1FLASHROM(8) System Manager's Manual FLASHROM(8)
2
6 flashrom - detect, read, write, verify and erase flash chips
7
9 flashrom [-h|-R|-L|-z|
10 -p <programmername>[:<parameters>] [-c <chipname>]
11 (--flash-name|--flash-size|
12 [-E|-r <file>|-w <file>|-v <file>]
13 [(-l <file>|--ifd| --fmap|--fmap-file <file>) [-i
14 <image>]]
15 [-n] [-N] [-f])]
16 [-V[V[V]]] [-o <logfile>]
17
19 flashrom is a utility for detecting, reading, writing, verifying and
20 erasing flash chips. It's often used to flash BIOS/EFI/core‐
21 boot/firmware images in-system using a supported mainboard. However, it
22 also supports various external PCI/USB/parallel-port/serial-port based
23 devices which can program flash chips, including some network cards
24 (NICs), SATA/IDE controller cards, graphics cards, the Bus Pirate
25 device, various FTDI FT2232/FT4232H/FT232H based USB devices, and more.
26 It supports a wide range of DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32,
28 TSOP40, TSOP48, and BGA chips, which use various protocols such as LPC,
29 FWH, parallel flash, or SPI.
30
32 IMPORTANT: Please note that the command line interface for flashrom
33 will change before flashrom 1.0. Do not use flashrom in scripts or
34 other automated tools without checking that your flashrom version won't
35 interpret options in a different way.
36 You can specify one of -h, -R, -L, -z, -E, -r, -w, -v or no operation.
38 If no operation is specified, flashrom will only probe for flash chips.
39 It is recommended that if you try flashrom the first time on a system,
40 you run it in probe-only mode and check the output. Also you are
41 advised to make a backup of your current ROM contents with -r before
42 you try to write a new image. All operations involving any chip access
43 (probe/read/write/...) require the -p/--programmer option to be used
44 (please see below).
45 -r, --read <file>
47 Read flash ROM contents and save them into the given <file>. If
48 the file already exists, it will be overwritten.
49 -w, --write <file>
51 Write <file> into flash ROM. This will first automatically erase
52 the chip, then write to it.
53 In the process the chip is also read several times. First an in-
55 memory backup is made for disaster recovery and to be able to
56 skip regions that are already equal to the image file. This copy
57 is updated along with the write operation. In case of erase
58 errors it is even re-read completely. After writing has finished
59 and if verification is enabled, the whole flash chip is read out
60 and compared with the input image.
61 -n, --noverify
63 Skip the automatic verification of flash ROM contents after
64 writing. Using this option is not recommended, you should only
65 use it if you know what you are doing and if you feel that the
66 time for verification takes too long.
67 Typical usage is: flashrom -p prog -n -w <file>
69 This option is only useful in combination with --write.
71 -N, --noverify-all
73 Skip not included regions during automatic verification after
74 writing (cf. -l and -i). You should only use this option if
75 you are sure that communication with the flash chip is reliable
76 (e.g. when using the internal programmer). Even if flashrom is
77 instructed not to touch parts of the flash chip, their contents
78 could be damaged (e.g. due to misunderstood erase commands).
79 This option is required to flash an Intel system with locked ME
81 flash region using the internal programmer. It may be enabled by
82 default in this case in the future.
83 -v, --verify <file>
85 Verify the flash ROM contents against the given <file>.
86 -E, --erase
88 Erase the flash ROM chip.
89 -V, --verbose
91 More verbose output. This option can be supplied multiple times
92 (max. 3 times, i.e. -VVV) for even more debug output.
93 -c, --chip <chipname>
95 Probe only for the specified flash ROM chip. This option takes
96 the chip name as printed by flashrom -L without the vendor name
97 as parameter. Please note that the chip name is case sensitive.
98 -f, --force
100 Force one or more of the following actions:
101 * Force chip read and pretend the chip is there.
103 * Force chip access even if the chip is bigger than the maximum
105 supported size for the flash bus.
106 * Force erase even if erase is known bad.
108 * Force write even if write is known bad.
110 -l, --layout <file>
112 Read ROM layout from <file>.
113 flashrom supports ROM layouts. This allows you to flash certain
115 parts of the flash chip only. A ROM layout file contains multi‐
116 ple lines with the following syntax:
117 startaddr:endaddr imagename
119 startaddr and endaddr are hexadecimal addresses within the ROM
121 file and do not refer to any physical address. Please note that
122 using a 0x prefix for those hexadecimal numbers is not neces‐
123 sary, but you can't specify decimal/octal numbers. imagename is
124 an arbitrary name for the region/image from startaddr to
125 endaddr (both addresses included).
126 Example:
128 00000000:00008fff gfxrom
130 00009000:0003ffff normal
131 00040000:0007ffff fallback
132 If you only want to update the image named normal in a ROM based
134 on the layout above, run
135 flashrom -p prog --layout rom.layout --image normal -w
137 some.rom
138 To update only the images named normal and fallback, run:
140 flashrom -p prog -l rom.layout -i normal -i fallback -w
142 some.rom
143 Overlapping sections are not supported.
145 --fmap Read layout from fmap in flash chip.
147 flashrom supports the fmap binary format which is commonly used
149 by coreboot for partitioning a flash chip. The on-chip fmap will
150 be read and used to generate the layout.
151 If you only want to update the COREBOOT region defined in the
153 fmap, run
154 flashrom -p prog --fmap --image COREBOOT -w some.rom
156 --fmap-file <file>
158 Read layout from a <file> containing binary fmap (e.g. coreboot
159 roms).
160 flashrom supports the fmap binary format which is commonly used
162 by coreboot for partitioning a flash chip. The fmap in the spec‐
163 ified file will be read and used to generate the layout.
164 If you only want to update the COREBOOT region defined in the
166 binary fmap file, run
167 flashrom -p prog --fmap-file some.rom --image COREBOOT -w
169 some.rom
170 --ifd Read ROM layout from Intel Firmware Descriptor.
172 flashrom supports ROM layouts given by an Intel Firmware
174 Descriptor (IFD). The on-chip descriptor will be read and used
175 to generate the layout. If you need to change the layout, you
176 have to update the IFD only first.
