1FLASHROM(8)                       2017-06-14                       FLASHROM(8)
2
3
4

NAME

6       flashrom - detect, read, write, verify and erase flash chips
7

SYNOPSIS

9       flashrom [-h|-R|-L|-z|-p <programmername>[:<parameters>]
10                      [-E|-r <file>|-w <file>|-v <file>] [-c <chipname>]
11                      [(-l <file>|--ifd) [-i <image>]] [-n] [-N] [-f]]
12                [-V[V[V]]] [-o <logfile>]
13

DESCRIPTION

15       flashrom  is  a  utility for detecting, reading, writing, verifying and
16       erasing  flash  chips.  It's  often  used   to   flash   BIOS/EFI/core‐
17       boot/firmware images in-system using a supported mainboard. However, it
18       also supports various external PCI/USB/parallel-port/serial-port  based
19       devices  which  can  program  flash chips, including some network cards
20       (NICs), SATA/IDE controller  cards,  graphics  cards,  the  Bus  Pirate
21       device, various FTDI FT2232/FT4232H/FT232H based USB devices, and more.
22
23       It  supports  a  wide  range of DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32,
24       TSOP40, TSOP48, and BGA chips, which use various protocols such as LPC,
25       FWH, parallel flash, or SPI.
26

OPTIONS

28       IMPORTANT:  Please  note  that  the command line interface for flashrom
29       will change before flashrom 1.0. Do not  use  flashrom  in  scripts  or
30       other automated tools without checking that your flashrom version won't
31       interpret options in a different way.
32
33       You can specify one of -h, -R, -L, -z, -E, -r, -w, -v or no  operation.
34       If no operation is specified, flashrom will only probe for flash chips.
35       It is recommended that if you try flashrom the first time on a  system,
36       you  run  it  in  probe-only  mode  and  check the output. Also you are
37       advised to make a backup of your current ROM contents  with  -r  before
38       you  try to write a new image. All operations involving any chip access
39       (probe/read/write/...) require the -p/--programmer option  to  be  used
40       (please see below).
41
42       -r, --read <file>
43              Read flash ROM contents and save them into the given <file>.  If
44              the file already exists, it will be overwritten.
45
46       -w, --write <file>
47              Write <file> into flash ROM. This will first automatically erase
48              the chip, then write to it.
49
50              In the process the chip is also read several times. First an in-
51              memory backup is made for disaster recovery and to  be  able  to
52              skip regions that are already equal to the image file. This copy
53              is updated along with the write  operation.  In  case  of  erase
54              errors it is even re-read completely. After writing has finished
55              and if verification is enabled, the whole flash chip is read out
56              and compared with the input image.
57
58       -n, --noverify
59              Skip  the  automatic  verification  of  flash ROM contents after
60              writing. Using this option is not recommended, you  should  only
61              use  it  if you know what you are doing and if you feel that the
62              time for verification takes too long.
63
64              Typical usage is: flashrom -p prog -n -w <file>
65
66              This option is only useful in combination with --write.
67
68       -N, --noverify-all
69              Skip not included regions during  automatic  verification  after
70              writing  (cf.   -l  and -i).  You should only use this option if
71              you are sure that communication with the flash chip is  reliable
72              (e.g.  when  using the internal programmer). Even if flashrom is
73              instructed not to touch parts of the flash chip, their  contents
74              could be damaged (e.g. due to misunderstood erase commands).
75
76              This  option is required to flash an Intel system with locked ME
77              flash region using the internal programmer. It may be enabled by
78              default in this case in the future.
79
80       -v, --verify <file>
81              Verify the flash ROM contents against the given <file>.
82
83       -E, --erase
84              Erase the flash ROM chip.
85
86       -V, --verbose
87              More  verbose output. This option can be supplied multiple times
88              (max. 3 times, i.e.  -VVV) for even more debug output.
89
90       -c, --chip <chipname>
91              Probe only for the specified flash ROM chip. This  option  takes
92              the  chip name as printed by flashrom -L without the vendor name
93              as parameter. Please note that the chip name is case sensitive.
94
95       -f, --force
96              Force one or more of the following actions:
97
98              * Force chip read and pretend the chip is there.
99
100              * Force chip access even if the chip is bigger than the  maximum
101              supported size for the flash bus.
102
103              * Force erase even if erase is known bad.
104
105              * Force write even if write is known bad.
106
107       -l, --layout <file>
108              Read ROM layout from <file>.
109
110              flashrom  supports ROM layouts. This allows you to flash certain
111              parts of the flash chip only. A ROM layout file contains  multi‐
112              ple lines with the following syntax:
113
114                startaddr:endaddr imagename
115
116              startaddr  and  endaddr are hexadecimal addresses within the ROM
117              file and do not refer to any physical address. Please note  that
118              using  a  0x  prefix for those hexadecimal numbers is not neces‐
119              sary, but you can't specify decimal/octal numbers.  imagename is
120              an  arbitrary  name  for  the  region/image  from   startaddr to
121              endaddr (both addresses included).
122
123              Example:
124
125                00000000:00008fff gfxrom
126                00009000:0003ffff normal
127                00040000:0007ffff fallback
128
129              If you only want to update the image named normal in a ROM based
