flashrom.8 28.8 KB
Newer Older
Stefan Tauner's avatar
Stefan Tauner committed
1
.TH FLASHROM 8 "Feb 15, 2012"
2
.SH NAME
3
flashrom \- detect, read, write, verify and erase flash chips
4
.SH SYNOPSIS
5 6 7
.B flashrom \fR[\fB\-n\fR] [\fB\-V\fR] [\fB\-f\fR] [\fB\-h\fR|\fB\-R\fR|\
\fB\-L\fR|\fB\-z\fR|\fB\-E\fR|\fB\-r\fR <file>|\fB\-w\fR <file>|\
\fB\-v\fR <file>]
8
         [\fB\-c\fR <chipname>] \
9 10
[\fB\-l\fR <file>]
         [\fB\-i\fR <image>] [\fB\-p\fR <programmername>[:<parameters>]]
11 12
.SH DESCRIPTION
.B flashrom
13
is a utility for detecting, reading, writing, verifying and erasing flash
14
chips. It's often used to flash BIOS/EFI/coreboot/firmware images in-system
15 16 17 18
using a supported mainboard. However, it also supports various external
PCI/USB/parallel-port/serial-port based devices which can program flash chips,
including some network cards (NICs), SATA/IDE controller cards, graphics cards,
the Bus Pirate device, various FTDI FT2232/FT4232H based USB devices, and more.
Uwe Hermann's avatar
Uwe Hermann committed
19
.PP
20
It supports a wide range of DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32, TSOP40,
21 22
TSOP48, and BGA chips, which use various protocols such as LPC, FWH,
parallel flash, or SPI.
23
.SH OPTIONS
24
.B IMPORTANT:
25 26
Please note that the command line interface for flashrom will change before
flashrom 1.0. Do not use flashrom in scripts or other automated tools without
27
checking that your flashrom version won't interpret options in a different way.
28
.PP
29 30 31
You can specify one of
.BR \-h ", " \-R ", " \-L ", " \-z ", " \-E ", " \-r ", " \-w ", " \-v
or no operation.
32
If no operation is specified, flashrom will only probe for flash chips. It is
33
recommended that if you try flashrom the first time on a system, you run it
34
in probe-only mode and check the output. Also you are advised to make a
35 36 37
backup of your current ROM contents with
.B \-r
before you try to write a new image.
38
.TP
Uwe Hermann's avatar
Uwe Hermann committed
39 40 41
.B "\-r, \-\-read <file>"
Read flash ROM contents and save them into the given
.BR <file> .
42
If the file already exists, it will be overwritten.
43
.TP
Uwe Hermann's avatar
Uwe Hermann committed
44
.B "\-w, \-\-write <file>"
45 46
Write
.B <file>
47 48 49
into flash ROM. This will first automatically
.B erase
the chip, then write to it.
50 51 52 53 54 55 56
.sp
In the process the chip is also read several times. First an in-memory backup
is made for disaster recovery and to be able to skip regions that are
already equal to the image file. This copy is updated along with the write
operation. In case of erase errors it is even re-read completely. After
writing has finished and if verification is enabled, the whole flash chip is
read out and compared with the input image.
57
.TP
58
.B "\-n, \-\-noverify"
59
Skip the automatic verification of flash ROM contents after writing. Using this
60 61
option is
.B not
62
recommended, you should only use it if you know what you are doing and if you
63 64 65
feel that the time for verification takes too long.
.sp
Typical usage is:
66
.B "flashrom \-n \-w <file>"
67 68 69 70
.sp
This option is only useful in combination with
.BR \-\-write .
.TP
Uwe Hermann's avatar
Uwe Hermann committed
71 72 73
.B "\-v, \-\-verify <file>"
Verify the flash ROM contents against the given
.BR <file> .
74
.TP
75
.B "\-E, \-\-erase"
Uwe Hermann's avatar
Uwe Hermann committed
76
Erase the flash ROM chip.
77
.TP
78
.B "\-V, \-\-verbose"
79
More verbose output. This option can be supplied multiple times
Stefan Tauner's avatar
Stefan Tauner committed
80 81
(max. 3 times, i.e.
.BR \-VVV )
82
for even more debug output.
83
.TP
84
.B "\-c, \-\-chip" <chipname>
85
Probe only for the specified flash ROM chip. This option takes the chip name as
86 87
printed by
.B "flashrom \-L"
88 89
without the vendor name as parameter. Please note that the chip name is
case sensitive.
90 91
.TP
.B "\-f, \-\-force"
92
Force one or more of the following actions:
93
.sp
94 95
* Force chip read and pretend the chip is there.
.sp
96
* Force chip access even if the chip is bigger than the maximum supported \
97
size for the flash bus.
98 99 100 101
.sp
* Force erase even if erase is known bad.
.sp
* Force write even if write is known bad.