177 The following ROM images may be present in an IFD:
179 fd the IFD itself
181 bios the host firmware aka. BIOS
182 me Intel Management Engine firmware
183 gbe gigabit ethernet firmware
184 pd platform specific data
185 -i, --image <imagename>
187 Only flash region/image <imagename> from flash layout.
188 --flash-name
190 Prints out the detected flash chips name.
191 --flash-size
193 Prints out the detected flash chips size.
194 -L, --list-supported
196 List the flash chips, chipsets, mainboards, and external pro‐
197 grammers (including PCI, USB, parallel port, and serial port
198 based devices) supported by flashrom.
199 There are many unlisted boards which will work out of the box,
201 without special support in flashrom. Please let us know if you
202 can verify that other boards work or do not work out of the box.
203 IMPORTANT: For verification you have to test an ERASE and/or
205 WRITE operation, so make sure you only do that if you have
206 proper means to recover from failure!
207 -z, --list-supported-wiki
209 Same as --list-supported, but outputs the supported hardware in
210 MediaWiki syntax, so that it can be easily pasted into the sup‐
211 ported hardware wiki page ⟨https://flashrom.org/Supported_hard‐
212 ware⟩. Please note that MediaWiki output is not compiled in by
213 default.
214 -p, --programmer <name>[:parameter[,parameter[,parameter]]]
216 Specify the programmer device. This is mandatory for all opera‐
217 tions involving any chip access (probe/read/write/...). Cur‐
218 rently supported are:
219 * internal (for in-system flashing in the mainboard)
221 * dummy (virtual programmer for testing flashrom)
223 * nic3com (for flash ROMs on 3COM network cards)
225 * nicrealtek (for flash ROMs on Realtek and SMC 1211 network
227 cards)
228 * nicnatsemi (for flash ROMs on National Semiconductor DP838*
230 network cards)
231 * nicintel (for parallel flash ROMs on Intel 10/100Mbit network
233 cards)
234 * gfxnvidia (for flash ROMs on NVIDIA graphics cards)
236 * drkaiser (for flash ROMs on Dr. Kaiser PC-Waechter PCI cards)
238 * satasii (for flash ROMs on Silicon Image SATA/IDE controllers)
240 * satamv (for flash ROMs on Marvell SATA controllers)
242 * atahpt (for flash ROMs on Highpoint ATA/RAID controllers)
244 * atavia (for flash ROMs on VIA VT6421A SATA controllers)
246 * atapromise (for flash ROMs on Promise PDC2026x ATA/RAID con‐
248 trollers)
249 * it8212 (for flash ROMs on ITE IT8212F ATA/RAID controller)
251 * ft2232_spi (for SPI flash ROMs attached to an
253 FT2232/FT4232H/FT232H family based USB SPI programmer).
254 * serprog (for flash ROMs attached to a programmer speaking ser‐
256 prog, including some Arduino-based devices).
257 * buspirate_spi (for SPI flash ROMs attached to a Bus Pirate)
259 * dediprog (for SPI flash ROMs attached to a Dediprog SF100)
261 * rayer_spi (for SPI flash ROMs attached to a parallel port by
263 one of various cable types)
264 * pony_spi (for SPI flash ROMs attached to a SI-Prog serial port
266 bitbanging adapter)
267 * nicintel_spi (for SPI flash ROMs on Intel Gigabit network
269 cards)
270 * ogp_spi (for SPI flash ROMs on Open Graphics Project graphics
272 card)
273 * linux_mtd (for SPI flash ROMs accessible via /dev/mtdX on
275 Linux)
276 * linux_spi (for SPI flash ROMs accessible via /dev/spidevX.Y on
278 Linux)
279 * usbblaster_spi (for SPI flash ROMs attached to an Altera USB-
281 Blaster compatible cable)
282 * nicintel_eeprom (for SPI EEPROMs on Intel Gigabit network
284 cards)
285 * mstarddc_spi (for SPI flash ROMs accessible through DDC in
287 MSTAR-equipped displays)
288 * pickit2_spi (for SPI flash ROMs accessible via Microchip
290 PICkit2)
291 * ch341a_spi (for SPI flash ROMs attached to WCH CH341A)
293 * digilent_spi (for SPI flash ROMs attached to iCEblink40 devel‐
295 opment boards)
296 * jlink_spi (for SPI flash ROMs attached to SEGGER J-Link and
298 compatible devices)
299 * ni845x_spi (for SPI flash ROMs attached to National Instru‐
301 ments USB-8451 or USB-8452)
302 * stlinkv3_spi (for SPI flash ROMs attached to STMicroelectron‐
304 ics STLINK V3 devices)
305 Some programmers have optional or mandatory parameters which are
307 described in detail in the PROGRAMMER-SPECIFIC INFORMATION sec‐
308 tion. Support for some programmers can be disabled at compile
309 time. flashrom -h lists all supported programmers.
310 -h, --help
312 Show a help text and exit.
313 -o, --output <logfile>
315 Save the full debug log to <logfile>. If the file already
316 exists, it will be overwritten. This is the recommended way to
317 gather logs from flashrom because they will be verbose even if
318 the on-screen messages are not verbose and don't require output
319 redirection.
320 -R, --version
322 Show version information and exit.
323
325 Some programmer drivers accept further parameters to set programmer-
326 specific parameters. These parameters are separated from the programmer
327 name by a colon. While some programmers take arguments at fixed posi‐
328 tions, other programmers use a key/value interface in which the key and
329 value is separated by an equal sign and different pairs are separated
330 by a comma or a colon.
331 internal programmer
333 Board Enables
334 Some mainboards require to run mainboard specific code to enable
336 flash erase and write support (and probe support on old systems
337 with parallel flash). The mainboard brand and model (if it
338 requires specific code) is usually autodetected using one of the
339 following mechanisms: If your system is running coreboot, the
340 mainboard type is determined from the coreboot table. Other‐
341 wise, the mainboard is detected by examining the onboard PCI
342 devices and possibly DMI info. If PCI and DMI do not contain
343 information to uniquely identify the mainboard (which is the
344 exception), or if you want to override the detected mainboard
345 model, you can specify the mainboard using the
346 flashrom -p internal:mainboard=<vendor>:<board> syntax.
348 See the 'Known boards' or 'Known laptops' section in the output
350 of 'flashrom -L' for a list of boards which require the specifi‐
351 cation of the board name, if no coreboot table is found.
