Flashrom

flashrom is a utility for identifying, reading, writing, verifying and erasing flash chips. It's often used to flash BIOS/EFI/coreboot/firmware images.

• Supports more than 195 flash chips, 75 chipsets, 130 mainboards, and 17 devices (PCI or USB) which can be used as external programmers.
• Supports parallel, LPC, FWH and SPI flash interfaces and various chip packages (DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32, TSOP40, TSOP48, and more)
• No physical access needed, root access is sufficient.
• No bootable floppy disk, bootable CD-ROM or other media needed.
• No keyboard or monitor needed. Simply reflash remotely via SSH.
• No instant reboot needed. Reflash your chip in a running system, verify it, be happy. The new firmware will be present next time you boot.
• Crossflashing and hotflashing is possible as long as the flash chips are electrically and logically compatible (same protocol). Great for recovery.
• Scriptability. Reflash a whole pool of identical machines at the same time from the command line. It is recommended to check flashrom output and error codes.
• Speed. flashrom is often much faster than most vendor flash tools.
• Portability. Supports Linux, FreeBSD, DragonFly BSD, Solaris, Mac OS X, and other Unix-like OSes.

Emergency help

IMPORTANT: If something went wrong during flashing, do NOT turn off/reboot your computer. Instead, let us help you recover. We can be contacted via IRC (#flashrom on irc.freenode.net) or email. Please allow for a few hours until someone responds on IRC, we're all volunteers.

Supported hardware

See Supported hardware.

Download & installation

See Downloads.

FAQ / Troubleshooting

Q: flashrom doesn't seem to work on my board, what can I do?

• First of all, check if your chipset, ROM chip, and mainboard are supported (see tables above, or use flashrom -L).
• If your board has a jumper for BIOS flash protection (check the manual), disable it.
• Should your BIOS menu have a BIOS flash protection option, disable it.
• If you run flashrom on a Linux system with kernels >= 2.6.27 there are two issues you have to check:
  • TODO: X86_PAT and nopat
  • TODO: CONFIG_STRICT_DEVMEM
• See this page for instructions on how to test flashrom support properly (this may be risky, make sure you have a working backup flash chip).

Q: How do I use flashrom?

Please see the flashrom(8) manpage.

Q: Is there a flashrom Live CD?

See Flashrom/Live CD.

Flash chip overview

Modern mainboards store the BIOS in a reprogrammable flash chip. There are hundreds of different flash (EEPROM) chips, with variables such as memory size, speed, communication bus (Parallel, LPC, FWH, SPI) and packaging to name just a few.

Packaging/housing/form factor

Probably the only property of flash chips which is completely irrelevant to flashrom. The BIOS copyright holders often place a fancy sticker on the BIOS chip showing a name or logo, BIOS version, serial number and copyright notice (all of which is also irrelevant for flashrom).

DIP32: Dual In-line Package, 32 pins

• 

  DIP32 top

• 

  DIP32 bottom

• 

  DIP32 in a socket

• 

  DIP32 socket

• 

  DIP32 extractor tool

A rectangular black plastic block with 16 pins along each of the two longer sides of the package (32 pins in total). DIP32 chips can be socketed which means they are detachable from the mainboard using physical force. Since they haven't been moved in and out of the socket very much (yet, hehe) they can appear to be quite difficult to release from the socket. One way to remove a DIP32 chip from a socket is by prying a thin screwdriver in between the plastic package and the socket, along the shorter sides where there are no pins, and then gently bending the screwdriver to push the chip upwards, away from the mainboard. Alternate between the two sides to avoid bending the pins, and don't touch any of the pins with the screwdriver (see FAQ about ESD, electro-static discharge). If the chip is soldered directly to the mainboard, it has to be desoldered in order to be reprogrammed outside the mainboard. If you do this, it's a good idea to solder a socket to the mainboard instead, to ease any future experiments.

PLCC32: Plastic Leaded Chip Carrier, 32 pins

• 

  PLCC32 top

• 

  PLCC32 bottom

• 

  PLCC32 in a socket

• 

  PLCC32 socket

• 

  Soldered PLCC32

• 

  Two soldered PLCC32

• 

  PLCC32 Bios Savior

• 

  PLCC32 Top-Hat-Flash adapter

• 

  PLCC32 pushpin trick

• 

  PLCC extractor tool

Black plastic block again, but this one is much more square. PLCC32 was becoming the standard for mainboards after DIP32 chips because of its smaller physical size. PLCC can also be socketed or soldered directly to the mainboard. Socketed PLCC32 chips can be removed using a special PLCC removal tool, or using a piece of nylon line tied in a loop around the chip and pulled swiftly straight up, or bending/prying using small screwdrivers if one is careful. PLCC32 sockets are often fragile so the screwdriver approach is not recommended. While the nylon line method sounds strange it works well. Desoldering PLCC32 chips and soldering on a socket be done] using either a desoldering station or even just a heat gun. You can also cut the chip with a sharp knife, but it will be destroyed in the process, of course.

DIP8: Dual In-line Package, 8 pins

• 

  DIP8 top

• 

  DIP8 bottom

• 

  DIP8 in a socket

• 

  DIP8 socket

Most recent boards use DIP8 chips (which always employ the SPI protocol) or SO8/SOIC8 chips (see below). DIP8 chips are always socketed, and can thus be easily removed (and hot-swapped), for example using a small screwdriver. This allows for relatively simple recovery in case of an incorrectly flashed chip.