102 103 104 105
.TP
.B "\-l, \-\-layout <file>"
Read ROM layout from
.BR <file> .
106 107 108 109 110 111 112 113 114 115 116 117 118 119
.sp
flashrom supports ROM layouts. This allows you to flash certain parts of
the flash chip only. A ROM layout file looks like follows:
.sp
  00000000:00008fff gfxrom
  00009000:0003ffff normal
  00040000:0007ffff fallback
.sp
  i.e.:
  startaddr:endaddr name
.sp
All addresses are offsets within the file, not absolute addresses!
If you only want to update the normal image in a ROM you can say:
.sp
120
.B "  flashrom \-\-layout rom.layout \-\-image normal \-w agami_aruma.rom"
121 122 123
.sp
To update normal and fallback but leave the VGA BIOS alone, say:
.sp
124
.B "  flashrom \-l rom.layout \-i normal \"
125
.br
126
.B "           \-i fallback \-w agami_aruma.rom"
127 128
.sp
Currently overlapping sections are not supported.
129
.TP
Uwe Hermann's avatar
Uwe Hermann committed
130
.B "\-i, \-\-image <name>"
Uwe Hermann's avatar
Uwe Hermann committed
131 132 133
Only flash image
.B <name>
from flash layout.
134
.TP
135
.B "\-L, \-\-list\-supported"
136 137
List the flash chips, chipsets, mainboards, and external programmers
(including PCI, USB, parallel port, and serial port based devices)
138 139 140 141
supported by flashrom.
.sp
There are many unlisted boards which will work out of the box, without
special support in flashrom. Please let us know if you can verify that
142 143 144 145
other boards work or do not work out of the box.
.sp
.B IMPORTANT:
For verification you have
146 147
to test an ERASE and/or WRITE operation, so make sure you only do that
if you have proper means to recover from failure!
148
.TP
149 150 151 152
.B "\-z, \-\-list\-supported-wiki"
Same as
.BR \-\-list\-supported ,
but outputs the supported hardware in MediaWiki syntax, so that it can be
153 154 155
easily pasted into the wiki page at
.BR http://www.flashrom.org/ .
Please note that MediaWiki output is not compiled in by default.
156
.TP
157
.B "\-p, \-\-programmer <name>[:parameter[,parameter[,parameter]]]"
158 159
Specify the programmer device. Currently supported are:
.sp
160 161
.BR "* internal" " (default, for in-system flashing in the mainboard)"
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
162
.BR "* dummy" " (virtual programmer for testing flashrom)"
163
.sp
164 165
.BR "* nic3com" " (for flash ROMs on 3COM network cards)"
.sp
Uwe Hermann's avatar
Uwe Hermann committed
166 167 168 169
.BR "* nicrealtek" " (for flash ROMs on Realtek network cards)"
.sp
.BR "* nicsmc1211" " (for flash ROMs on RTL8139-compatible SMC2 network cards)"
.sp
170 171 172
.BR "* nicnatsemi" " (for flash ROMs on National Semiconductor DP838* network \
cards)"
.sp
173
.BR "* nicintel" " (for parallel flash ROMs on Intel 10/100Mbit network cards)
Uwe Hermann's avatar
Uwe Hermann committed
174
.sp
175 176
.BR "* gfxnvidia" " (for flash ROMs on NVIDIA graphics cards)"
.sp
177 178
.BR "* drkaiser" " (for flash ROMs on Dr. Kaiser PC-Waechter PCI cards)"
.sp
179 180
.BR "* satasii" " (for flash ROMs on Silicon Image SATA/IDE controllers)"
.sp
Uwe Hermann's avatar
Uwe Hermann committed
181 182
.BR "* satamv" " (for flash ROMs on Marvell SATA controllers)"
.sp
183 184
.BR "* atahpt" " (for flash ROMs on Highpoint ATA/RAID controllers)"
.sp
185
.BR "* ft2232_spi" " (for SPI flash ROMs attached to an FT2232/FT4232H family \
186 187
based USB SPI programmer), including the DLP Design DLP-USB1232H, \
FTDI FT2232H Mini-Module, FTDI FT4232H Mini-Module, openbiosprog-spi, Amontec \
188
JTAGkey/JTAGkey-tiny/JTAGkey-2, Dangerous Prototypes Bus Blaster, \
189 190
Olimex ARM-USB-TINY/-H, Olimex ARM-USB-OCD/-H, TIAO/DIYGADGET USB
Multi-Protocol Adapter (TUMPA), and GOEPEL PicoTAP.
191
.sp
192 193 194 195
.BR "* serprog" " (for flash ROMs attached to a programmer speaking serprog), \
including AVR flasher by Urja Rannikko, AVR flasher by eightdot, \
Arduino Mega flasher by fritz, InSystemFlasher by Juhana Helovuo, and \
atmegaXXu2-flasher by Stefan Tauner."
