1FLASHROM(8) 2022-12-13 FLASHROM(8)
2
6 flashrom - detect, read, write, verify and erase flash chips
7
9 flashrom [-h|-R|-L|-z|
10 -p <programmername>[:<parameters>] [-c <chipname>]
11 (--flash-name|--flash-size|
12 [-E|-x|-r <file>|-w <file>|-v <file>]
13 [(-l <file>|--ifd| --fmap|--fmap-file <file>)
14 [-i <include>[:<file>]]]
15 [--wp-status] [--wp-list] [--wp-enable|--wp-disable]
16 [--wp-range <start>,<length>|--wp-region <region>]
17 [-n] [-N] [-f])]
18 [-V[V[V]]] [-o <logfile>]
19
21 flashrom is a utility for detecting, reading, writing, verifying and
22 erasing flash chips. It's often used to flash BIOS/EFI/core‐
23 boot/firmware images in-system using a supported mainboard. However, it
24 also supports various external PCI/USB/parallel-port/serial-port based
25 devices which can program flash chips, including some network cards
26 (NICs), SATA/IDE controller cards, graphics cards, the Bus Pirate de‐
27 vice, various FTDI FT2232/FT4232H/FT232H based USB devices, and more.
28 It supports a wide range of DIP32, PLCC32, DIP8, SO8/SOIC8, TSOP32,
30 TSOP40, TSOP48, and BGA chips, which use various protocols such as LPC,
31 FWH, parallel flash, or SPI.
32
34 You can specify one of -h, -R, -L, -z, -E, -r, -w, -v or no operation.
35 If no operation is specified, flashrom will only probe for flash chips.
36 It is recommended that if you try flashrom the first time on a system,
37 you run it in probe-only mode and check the output. Also you are ad‐
38 vised to make a backup of your current ROM contents with -r before you
39 try to write a new image. All operations involving any chip access
40 (probe/read/write/...) require the -p/--programmer option to be used
41 (please see below).
42 -r, --read <file>
44 Read flash ROM contents and save them into the given <file>. If
45 the file already exists, it will be overwritten.
46 -w, --write (<file>|-)
48 Write <file> into flash ROM. If - is provided instead, contents
49 will be read from stdin. This will first automatically
50 B erase the chip, then write to it.
51 In the process the chip is also read several times. First an in-
53 memory backup is made for disaster recovery and to be able to
54 skip regions that are already equal to the image file. This copy
55 is updated along with the write operation. In case of erase er‐
56 rors it is even re-read completely. After writing has finished
57 and if verification is enabled, the whole flash chip is read out
58 and compared with the input image.
59 -n, --noverify
61 Skip the automatic verification of flash ROM contents after
62 writing. Using this option is not recommended, you should only
63 use it if you know what you are doing and if you feel that the
64 time for verification takes too long.
65 Typical usage is: flashrom -p prog -n -w <file>
67 This option is only useful in combination with --write.
69 -N, --noverify-all
71 Skip not included regions during automatic verification after
72 writing (cf. -l and -i). You should only use this option if
73 you are sure that communication with the flash chip is reliable
74 (e.g. when using the internal programmer). Even if flashrom is
75 instructed not to touch parts of the flash chip, their contents
76 could be damaged (e.g. due to misunderstood erase commands).
77 This option is required to flash an Intel system with locked ME
79 flash region using the internal programmer. It may be enabled by
80 default in this case in the future.
81 -v, --verify (<file>|-)
83 Verify the flash ROM contents against the given <file>. If - is
84 provided instead, contents will be written to the stdout.
85 -E, --erase
87 Erase the flash ROM chip.
88 -x, --extract
90 Extract every region defined on the layout from flash ROM chip
91 to a file with the same name as the extracted region (replacing
92 spaces with underscores).
93 -V, --verbose
95 More verbose output. This option can be supplied multiple times
96 (max. 3 times, i.e. -VVV) for even more debug output.
97 -c, --chip <chipname>
99 Probe only for the specified flash ROM chip. This option takes
100 the chip name as printed by flashrom -L without the vendor name
101 as parameter. Please note that the chip name is case sensitive.
102 -f, --force
104 Force one or more of the following actions:
105 * Force chip read and pretend the chip is there.
107 * Force chip access even if the chip is bigger than the maximum
109 supported size for the flash bus.
110 * Force erase even if erase is known bad.
112 * Force write even if write is known bad.