352 Some of these board-specific flash enabling functions (called
354 board enables) in flashrom have not yet been tested. If your
355 mainboard is detected needing an untested board enable function,
356 a warning message is printed and the board enable is not exe‐
357 cuted, because a wrong board enable function might cause the
358 system to behave erratically, as board enable functions touch
359 the low-level internals of a mainboard. Not executing a board
360 enable function (if one is needed) might cause detection or
361 erasing failure. If your board protects only part of the flash
362 (commonly the top end, called boot block), flashrom might
363 encounter an error only after erasing the unprotected part, so
364 running without the board-enable function might be dangerous for
365 erase and write (which includes erase).
366 The suggested procedure for a mainboard with untested board spe‐
368 cific code is to first try to probe the ROM (just invoke
369 flashrom and check that it detects your flash chip type) without
370 running the board enable code (i.e. without any parameters). If
371 it finds your chip, fine. Otherwise, retry probing your chip
372 with the board-enable code running, using
373 flashrom -p internal:boardenable=force
375 If your chip is still not detected, the board enable code seems
377 to be broken or the flash chip unsupported. Otherwise, make a
378 backup of your current ROM contents (using -r) and store it to a
379 medium outside of your computer, like a USB drive or a network
380 share. If you needed to run the board enable code already for
381 probing, use it for reading too. If reading succeeds and the
382 contens of the read file look legit you can try to write the new
383 image. You should enable the board enable code in any case now,
384 as it has been written because it is known that writing/erasing
385 without the board enable is going to fail. In any case (success
386 or failure), please report to the flashrom mailing list, see
387 below.
388 Coreboot
391 On systems running coreboot, flashrom checks whether the desired
393 image matches your mainboard. This needs some special board ID
394 to be present in the image. If flashrom detects that the image
395 you want to write and the current board do not match, it will
396 refuse to write the image unless you specify
397 flashrom -p internal:boardmismatch=force
399 ITE IT87 Super I/O
401 If your mainboard is manufactured by GIGABYTE and supports Dual‐
403 BIOS it is very likely that it uses an ITE IT87 series Super I/O
404 to switch between the two flash chips. Only one of them can be
405 accessed at a time and you can manually select which one to use
406 with the
407 flashrom -p internal:dualbiosindex=chip
409 syntax where chip is the index of the chip to use (0 = main, 1 =
411 backup). You can check which one is currently selected by leav‐
412 ing out the chip parameter.
413 If your mainboard uses an ITE IT87 series Super I/O for
415 LPC<->SPI flash bus translation, flashrom should autodetect that
416 configuration. If you want to set the I/O base port of the IT87
417 series SPI controller manually instead of using the value pro‐
418 vided by the BIOS, use the
419 flashrom -p internal:it87spiport=portnum
421 syntax where portnum is the I/O port number (must be a multiple
423 of 8). In the unlikely case flashrom doesn't detect an active
424 IT87 LPC<->SPI bridge, please send a bug report so we can diag‐
425 nose the problem.
426 AMD chipsets
429 Beginning with the SB700 chipset there is an integrated micro‐
431 controller (IMC) based on the 8051 embedded in every AMD south‐
432 bridge. Its firmware resides in the same flash chip as the
433 host's which makes writing to the flash risky if the IMC is
434 active. Flashrom tries to temporarily disable the IMC but even
435 then changing the contents of the flash can have unwanted
436 effects: when the IMC continues (at the latest after a reboot)
437 it will continue executing code from the flash. If the code was
438 removed or changed in an unfortunate way it is unpredictable
439 what the IMC will do. Therefore, if flashrom detects an active
440 IMC it will disable write support unless the user forces it with
441 the
442 flashrom -p internal:amd_imc_force=yes
444 syntax. The user is responsible for supplying a suitable image
446 or leaving out the IMC region with the help of a layout file.
447 This limitation might be removed in the future when we under‐
448 stand the details better and have received enough feedback from
449 users. Please report the outcome if you had to use this option
450 to write a chip.
451 An optional spispeed parameter specifies the frequency of the
453 SPI bus where applicable (i.e. SB600 or later with an SPI flash
454 chip directly attached to the chipset). Syntax is
455 flashrom -p internal:spispeed=frequency
457 where frequency can be '16.5 MHz', '22 MHz', '33 MHz', '66 MHz',
459 '100 MHZ', or '800 kHz'. Support of individual frequencies
460 depends on the generation of the chipset:
461 * SB6xx, SB7xx, SP5xxx: from 16.5 MHz up to and including 33 MHz
463 * SB8xx, SB9xx, Hudson: from 16.5 MHz up to and including 66 MHz
465 * Yangtze (with SPI 100 engine as found in Kabini and Tamesh):
467 all of them
468 The default is to use 16.5 MHz and disable Fast Reads.
470 Intel chipsets
472 If you have an Intel chipset with an ICH8 or later southbridge
474 with SPI flash attached, and if a valid descriptor was written
475 to it (e.g. by the vendor), the chipset provides an alternative
476 way to access the flash chip(s) named Hardware Sequencing. It
477 is much simpler than the normal access method (called Software
478 Sequencing), but does not allow the software to choose the SPI
479 commands to be sent. You can use the
480 flashrom -p internal:ich_spi_mode=value
482 syntax where value can be auto, swseq or hwseq. By default (or
484 when setting ich_spi_mode=auto) the module tries to use swseq
485 and only activates hwseq if need be (e.g. if important opcodes
486 are inaccessible due to lockdown; or if more than one flash chip
487 is attached). The other options (swseq, hwseq) select the
488 respective mode (if possible).
489 ICH8 and later southbridges may also have locked address ranges
491 of different kinds if a valid descriptor was written to it. The
492 flash address space is then partitioned in multiple so called
493 "Flash Regions" containing the host firmware, the ME firmware
494 and so on respectively. The flash descriptor can also specify up
495 to 5 so called "Protected Regions", which are freely chosen
496 address ranges independent from the aforementioned "Flash
497 Regions". All of them can be write and/or read protected indi‐
498 vidually.