196
.sp
197
.BR "* buspirate_spi" " (for SPI flash ROMs attached to a Bus Pirate)"
198
.sp
199 200
.BR "* dediprog" " (for SPI flash ROMs attached to a Dediprog SF100)"
.sp
201 202
.BR "* rayer_spi" " (for SPI flash ROMs attached to a RayeR parport "
or Xilinx DLC5 compatible cable)
203
.sp
204 205 206
.BR "* pony_spi" " (for SPI flash ROMs attached to a SI-Prog serial port "
bitbanging adapter)
.sp
207
.BR "* nicintel_spi" " (for SPI flash ROMs on Intel Gigabit network cards)"
208
.sp
209
.BR "* ogp_spi" " (for SPI flash ROMs on Open Graphics Project graphics card)"
210
.sp
211 212
.BR "* linux_spi" " (for SPI flash ROMs accessible via /dev/spidevX.Y on Linux)"
.sp
Michael Karcher's avatar
Michael Karcher committed
213 214 215 216
Some programmers have optional or mandatory parameters which are described
in detail in the
.B PROGRAMMER SPECIFIC INFO
section. Support for some programmers can be disabled at compile time.
217
.B "flashrom \-h"
Michael Karcher's avatar
Michael Karcher committed
218 219 220 221 222 223 224 225 226
lists all supported programmers.
.TP
.B "\-h, \-\-help"
Show a help text and exit.
.TP
.B "\-R, \-\-version"
Show version information and exit.
.SH PROGRAMMER SPECIFIC INFO
Some programmer drivers accept further parameters to set programmer-specific
227
parameters. These parameters are separated from the programmer name by a
Michael Karcher's avatar
Michael Karcher committed
228 229 230
colon. While some programmers take arguments at fixed positions, other
programmers use a key/value interface in which the key and value is separated
by an equal sign and different pairs are separated by a comma or a colon.
Stefan Tauner's avatar
Stefan Tauner committed
231
.SS
232
.BR "internal " programmer
Stefan Tauner's avatar
Stefan Tauner committed
233 234 235
.TP
.B Board Enables
.sp
236 237 238 239
Some mainboards require to run mainboard specific code to enable flash erase
and write support (and probe support on old systems with parallel flash).
The mainboard brand and model (if it requires specific code) is usually
autodetected using one of the following mechanisms: If your system is
240 241
running coreboot, the mainboard type is determined from the coreboot table.
Otherwise, the mainboard is detected by examining the onboard PCI devices
242
and possibly DMI info. If PCI and DMI do not contain information to uniquely
243 244 245 246 247 248 249 250 251
identify the mainboard (which is the exception), or if you want to override
the detected mainboard model, you can specify the mainboard using the
.sp
.B "  flashrom \-p internal:mainboard=[<vendor>:]<board>"
syntax.
.sp
See the 'Known boards' or 'Known laptops' section in the output
of 'flashrom \-L' for a list of boards which require the specification of
the board name, if no coreboot table is found.
252
.sp
253 254
Some of these board-specific flash enabling functions (called
.BR "board enables" )
255 256 257 258 259 260 261 262 263 264 265 266 267 268
in flashrom have not yet been tested. If your mainboard is detected needing
an untested board enable function, a warning message is printed and the
board enable is not executed, because a wrong board enable function might
cause the system to behave erratically, as board enable functions touch the
low-level internals of a mainboard. Not executing a board enable function
(if one is needed) might cause detection or erasing failure. If your board
protects only part of the flash (commonly the top end, called boot block),
flashrom might encounter an error only after erasing the unprotected part,
so running without the board-enable function might be dangerous for erase
and write (which includes erase).
.sp
The suggested procedure for a mainboard with untested board specific code is
to first try to probe the ROM (just invoke flashrom and check that it
detects your flash chip type) without running the board enable code (i.e.
269
without any parameters). If it finds your chip, fine. Otherwise, retry
270 271
probing your chip with the board-enable code running, using
.sp
272
.B "  flashrom \-p internal:boardenable=force"
273 274 275
.sp
If your chip is still not detected, the board enable code seems to be broken
or the flash chip unsupported. Otherwise, make a backup of your current ROM
276 277 278 279
contents (using
.BR \-r )
and store it to a medium outside of your computer, like
a USB drive or a network share. If you needed to run the board enable code
280 281 282 283 284 285
already for probing, use it for reading too. Now you can try to write the
new image. You should enable the board enable code in any case now, as it
has been written because it is known that writing/erasing without the board
enable is going to fail. In any case (success or failure), please report to
the flashrom mailing list, see below.
.sp
Stefan Tauner's avatar
Stefan Tauner committed
286 287 288
.TP
.B Coreboot
.sp
289 290 291 292 293
On systems running coreboot, flashrom checks whether the desired image matches
your mainboard. This needs some special board ID to be present in the image.