130              on the layout above, run
131
132                 flashrom  -p  prog  --layout  rom.layout  --image  normal  -w
133              some.rom
134
135              To update only the images named normal and fallback, run:
136
137                flashrom -p prog  -l  rom.layout  -i  normal  -i  fallback  -w
138              some.rom
139
140              Overlapping sections are not supported.
141
142       --ifd  Read ROM layout from Intel Firmware Descriptor.
143
144              flashrom  supports  ROM  layouts  given  by  an  Intel  Firmware
145              Descriptor (IFD). The on-chip descriptor will be read  and  used
146              to  generate  the  layout. If you need to change the layout, you
147              have to update the IFD only first.
148
149              The following ROM images may be present in an IFD:
150
151                fd    the IFD itself
152                bios  the host firmware aka. BIOS
153                me    Intel Management Engine firmware
154                gbe   gigabit ethernet firmware
155                pd    platform specific data
156
157       -i, --image <imagename>
158              Only flash region/image <imagename> from flash layout.
159
160       -L, --list-supported
161              List the flash chips, chipsets, mainboards,  and  external  pro‐
162              grammers  (including  PCI,  USB,  parallel port, and serial port
163              based devices) supported by flashrom.
164
165              There are many unlisted boards which will work out of  the  box,
166              without  special  support in flashrom. Please let us know if you
167              can verify that other boards work or do not work out of the box.
168
169              IMPORTANT: For verification you have to  test  an  ERASE  and/or
170              WRITE  operation,  so  make  sure  you  only do that if you have
171              proper means to recover from failure!
172
173       -z, --list-supported-wiki
174              Same as --list-supported, but outputs the supported hardware  in
175              MediaWiki  syntax, so that it can be easily pasted into the sup‐
176              ported hardware wiki page  ⟨https://flashrom.org/Supported_hard
177              ware⟩.   Please note that MediaWiki output is not compiled in by
178              default.
179
180       -p, --programmer <name>[:parameter[,parameter[,parameter]]]
181              Specify the programmer device. This is mandatory for all  opera‐
182              tions  involving  any  chip  access (probe/read/write/...). Cur‐
183              rently supported are:
184
185              * internal (for in-system flashing in the mainboard)
186
187              * dummy (virtual programmer for testing flashrom)
188
189              * nic3com (for flash ROMs on 3COM network cards)
190
191              * nicrealtek (for flash ROMs on Realtek  and  SMC  1211  network
192              cards)
193
194              *  nicnatsemi  (for  flash ROMs on National Semiconductor DP838*
195              network cards)
196
197              * nicintel (for parallel flash ROMs on Intel 10/100Mbit  network
198              cards)
199
200              * gfxnvidia (for flash ROMs on NVIDIA graphics cards)
201
202              * drkaiser (for flash ROMs on Dr. Kaiser PC-Waechter PCI cards)
203
204              * satasii (for flash ROMs on Silicon Image SATA/IDE controllers)
205
206              * satamv (for flash ROMs on Marvell SATA controllers)
207
208              * atahpt (for flash ROMs on Highpoint ATA/RAID controllers)
209
210              * atavia (for flash ROMs on VIA VT6421A SATA controllers)
211
212              *  atapromise  (for flash ROMs on Promise PDC2026x ATA/RAID con‐
213              trollers)
214
215              * it8212 (for flash ROMs on ITE IT8212F ATA/RAID controller)
216
217              *   ft2232_spi   (for   SPI   flash   ROMs   attached   to    an
218              FT2232/FT4232H/FT232H family based USB SPI programmer).
219
220              * serprog (for flash ROMs attached to a programmer speaking ser‐
221              prog, including some Arduino-based devices).
222
223              * buspirate_spi (for SPI flash ROMs attached to a Bus Pirate)
224
225              * dediprog (for SPI flash ROMs attached to a Dediprog SF100)
226
227              * rayer_spi (for SPI flash ROMs attached to a parallel  port  by
228              one of various cable types)
229
230              * pony_spi (for SPI flash ROMs attached to a SI-Prog serial port
231              bitbanging adapter)
232
233              * nicintel_spi (for SPI flash  ROMs  on  Intel  Gigabit  network
234              cards)
235
236              *  ogp_spi (for SPI flash ROMs on Open Graphics Project graphics
237              card)
238
239              * linux_spi (for SPI flash ROMs accessible via /dev/spidevX.Y on
240              Linux)
241
242              *  usbblaster_spi (for SPI flash ROMs attached to an Altera USB-
243              Blaster compatible cable)
244
245              * nicintel_eeprom (for SPI  EEPROMs  on  Intel  Gigabit  network
246              cards)
247
248              *  mstarddc_spi  (for  SPI  flash ROMs accessible through DDC in
249              MSTAR-equipped displays)
250
251              * pickit2_spi (for  SPI  flash  ROMs  accessible  via  Microchip
252              PICkit2)
253
254              * ch341a_spi (for SPI flash ROMs attached to WCH CH341A)
255
256              Some programmers have optional or mandatory parameters which are
257              described in detail in the PROGRAMMER-SPECIFIC INFORMATION  sec‐
258              tion.  Support  for  some programmers can be disabled at compile
259              time.  flashrom -h lists all supported programmers.
260
261       -h, --help
262              Show a help text and exit.
263
264       -o, --output <logfile>
265              Save the full debug log  to  <logfile>.   If  the  file  already
266              exists,  it  will be overwritten. This is the recommended way to
267              gather logs from flashrom because they will be verbose  even  if
268              the  on-screen messages are not verbose and don't require output
269              redirection.
270
271       -R, --version
272              Show version information and exit.
273