114 -l, --layout <file>
116 Read ROM layout from <file>.
117 flashrom supports ROM layouts. This allows you to flash certain
119 parts of the flash chip only. A ROM layout file contains multi‐
120 ple lines with the following syntax:
121 startaddr:endaddr imagename
123 startaddr and endaddr are hexadecimal addresses within the ROM
125 file and do not refer to any physical address. Please note that
126 using a 0x prefix for those hexadecimal numbers is not neces‐
127 sary, but you can't specify decimal/octal numbers. imagename is
128 an arbitrary name for the region/image from startaddr to en‐
129 daddr (both addresses included).
130 Example:
132 00000000:00008fff gfxrom
134 00009000:0003ffff normal
135 00040000:0007ffff fallback
136 If you only want to update the image named normal in a ROM based
138 on the layout above, run
139 flashrom -p prog --layout rom.layout --image normal -w
141 some.rom
142 To update only the images named normal and fallback, run:
144 flashrom -p prog -l rom.layout -i normal -i fallback -w
146 some.rom
147 Overlapping sections are not supported.
149 --fmap Read layout from fmap in flash chip.
151 flashrom supports the fmap binary format which is commonly used
153 by coreboot for partitioning a flash chip. The on-chip fmap will
154 be read and used to generate the layout.
155 If you only want to update the COREBOOT region defined in the
157 fmap, run
158 flashrom -p prog --fmap --image COREBOOT -w some.rom
160 --fmap-file <file>
162 Read layout from a <file> containing binary fmap (e.g. coreboot
163 roms).
164 flashrom supports the fmap binary format which is commonly used
166 by coreboot for partitioning a flash chip. The fmap in the spec‐
167 ified file will be read and used to generate the layout.
168 If you only want to update the COREBOOT region defined in the
170 binary fmap file, run
171 flashrom -p prog --fmap-file some.rom --image COREBOOT -w
173 some.rom
174 --ifd Read ROM layout from Intel Firmware Descriptor.
176 flashrom supports ROM layouts given by an Intel Firmware De‐
178 scriptor (IFD). The on-chip descriptor will be read and used to
179 generate the layout. If you need to change the layout, you have
180 to update the IFD only first.
181 The following ROM images may be present in an IFD:
183 fd the IFD itself
185 bios the host firmware aka. BIOS
186 me Intel Management Engine firmware
187 gbe gigabit ethernet firmware
188 pd platform specific data
189 -i, --include <region>[:<file>]
191 Read or write only <region> to or from ROM. The -i option may
192 be used multiple times if the user wishes to read or write mul‐
193 tiple regions using a single command.
194 The user may optionally specify a corresponding <file> for any
196 region they wish to read or write. A read operation will read
197 the corresponding regions from ROM and write individual files
198 for each one. A write option will read file(s) and write to the
199 corresponding region(s) in ROM.
200 For write operations, files specified using -i take precedence
202 over content from the argument to -w.
203 Examples:
205 To read regions named foo and bar in layout file <layout> into
207 region-sized files foo.bin and bar.bin, run:
208 flashrom -p prog -l <layout> -i foo:foo.bin -i bar:bar.bin
210 -r rom.bin
211 To write files foo.bin and bar.bin into regions named foo and
213 bar in layout file <layout> to the ROM, run:
214 flashrom -p prog -l <layout> -i foo:foo.bin -i bar:bar.bin
216 -w rom.bin
217 --wp-status
219 Prints the flash's current status register protection mode and
220 write protection range.
221 --wp-list
223 Prints a list of all protection ranges that the flash supports.
224 --wp-enable
226 Enables hardware status register protection (SRP) if the flash
227 supports it. Once SRP is enabled, operations that change the
228 flash's status registers (including --wp-disable and --wp-range)
229 can only be performed if the flash's #WP pin is at an inactive
230 logic level.
231 --wp-disable
233 Disables status register protection if the flash allows it.
234 --wp-range <start>,<length>
236 Configures the flash to protect a range of addresses from
237 <start> to (<start> + <length> - 1), bounds inclusive. The range
238 must be supported by the flash, see --wp-list.
239 --wp-region <region>
241 Same as --wp-range but protects the range occupied by an image
242 region. This option requires a image layout to be specified,
243 see --layout. The region must be supported by the flash, see
244 --wp-list.
245 --flash-name
247 Prints out the detected flash chip's name.
248 --flash-size
250 Prints out the detected flash chip's size.
251 --flash-contents <ref-file>
253 The file contents of <ref-file> will be used to decide which
254 parts of the flash need to be written. Providing this saves an
255 initial read of the full flash chip. Be careful, if the provided
256 data doesn't actually match the flash contents, results are un‐
257 defined.
258 -L, --list-supported
260 List the flash chips, chipsets, mainboards, and external pro‐
261 grammers (including PCI, USB, parallel port, and serial port
262 based devices) supported by flashrom.