If flashrom detects that the image you want to write and the current board
do not match, it will refuse to write the image unless you specify
.sp
294
.B "  flashrom \-p internal:boardmismatch=force"
Stefan Tauner's avatar
Stefan Tauner committed
295 296
.TP
.B ITE IT87 Super I/O
297
.sp
298
If your mainboard uses an ITE IT87 series Super I/O for LPC<->SPI flash bus
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
299 300
translation, flashrom should autodetect that configuration. If you want to
set the I/O base port of the IT87 series SPI controller manually instead of
Stefan Tauner's avatar
Stefan Tauner committed
301
using the value provided by the BIOS, use the
302 303
.sp
.B "  flashrom \-p internal:it87spiport=portnum"
304
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
305 306 307 308 309
syntax where
.B portnum
is the I/O port number (must be a multiple of 8). In the unlikely case
flashrom doesn't detect an active IT87 LPC<->SPI bridge, please send a bug
report so we can diagnose the problem.
310
.sp
Stefan Tauner's avatar
Stefan Tauner committed
311 312 313
.TP
.B Intel chipsets
.sp
314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333
If you have an Intel chipset with an ICH8 or later southbridge with SPI flash
attached, and if a valid descriptor was written to it (e.g. by the vendor), the
chipset provides an alternative way to access the flash chip(s) named
.BR "Hardware Sequencing" .
It is much simpler than the normal access method (called
.BR "Software Sequencing" "),"
but does not allow the software to choose the SPI commands to be sent.
You can use the
.sp
.B "  flashrom \-p internal:ich_spi_mode=value"
.sp
syntax where value can be
.BR auto ", " swseq " or " hwseq .
By default
.RB "(or when setting " ich_spi_mode=auto )
the module tries to use swseq and only activates hwseq if need be (e.g. if
important opcodes are inaccessible due to lockdown; or if more than one flash
chip is attached). The other options (swseq, hwseq) select the respective mode
(if possible).
.sp
334 335 336 337 338 339 340 341 342 343 344 345 346 347 348
ICH8 and later southbridges may also have locked address ranges of different
kinds if a valid descriptor was written to it. The flash address space is then
partitioned in multiple so called "Flash Regions" containing the host firmware,
the ME firmware and so on respectively. The flash descriptor can also specify up
to 5 so called "Protected Regions", which are freely chosen address ranges
independent from the aforementioned "Flash Regions". All of them can be write
and/or read protected individually. If flashrom detects such a lock it will
disable write support unless the user forces it with the
.sp
.B "  flashrom \-p internal:ich_spi_force=yes"
.sp
syntax. If this leads to erase or write accesses to the flash it would most
probably bring it into an inconsistent and unbootable state and we will not
provide any support in such a case.
.sp
349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364
If you have an Intel chipset with an ICH6 or later southbridge and if you want
to set specific IDSEL values for a non-default flash chip or an embedded
controller (EC), you can use the
.sp
.B "  flashrom \-p internal:fwh_idsel=value"
.sp
syntax where value is the 48-bit hexadecimal raw value to be written in the
IDSEL registers of the Intel southbridge. The upper 32 bits use one hex digit
each per 512 kB range between 0xffc00000 and 0xffffffff, and the lower 16 bits
use one hex digit each per 1024 kB range between 0xff400000 and 0xff7fffff.
The rightmost hex digit corresponds with the lowest address range. All address
ranges have a corresponding sister range 4 MB below with identical IDSEL
settings. The default value for ICH7 is given in the example below.
.sp
Example:
.B "flashrom \-p internal:fwh_idsel=0x001122334567"
Stefan Tauner's avatar
Stefan Tauner committed
365 366
.TP
.B Laptops
367
.sp
368
Using flashrom on laptops is dangerous and may easily make your hardware
369 370 371 372 373
unusable (see also the
.B BUGS
section). The embedded controller (EC) in these
machines often interacts badly with flashing.
.B http://www.flashrom.org/Laptops
Stefan Tauner's avatar
Stefan Tauner committed
374 375 376 377 378 379 380 381
has more information. For example the EC firmware sometimes resides on the same
flash chip as the host firmware. While flashrom tries to change the contents of
that memory the EC might need to fetch new instructions or data from it and
could stop working correctly. Probing for and reading from the chip may also
irritate your EC and cause fan failure, backlight failure, sudden poweroff, and
other nasty effects. flashrom will attempt to detect if it is running on a
laptop and abort immediately for safety reasons if it clearly identifies the
host computer as one. If you want to proceed anyway at your own risk, use
382
.sp
383
.B "  flashrom \-p internal:laptop=force_I_want_a_brick"
384 385 386
.sp
We will not help you if you force flashing on a laptop because this is a really
dumb idea.
Stefan Tauner's avatar
Stefan Tauner committed
387 388 389 390 391 392 393 394 395 396 397 398
.sp
You have been warned.