499 If you have an Intel chipset with an ICH2 or later southbridge
501 and if you want to set specific IDSEL values for a non-default
502 flash chip or an embedded controller (EC), you can use the
503 flashrom -p internal:fwh_idsel=value
505 syntax where value is the 48-bit hexadecimal raw value to be
507 written in the IDSEL registers of the Intel southbridge. The
508 upper 32 bits use one hex digit each per 512 kB range between
509 0xffc00000 and 0xffffffff, and the lower 16 bits use one hex
510 digit each per 1024 kB range between 0xff400000 and 0xff7fffff.
511 The rightmost hex digit corresponds with the lowest address
512 range. All address ranges have a corresponding sister range 4 MB
513 below with identical IDSEL settings. The default value for ICH7
514 is given in the example below.
515 Example: flashrom -p internal:fwh_idsel=0x001122334567
517 Laptops
519 Using flashrom on older laptops that don't boot from the SPI bus
521 is dangerous and may easily make your hardware unusable (see
522 also the BUGS section). The embedded controller (EC) in some
523 machines may interact badly with flashing. More information is
524 in the wiki ⟨https://flashrom.org/Laptops⟩. Problems occur when
525 the flash chip is shared between BIOS and EC firmware, and the
526 latter does not expect flashrom to access the chip. While
527 flashrom tries to change the contents of that memory the EC
528 might need to fetch new instructions or data from it and could
529 stop working correctly. Probing for and reading from the chip
530 may also irritate your EC and cause fan failure, backlight fail‐
531 ure, sudden poweroff, and other nasty effects. flashrom will
532 attempt to detect if it is running on such a laptop and limit
533 probing to SPI buses. If you want to probe the LPC bus anyway at
534 your own risk, use
535 flashrom -p internal:laptop=force_I_want_a_brick
537 We will not help you if you force flashing on a laptop because
539 this is a really dumb idea.
540 You have been warned.
542 Currently we rely on the chassis type encoded in the DMI/SMBIOS
544 data to detect laptops. Some vendors did not implement those
545 bits correctly or set them to generic and/or dummy values.
546 flashrom will then issue a warning and restrict buses like
547 above. In this case you can use
548 flashrom -p internal:laptop=this_is_not_a_laptop
550 to tell flashrom (at your own risk) that it is not running on a
552 laptop.
553 dummy programmer
555 The dummy programmer operates on a buffer in memory only. It
556 provides a safe and fast way to test various aspects of flashrom
557 and is mainly used in development and while debugging. It is
558 able to emulate some chips to a certain degree (basic iden‐
559 tify/read/erase/write operations work).
560 An optional parameter specifies the bus types it should support.
562 For that you have to use the
563 flashrom -p dummy:bus=[type[+type[+type]]]
565 syntax where type can be parallel, lpc, fwh, spi in any order.
567 If you specify bus without type, all buses will be disabled. If
568 you do not specify bus, all buses will be enabled.
569 Example: flashrom -p dummy:bus=lpc+fwh
571 The dummy programmer supports flash chip emulation for automated
573 self-tests without hardware access. If you want to emulate a
574 flash chip, use the
575 flashrom -p dummy:emulate=chip
577 syntax where chip is one of the following chips (please specify
579 only the chip name, not the vendor):
580 * ST M25P10.RES SPI flash chip (128 kB, RES, page write)
582 * SST SST25VF040.REMS SPI flash chip (512 kB, REMS, byte write)
584 * SST SST25VF032B SPI flash chip (4096 kB, RDID, AAI write)
586 * Macronix MX25L6436 SPI flash chip (8192 kB, RDID, SFDP)
588 Example: flashrom -p dummy:emulate=SST25VF040.REMS
590 Persistent images
592 If you use flash chip emulation, flash image persistence is
594 available as well by using the
595 flashrom -p dummy:emulate=chip,image=image.rom
597 syntax where image.rom is the file where the simulated chip con‐
599 tents are read on flashrom startup and where the chip contents
600 on flashrom shutdown are written to.
601 Example: flashrom -p dummy:emulate=M25P10.RES,image=dummy.bin
603 SPI write chunk size
605 If you use SPI flash chip emulation for a chip which supports
607 SPI page write with the default opcode, you can set the maximum
608 allowed write chunk size with the
609 flashrom -p dummy:emulate=chip,spi_write_256_chunksize=size
611 syntax where size is the number of bytes (min. 1, max. 256).
613 Example:
615 flashrom -p dummy:emulate=M25P10.RES,spi_write_256_chunksize=5
617 SPI blacklist
619 To simulate a programmer which refuses to send certain SPI com‐
621 mands to the flash chip, you can specify a blacklist of SPI com‐
622 mands with the
623 flashrom -p dummy:spi_blacklist=commandlist
625 syntax where commandlist is a list of two-digit hexadecimal rep‐
627 resentations of SPI commands. If commandlist is e.g. 0302,
628 flashrom will behave as if the SPI controller refuses to run
629 command 0x03 (READ) and command 0x02 (WRITE). commandlist may
630 be up to 512 characters (256 commands) long. Implementation
631 note: flashrom will detect an error during command execution.
632 SPI ignorelist
635 To simulate a flash chip which ignores (doesn't support) certain
637 SPI commands, you can specify an ignorelist of SPI commands with
638 the
639 flashrom -p dummy:spi_ignorelist=commandlist
641 syntax where commandlist is a list of two-digit hexadecimal rep‐
643 resentations of SPI commands. If commandlist is e.g. 0302, the
644 emulated flash chip will ignore command 0x03 (READ) and command
645 0x02 (WRITE). commandlist may be up to 512 characters (256 com‐
646 mands) long. Implementation note: flashrom won't detect an
647 error during command execution.
648 SPI status register
651 You can specify the initial content of the chip's status regis‐
653 ter with the
654 flashrom -p dummy:spi_status=content
656 syntax where content is an 8-bit hexadecimal value.
658 nic3com, nicrealtek, nicnatsemi, nicintel, nicintel_eeprom, nicintel_spi,
660 gfxnvidia, ogp_spi, drkaiser, satasii, satamv, atahpt, atavia ,
661 atapromise and it8212 programmers
662 These programmers have an option to specify the PCI address of
663 the card your want to use, which must be specified if more than
664 one card supported by the selected programmer is installed in
665 your system. The syntax is
666 flashrom -p xxxx:pci=bb:dd.f,
668 where xxxx is the name of the programmer, bb is the PCI bus num‐
670 ber, dd is the PCI device number, and f is the PCI function num‐
671 ber of the desired device.