PROGRAMMER-SPECIFIC INFORMATION

275       Some programmer drivers accept further parameters  to  set  programmer-
276       specific parameters. These parameters are separated from the programmer
277       name by a colon. While some programmers take arguments at  fixed  posi‐
278       tions, other programmers use a key/value interface in which the key and
279       value is separated by an equal sign and different pairs  are  separated
280       by a comma or a colon.
281
282   internal programmer
283       Board Enables
284
285              Some mainboards require to run mainboard specific code to enable
286              flash erase and write support (and probe support on old  systems
287              with  parallel  flash).   The  mainboard  brand and model (if it
288              requires specific code) is usually autodetected using one of the
289              following  mechanisms:  If  your system is running coreboot, the
290              mainboard type is determined from the  coreboot  table.   Other‐
291              wise,  the  mainboard  is  detected by examining the onboard PCI
292              devices and possibly DMI info. If PCI and  DMI  do  not  contain
293              information  to  uniquely  identify  the mainboard (which is the
294              exception), or if you want to override  the  detected  mainboard
295              model, you can specify the mainboard using the
296
297                flashrom -p internal:mainboard=<vendor>:<board> syntax.
298
299              See  the 'Known boards' or 'Known laptops' section in the output
300              of 'flashrom -L' for a list of boards which require the specifi‐
301              cation of the board name, if no coreboot table is found.
302
303              Some  of  these  board-specific flash enabling functions (called
304              board enables) in flashrom have not yet  been  tested.  If  your
305              mainboard is detected needing an untested board enable function,
306              a warning message is printed and the board enable  is  not  exe‐
307              cuted,  because  a  wrong  board enable function might cause the
308              system to behave erratically, as board  enable  functions  touch
309              the  low-level  internals  of a mainboard. Not executing a board
310              enable function (if one is  needed)  might  cause  detection  or
311              erasing  failure.  If your board protects only part of the flash
312              (commonly the  top  end,  called  boot  block),  flashrom  might
313              encounter  an  error only after erasing the unprotected part, so
314              running without the board-enable function might be dangerous for
315              erase and write (which includes erase).
316
317              The suggested procedure for a mainboard with untested board spe‐
318              cific code is to  first  try  to  probe  the  ROM  (just  invoke
319              flashrom and check that it detects your flash chip type) without
320              running the board enable code (i.e.  without any parameters). If
321              it  finds  your  chip,  fine. Otherwise, retry probing your chip
322              with the board-enable code running, using
323
324                flashrom -p internal:boardenable=force
325
326              If your chip is still not detected, the board enable code  seems
327              to  be  broken  or the flash chip unsupported. Otherwise, make a
328              backup of your current ROM contents (using -r) and store it to a
329              medium  outside  of your computer, like a USB drive or a network
330              share. If you needed to run the board enable  code  already  for
331              probing,  use  it  for reading too.  If reading succeeds and the
332              contens of the read file look legit you can try to write the new
333              image.  You should enable the board enable code in any case now,
334              as it has been written because it is known that  writing/erasing
335              without  the board enable is going to fail. In any case (success
336              or failure), please report to the  flashrom  mailing  list,  see
337              below.
338
339
340       Coreboot
341
342              On systems running coreboot, flashrom checks whether the desired
343              image matches your mainboard. This needs some special  board  ID
344              to  be present in the image.  If flashrom detects that the image
345              you want to write and the current board do not  match,  it  will
346              refuse to write the image unless you specify
347
348                flashrom -p internal:boardmismatch=force
349
350       ITE IT87 Super I/O
351
352              If your mainboard is manufactured by GIGABYTE and supports Dual‐
353              BIOS it is very likely that it uses an ITE IT87 series Super I/O
354              to  switch  between the two flash chips. Only one of them can be
355              accessed at a time and you can manually select which one to  use
356              with the
357
358                flashrom -p internal:dualbiosindex=chip
359
360              syntax where chip is the index of the chip to use (0 = main, 1 =
361              backup). You can check which one is currently selected by  leav‐
362              ing out the chip parameter.
363
364              If  your  mainboard  uses  an  ITE  IT87  series  Super  I/O for
365              LPC<->SPI flash bus translation, flashrom should autodetect that
366              configuration.  If you want to set the I/O base port of the IT87
367              series SPI controller manually instead of using the  value  pro‐
368              vided by the BIOS, use the
369
370                flashrom -p internal:it87spiport=portnum
371
372              syntax  where portnum is the I/O port number (must be a multiple
373              of 8). In the unlikely case flashrom doesn't  detect  an  active
374              IT87  LPC<->SPI bridge, please send a bug report so we can diag‐
375              nose the problem.
376
377
378       AMD chipsets
379
380              Beginning with the SB700 chipset there is an  integrated  micro‐
381              controller  (IMC) based on the 8051 embedded in every AMD south‐
382              bridge. Its firmware resides in  the  same  flash  chip  as  the
383              host's  which  makes  writing  to  the flash risky if the IMC is
384              active. Flashrom tries to temporarily disable the IMC  but  even
385              then  changing  the  contents  of  the  flash  can have unwanted
386              effects: when the IMC continues (at the latest after  a  reboot)
387              it  will continue executing code from the flash. If the code was
388              removed or changed in an unfortunate  way  it  is  unpredictable
389              what  the  IMC will do. Therefore, if flashrom detects an active
390              IMC it will disable write support unless the user forces it with
391              the
392