SO8/SOIC8: Small-Outline Integrated Circuit, 8 pins

• 

  Soldered SOIC8

• 

  SOIC8 adapter

Similarly to the DIP8 chips, these are always use the SPI protocol. However, SO8/SOIC8 chips are always soldered onto the board directly.

TSOP: Thin Small-Outline Package, 32, 40, or 48 pins

• 

  Soldered TSOP40

• 

  Soldered TSOP48

TSOPs are often used in embedded systems where size is important and there is no need for replacement in the field. It is possible to (de)solder TSOPs by hand, but it's not trivial and a reasonable amount of soldering skills are required.

Communication bus protocol

There are four major communication bus protocols for flash chips, each with multiple subtle variants in the command set:

• Parallel: The oldest flash bus, phased out on mainboards around 2002.
• LPC: Low Pin Count, a standard introduced ca. 1998.
• FWH: Firmware Hub, a variant of the LPC standard introduced at the same time. FWH is a special case variant of LPC with one bit set differently in the memory read/write commands. That means some data sheets mention the chips speak LPC although they will not respond to regular LPC read/write cycles.
• SPI: Serial Peripheral Interface, introduced ca. 2006.

Here's an attempt to create a marketing language -> chip type mapping:

• JEDEC Flash -> Parallel (well, mostly)
• FWH -> FWH
• Firmware Hub -> FWH
• LPC Firmware -> FWH
• Firmware Memory -> FWH
• Low Pin Count (if Firmware/FWH is not mentioned) -> LPC
• LPC (if Firmware is not mentioned) -> LPC
• Serial Flash -> SPI

SST data sheets have the following conventions:

• LPC Memory Read -> LPC
• Firmware Memory Read -> FWH

If both are mentioned, the chip supports both.

If you're not sure about whether a device is LPC or FWH, look at the read/write cycle definitions.

FWH

Clock Cycle	Field Name	Field contents	Comments
1	START	1101/1110	1101 for READ, 1110 for WRITE.
2	IDSEL	0000 to 1111	IDSEL value to be shifted out to the chip.
3-9	IMADDR	YYYY	The address to be read/written. 7 cycles total == 28 bits.
10+	...	...	...

LPC

Clock Cycle	Field Name	Field contents	Comments
1	START	0000	...
2	CYCLETYPE+DIRECTION	010X/011X	010X for READ, 011X for WRITE. X means "reserved".
3-10	ADDRESS	YYYY	The address to be read/written. 8 cycles total == 32 bits.
11+	...	...	...

Generally, a parallel flash chip will not speak any other protocols. SPI flash chips also don't speak any other protocols. LPC flash chips sometimes speak FWH as well and vice versa, but they will not speak any protocols besides LPC/FWH.

External flashers/programmers

Silicon Image (SiI) SATA/IDE controllers:

Flashrom supports some SiI SATA controllers to reflash the flash attached to these controller cards, but it is also possible to use these cards to reflash other chips which fit in there electrically. Please note that the small number of address lines connected to the chip may make accessing large chips impossible.

3Com network cards:

Flashrom supports some 3Com network cards to reflash the flash attached to these cards, but it is also possible to use these cards to reflash other chips which fit in there electrically. Please note that the small number of address lines connected to the chip may make accessing large chips impossible.

FTDI FT2232H/FT4232H-based USB-to-serial controllers:

Flashrom supports usage of external FTDI FT2232H/FT4232H-based USB-to-serial controllers as SPI flashers.

Useful information

Random notes

Flash chip handling is still mostly a black art, so we've collected useful snippets from email and IRC conversations on our Random notes page:

• What numbers do FWH/LPC chips tend to start with?
• Dirty little secrets why chips are not found although the chipset and the chip are supported
• Patch submission
• Command set secrets
• Writing or reusing a probe function
• flashchips.c rules
• Finding GPIOs for board enable routines

Open development

We welcome contributions from every human being, corporate entity or club.

If you want to contribute patches or test reports, please send them to our flashrom mailing list. For one-off test reports, you don't have to subscribe, but if you want to contribute patches, we strongly recommend you subscribe to our mailing list to make communication easier.

Flashrom development is volunteer-driven, and our developers tackle the features they're interested in. Most developers have pretty long personal TODO lists, so if you want to suggest a feature, please make sure you have all the datasheets and/or programming guides needed for that feature (preferably without NDA). For testing, our developers usually need physical access to the hardware in question. It also helps to be friendly to the developers.

Paid support/development

Some companies and individual developers offer paid flashrom support and development if you desire a particular feature nobody is working on.

Donations

We've been asked repeatedly about a way to donate to the flashrom project. Donations are a great way to show your appreciation for the project (and it may have saved you loads of money for dedicated flash programmer devices). Since this usually involves a lot of paperwork, we're not accepting donations to the project (yet).

Many of our developers do appreciate flashrom related hardware donations, though.

In the meantime, we ask you to spread the word about flashrom to your friends, to colleagues at work, to the local computer user group and to the readers of your blog.