263 There are many unlisted boards which will work out of the box,
265 without special support in flashrom. Please let us know if you
266 can verify that other boards work or do not work out of the box.
267 IMPORTANT: For verification you have to test an ERASE and/or
269 WRITE operation, so make sure you only do that if you have
270 proper means to recover from failure!
271 -z, --list-supported-wiki
273 Same as --list-supported, but outputs the supported hardware in
274 MediaWiki syntax, so that it can be easily pasted into the sup‐
275 ported hardware wiki page ⟨https://flashrom.org/Supported_hard‐
276 ware⟩. Please note that MediaWiki output is not compiled in by
277 default.
278 -p, --programmer <name>[:parameter[,parameter[,parameter]]]
280 Specify the programmer device. This is mandatory for all opera‐
281 tions involving any chip access (probe/read/write/...). Cur‐
282 rently supported are:
283 * internal (for in-system flashing in the mainboard)
285 * dummy (virtual programmer for testing flashrom)
287 * nic3com (for flash ROMs on 3COM network cards)
289 * nicrealtek (for flash ROMs on Realtek and SMC 1211 network
291 cards)
292 * nicnatsemi (for flash ROMs on National Semiconductor DP838*
294 network cards)
295 * nicintel (for parallel flash ROMs on Intel 10/100Mbit network
297 cards)
298 * gfxnvidia (for flash ROMs on NVIDIA graphics cards)
300 * drkaiser (for flash ROMs on Dr. Kaiser PC-Waechter PCI cards)
302 * satasii (for flash ROMs on Silicon Image SATA/IDE controllers)
304 * satamv (for flash ROMs on Marvell SATA controllers)
306 * atahpt (for flash ROMs on Highpoint ATA/RAID controllers)
308 * atavia (for flash ROMs on VIA VT6421A SATA controllers)
310 * atapromise (for flash ROMs on Promise PDC2026x ATA/RAID con‐
312 trollers)
313 * it8212 (for flash ROMs on ITE IT8212F ATA/RAID controller)
315 * ft2232_spi (for SPI flash ROMs attached to an
317 FT2232/FT4232H/FT232H family based USB SPI programmer).
318 * serprog (for flash ROMs attached to a programmer speaking ser‐
320 prog, including some Arduino-based devices).
321 * buspirate_spi (for SPI flash ROMs attached to a Bus Pirate)
323 * dediprog (for SPI flash ROMs attached to a Dediprog SF100)
325 * rayer_spi (for SPI flash ROMs attached to a parallel port by
327 one of various cable types)
328 * raiden_debug_spi (For Chrome EC based debug tools - SuzyQable,
330 Servo V4, C2D2 & uServo)
331 * pony_spi (for SPI flash ROMs attached to a SI-Prog serial port
333 bitbanging adapter)
334 * nicintel_spi (for SPI flash ROMs on Intel Gigabit network
336 cards)
337 * ogp_spi (for SPI flash ROMs on Open Graphics Project graphics
339 card)
340 * linux_mtd (for SPI flash ROMs accessible via /dev/mtdX on
342 Linux)
343 * linux_spi (for SPI flash ROMs accessible via /dev/spidevX.Y on
345 Linux)
346 * usbblaster_spi (for SPI flash ROMs attached to an Altera USB-
348 Blaster compatible cable)
349 * nicintel_eeprom (for SPI EEPROMs on Intel Gigabit network
351 cards)
352 * mstarddc_spi (for SPI flash ROMs accessible through DDC in
354 MSTAR-equipped displays)
355 * pickit2_spi (for SPI flash ROMs accessible via Microchip
357 PICkit2)
358 * ch341a_spi (for SPI flash ROMs attached to WCH CH341A)
360 * digilent_spi (for SPI flash ROMs attached to iCEblink40 devel‐
362 opment boards)
363 * jlink_spi (for SPI flash ROMs attached to SEGGER J-Link and
365 compatible devices)
366 * ni845x_spi (for SPI flash ROMs attached to National Instru‐
368 ments USB-8451 or USB-8452)
369 * stlinkv3_spi (for SPI flash ROMs attached to STMicroelectron‐
371 ics STLINK V3 devices)
372 * realtek_mst_i2c_spi (for SPI flash ROMs attached to Realtek
374 DisplayPort hubs accessible through I2C)
375 * parade_lspcon (for SPI flash ROMs attached to Parade Technolo‐
377 gies LSPCONs (PS175))
378 * mediatek_i2c_spi (for SPI flash ROMs attached to some Mediatek
380 display devices accessible over I2C)
381 * dirtyjtag_spi (for SPI flash ROMs attached to DirtyJTAG-com‐
383 patible devices)
384 Some programmers have optional or mandatory parameters which are
386 described in detail in the PROGRAMMER-SPECIFIC INFORMATION sec‐
387 tion. Support for some programmers can be disabled at compile
388 time. flashrom -h lists all supported programmers.