393                flashrom -p internal:amd_imc_force=yes
394
395              syntax.  The  user is responsible for supplying a suitable image
396              or leaving out the IMC region with the help of  a  layout  file.
397              This  limitation  might  be removed in the future when we under‐
398              stand the details better and have received enough feedback  from
399              users.  Please  report the outcome if you had to use this option
400              to write a chip.
401
402              An optional spispeed parameter specifies the  frequency  of  the
403              SPI  bus where applicable (i.e. SB600 or later with an SPI flash
404              chip directly attached to the chipset).  Syntax is
405
406                flashrom -p internal:spispeed=frequency
407
408              where frequency can be '16.5 MHz', '22 MHz', '33 MHz', '66 MHz',
409              '100 MHZ',  or  '800 kHz'.   Support  of  individual frequencies
410              depends on the generation of the chipset:
411
412              * SB6xx, SB7xx, SP5xxx: from 16.5 MHz up to and including 33 MHz
413
414              * SB8xx, SB9xx, Hudson: from 16.5 MHz up to and including 66 MHz
415
416              * Yangtze (with SPI 100 engine as found in Kabini  and  Tamesh):
417              all of them
418
419              The default is to use 16.5 MHz and disable Fast Reads.
420
421       Intel chipsets
422
423              If  you  have an Intel chipset with an ICH8 or later southbridge
424              with SPI flash attached, and if a valid descriptor  was  written
425              to  it (e.g. by the vendor), the chipset provides an alternative
426              way to access the flash chip(s) named Hardware  Sequencing.   It
427              is  much  simpler than the normal access method (called Software
428              Sequencing), but does not allow the software to choose  the  SPI
429              commands to be sent.  You can use the
430
431                flashrom -p internal:ich_spi_mode=value
432
433              syntax  where value can be auto, swseq or hwseq.  By default (or
434              when setting ich_spi_mode=auto) the module tries  to  use  swseq
435              and  only  activates hwseq if need be (e.g. if important opcodes
436              are inaccessible due to lockdown; or if more than one flash chip
437              is  attached).  The  other  options  (swseq,  hwseq)  select the
438              respective mode (if possible).
439
440              ICH8 and later southbridges may also have locked address  ranges
441              of  different kinds if a valid descriptor was written to it. The
442              flash address space is then partitioned in  multiple  so  called
443              "Flash  Regions"  containing  the host firmware, the ME firmware
444              and so on respectively. The flash descriptor can also specify up
445              to  5  so  called  "Protected  Regions", which are freely chosen
446              address  ranges  independent  from  the  aforementioned   "Flash
447              Regions".  All  of them can be write and/or read protected indi‐
448              vidually. If flashrom detects such a lock it will disable  write
449              support unless the user forces it with the
450
451                flashrom -p internal:ich_spi_force=yes
452
453              syntax. If this leads to erase or write accesses to the flash it
454              would most probably bring it into an inconsistent and unbootable
455              state and we will not provide any support in such a case.
456
457              If  you  have an Intel chipset with an ICH2 or later southbridge
458              and if you want to set specific IDSEL values for  a  non-default
459              flash chip or an embedded controller (EC), you can use the
460
461                flashrom -p internal:fwh_idsel=value
462
463              syntax  where  value  is  the 48-bit hexadecimal raw value to be
464              written in the IDSEL registers of  the  Intel  southbridge.  The
465              upper  32  bits  use one hex digit each per 512 kB range between
466              0xffc00000 and 0xffffffff, and the lower 16  bits  use  one  hex
467              digit  each per 1024 kB range between 0xff400000 and 0xff7fffff.
468              The rightmost hex digit  corresponds  with  the  lowest  address
469              range. All address ranges have a corresponding sister range 4 MB
470              below with identical IDSEL settings. The default value for  ICH7
471              is given in the example below.
472
473              Example: flashrom -p internal:fwh_idsel=0x001122334567
474
475       Laptops
476
477              Using  flashrom on laptops is dangerous and may easily make your
478              hardware unusable (see also the BUGS section). The embedded con‐
479              troller (EC) in these machines often interacts badly with flash‐
480              ing.  More information is in the wiki ⟨https://flashrom.org/Lap
481              tops⟩.   For  example  the  EC firmware sometimes resides on the
482              same flash chip as the host firmware. While  flashrom  tries  to
483              change  the  contents  of that memory the EC might need to fetch
484              new instructions or data from it and  could  stop  working  cor‐
485              rectly.  Probing for and reading from the chip may also irritate
486              your  EC  and  cause  fan  failure,  backlight  failure,  sudden
487              poweroff,  and  other  nasty  effects.  flashrom will attempt to
488              detect if it is running on a laptop and  abort  immediately  for
489              safety  reasons  if  it  clearly identifies the host computer as
490              one. If you want to proceed anyway at your own risk, use
491
492                flashrom -p internal:laptop=force_I_want_a_brick
493
494              We will not help you if you force flashing on a  laptop  because
495              this is a really dumb idea.
496
497              You have been warned.
498
499              Currently  we rely on the chassis type encoded in the DMI/SMBIOS
500              data to detect laptops. Some vendors  did  not  implement  those
501              bits  correctly  or  set  them  to  generic and/or dummy values.
502              flashrom will then issue a warning and bail out like  above.  In
503              this case you can use
504
505                flashrom -p internal:laptop=this_is_not_a_laptop
506
507              to  tell flashrom (at your own risk) that it is not running on a
508              laptop.
509
510   dummy programmer
511              The dummy programmer operates on a buffer  in  memory  only.  It
512              provides a safe and fast way to test various aspects of flashrom
513              and is mainly used in development and while  debugging.   It  is
514              able  to  emulate  some  chips  to a certain degree (basic iden‐
515              tify/read/erase/write operations work).
516
517              An optional parameter specifies the bus types it should support.