.sp
Currently we rely on the chassis type encoded in the DMI/SMBIOS data to detect
laptops. Some vendors did not implement those bits correctly or set them to
generic and/or dummy values. flashrom will then issue a warning and bail out
like above. In this case you can use
.sp
.B "  flashrom \-p internal:laptop=this_is_not_a_laptop"
.sp
to tell flashrom (at your own risk) that it does not running on a laptop.
.SS
Michael Karcher's avatar
Michael Karcher committed
399
.BR "dummy " programmer
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
400 401 402 403 404 405 406
The dummy programmer operates on a buffer in memory only. It provides a safe
and fast way to test various aspects of flashrom and is mainly used in
development and while debugging.
.sp
It is able to emulate some chips to a certain degree (basic
identify/read/erase/write operations work).
.sp
Michael Karcher's avatar
Michael Karcher committed
407
An optional parameter specifies the bus types it
408
should support. For that you have to use the
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
409 410 411
.sp
.B "  flashrom \-p dummy:bus=[type[+type[+type]]]"
.sp
412 413
syntax where
.B type
Uwe Hermann's avatar
Uwe Hermann committed
414
can be
415 416 417
.BR parallel ", " lpc ", " fwh ", " spi
in any order. If you specify bus without type, all buses will be disabled.
If you do not specify bus, all buses will be enabled.
418 419
.sp
Example:
420
.B "flashrom \-p dummy:bus=lpc+fwh"
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437
.sp
The dummy programmer supports flash chip emulation for automated self-tests
without hardware access. If you want to emulate a flash chip, use the
.sp
.B "  flashrom \-p dummy:emulate=chip"
.sp
syntax where
.B chip
is one of the following chips (please specify only the chip name, not the
vendor):
.sp
.RB "* ST " M25P10.RES " SPI flash chip (RES, page write)"
.sp
.RB "* SST " SST25VF040.REMS " SPI flash chip (REMS, byte write)"
.sp
.RB "* SST " SST25VF032B " SPI flash chip (RDID, AAI write)"
.sp
438 439
.RB "* Macronix " MX25L6436 " SPI flash chip (RDID, SFDP)"
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
440 441
Example:
.B "flashrom -p dummy:emulate=SST25VF040.REMS"
Stefan Tauner's avatar
Stefan Tauner committed
442 443
.TP
.B Persistent images
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
444 445 446 447 448 449 450 451 452 453 454 455 456
.sp
If you use flash chip emulation, flash image persistence is available as well
by using the
.sp
.B "  flashrom \-p dummy:emulate=chip,image=image.rom"
.sp
syntax where
.B image.rom
is the file where the simulated chip contents are read on flashrom startup and
where the chip contents on flashrom shutdown are written to.
.sp
Example:
.B "flashrom -p dummy:emulate=M25P10.RES,image=dummy.bin"
Stefan Tauner's avatar
Stefan Tauner committed
457 458
.TP
.B SPI write chunk size
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
459 460 461 462 463 464 465 466 467 468 469 470 471 472
.sp
If you use SPI flash chip emulation for a chip which supports SPI page write
with the default opcode, you can set the maximum allowed write chunk size with
the
.sp
.B "  flashrom \-p dummy:emulate=chip,spi_write_256_chunksize=size"
.sp
syntax where
.B size
is the number of bytes (min. 1, max. 256).
.sp
Example:
.sp
.B "  flashrom -p dummy:emulate=M25P10.RES,spi_write_256_chunksize=5"
Stefan Tauner's avatar
Stefan Tauner committed
473 474
.TP
.B SPI blacklist
475 476 477 478 479 480 481 482 483 484 485 486
.sp
To simulate a programmer which refuses to send certain SPI commands to the
flash chip, you can specify a blacklist of SPI commands with the
.sp
.B "  flashrom -p dummy:spi_blacklist=commandlist"
.sp
syntax where commandlist is a list of two-digit hexadecimal representations of
SPI commands. If commandlist is e.g. 0302, flashrom will behave as if the SPI
controller refuses to run command 0x03 (READ) and command 0x02 (WRITE).
commandlist may be up to 512 characters (256 commands) long.
Implementation note: flashrom will detect an error during command execution.
.sp
Stefan Tauner's avatar
Stefan Tauner committed
487 488 489
.TP
.B SPI ignorelist
.sp
490 491 492 493 494 495 496 497 498 499
To simulate a flash chip which ignores (doesn't support) certain SPI commands,
you can specify an ignorelist of SPI commands with the
.sp
.B "  flashrom -p dummy:spi_ignorelist=commandlist"
.sp
syntax where commandlist is a list of two-digit hexadecimal representations of
SPI commands. If commandlist is e.g. 0302, the emulated flash chip will ignore
command 0x03 (READ) and command 0x02 (WRITE).  commandlist may be up to 512
characters (256 commands) long.