389 -h, --help
391 Show a help text and exit.
392 -o, --output <logfile>
394 Save the full debug log to <logfile>. If the file already ex‐
395 ists, it will be overwritten. This is the recommended way to
396 gather logs from flashrom because they will be verbose even if
397 the on-screen messages are not verbose and don't require output
398 redirection.
399 -R, --version
401 Show version information and exit.
402
404 Some programmer drivers accept further parameters to set programmer-
405 specific parameters. These parameters are separated from the programmer
406 name by a colon. While some programmers take arguments at fixed posi‐
407 tions, other programmers use a key/value interface in which the key and
408 value is separated by an equal sign and different pairs are separated
409 by a comma or a colon.
410 internal programmer
412 Board Enables
413 Some mainboards require to run mainboard specific code to enable
415 flash erase and write support (and probe support on old systems
416 with parallel flash). The mainboard brand and model (if it re‐
417 quires specific code) is usually autodetected using one of the
418 following mechanisms: If your system is running coreboot, the
419 mainboard type is determined from the coreboot table. Other‐
420 wise, the mainboard is detected by examining the onboard PCI de‐
421 vices and possibly DMI info. If PCI and DMI do not contain in‐
422 formation to uniquely identify the mainboard (which is the ex‐
423 ception), or if you want to override the detected mainboard
424 model, you can specify the mainboard using the
425 flashrom -p internal:mainboard=<vendor>:<board> syntax.
427 See the 'Known boards' or 'Known laptops' section in the output
429 of 'flashrom -L' for a list of boards which require the specifi‐
430 cation of the board name, if no coreboot table is found.
431 Some of these board-specific flash enabling functions (called
433 board enables) in flashrom have not yet been tested. If your
434 mainboard is detected needing an untested board enable function,
435 a warning message is printed and the board enable is not exe‐
436 cuted, because a wrong board enable function might cause the
437 system to behave erratically, as board enable functions touch
438 the low-level internals of a mainboard. Not executing a board
439 enable function (if one is needed) might cause detection or
440 erasing failure. If your board protects only part of the flash
441 (commonly the top end, called boot block), flashrom might en‐
442 counter an error only after erasing the unprotected part, so
443 running without the board-enable function might be dangerous for
444 erase and write (which includes erase).
445 The suggested procedure for a mainboard with untested board spe‐
447 cific code is to first try to probe the ROM (just invoke
448 flashrom and check that it detects your flash chip type) without
449 running the board enable code (i.e. without any parameters). If
450 it finds your chip, fine. Otherwise, retry probing your chip
451 with the board-enable code running, using
452 flashrom -p internal:boardenable=force
454 If your chip is still not detected, the board enable code seems
456 to be broken or the flash chip unsupported. Otherwise, make a
457 backup of your current ROM contents (using -r) and store it to a
458 medium outside of your computer, like a USB drive or a network
459 share. If you needed to run the board enable code already for
460 probing, use it for reading too. If reading succeeds and the
461 contents of the read file look legit you can try to write the
462 new image. You should enable the board enable code in any case
463 now, as it has been written because it is known that writ‐
464 ing/erasing without the board enable is going to fail. In any
465 case (success or failure), please report to the flashrom mailing
466 list, see below.
467 Coreboot
470 On systems running coreboot, flashrom checks whether the desired
472 image matches your mainboard. This needs some special board ID
473 to be present in the image. If flashrom detects that the image
474 you want to write and the current board do not match, it will
475 refuse to write the image unless you specify
476 flashrom -p internal:boardmismatch=force
478 ITE IT87 Super I/O
480 If your mainboard is manufactured by GIGABYTE and supports Dual‐
482 BIOS it is very likely that it uses an ITE IT87 series Super I/O
483 to switch between the two flash chips. Only one of them can be
484 accessed at a time and you can manually select which one to use
485 with the
486 flashrom -p internal:dualbiosindex=chip
488 syntax where chip is the index of the chip to use (0 = main, 1 =
490 backup). You can check which one is currently selected by leav‐
491 ing out the chip parameter.