672 Example: flashrom -p nic3com:pci=05:04.0
674 atavia programmer
676 Due to the mysterious address handling of the VIA VT6421A con‐
677 troller the user can specify an offset with the
678 flashrom -p atavia:offset=addr
680 syntax where addr will be interpreted as usual (leading 0x (0)
682 for hexadecimal (octal) values, or else decimal). For more
683 information please see its wiki page
684 ⟨https://flashrom.org/VT6421A⟩.
685 atapromise programmer
687 This programmer is currently limited to 32 kB, regardless of the
688 actual size of the flash chip. This stems from the fact that, on
689 the tested device (a Promise Ultra100), not all of the chip's
690 address lines were actually connected. You may use this program‐
691 mer to flash firmware updates, since these are only 16 kB in
692 size (padding to 32 kB is required).
693 nicintel_eeprom programmer
695 This is the first programmer module in flashrom that does not
696 provide access to NOR flash chips but EEPROMs mounted on gigabit
697 Ethernet cards based on Intel's 82580 NIC. Because EEPROMs nor‐
698 mally do not announce their size nor allow themselves to be
699 identified, the controller relies on correct size values written
700 to predefined addresses within the chip. Flashrom follows this
701 scheme but assumes the minimum size of 16 kB (128 kb) if an
702 unprogrammed EEPROM/card is detected. Intel specifies following
703 EEPROMs to be compatible: Atmel AT25128, AT25256, Micron (ST)
704 M95128, M95256 and OnSemi (Catalyst) CAT25CS128.
705 ft2232_spi programmer
707 This module supports various programmers based on FTDI
708 FT2232/FT4232H/FT232H chips including the DLP Design DLP-
709 USB1232H, openbiosprog-spi, Amontec JTAGkey/JTAGkey-
710 tiny/JTAGkey-2, Dangerous Prototypes Bus Blaster, Olimex ARM-
711 USB-TINY/-H, Olimex ARM-USB-OCD/-H, OpenMoko Neo1973 Debug board
712 (V2+), TIAO/DIYGADGET USB Multi-Protocol Adapter (TUMPA), TUMPA
713 Lite, GOEPEL PicoTAP, Google Servo v1/v2 and Tin Can Tools Fly‐
714 swatter/Flyswatter 2.
715 An optional parameter specifies the controller type, chan‐
717 nel/interface/port and GPIO-based chip select it should support.
718 For that you have to use the
719 flashrom -p ft2232_spi:type=model,port=interface,csgpiol=gpio
721 syntax where model can be 2232H, 4232H, 232H, jtagkey, bus‐
723 blaster, openmoko, arm-usb-tiny, arm-usb-tiny-h, arm-usb-ocd,
724 arm-usb-ocd-h, tumpa, tumpalite, picotap, google-servo, google-
725 servo-v2 or google-servo-v2-legacy interface can be A, B, C, or
726 D and csgpiol can be a number between 0 and 3, denoting
727 GPIOL0-GPIOL3 correspondingly. The default model is 4232H the
728 default interface is A and GPIO is not used by default.
729 If there is more than one ft2232_spi-compatible device con‐
731 nected, you can select which one should be used by specifying
732 its serial number with the
733 flashrom -p ft2232_spi:serial=number
735 syntax where number is the serial number of the device (which
737 can be found for example in the output of lsusb -v).
738 All models supported by the ft2232_spi driver can configure the
740 SPI clock rate by setting a divisor. The expressible divisors
741 are all even numbers between 2 and 2^17 (=131072) resulting in
742 SPI clock frequencies of 6 MHz down to about 92 Hz for 12 MHz
743 inputs. The default divisor is set to 2, but you can use another
744 one by specifying the optional divisor parameter with the
745 flashrom -p ft2232_spi:divisor=div
747 syntax.
749 serprog programmer
751 This module supports all programmers speaking the serprog proto‐
752 col. This includes some Arduino-based devices as well as various
753 programmers by Urja Rannikko, Juhana Helovuo, Stefan Tauner, Chi
754 Zhang and many others.
755 A mandatory parameter specifies either a serial device (and baud
757 rate) or an IP/port combination for communicating with the pro‐
758 grammer. The device/baud combination has to start with dev= and
759 separate the optional baud rate with a colon. For example
760 flashrom -p serprog:dev=/dev/ttyS0:115200
762 If no baud rate is given the default values by the operating
764 system/hardware will be used. For IP connections you have to
765 use the
766 flashrom -p serprog:ip=ipaddr:port
768 syntax. In case the device supports it, you can set the SPI
770 clock frequency with the optional spispeed parameter. The fre‐
771 quency is parsed as hertz, unless an M, or k suffix is given,
772 then megahertz or kilohertz are used respectively. Example that
773 sets the frequency to 2 MHz:
774 flashrom -p serprog:dev=/dev/device:baud,spispeed=2M
776 More information about serprog is available in serprog-proto‐
778 col.txt in the source distribution.
779 buspirate_spi programmer
781 A required dev parameter specifies the Bus Pirate device node
782 and an optional spispeed parameter specifies the frequency of
783 the SPI bus. The parameter delimiter is a comma. Syntax is
784 flashrom -p buspirate_spi:dev=/dev/device,spispeed=frequency
786 where frequency can be 30k, 125k, 250k, 1M, 2M, 2.6M, 4M or 8M
788 (in Hz). The default is the maximum frequency of 8 MHz.
789 The baud rate for communication between the host and the Bus
791 Pirate can be specified with the optional serialspeed parameter.
792 Syntax is
793 flashrom -p buspirate_spi:serialspeed=baud
795 where baud can be 115200, 230400, 250000 or 2000000 (2M). The
797 default is 2M baud for Bus Pirate hardware version 3.0 and
798 greater, and 115200 otherwise.
799 An optional pullups parameter specifies the use of the Bus
801 Pirate internal pull-up resistors. This may be needed if you are
802 working with a flash ROM chip that you have physically removed
803 from the board. Syntax is
804 flashrom -p buspirate_spi:pullups=state
806 where state can be on or off. More information about the Bus
808 Pirate pull-up resistors and their purpose is available in a
809 guide by dangerousprototypes ⟨http://dangerousproto‐
810 types.com/docs/Practical_guide_to_Bus_Pirate_pull-up_resistors⟩.