518              For that you have to use the
519
520                flashrom -p dummy:bus=[type[+type[+type]]]
521
522              syntax  where  type can be parallel, lpc, fwh, spi in any order.
523              If you specify bus without type, all buses will be disabled.  If
524              you do not specify bus, all buses will be enabled.
525
526              Example: flashrom -p dummy:bus=lpc+fwh
527
528              The dummy programmer supports flash chip emulation for automated
529              self-tests without hardware access. If you  want  to  emulate  a
530              flash chip, use the
531
532                flashrom -p dummy:emulate=chip
533
534              syntax  where chip is one of the following chips (please specify
535              only the chip name, not the vendor):
536
537              * ST M25P10.RES SPI flash chip (128 kB, RES, page write)
538
539              * SST SST25VF040.REMS SPI flash chip (512 kB, REMS, byte write)
540
541              * SST SST25VF032B SPI flash chip (4096 kB, RDID, AAI write)
542
543              * Macronix MX25L6436 SPI flash chip (8192 kB, RDID, SFDP)
544
545              Example: flashrom -p dummy:emulate=SST25VF040.REMS
546
547       Persistent images
548
549              If you use flash chip  emulation,  flash  image  persistence  is
550              available as well by using the
551
552                flashrom -p dummy:emulate=chip,image=image.rom
553
554              syntax where image.rom is the file where the simulated chip con‐
555              tents are read on flashrom startup and where the  chip  contents
556              on flashrom shutdown are written to.
557
558              Example: flashrom -p dummy:emulate=M25P10.RES,image=dummy.bin
559
560       SPI write chunk size
561
562              If  you  use  SPI flash chip emulation for a chip which supports
563              SPI page write with the default opcode, you can set the  maximum
564              allowed write chunk size with the
565
566                flashrom -p dummy:emulate=chip,spi_write_256_chunksize=size
567
568              syntax where size is the number of bytes (min. 1, max. 256).
569
570              Example:
571
572                flashrom -p dummy:emulate=M25P10.RES,spi_write_256_chunksize=5
573
574       SPI blacklist
575
576              To  simulate a programmer which refuses to send certain SPI com‐
577              mands to the flash chip, you can specify a blacklist of SPI com‐
578              mands with the
579
580                flashrom -p dummy:spi_blacklist=commandlist
581
582              syntax where commandlist is a list of two-digit hexadecimal rep‐
583              resentations of SPI  commands.  If  commandlist  is  e.g.  0302,
584              flashrom  will  behave  as  if the SPI controller refuses to run
585              command 0x03 (READ) and command 0x02 (WRITE).   commandlist  may
586              be  up  to  512  characters (256 commands) long.  Implementation
587              note: flashrom will detect an error during command execution.
588
589
590       SPI ignorelist
591
592              To simulate a flash chip which ignores (doesn't support) certain
593              SPI commands, you can specify an ignorelist of SPI commands with
594              the
595
596                flashrom -p dummy:spi_ignorelist=commandlist
597
598              syntax where commandlist is a list of two-digit hexadecimal rep‐
599              resentations  of  SPI commands. If commandlist is e.g. 0302, the
600              emulated flash chip will ignore command 0x03 (READ) and  command
601              0x02 (WRITE).  commandlist may be up to 512 characters (256 com‐
602              mands) long.  Implementation  note:  flashrom  won't  detect  an
603              error during command execution.
604
605
606       SPI status register
607
608              You  can specify the initial content of the chip's status regis‐
609              ter with the
610
611                flashrom -p dummy:spi_status=content
612
613              syntax where content is an 8-bit hexadecimal value.
614
615   nic3com, nicrealtek, nicnatsemi, nicintel,  nicintel_eeprom,  nicintel_spi,
616       gfxnvidia,   ogp_spi,  drkaiser,  satasii,  satamv,  atahpt,  atavia  ,
617       atapromise and it8212 programmers
618              These programmers have an option to specify the PCI  address  of
619              the  card your want to use, which must be specified if more than
620              one card supported by the selected programmer  is  installed  in
621              your system. The syntax is
622
623                flashrom -p xxxx:pci=bb:dd.f,
624
625              where xxxx is the name of the programmer, bb is the PCI bus num‐
626              ber, dd is the PCI device number, and f is the PCI function num‐
627              ber of the desired device.
628
629              Example: flashrom -p nic3com:pci=05:04.0
630
631   atavia programmer
632              Due  to  the mysterious address handling of the VIA VT6421A con‐
633              troller the user can specify an offset with the
634
635                flashrom -p atavia:offset=addr
636
637              syntax where addr will be interpreted as usual (leading  0x  (0)
638              for  hexadecimal  (octal)  values,  or  else decimal).  For more
639              information      please      see       its       wiki       page
640https://flashrom.org/VT6421A⟩.
641
642   atapromise programmer
643              This programmer is currently limited to 32 kB, regardless of the
644              actual size of the flash chip. This stems from the fact that, on
645              the  tested  device  (a Promise Ultra100), not all of the chip's
646              address lines were actually connected. You may use this program‐
647              mer  to  flash  firmware  updates, since these are only 16 kB in
648              size (padding to 32 kB is required).
649
650   nicintel_eeprom programmer
651              This is the first programmer module in flashrom  that  does  not
652              provide access to NOR flash chips but EEPROMs mounted on gigabit
653              Ethernet cards based on Intel's 82580 NIC. Because EEPROMs  nor‐
654              mally  do  not  announce  their  size nor allow themselves to be
655              identified, the controller relies on correct size values written
656              to  predefined  addresses within the chip. Flashrom follows this
657              scheme but assumes the minimum size of 16  kB  (128  kb)  if  an
658              unprogrammed  EEPROM/card is detected. Intel specifies following
659              EEPROMs to be compatible: Atmel AT25128,  AT25256,  Micron  (ST)
660              M95128, M95256 and OnSemi (Catalyst) CAT25CS128.
661
662   ft2232_spi programmer
663              This   module   supports   various  programmers  based  on  FTDI
664              FT2232/FT4232H/FT232H  chips  including  the  DLP  Design   DLP-
665              USB1232H,     openbiosprog-spi,     Amontec     JTAGkey/JTAGkey-