Implementation note: flashrom won't detect an error during command execution.
500 501 502 503 504 505 506 507 508
.sp
.TP
.B SPI status register
.sp
You can specify the initial content of the chip's status register with the
.sp
.B "  flashrom -p dummy:spi_status=content"
.sp
syntax where content is an 8-bit hexadecimal value.
Stefan Tauner's avatar
Stefan Tauner committed
509
.SS
Uwe Hermann's avatar
Uwe Hermann committed
510 511 512
.BR "nic3com" , " nicrealtek" , " nicsmc1211" , " nicnatsemi" , " nicintel\
" , " nicintel_spi" , " gfxnvidia" , " ogp_spi" , " drkaiser" , " satasii\
" , " satamv" ", and " atahpt " programmers
Michael Karcher's avatar
Michael Karcher committed
513 514 515
These programmers have an option to specify the PCI address of the card
your want to use, which must be specified if more than one card supported
by the selected programmer is installed in your system. The syntax is
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
516 517 518
.sp
.BR "  flashrom \-p xxxx:pci=bb:dd.f" ,
.sp
519
where
520 521
.B xxxx
is the name of the programmer
522 523 524 525 526
.B bb
is the PCI bus number,
.B dd
is the PCI device number, and
.B f
527
is the PCI function number of the desired device.
528 529
.sp
Example:
530
.B "flashrom \-p nic3com:pci=05:04.0"
Stefan Tauner's avatar
Stefan Tauner committed
531
.SS
532
.BR "ft2232_spi " programmer
533
An optional parameter specifies the controller
534
type and interface/port it should support. For that you have to use the
535
.sp
536
.B "  flashrom \-p ft2232_spi:type=model,port=interface"
537
.sp
538 539
syntax where
.B model
Uwe Hermann's avatar
Uwe Hermann committed
540
can be
541
.BR 2232H ", " 4232H ", " jtagkey ", " busblaster ", " openmoko ", " \
542
arm-usb-tiny ", " arm-usb-tiny-h ", " arm-usb-ocd ", " arm-usb-ocd-h \
543
", " tumpa ", or " picotap
544 545
and
.B interface
Uwe Hermann's avatar
Uwe Hermann committed
546
can be
547
.BR A ", or " B .
548 549 550 551
The default model is
.B 4232H
and the default interface is
.BR B .
Stefan Tauner's avatar
Stefan Tauner committed
552
.SS
Michael Karcher's avatar
Michael Karcher committed
553 554
.BR "serprog " programmer
A mandatory parameter specifies either a serial
555
device/baud combination or an IP/port combination for communication with the
Michael Karcher's avatar
Michael Karcher committed
556 557
programmer. In the device/baud combination, the device has to start with a
slash. For serial, you have to use the
558
.sp
559
.B "  flashrom \-p serprog:dev=/dev/device:baud"
560
.sp
561
syntax and for IP, you have to use
562
.sp
563
.B "  flashrom \-p serprog:ip=ipaddr:port"
564 565 566 567
.sp
instead. More information about serprog is available in
.B serprog-protocol.txt
in the source distribution.
Stefan Tauner's avatar
Stefan Tauner committed
568
.SS
569
.BR "buspirate_spi " programmer
570 571 572 573 574
A required
.B dev
parameter specifies the Bus Pirate device node and an optional
.B spispeed
parameter specifies the frequency of the SPI bus. The parameter
Michael Karcher's avatar
Michael Karcher committed
575
delimiter is a comma. Syntax is
576
.sp
Uwe Hermann's avatar
Uwe Hermann committed
577
.B "  flashrom \-p buspirate_spi:dev=/dev/device,spispeed=frequency"
Michael Karcher's avatar
Michael Karcher committed
578
.sp
579 580
where
.B frequency
Uwe Hermann's avatar
Uwe Hermann committed
581 582
can be
.BR 30k ", " 125k ", " 250k ", " 1M ", " 2M ", " 2.6M ", " 4M " or " 8M
Michael Karcher's avatar
Michael Karcher committed
583
(in Hz). The default is the maximum frequency of 8 MHz.
Stefan Tauner's avatar
Stefan Tauner committed
584
.SS
585
.BR "dediprog " programmer
586 587 588 589 590 591 592
An optional
.B voltage
parameter specifies the voltage the Dediprog should use. The default unit is
Volt if no unit is specified. You can use
.BR mV ", " milliVolt ", " V " or " Volt
as unit specifier. Syntax is
.sp
Uwe Hermann's avatar
Uwe Hermann committed
593
.B "  flashrom \-p dediprog:voltage=value"
594 595 596
.sp
where
.B value
Uwe Hermann's avatar
Uwe Hermann committed
597
can be
598 599
.BR 0V ", " 1.8V ", " 2.5V ", " 3.5V
or the equivalent in mV.
