -> LPC
- LPC (if Firmware is not mentioned) -> LPC
- Serial Flash -> SPI
SST data sheets have the following conventions:
- LPC Memory Read -> LPC
- Firmware Memory Read -> FWH
If both are mentioned, the chip supports both.
If you're not sure about whether a device is LPC or FWH, look at the read/write cycle definitions.
| Clock Cycle | Field Name | Field contents | Comments |
|---|---|---|---|
| 1 | START | 1101/1110 | 1101 for READ, 1110 for WRITE. |
| 2 | IDSEL | 0000 to 1111 | IDSEL value to be shifted out to the chip. |
| 3-9 | IMADDR | YYYY | The address to be read/written. 7 cycles total == 28 bits. |
| 10+ | ... | ... | ... |
| Clock Cycle | Field Name | Field contents | Comments |
|---|---|---|---|
| 1 | START | 0000 | ... |
| 2 | CYCLETYPE+DIRECTION | 010X/011X | 010X for READ, 011X for WRITE. X means "reserved". |
| 3-10 | ADDRESS | YYYY | The address to be read/written. 8 cycles total == 32 bits. |
| 11+ | ... | ... | ... |
Generally, a parallel flash chip will not speak any other protocols. SPI flash chips also don't speak any other protocols. LPC flash chips sometimes speak FWH as well and vice versa, but they will not speak any protocols besides LPC/FWH.
External flashers/programmers
Silicon Image (SiI) SATA/IDE controllers:
Flashrom supports some SiI SATA controllers to reflash the flash attached to these controller cards, but it is also possible to use these cards to reflash other chips which fit in there electrically. Please note that the small number of address lines connected to the chip may make accessing large chips impossible.
3Com network cards:
Flashrom supports some 3Com network cards to reflash the flash attached to these cards, but it is also possible to use these cards to reflash other chips which fit in there electrically. Please note that the small number of address lines connected to the chip may make accessing large chips impossible.
FTDI FT2232H/FT4232H-based USB-to-serial controllers:
Flashrom supports usage of external FTDI FT2232H/FT4232H-based USB-to-serial controllers as SPI flashers.
Useful information
Random notes
Flash chip handling is still mostly a black art, so we've collected useful snippets from email and IRC conversations on our Random notes page:
- What numbers do FWH/LPC chips tend to start with?
- Dirty little secrets why chips are not found although the chipset and the chip are supported
- Patch submission
- Command set secrets
- Writing or reusing a probe function
- flashchips.c rules
- Finding GPIOs for board enable routines
Open development
We welcome contributions from every human being, corporate entity or club.
If you want to contribute patches or test reports, please send them to our flashrom mailing list. For one-off test reports, you don't have to subscribe, but if you want to contribute patches, we strongly recommend you subscribe to our mailing list to make communication easier.
Flashrom development is volunteer-driven, and our developers tackle the features they're interested in. Most developers have pretty long personal TODO lists, so if you want to suggest a feature, please make sure you have all the datasheets and/or programming guides needed for that feature (preferably without NDA). For testing, our developers usually need physical access to the hardware in question. It also helps to be friendly to the developers.
Paid support/development
Some companies and individual developers offer paid flashrom support and development if you desire a particular feature nobody is working on.
Donations
We've been asked repeatedly about a way to donate to the flashrom project. Donations are a great way to show your appreciation for the project (and it may have saved you loads of money for dedicated flash programmer devices). Since this usually involves a lot of paperwork, we're not accepting donations to the project (yet).
Many of our developers do appreciate flashrom related hardware donations, though.
In the meantime, we ask you to spread the word about flashrom to your friends, to colleagues at work, to the local computer user group and to the readers of your blog.