666              tiny/JTAGkey-2, Dangerous Prototypes Bus  Blaster,  Olimex  ARM-
667              USB-TINY/-H, Olimex ARM-USB-OCD/-H, OpenMoko Neo1973 Debug board
668              (V2+), TIAO/DIYGADGET USB Multi-Protocol Adapter (TUMPA),  TUMPA
669              Lite, GOEPEL PicoTAP and Google Servo v1/v2.
670
671              An  optional  parameter  specifies the controller type and chan‐
672              nel/interface/port it should support. For that you have  to  use
673              the
674
675                flashrom -p ft2232_spi:type=model,port=interface
676
677              syntax  where  model  can  be  2232H, 4232H, 232H, jtagkey, bus‐
678              blaster, openmoko,  arm-usb-tiny,  arm-usb-tiny-h,  arm-usb-ocd,
679              arm-usb-ocd-h,  tumpa, tumpalite, picotap, google-servo, google-
680              servo-v2 or google-servo-v2-legacy and interface can be A, B, C,
681              or  D.   The default model is 4232H and the default interface is
682              A.
683
684              If there is more  than  one  ft2232_spi-compatible  device  con‐
685              nected,  you  can  select which one should be used by specifying
686              its serial number with the
687
688                flashrom -p ft2232_spi:serial=number
689
690              syntax where number is the serial number of  the  device  (which
691              can be found for example in the output of lsusb -v).
692
693              All  models supported by the ft2232_spi driver can configure the
694              SPI clock rate by setting a divisor.  The  expressible  divisors
695              are  all  even numbers between 2 and 2^17 (=131072) resulting in
696              SPI clock frequencies of 6 MHz down to about 92 Hz  for  12  MHz
697              inputs. The default divisor is set to 2, but you can use another
698              one by specifying the optional divisor parameter with the
699
700                flashrom -p ft2232_spi:divisor=div
701
702              syntax.
703
704   serprog programmer
705              This module supports all programmers speaking the serprog proto‐
706              col. This includes some Arduino-based devices as well as various
707              programmers by Urja Rannikko, Juhana Helovuo, Stefan Tauner, Chi
708              Zhang and many others.
709
710              A mandatory parameter specifies either a serial device (and baud
711              rate) or an IP/port combination for communicating with the  pro‐
712              grammer.  The device/baud combination has to start with dev= and
713              separate the optional baud rate with a colon.  For example
714
715                flashrom -p serprog:dev=/dev/ttyS0:115200
716
717              If no baud rate is given the default  values  by  the  operating
718              system/hardware  will  be  used.  For IP connections you have to
719              use the
720
721                flashrom -p serprog:ip=ipaddr:port
722
723              syntax.  In case the device supports it, you  can  set  the  SPI
724              clock  frequency  with the optional spispeed parameter. The fre‐
725              quency is parsed as hertz, unless an M, or k  suffix  is  given,
726              then megahertz or kilohertz are used respectively.  Example that
727              sets the frequency to 2 MHz:
728
729                flashrom -p serprog:dev=/dev/device:baud,spispeed=2M
730
731              More information about serprog is  available  in  serprog-proto‐
732              col.txt in the source distribution.
733
734   buspirate_spi programmer
735              A  required  dev  parameter specifies the Bus Pirate device node
736              and an optional spispeed parameter specifies  the  frequency  of
737              the SPI bus. The parameter delimiter is a comma. Syntax is
738
739                flashrom -p buspirate_spi:dev=/dev/device,spispeed=frequency
740
741              where  frequency  can be 30k, 125k, 250k, 1M, 2M, 2.6M, 4M or 8M
742              (in Hz). The default is the maximum frequency of 8 MHz.
743
744              An optional pullups parameter  specifies  the  use  of  the  Bus
745              Pirate internal pull-up resistors. This may be needed if you are
746              working with a flash ROM chip that you have  physically  removed
747              from the board. Syntax is
748
749                flashrom -p buspirate_spi:pullups=state
750
751              where  state  can  be on or off.  More information about the Bus
752              Pirate pull-up resistors and their purpose  is  available  in  a
753              guide     by     dangerousprototypes     ⟨http://dangerousproto
754              types.com/docs/Practical_guide_to_Bus_Pirate_pull-up_resistors⟩.
755              Only  the  external supply voltage (Vpu) is supported as of this
756              writing.
757
758   pickit2_spi programmer
759              An optional voltage parameter specifies the voltage the  PICkit2
760              should  use.  The  default unit is Volt if no unit is specified.
761              You can use mV, millivolt, V or Volt as unit  specifier.  Syntax
762              is
763
764                flashrom -p pickit2_spi:voltage=value
765
766              where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
767
768              An  optional  spispeed  parameter specifies the frequency of the
769              SPI bus. Syntax is
770
771                flashrom -p pickit2_spi:spispeed=frequency
772
773              where frequency can be 250k, 333k,  500k  or  1M  (in  Hz).  The
774              default is a frequency of 1 MHz.
775
776   dediprog programmer
777              An optional voltage parameter specifies the voltage the Dediprog
778              should use. The default unit is Volt if no  unit  is  specified.
779              You  can  use mV, milliVolt, V or Volt as unit specifier. Syntax
780              is
781
782                flashrom -p dediprog:voltage=value
783
784              where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
785
786              An optional device parameter specifies which  of  multiple  con‐
787              nected  Dediprog  devices  should be used.  Please be aware that
788              the order depends on libusb's usb_get_busses() function and that
789              the  numbering  starts at 0.  Usage example to select the second
790              device:
791
792                flashrom -p dediprog:device=1
793
794              An optional spispeed parameter specifies the  frequency  of  the
795              SPI  bus. The firmware on the device needs to be 5.0.0 or newer.
796              Syntax is
797
798                flashrom -p dediprog:spispeed=frequency
799
800              where frequency can be 375k, 750k, 1.5M, 2.18M, 3M, 8M,  12M  or
801              24M (in Hz). The default is a frequency of 12 MHz.
802
803              An  optional target parameter specifies which target chip should
804              be used. Syntax is
805
806                flashrom -p dediprog:target=value
807
808              where value can be 1 or 2 to select target chip 1 or  2  respec‐