811 Only the external supply voltage (Vpu) is supported as of this
812 writing.
813 pickit2_spi programmer
815 An optional voltage parameter specifies the voltage the PICkit2
816 should use. The default unit is Volt if no unit is specified.
817 You can use mV, millivolt, V or Volt as unit specifier. Syntax
818 is
819 flashrom -p pickit2_spi:voltage=value
821 where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
823 An optional spispeed parameter specifies the frequency of the
825 SPI bus. Syntax is
826 flashrom -p pickit2_spi:spispeed=frequency
828 where frequency can be 250k, 333k, 500k or 1M (in Hz). The
830 default is a frequency of 1 MHz.
831 dediprog programmer
833 An optional voltage parameter specifies the voltage the Dediprog
834 should use. The default unit is Volt if no unit is specified.
835 You can use mV, milliVolt, V or Volt as unit specifier. Syntax
836 is
837 flashrom -p dediprog:voltage=value
839 where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
841 An optional device parameter specifies which of multiple con‐
843 nected Dediprog devices should be used. Please be aware that
844 the order depends on libusb's usb_get_busses() function and that
845 the numbering starts at 0. Usage example to select the second
846 device:
847 flashrom -p dediprog:device=1
849 An optional spispeed parameter specifies the frequency of the
851 SPI bus. The firmware on the device needs to be 5.0.0 or newer.
852 Syntax is
853 flashrom -p dediprog:spispeed=frequency
855 where frequency can be 375k, 750k, 1.5M, 2.18M, 3M, 8M, 12M or
857 24M (in Hz). The default is a frequency of 12 MHz.
858 An optional target parameter specifies which target chip should
860 be used. Syntax is
861 flashrom -p dediprog:target=value
863 where value can be 1 or 2 to select target chip 1 or 2 respec‐
865 tively. The default is target chip 1.
866 rayer_spi programmer
868 The default I/O base address used for the parallel port is 0x378
869 and you can use the optional iobase parameter to specify an
870 alternate base I/O address with the
871 flashrom -p rayer_spi:iobase=baseaddr
873 syntax where baseaddr is base I/O port address of the parallel
875 port, which must be a multiple of four. Make sure to not forget
876 the "0x" prefix for hexadecimal port addresses.
877 The default cable type is the RayeR cable. You can use the
879 optional type parameter to specify the cable type with the
880 flashrom -p rayer_spi:type=model
882 syntax where model can be rayer for the RayeR cable, byte‐
884 blastermv for the Altera ByteBlasterMV, stk200 for the Atmel
885 STK200/300, wiggler for the Macraigor Wiggler, xilinx for the
886 Xilinx Parallel Cable III (DLC 5), or spi_tt for SPI Tiny Tools-
887 compatible hardware.
888 More information about the RayeR hardware is available at
890 RayeR's website ⟨http://rayer.g6.cz/elektro/spipgm.htm⟩. The
891 Altera ByteBlasterMV datasheet can be obtained from Altera
892 ⟨http://www.altera.co.jp/literature/ds/dsbytemv.pdf⟩. For more
893 information about the Macraigor Wiggler see their company
894 homepage ⟨http://www.macraigor.com/wiggler.htm⟩. The schematic
895 of the Xilinx DLC 5 was published in a Xilinx user guide
896 ⟨http://www.xilinx.com/support/documentation/user_guides/xtp029.pdf⟩.
897 pony_spi programmer
899 The serial port (like /dev/ttyS0, /dev/ttyUSB0 on Linux or COM3
900 on windows) is specified using the mandatory dev parameter. The
901 adapter type is selectable between SI-Prog (used for SPI devices
902 with PonyProg 2000) or a custom made serial bitbanging
903 programmer named "serbang". The optional type parameter accepts
904 the values "si_prog" (default) or "serbang".
905 Information about the SI-Prog adapter can be found at its
907 website ⟨http://www.lancos.com/siprogsch.html⟩.
908 An example call to flashrom is
910 flashrom -p pony_spi:dev=/dev/ttyS0,type=serbang
912 Please note that while USB-to-serial adapters work under certain
914 circumstances, this slows down operation considerably.
915 ogp_spi programmer
917 The flash ROM chip to access must be specified with the rom
918 parameter.
919 flashrom -p ogp_spi:rom=name
921 Where name is either cprom or s3 for the configuration ROM and
923 bprom or bios for the BIOS ROM. If more than one card supported
924 by the ogp_spi programmer is installed in your system, you have
925 to specify the PCI address of the card you want to use with the
926 pci= parameter as explained in the nic3com et al. section above.
927 linux_mtd programmer
929 You may specify the MTD device to use with the
930 flashrom -p linux_mtd:dev=/dev/mtdX
932 syntax where /dev/mtdX is the Linux device node for your MTD
934 device. If left unspecified the first MTD device found (e.g.
935 /dev/mtd0) will be used by default.
936 Please note that the linux_mtd driver only works on Linux.
938 linux_spi programmer
940 You have to specify the SPI controller to use with the
941 flashrom -p linux_spi:dev=/dev/spidevX.Y
943 syntax where /dev/spidevX.Y is the Linux device node for your
945 SPI controller.
946 In case the device supports it, you can set the SPI clock
948 frequency with the optional spispeed parameter. The frequency is
949 parsed as kilohertz. Example that sets the frequency to 8 MHz:
950 flashrom -p linux_spi:dev=/dev/spidevX.Y,spispeed=8000
952 Please note that the linux_spi driver only works on Linux.
954 mstarddc_spi programmer
956 The Display Data Channel (DDC) is an I2C bus present on VGA and
957 DVI connectors, that allows exchanging information between a
958 computer and attached displays. Its most common uses are getting
959 display capabilities through EDID (at I2C address 0x50) and
960 sending commands to the display using the DDC/CI protocol (at
961 address 0x37). On displays driven by MSTAR SoCs, it is also
962 possible to access the SoC firmware flash (connected to the Soc
963 through another SPI bus) using an In-System Programming (ISP)
964 port, usually at address 0x49. This flashrom module allows the
965 latter via Linux's I2C driver.
966 IMPORTANT: Before using this programmer, the display MUST be in
968 standby mode, and only connected to the computer that will run
969 flashrom using a VGA cable, to an inactive VGA output. It
970 absolutely MUST NOT be used as a display during the procedure!