492 If your mainboard uses an ITE IT87 series Super I/O for
494 LPC<->SPI flash bus translation, flashrom should autodetect that
495 configuration. If you want to set the I/O base port of the IT87
496 series SPI controller manually instead of using the value pro‐
497 vided by the BIOS, use the
498 flashrom -p internal:it87spiport=portnum
500 syntax where portnum is the I/O port number (must be a multiple
502 of 8). In the unlikely case flashrom doesn't detect an active
503 IT87 LPC<->SPI bridge, please send a bug report so we can diag‐
504 nose the problem.
505 AMD chipsets
508 Beginning with the SB700 chipset there is an integrated micro‐
510 controller (IMC) based on the 8051 embedded in every AMD south‐
511 bridge. Its firmware resides in the same flash chip as the
512 host's which makes writing to the flash risky if the IMC is ac‐
513 tive. Flashrom tries to temporarily disable the IMC but even
514 then changing the contents of the flash can have unwanted ef‐
515 fects: when the IMC continues (at the latest after a reboot) it
516 will continue executing code from the flash. If the code was re‐
517 moved or changed in an unfortunate way it is unpredictable what
518 the IMC will do. Therefore, if flashrom detects an active IMC it
519 will disable write support unless the user forces it with the
520 flashrom -p internal:amd_imc_force=yes
522 syntax. The user is responsible for supplying a suitable image
524 or leaving out the IMC region with the help of a layout file.
525 This limitation might be removed in the future when we under‐
526 stand the details better and have received enough feedback from
527 users. Please report the outcome if you had to use this option
528 to write a chip.
529 An optional spispeed parameter specifies the frequency of the
531 SPI bus where applicable (i.e. SB600 or later with an SPI flash
532 chip directly attached to the chipset). Syntax is
533 flashrom -p internal:spispeed=frequency
535 where frequency can be '16.5 MHz', '22 MHz', '33 MHz', '66 MHz',
537 '100 MHZ', or '800 kHz'. Support of individual frequencies de‐
538 pends on the generation of the chipset:
539 * SB6xx, SB7xx, SP5xxx: from 16.5 MHz up to and including 33 MHz
541 -The default is to use 16.5 MHz and disable Fast Reads.
543 * SB8xx, SB9xx, Hudson: from 16.5 MHz up to and including 66 MHz
545 -The default is to use 16.5 MHz and disable Fast Reads.
547 * Yangtze (with SPI 100 engine as found in Kabini and Tamesh):
549 all of them
550 -The default is to use the frequency that is currently config‐
552 ured.
553 An optional spireadmode parameter specifies the read mode of the
555 SPI bus where applicable (Bolton or later). Syntax is
556 flashrom -p internal:spireadmode=mode
558 where mode can be 'Normal (up to 33 MHz)', 'Normal (up to 66
560 MHz)', 'Dual IO (1-1-2)', 'Quad IO (1-1-4)', 'Dual IO (1-2-2)',
561 'Quad IO (1-4-4)', or 'Fast Read'.
562 The default is to use the read mode that is currently config‐
564 ured.
565 Intel chipsets
567 If you have an Intel chipset with an ICH8 or later southbridge
569 with SPI flash attached, and if a valid descriptor was written
570 to it (e.g. by the vendor), the chipset provides an alternative
571 way to access the flash chip(s) named Hardware Sequencing. It
572 is much simpler than the normal access method (called Software
573 Sequencing), but does not allow the software to choose the SPI
574 commands to be sent. You can use the
575 flashrom -p internal:ich_spi_mode=value
577 syntax where value can be auto, swseq or hwseq. By default (or
579 when setting ich_spi_mode=auto) the module tries to use swseq
580 and only activates hwseq if need be (e.g. if important opcodes
581 are inaccessible due to lockdown; or if more than one flash chip
582 is attached). The other options (swseq, hwseq) select the re‐
583 spective mode (if possible).
584 ICH8 and later southbridges may also have locked address ranges
586 of different kinds if a valid descriptor was written to it. The
587 flash address space is then partitioned in multiple so called
588 "Flash Regions" containing the host firmware, the ME firmware
589 and so on respectively. The flash descriptor can also specify up
590 to 5 so called "Protected Regions", which are freely chosen ad‐
591 dress ranges independent from the aforementioned "Flash Re‐
592 gions". All of them can be write and/or read protected individu‐
593 ally.
594 If you have an Intel chipset with an ICH2 or later southbridge
596 and if you want to set specific IDSEL values for a non-default
597 flash chip or an embedded controller (EC), you can use the
598 flashrom -p internal:fwh_idsel=value
600 syntax where value is the 48-bit hexadecimal raw value to be
602 written in the IDSEL registers of the Intel southbridge. The up‐
603 per 32 bits use one hex digit each per 512 kB range between
604 0xffc00000 and 0xffffffff, and the lower 16 bits use one hex
605 digit each per 1024 kB range between 0xff400000 and 0xff7fffff.