Stefan Tauner's avatar
Stefan Tauner committed
600
.SS
601
.BR "rayer_spi " programmer
602 603 604 605 606 607 608 609 610 611 612 613
The default I/O base address used for the parallel port is 0x378 and you can use
the optional
.B iobase
parameter to specify an alternate base I/O address with the
.sp
.B "  flashrom \-p rayer_spi:iobase=baseaddr"
.sp
syntax where
.B baseaddr
is base I/O port address of the parallel port, which must be a multiple of
four. Make sure to not forget the "0x" prefix for hexadecimal port addresses.
.sp
614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629
The default cable type is the RayeR cable. You can use the optional
.B type
parameter to specify the cable type with the
.sp
.B "  flashrom \-p rayer_spi:type=model"
.sp
syntax where
.B model
can be
.BR rayer " for the RayeR cable or " xilinx " for the Xilinx Parallel Cable III
(DLC 5).
.sp
More information about the RayeR hardware is available at
.BR "http://rayer.ic.cz/elektro/spipgm.htm " .
The schematic of the Xilinx DLC 5 was published at
.BR "http://www.xilinx.com/itp/xilinx4/data/docs/pac/appendixb.html " .
Stefan Tauner's avatar
Stefan Tauner committed
630
.SS
631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650
.BR "pony_spi " programmer
The serial port (like /dev/ttyS0, /dev/ttyUSB0 on Linux or COM3 on windows) is
specified using the mandatory
.B dev 
parameter. The adapter type is selectable between SI-Prog (used for
SPI devices with PonyProg 2000) or a custom made serial bitbanging programmer
named "serbang". The optional
.B type 
parameter accepts the values "si_prog" (default) or "serbang".
.sp
Information about the SI-Prog adapter can be found at
.BR "http://www.lancos.com/siprogsch.html " .
.sp
An example call to flashrom is
.sp
.B "  flashrom \-p pony_spi:dev=/dev/ttyS0,type=serbang"
.sp
Please note that while USB-to-serial adapters work under certain circumstances,
this slows down operation considerably.
.SS
651
.BR "ogp_spi " programmer
Stefan Tauner's avatar
Stefan Tauner committed
652
The flash ROM chip to access must be specified with the
653 654 655 656 657 658 659 660 661 662 663 664 665 666 667
.B rom
parameter.
.sp
.B "  flashrom \-p ogp_spi:rom=name"
.sp
Where
.B name
is either
.B cprom
or
.B s3
for the configuration ROM and 
.B bprom
or
.B bios
Uwe Hermann's avatar
Uwe Hermann committed
668
for the BIOS ROM. If more than one card supported by the ogp_spi programmer
669 670 671 672 673 674 675 676
is installed in your system, you have to specify the PCI address of the card
you want to use with the
.B pci=
parameter as explained in the
.B nic3com
section above.
.sp
More information about the hardware is available at
677
.BR http://wiki.opengraphics.org .
678 679 680 681 682 683 684 685 686 687 688
.SS
.BR "linux_spi " programmer
You have to specify the SPI controller to use with the
.sp
.B "  flashrom \-p linux_spi:dev=/dev/spidevX.Y"
.sp
syntax where
.B /dev/spidevX.Y
is the Linux device node for your SPI controller.
.sp
Please note that the linux_spi driver only works on Linux.
689 690 691
.SH EXIT STATUS
flashrom exits with 0 on success, 1 on most failures but with 2 if /dev/mem
(/dev/xsvc on Solaris) can not be opened and with 3 if a call to mmap() fails.
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707
.SH REQUIREMENTS
flashrom needs different access permissions for different programmers.
.sp
.B internal
needs raw memory access, PCI configuration space access, raw I/O port
access (x86) and MSR access (x86).
.sp
.BR nic3com ", " nicrealtek ", " nicsmc1211 " and " nicnatsemi "
need PCI configuration space read access and raw I/O port access.
.sp
.B atahpt
needs PCI configuration space access and raw I/O port access.
.sp
.BR gfxnvidia " and " drkaiser
need PCI configuration space access and raw memory access.
.sp
708 709 710
.B rayer_spi
needs raw I/O port access.
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
711 712 713
.B satasii
needs PCI configuration space read access and raw memory access.
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
714 715 716 717
.B satamv
needs PCI configuration space read access, raw I/O port access and raw memory
access.
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
718 719 720 721 722 723 724 725 726 727 728 729
.B serprog
needs TCP access to the network or userspace access to a serial port.
.sp
.B buspirate_spi
needs userspace access to a serial port.
.sp
.BR dediprog " and " ft2232_spi
need access to the USB device via libusb.
.sp
.B dummy
needs no access permissions at all.
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
730 731
.BR internal ", " nic3com ", " nicrealtek ", " nicsmc1211 ", " nicnatsemi ", "
.BR gfxnvidia ", " drkaiser ", " satasii ", " satamv " and " atahpt
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
732 733 734 735 736 737
have to be run as superuser/root, and need additional raw access permission.