971 You have to specify the DDC/I2C controller and I2C address to
973 use with the
974 flashrom -p mstarddc_spi:dev=/dev/i2c-X:YY
976 syntax where /dev/i2c-X is the Linux device node for your I2C
978 controller connected to the display's DDC channel, and YY is the
979 (hexadecimal) address of the MSTAR ISP port (address 0x49 is
980 usually used). Example that uses I2C controller /dev/i2c-1 and
981 address 0x49:
982 flashrom -p mstarddc_spi:dev=/dev/i2c-1:49
984 It is also possible to inhibit the reset command that is
986 normally sent to the display once the flashrom operation is
987 completed using the optional noreset parameter. A value of 1
988 prevents flashrom from sending the reset command. Example that
989 does not reset the display at the end of the operation:
990 flashrom -p mstarddc_spi:dev=/dev/i2c-1:49,noreset=1
992 Please note that sending the reset command is also inhibited if
994 an error occurred during the operation. To send the reset
995 command afterwards, you can simply run flashrom once more, in
996 chip probe mode (not specifying an operation), without the
997 noreset parameter, once the flash read/write operation you
998 intended to perform has completed successfully.
999 Please also note that the mstarddc_spi driver only works on
1001 Linux.
1002 ch341a_spi programmer
1004 The WCH CH341A programmer does not support any parameters currently.
1005 SPI frequency is fixed at 2 MHz, and CS0 is used as per the device.
1006 ni845x_spi programmer
1008 An optional voltage parameter could be used to specify the IO
1009 voltage. This parameter is available for the NI USB-8452 device.
1010 The default unit is Volt if no unit is specified. You can use
1011 mV, milliVolt, V or Volt as unit specifier. Syntax is
1012 flashrom -p ni845x_spi:voltage=value
1014 where value can be 1.2V, 1.5V, 1.8V, 2.5V, 3.3V or the
1016 equivalent in mV.
1017 In the case if none of the programmer's supported IO voltage is
1019 within the supported voltage range of the detected flash chip
1020 the flashrom will abort the operation (to prevent damaging the
1021 flash chip). You can override this behaviour by passing "yes"
1022 to the ignore_io_voltage_limits parameter (for e.g. if you are
1023 using an external voltage translator circuit). Syntax is
1024 flashrom -p ni845x_spi:ignore_io_voltage_limits=yes
1026 You can use the serial parameter to explicitly specify which
1028 connected NI USB-845x device should be used. You should use
1029 your device's 7 digit hexadecimal serial number. Usage example
1030 to select the device with 1230A12 serial number:
1031 flashrom -p ni845x_spi:serial=1230A12
1033 An optional spispeed parameter specifies the frequency of the
1035 SPI bus. Syntax is
1036 flashrom -p ni845x_spi:spispeed=frequency
1038 where frequency should a number corresponding to the desired
1040 frequency in kHz. The maximum frequency is 12 MHz (12000 kHz)
1041 for the USB-8451 and 50 MHz (50000 kHz) for the USB-8452. The
1042 default is a frequency of 1 MHz (1000 kHz).
1043 An optional cs parameter specifies which target chip select line
1045 should be used. Syntax is
1046 flashrom -p ni845x_spi:csnumber=value
1048 where value should be between 0 and 7 By default the CS0 is
1050 used.
1051 digilent_spi programmer
1053 An optional spispeed parameter specifies the frequency of the
1054 SPI bus. Syntax is
1055 flashrom -p digilent_spi:spispeed=frequency
1057 where frequency can be 62.5k, 125k, 250k, 500k, 1M, 2M or 4M (in
1059 Hz). The default is a frequency of 4 MHz.
1060 jlink_spi programmer
1063 This module supports SEGGER J-Link and compatible devices.
1064 The MOSI signal of the flash chip must be attached to TDI pin of
1066 the programmer, MISO to TDO and SCK to TCK. The chip select
1067 (CS) signal of the flash chip can be attached to different pins
1068 of the programmer which can be selected with the
1069 flashrom -p jlink_spi:cs=pin
1071 syntax where pin can be either TRST or RESET. The default pin
1073 for chip select is RESET. Note that, when using RESET, it is
1074 normal that the indicator LED blinks orange or red.
1075 Additionally, the VTref pin of the programmer must be attached
1076 to the logic level of the flash chip. The programmer measures
1077 the voltage on this pin and generates the reference voltage for
1078 its input comparators and adapts its output voltages to it.
1079 Pinout for devices with 20-pin JTAG connector:
1081 +-------+
1083 | 1 2 | 1: VTref 2:
1084 | 3 4 | 3: TRST 4: GND
1085 | 5 6 | 5: TDI 6: GND
1086 +-+ 7 8 | 7: 8: GND
1087 | 9 10 | 9: TCK 10: GND
1088 | 11 12 | 11: 12: GND
1089 +-+ 13 14 | 13: TDO 14:
1090 | 15 16 | 15: RESET 16:
1091 | 17 18 | 17: 18:
1092 | 19 20 | 19: PWR_5V 20:
1093 +-------+
1094 If there is more than one compatible device connected, you can
1096 select which one should be used by specifying its serial number
1097 with the
1098 flashrom -p jlink_spi:serial=number
1100 syntax where number is the serial number of the device (which
1102 can be found for example in the output of lsusb -v).
1103 The SPI speed can be selected by using the
1105 flashrom -p jlink_spi:spispeed=frequency
1107 syntax where frequency is the SPI clock frequency in kHz. The
1109 maximum speed depends on the device in use.
1110 stlinkv3_spi programmer
1112 This module supports SPI flash programming through the
1113 STMicroelectronics STLINK V3 programmer/debugger's SPI bridge
1114 interface
1115 flashrom -p stlinkv3_spi
1117 If there is more than one compatible device connected, you can
1119 select which one should be used by specifying its serial number
1120 with the
1121 flashrom -p stlinkv3_spi:serial=number
1123 syntax where number is the serial number of the device (which
1125 can be found for example in the output of lsusb -v).
1126 The SPI speed can be selected by using the
1128 flashrom -p stlinkv3_spi:spispeed=frequency
1130 syntax where frequency is the SPI clock frequency in kHz. If
1132 the passed frequency is not supported by the adapter the nearest
1133 lower supported frequency will be used.