809              tively. The default is target chip 1.
810
811   rayer_spi programmer
812              The default I/O base address used for the parallel port is 0x378
813              and you can use the optional  iobase  parameter  to  specify  an
814              alternate base I/O address with the
815
816                flashrom -p rayer_spi:iobase=baseaddr
817
818              syntax  where  baseaddr is base I/O port address of the parallel
819              port, which must be a multiple of four. Make sure to not  forget
820              the "0x" prefix for hexadecimal port addresses.
821
822              The  default  cable  type  is  the  RayeR cable. You can use the
823              optional type parameter to specify the cable type with the
824
825                flashrom -p rayer_spi:type=model
826
827              syntax where model can be  rayer  for  the  RayeR  cable,  byte‐
828              blastermv  for  the  Altera  ByteBlasterMV, stk200 for the Atmel
829              STK200/300, wiggler for the Macraigor Wiggler,  xilinx  for  the
830              Xilinx Parallel Cable III (DLC 5), or spi_tt for SPI Tiny Tools-
831              compatible hardware.
832
833              More information  about  the  RayeR  hardware  is  available  at
834              RayeR's  website  ⟨http://rayer.g6.cz/elektro/spipgm.htm⟩.   The
835              Altera ByteBlasterMV  datasheet  can  be  obtained  from  Altera
836http://www.altera.co.jp/literature/ds/dsbytemv.pdf⟩.   For more
837              information  about  the  Macraigor  Wiggler  see  their  company
838              homepage  ⟨http://www.macraigor.com/wiggler.htm⟩.  The schematic
839              of the Xilinx DLC  5  was  published  in  a  Xilinx  user  guide
840http://www.xilinx.com/support/documentation/user_guides/xtp029.pdf⟩.
841
842   pony_spi programmer
843              The serial port (like /dev/ttyS0, /dev/ttyUSB0 on Linux or  COM3
844              on  windows) is specified using the mandatory dev parameter. The
845              adapter type is selectable between SI-Prog (used for SPI devices
846              with   PonyProg   2000)  or  a  custom  made  serial  bitbanging
847              programmer named "serbang". The optional type parameter  accepts
848              the values "si_prog" (default) or "serbang".
849
850              Information  about  the  SI-Prog  adapter  can  be  found at its
851              website ⟨http://www.lancos.com/siprogsch.html⟩.
852
853              An example call to flashrom is
854
855                flashrom -p pony_spi:dev=/dev/ttyS0,type=serbang
856
857              Please note that while USB-to-serial adapters work under certain
858              circumstances, this slows down operation considerably.
859
860   ogp_spi programmer
861              The  flash  ROM  chip  to  access must be specified with the rom
862              parameter.
863
864                flashrom -p ogp_spi:rom=name
865
866              Where name is either cprom or s3 for the configuration  ROM  and
867              bprom  or bios for the BIOS ROM. If more than one card supported
868              by the ogp_spi programmer is installed in your system, you  have
869              to  specify the PCI address of the card you want to use with the
870              pci= parameter as explained in the nic3com et al. section above.
871
872   linux_spi programmer
873              You have to specify the SPI controller to use with the
874
875                flashrom -p linux_spi:dev=/dev/spidevX.Y
876
877              syntax where /dev/spidevX.Y is the Linux device  node  for  your
878              SPI controller.
879
880              In  case  the  device  supports  it,  you  can set the SPI clock
881              frequency with the optional spispeed parameter. The frequency is
882              parsed as kilohertz.  Example that sets the frequency to 8 MHz:
883
884                flashrom -p linux_spi:dev=/dev/spidevX.Y,spispeed=8000
885
886              Please note that the linux_spi driver only works on Linux.
887
888   mstarddc_spi programmer
889              The  Display Data Channel (DDC) is an I2C bus present on VGA and
890              DVI connectors, that allows  exchanging  information  between  a
891              computer and attached displays. Its most common uses are getting
892              display capabilities through EDID  (at  I2C  address  0x50)  and
893              sending  commands  to  the display using the DDC/CI protocol (at
894              address 0x37). On displays driven by  MSTAR  SoCs,  it  is  also
895              possible  to access the SoC firmware flash (connected to the Soc
896              through another SPI bus) using an  In-System  Programming  (ISP)
897              port,  usually at address 0x49.  This flashrom module allows the
898              latter via Linux's I2C driver.
899
900              IMPORTANT: Before using this programmer, the display MUST be  in
901              standby  mode,  and only connected to the computer that will run
902              flashrom using a VGA  cable,  to  an  inactive  VGA  output.  It
903              absolutely MUST NOT be used as a display during the procedure!
904
905              You  have  to  specify the DDC/I2C controller and I2C address to
906              use with the
907
908                flashrom -p mstarddc_spi:dev=/dev/i2c-X:YY
909
910              syntax where /dev/i2c-X is the Linux device node  for  your  I2C
911              controller connected to the display's DDC channel, and YY is the
912              (hexadecimal) address of the MSTAR ISP  port  (address  0x49  is
913              usually  used).  Example that uses I2C controller /dev/i2c-1 and
914              address 0x49:
915
916                flashrom -p mstarddc_spi:dev=/dev/i2c-1:49
917
918              It is also  possible  to  inhibit  the  reset  command  that  is
919              normally  sent  to  the  display  once the flashrom operation is
920              completed using the optional noreset parameter.  A  value  of  1
921              prevents  flashrom from sending the reset command.  Example that
922              does not reset the display at the end of the operation:
923
924                flashrom -p mstarddc_spi:dev=/dev/i2c-1:49,noreset=1
925
926              Please note that sending the reset command is also inhibited  if
927              an  error  occurred  during  the  operation.   To send the reset
928              command afterwards, you can simply run flashrom  once  more,  in
929              chip  probe  mode  (not  specifying  an  operation), without the
930              noreset parameter,  once  the  flash  read/write  operation  you
931              intended to perform has completed successfully.
932
933              Please  also  note  that  the  mstarddc_spi driver only works on
934              Linux.
935
936   ch341a_spi programmer
937       The WCH CH341A programmer does not support  any  parameters  currently.
938       SPI frequency is fixed at 2 MHz, and CS0 is used as per the device.
939