.sp
.BR serprog ", " buspirate_spi ", " dediprog " and " ft2232_spi
can be run as normal user on most operating systems if appropriate device
permissions are set.
.sp
738 739 740
.B ogp
needs PCI configuration space read access and raw memory access.
.sp
Carl-Daniel Hailfinger's avatar
Carl-Daniel Hailfinger committed
741
On OpenBSD, you can obtain raw access permission by setting
742 743 744 745
.B "securelevel=-1"
in
.B "/etc/rc.securelevel"
and rebooting, or rebooting into single user mode.
746
.SH BUGS
Stefan Tauner's avatar
Stefan Tauner committed
747
Please report any bugs to the flashrom mailing list at
748 749 750
.B "<flashrom@flashrom.org>"
.sp
We recommend to subscribe first at
751 752
.sp
.B "  http://www.flashrom.org/mailman/listinfo/flashrom"
753
.sp
Stefan Tauner's avatar
Stefan Tauner committed
754 755 756 757 758 759 760 761 762 763 764 765 766
Many of the developers communicate via the
.B "#flashrom"
IRC channel on
.BR chat.freenode.net .
You are welcome to join and ask questions, send us bug and success reports there
too. Please provide a way to contact you later (e.g. a mail address) and be
patient if there is no immediate reaction. Also, we provide a pastebin service
at
.B http://paste.flashrom.org
that is very useful when you want to share logs etc. without spamming the
channel.
.SS
.B Laptops
767
.sp
Stefan Tauner's avatar
Stefan Tauner committed
768 769 770 771 772 773 774 775 776 777
Using flashrom on laptops is dangerous and may easily make your hardware
unusable. flashrom will attempt to detect if it is running on a laptop and abort
immediately for safety reasons. Please see the detailed discussion of this topic
and associated flashrom options in the
.B Laptops
paragraph in the
.B internal programmer
subsection of the
.B PROGRAMMER SPECIFIC INFO
section.
778
.B "  http://www.flashrom.org/Laptops"
779 780 781 782 783 784 785 786 787 788 789 790
.SS
One-time programmable (OTP) memory and unique IDs
.sp
Some flash chips contain OTP memory often denoted as "security registers".
They usually have a capacity in the range of some bytes to a few hundred
bytes and can be used to give devices unique IDs etc. flashrom is not able
to read or write these memories and may therefore not be able to duplicate a
chip completely. For chip types known to include OTP memories a warning is
printed when they are detected.
.sp
Similar to OTP memories are unique, factory programmed, unforgeable IDs.
They are not modifiable by the user at all.
791
.SH LICENSE
792
.B flashrom
793 794
is covered by the GNU General Public License (GPL), version 2. Some files are
additionally available under the GPL (version 2, or any later version).
795 796
.SH COPYRIGHT
.br
797 798
Please see the individual files.
.SH AUTHORS
799
Andrew Morgan
800
.br
801
Carl-Daniel Hailfinger
802
.br
803
Claus Gindhart
804
.br
805
David Borg
806
.br
807
David Hendricks
808
.br
809
Dominik Geyer
810
.br
811
Eric Biederman
812
.br
813
Giampiero Giancipoli
814
.br
815
Helge Wagner
816
.br
817
Idwer Vollering
818
.br
819
Joe Bao
820
.br
821
Joerg Fischer
822
.br
823
Joshua Roys
824
.br
825
Luc Verhaegen
826
.br
827 828
Li-Ta Lo
.br
829 830
Mark Marshall
.br
831
Markus Boas
832
.br
833
Mattias Mattsson
834
.br
835
Michael Karcher
836
.br
837
Nikolay Petukhov
838
.br
839
Patrick Georgi
840
.br
841
Peter Lemenkov
842
.br
843
Peter Stuge
844
.br
845
Reinder E.N. de Haan
846
.br
847
Ronald G. Minnich
848
.br
849
Ronald Hoogenboom
850
.br
851
Sean Nelson
852
.br
853
Stefan Reinauer
854
.br
Uwe Hermann's avatar
Uwe Hermann committed
855 856
Stefan Tauner
.br
857
Stefan Wildemann
858
.br
859
Stephan Guilloux
860
.br
861
Steven James
862
.br
863
Uwe Hermann
864
.br
865
Wang Qingpei
866
.br
867
Yinghai Lu
868
.br
869 870
some others, please see the flashrom svn changelog for details.
.br
Uwe Hermann's avatar
Uwe Hermann committed
871
All authors can be reached via email at <flashrom@flashrom.org>.
872
.PP
873 874
This manual page was written by Uwe Hermann <uwe@hermann-uwe.de>,
Carl-Daniel Hailfinger and others.
875
It is licensed under the terms of the GNU GPL (version 2 or later).