1134
1138 To back up and update your BIOS, run
1139 flashrom -p internal -r backup.rom -o backuplog.txt
1141 flashrom -p internal -w newbios.rom -o writelog.txt
1142 Please make sure to copy backup.rom to some external media before you
1144 try to write. That makes offline recovery easier.
1145 If writing fails and flashrom complains about the chip being in an
1146 unknown state, you can try to restore the backup by running
1147 flashrom -p internal -w backup.rom -o restorelog.txt
1149 If you encounter any problems, please contact us and supply
1151 backuplog.txt, writelog.txt and restorelog.txt. See section BUGS for
1152 contact info.
1153
1155 flashrom exits with 0 on success, 1 on most failures but with 3 if a
1156 call to mmap() fails.
1157
1159 flashrom needs different access permissions for different programmers.
1160 internal needs raw memory access, PCI configuration space access, raw
1162 I/O port access (x86) and MSR access (x86).
1163 atavia needs PCI configuration space access.
1165 nic3com, nicrealtek and nicnatsemi need PCI configuration space read
1167 access and raw I/O port access.
1168 atahpt needs PCI configuration space access and raw I/O port access.
1170 gfxnvidia, drkaiser and it8212 need PCI configuration space access and
1172 raw memory access.
1173 rayer_spi needs raw I/O port access.
1175 satasii, nicintel, nicintel_eeprom and nicintel_spi need PCI
1177 configuration space read access and raw memory access.
1178 satamv and atapromise need PCI configuration space read access, raw I/O
1180 port access and raw memory access.
1181 serprog needs TCP access to the network or userspace access to a serial
1183 port.
1184 buspirate_spi needs userspace access to a serial port.
1186 ft2232_spi, usbblaster_spi and pickit2_spi need access to the
1188 respective USB device via libusb API version 0.1.
1189 ch341a_spi and dediprog need access to the respective USB device via
1191 libusb API version 1.0.
1192 dummy needs no access permissions at all.
1194 internal, nic3com, nicrealtek, nicnatsemi, gfxnvidia, drkaiser,
1196 satasii, satamv, atahpt, atavia and atapromise have to be run as
1197 superuser/root, and need additional raw access permission.
1198 serprog, buspirate_spi, dediprog, usbblaster_spi, ft2232_spi,
1200 pickit2_spi, ch341a_spi and digilent_spi can be run as normal user on
1201 most operating systems if appropriate device permissions are set.
1202 ogp needs PCI configuration space read access and raw memory access.
1204 On OpenBSD, you can obtain raw access permission by setting
1206 securelevel=-1 in /etc/rc.securelevel and rebooting, or rebooting into
1207 single user mode.
1208
1210 Please report any bugs to the flashrom mailing list
1211 ⟨flashrom@flashrom.org⟩.
1212 We recommend to subscribe first at
1214 https://flashrom.org/mailman/listinfo/flashrom.
1215 Many of the developers communicate via the #flashrom IRC channel on
1217 chat.freenode.net. If you don't have an IRC client, you can use the
1218 freenode webchat ⟨http://webchat.freenode.net/?channels=flashrom⟩. You
1219 are welcome to join and ask questions, send us bug and success reports
1220 there too. Please provide a way to contact you later (e.g. a mail
1221 address) and be patient if there is no immediate reaction. Also, we
1222 provide a pastebin service ⟨https://paste.flashrom.org⟩ that is very
1223 useful when you want to share logs etc. without spamming the channel.
1224 Laptops
1226 Using flashrom on older laptops is dangerous and may easily make your
1227 hardware unusable. flashrom will attempt to detect if it is running on
1228 a susceptible laptop and restrict flash-chip probing for safety
1229 reasons. Please see the detailed discussion of this topic and
1230 associated flashrom options in the Laptops paragraph in the internal
1231 programmer subsection of the PROGRAMMER-SPECIFIC INFORMATION section
1232 and the information in our wiki ⟨https://flashrom.org/Laptops⟩.
1233 One-time programmable (OTP) memory and unique IDs
1235 Some flash chips contain OTP memory often denoted as "security
1236 registers". They usually have a capacity in the range of some bytes to
1237 a few hundred bytes and can be used to give devices unique IDs etc.
1238 flashrom is not able to read or write these memories and may therefore
1239 not be able to duplicate a chip completely. For chip types known to
1240 include OTP memories a warning is printed when they are detected.
1241 Similar to OTP memories are unique, factory programmed, unforgeable
1243 IDs. They are not modifiable by the user at all.
1244
1246 flashrom is covered by the GNU General Public License (GPL), version 2.
1247 Some files are additionally available under any later version of the
1248 GPL.
1249
1251 Please see the individual files.
1252
1254 Andrew Morgan
1255 Carl-Daniel Hailfinger
1256 Claus Gindhart
1257 David Borg
1258 David Hendricks
1259 Dominik Geyer
1260 Edward O'Callaghan
1261 Eric Biederman
1262 Giampiero Giancipoli
1263 Helge Wagner
1264 Idwer Vollering
1265 Joe Bao
1266 Joerg Fischer
1267 Joshua Roys
1268 Kyösti Mälkki
1269 Luc Verhaegen
1270 Li-Ta Lo
1271 Mark Marshall
1272 Markus Boas
1273 Mattias Mattsson
1274 Michael Karcher
1275 Nikolay Petukhov
1276 Patrick Georgi
1277 Peter Lemenkov
1278 Peter Stuge
1279 Reinder E.N. de Haan
1280 Ronald G. Minnich
1281 Ronald Hoogenboom
1282 Sean Nelson
1283 Stefan Reinauer
1284 Stefan Tauner
1285 Stefan Wildemann
1286 Stephan Guilloux
1287 Steven James
1288 Urja Rannikko
1289 Uwe Hermann
1290 Wang Qingpei
1291 Yinghai Lu
1292 some others, please see the flashrom svn changelog for details.
1293 All still active authors can be reached via the mailing list
1294 ⟨flashrom@flashrom.org⟩.
1295 This manual page was written by Uwe Hermann ⟨uwe@hermann-uwe.de⟩, Carl-
1297 Daniel Hailfinger, Stefan Tauner and others. It is licensed under the
1298 terms of the GNU GPL (version 2 or later).
1299 FLASHROM(8)