606 The rightmost hex digit corresponds with the lowest address
607 range. All address ranges have a corresponding sister range 4 MB
608 below with identical IDSEL settings. The default value for ICH7
609 is given in the example below.
610 Example: flashrom -p internal:fwh_idsel=0x001122334567
612 Laptops
614 Using flashrom on older laptops that don't boot from the SPI bus
616 is dangerous and may easily make your hardware unusable (see
617 also the BUGS section). The embedded controller (EC) in some ma‐
618 chines may interact badly with flashing. More information is in
619 the wiki ⟨https://flashrom.org/Laptops⟩. Problems occur when
620 the flash chip is shared between BIOS and EC firmware, and the
621 latter does not expect flashrom to access the chip. While
622 flashrom tries to change the contents of that memory the EC
623 might need to fetch new instructions or data from it and could
624 stop working correctly. Probing for and reading from the chip
625 may also irritate your EC and cause fan failure, backlight fail‐
626 ure, sudden poweroff, and other nasty effects. flashrom will at‐
627 tempt to detect if it is running on such a laptop and limit
628 probing to SPI buses. If you want to probe the LPC bus anyway at
629 your own risk, use
630 flashrom -p internal:laptop=force_I_want_a_brick
632 We will not help you if you force flashing on a laptop because
634 this is a really dumb idea.
635 You have been warned.
637 Currently we rely on the chassis type encoded in the DMI/SMBIOS
639 data to detect laptops. Some vendors did not implement those
640 bits correctly or set them to generic and/or dummy values.
641 flashrom will then issue a warning and restrict buses like
642 above. In this case you can use
643 flashrom -p internal:laptop=this_is_not_a_laptop
645 to tell flashrom (at your own risk) that it is not running on a
647 laptop.
648 dummy programmer
650 The dummy programmer operates on a buffer in memory only. It
651 provides a safe and fast way to test various aspects of flashrom
652 and is mainly used in development and while debugging. It is
653 able to emulate some chips to a certain degree (basic iden‐
654 tify/read/erase/write operations work).
655 An optional parameter specifies the bus types it should support.
657 For that you have to use the
658 flashrom -p dummy:bus=[type[+type[+type]]]
660 syntax where type can be parallel, lpc, fwh, spi in any order.
662 If you specify bus without type, all buses will be disabled. If
663 you do not specify bus, all buses will be enabled.
664 Example: flashrom -p dummy:bus=lpc+fwh
666 The dummy programmer supports flash chip emulation for automated
668 self-tests without hardware access. If you want to emulate a
669 flash chip, use the
670 flashrom -p dummy:emulate=chip
672 syntax where chip is one of the following chips (please specify
674 only the chip name, not the vendor):
675 * ST M25P10.RES SPI flash chip (128 kB, RES, page write)
677 * SST SST25VF040.REMS SPI flash chip (512 kB, REMS, byte write)
679 * SST SST25VF032B SPI flash chip (4096 kB, RDID, AAI write)
681 * Macronix MX25L6436 SPI flash chip (8192 kB, RDID, SFDP)
683 * Winbond W25Q128FV SPI flash chip (16384 kB, RDID)
685 * Spansion S25FL128L SPI flash chip (16384 kB, RDID)
687 * Dummy vendor VARIABLE_SIZE SPI flash chip (configurable size,
689 page write)
690 Example: flashrom -p dummy:emulate=SST25VF040.REMS
692 To use VARIABLE_SIZE chip, size must be specified to configure
694 the size of the flash chip as a power of two.
695 Example: flashrom -p dummy:emulate=VARI‐
697 ABLE_SIZE,size=16777216,image=dummy.bin
698 Persistent images
700 If you use flash chip emulation, flash image persistence is
702 available as well by using the
703 flashrom -p dummy:emulate=chip,image=image.rom
705 syntax where image.rom is the file where the simulated chip con‐
707 tents are read on flashrom startup and where the chip contents
708 on flashrom shutdown are written to.
709 Example: flashrom -p dummy:emulate=M25P10.RES,image=dummy.bin
711 SPI write chunk size
713 If you use SPI flash chip emulation for a chip which supports
715 SPI page write with the default opcode, you can set the maximum
716 allowed write chunk size with the
717 flashrom -p dummy:emulate=chip,spi_write_256_chunksize=size
719 syntax where size is the number of bytes (min. 1, max. 256).