EXAMPLES

941       To back up and update your BIOS, run
942
943       flashrom -p internal -r backup.rom -o backuplog.txt
944       flashrom -p internal -w newbios.rom -o writelog.txt
945
946       Please  make  sure to copy backup.rom to some external media before you
947       try to write. That makes offline recovery easier.
948       If writing fails and flashrom complains about  the  chip  being  in  an
949       unknown state, you can try to restore the backup by running
950
951       flashrom -p internal -w backup.rom -o restorelog.txt
952
953       If   you   encounter   any  problems,  please  contact  us  and  supply
954       backuplog.txt, writelog.txt and restorelog.txt. See  section  BUGS  for
955       contact info.
956

EXIT STATUS

958       flashrom  exits  with  0 on success, 1 on most failures but with 3 if a
959       call to mmap() fails.
960

REQUIREMENTS

962       flashrom needs different access permissions for different programmers.
963
964       internal needs raw memory access, PCI configuration space  access,  raw
965       I/O port access (x86) and MSR access (x86).
966
967       atavia needs PCI configuration space access.
968
969       nic3com,  nicrealtek  and  nicnatsemi need PCI configuration space read
970       access and raw I/O port access.
971
972       atahpt needs PCI configuration space access and raw I/O port access.
973
974       gfxnvidia, drkaiser and it8212 need PCI configuration space access  and
975       raw memory access.
976
977       rayer_spi needs raw I/O port access.
978
979       satasii,   nicintel,   nicintel_eeprom   and   nicintel_spi   need  PCI
980       configuration space read access and raw memory access.
981
982       satamv and atapromise need PCI configuration space read access, raw I/O
983       port access and raw memory access.
984
985       serprog needs TCP access to the network or userspace access to a serial
986       port.
987
988       buspirate_spi needs userspace access to a serial port.
989
990       ft2232_spi,  usbblaster_spi  and  pickit2_spi  need   access   to   the
991       respective USB device via libusb API version 0.1.
992
993       ch341a_spi  and  dediprog  need access to the respective USB device via
994       libusb API version 1.0.
995
996       dummy needs no access permissions at all.
997
998       internal,  nic3com,  nicrealtek,   nicnatsemi,   gfxnvidia,   drkaiser,
999       satasii,  satamv,  atahpt,  atavia  and  atapromise  have  to be run as
1000       superuser/root, and need additional raw access permission.
1001
1002       serprog,   buspirate_spi,   dediprog,    usbblaster_spi,    ft2232_spi,
1003       pickit2_spi  and ch341a_spi can be run as normal user on most operating
1004       systems if appropriate device permissions are set.
1005
1006       ogp needs PCI configuration space read access and raw memory access.
1007
1008       On  OpenBSD,  you  can  obtain  raw  access   permission   by   setting
1009       securelevel=-1  in /etc/rc.securelevel and rebooting, or rebooting into
1010       single user mode.
1011

BUGS

1013       Please   report   any   bugs   to    the    flashrom    mailing    list
1014flashrom@flashrom.org⟩.
1015
1016       We         recommend         to        subscribe        first        at
1017       https://flashrom.org/mailman/listinfo/flashrom.
1018
1019       Many of the developers communicate via the  #flashrom  IRC  channel  on
1020       chat.freenode.net.   If  you  don't have an IRC client, you can use the
1021       freenode webchat ⟨http://webchat.freenode.net/?channels=flashrom⟩.  You
1022       are  welcome to join and ask questions, send us bug and success reports
1023       there too. Please provide a way to  contact  you  later  (e.g.  a  mail
1024       address)  and  be  patient  if there is no immediate reaction. Also, we
1025       provide a pastebin service ⟨https://paste.flashrom.org⟩  that  is  very
1026       useful when you want to share logs etc. without spamming the channel.
1027
1028   Laptops
1029       Using  flashrom  on  laptops  is  dangerous  and  may  easily make your
1030       hardware unusable. flashrom will attempt to detect if it is running  on
1031       a  laptop  and  abort  immediately  for  safety reasons. Please see the
1032       detailed discussion of this topic and associated  flashrom  options  in
1033       the  Laptops  paragraph  in  the  internal programmer subsection of the
1034       PROGRAMMER-SPECIFIC INFORMATION section and the information in our wiki
1035https://flashrom.org/Laptops⟩.
1036
1037   One-time programmable (OTP) memory and unique IDs
1038       Some  flash  chips  contain  OTP  memory  often  denoted  as  "security
1039       registers".  They usually have a capacity in the range of some bytes to
1040       a  few  hundred  bytes  and can be used to give devices unique IDs etc.
1041       flashrom is not able to read or write these memories and may  therefore
1042       not  be  able  to  duplicate a chip completely. For chip types known to
1043       include OTP memories a warning is printed when they are detected.
1044
1045       Similar to OTP memories are  unique,  factory  programmed,  unforgeable
1046       IDs.  They are not modifiable by the user at all.
1047

LICENSE

1049       flashrom is covered by the GNU General Public License (GPL), version 2.
1050       Some files are additionally available under any later  version  of  the
1051       GPL.
1052
1054       Please see the individual files.
1055

AUTHORS

1057       Andrew Morgan
1058       Carl-Daniel Hailfinger
1059       Claus Gindhart
1060       David Borg
1061       David Hendricks
1062       Dominik Geyer
1063       Eric Biederman
1064       Giampiero Giancipoli
1065       Helge Wagner
1066       Idwer Vollering
1067       Joe Bao
1068       Joerg Fischer
1069       Joshua Roys
1070       Kyösti Mälkki
1071       Luc Verhaegen
1072       Li-Ta Lo
1073       Mark Marshall
1074       Markus Boas
1075       Mattias Mattsson
1076       Michael Karcher
1077       Nikolay Petukhov
1078       Patrick Georgi
1079       Peter Lemenkov
1080       Peter Stuge
1081       Reinder E.N. de Haan
1082       Ronald G. Minnich
1083       Ronald Hoogenboom
1084       Sean Nelson
1085       Stefan Reinauer
1086       Stefan Tauner
1087       Stefan Wildemann
1088       Stephan Guilloux
1089       Steven James
1090       Urja Rannikko
1091       Uwe Hermann
1092       Wang Qingpei
1093       Yinghai Lu
1094       some others, please see the flashrom svn changelog for details.
1095       All   still  active  authors  can  be  reached  via  the  mailing  list
1096flashrom@flashrom.org⟩.
1097
1098       This manual page was written by Uwe Hermann ⟨uwe@hermann-uwe.de⟩, Carl-
1099       Daniel  Hailfinger, Stefan Tauner and others.  It is licensed under the
1100       terms of the GNU GPL (version 2 or later).
1101
1102
1103
1104v1.0                              2017-06-14                       FLASHROM(8)
Impressum