721 Example:
723 flashrom -p dummy:emulate=M25P10.RES,spi_write_256_chunksize=5
725 SPI blacklist
727 To simulate a programmer which refuses to send certain SPI com‐
729 mands to the flash chip, you can specify a blacklist of SPI com‐
730 mands with the
731 flashrom -p dummy:spi_blacklist=commandlist
733 syntax where commandlist is a list of two-digit hexadecimal rep‐
735 resentations of SPI commands. If commandlist is e.g. 0302,
736 flashrom will behave as if the SPI controller refuses to run
737 command 0x03 (READ) and command 0x02 (WRITE). commandlist may
738 be up to 512 characters (256 commands) long. Implementation
739 note: flashrom will detect an error during command execution.
740 SPI ignorelist
743 To simulate a flash chip which ignores (doesn't support) certain
745 SPI commands, you can specify an ignorelist of SPI commands with
746 the
747 flashrom -p dummy:spi_ignorelist=commandlist
749 syntax where commandlist is a list of two-digit hexadecimal rep‐
751 resentations of SPI commands. If commandlist is e.g. 0302, the
752 emulated flash chip will ignore command 0x03 (READ) and command
753 0x02 (WRITE). commandlist may be up to 512 characters (256 com‐
754 mands) long. Implementation note: flashrom won't detect an er‐
755 ror during command execution.
756 SPI status register
759 You can specify the initial content of the chip's status regis‐
761 ter with the
762 flashrom -p dummy:spi_status=content
764 syntax where content is a hexadecimal value of up to 24 bits.
766 For example, 0x332211 assigns 0x11 to SR1, 0x22 to SR2 and 0x33
767 to SR3. Shorter value is padded to 24 bits with zeroes on the
768 left. See datasheet for chosen chip for details about the regis‐
769 ters content.
770 Write protection
773 Chips with emulated WP: W25Q128FV, S25FL128L.
775 You can simulate state of hardware protection pin (WP) with the
777 flashrom -p dummy:hwwp=state
779 syntax where state is "yes" or "no" (default value). "yes" means
781 active state of the pin implies that chip is write-protected (on
782 real hardware the pin is usually negated, but not here).
783 nic3com, nicrealtek, nicnatsemi, nicintel, nicintel_eeprom, nicintel_spi,
785 gfxnvidia, ogp_spi, drkaiser, satasii, satamv, atahpt, atavia , at‐
786 apromise and it8212 programmers
787 These programmers have an option to specify the PCI address of
788 the card your want to use, which must be specified if more than
789 one card supported by the selected programmer is installed in
790 your system. The syntax is
791 flashrom -p xxxx:pci=bb:dd.f,
793 where xxxx is the name of the programmer, bb is the PCI bus num‐
795 ber, dd is the PCI device number, and f is the PCI function num‐
796 ber of the desired device.
797 Example: flashrom -p nic3com:pci=05:04.0
799 atavia programmer
801 Due to the mysterious address handling of the VIA VT6421A con‐
802 troller the user can specify an offset with the
803 flashrom -p atavia:offset=addr
805 syntax where addr will be interpreted as usual (leading 0x (0)
807 for hexadecimal (octal) values, or else decimal). For more in‐
808 formation please see its wiki page
809 ⟨https://flashrom.org/VT6421A⟩.
810 atapromise programmer
812 This programmer is currently limited to 32 kB, regardless of the
813 actual size of the flash chip. This stems from the fact that, on
814 the tested device (a Promise Ultra100), not all of the chip's
815 address lines were actually connected. You may use this program‐
816 mer to flash firmware updates, since these are only 16 kB in
817 size (padding to 32 kB is required).
818 nicintel_eeprom programmer
820 This is the first programmer module in flashrom that does not
821 provide access to NOR flash chips but EEPROMs mounted on gigabit
822 Ethernet cards based on Intel's 82580 NIC. Because EEPROMs nor‐
823 mally do not announce their size nor allow themselves to be
824 identified, the controller relies on correct size values written
825 to predefined addresses within the chip. Flashrom follows this
826 scheme but assumes the minimum size of 16 kB (128 kb) if an un‐
827 programmed EEPROM/card is detected. Intel specifies following
828 EEPROMs to be compatible: Atmel AT25128, AT25256, Micron (ST)
829 M95128, M95256 and OnSemi (Catalyst) CAT25CS128.
830 ft2232_spi programmer
832 This module supports various programmers based on FTDI
833 FT2232/FT4232H/FT232H chips including the DLP Design DLP-
834 USB1232H, openbiosprog-spi, Amontec JTAGkey/JTAGkey-
835 tiny/JTAGkey-2, Dangerous Prototypes Bus Blaster, Olimex ARM-
836 USB-TINY/-H, Olimex ARM-USB-OCD/-H, OpenMoko Neo1973 Debug board
837 (V2+), TIAO/DIYGADGET USB Multi-Protocol Adapter (TUMPA), TUMPA
838 Lite, GOEPEL PicoTAP, Google Servo v1/v2, Tin Can Tools Flyswat‐
839 ter/Flyswatter 2 and Kristech KT-LINK.
840 An optional parameter specifies the controller type, channel/in‐
842 terface/port it should support. For that you have to use the
843 flashrom -p ft2232_spi:type=model,port=interface
845 syntax where model can be 2232H, 4232H, 232H, jtagkey, bus‐
847 blaster, openmoko, arm-usb-tiny, arm-usb-tiny-h, arm-usb-ocd,
848 arm-usb-ocd-h, tumpa, tumpalite, picotap, google-servo, google-
849 servo-v2, google-servo-v2-legacy or kt-link interface can be A,
850 B, C, or D. The default model is 4232H the default interface is
851 A and GPIO is not used by default.
852 If there is more than one ft2232_spi-compatible device con‐
854 nected, you can select which one should be used by specifying
855 its serial number with the
856 flashrom -p ft2232_spi:serial=number
858 syntax where number is the serial number of the device (which
860 can be found for example in the output of lsusb -v).
861 All models supported by the ft2232_spi driver can configure the
863 SPI clock rate by setting a divisor. The expressible divisors
864 are all even numbers between 2 and 2^17 (=131072) resulting in
865 SPI clock frequencies of 6 MHz down to about 92 Hz for 12 MHz
866 inputs. The default divisor is set to 2, but you can use another
867 one by specifying the optional divisor parameter with the
868 flashrom -p ft2232_spi:divisor=div
870 syntax.
872 Using the parameter csgpiol (DEPRECATED - use gpiol instead) an
874 additional CS# pin can be chosen, where the value can be a num‐
875 ber between 0 and 3, denoting GPIOL0-GPIOL3 correspondingly. Ex‐
876 ample:
877 flashrom -p ft2232_spi:csgpiol=3
879 The parameter gpiolX=[HLC] allows use of the GPIOL pins either
881 as generic gpios with a fixed value during flashing or as addi‐
882 tional CS# signal, where X can be a number between 0 and 3, de‐
883 noting GPIOL0-GPIOL3 correspondingly. The parameter may be spec‐
884 ified multiple times, one time per GPIOL pin. Valid values are
885 H , L and C :
886 H - Set GPIOL output high
887 L - Set GPIOL output low
888 C - Use GPIOL as additional CS# output
889 Example:
891 flashrom -p ft2232_spi:gpiol0=H
893 Note that not all GPIOL pins are freely usable with all program‐
895 mers as some have special functionality.
896 serprog programmer
898 This module supports all programmers speaking the serprog proto‐
899 col. This includes some Arduino-based devices as well as various
900 programmers by Urja Rannikko, Juhana Helovuo, Stefan Tauner, Chi
901 Zhang and many others.
902 A mandatory parameter specifies either a serial device (and baud
904 rate) or an IP/port combination for communicating with the pro‐
905 grammer. The device/baud combination has to start with dev= and
906 separate the optional baud rate with a colon. For example
907 flashrom -p serprog:dev=/dev/ttyS0:115200
909 If no baud rate is given the default values by the operating
911 system/hardware will be used. For IP connections you have to
912 use the
913 flashrom -p serprog:ip=ipaddr:port
915 syntax. In case the device supports it, you can set the SPI
917 clock frequency with the optional spispeed parameter. The fre‐
918 quency is parsed as hertz, unless an M, or k suffix is given,
919 then megahertz or kilohertz are used respectively. Example that
920 sets the frequency to 2 MHz:
921 flashrom -p serprog:dev=/dev/device:baud,spispeed=2M
923 More information about serprog is available in serprog-proto‐
925 col.txt in the source distribution.
926 buspirate_spi programmer
928 A required dev parameter specifies the Bus Pirate device node
929 and an optional spispeed parameter specifies the frequency of
930 the SPI bus. The parameter delimiter is a comma. Syntax is
931 flashrom -p buspirate_spi:dev=/dev/device,spispeed=frequency
933 where frequency can be 30k, 125k, 250k, 1M, 2M, 2.6M, 4M or 8M
935 (in Hz). The default is the maximum frequency of 8 MHz.
936 The baud rate for communication between the host and the Bus Pi‐
938 rate can be specified with the optional serialspeed parameter.
939 Syntax is
940 flashrom -p buspirate_spi:serialspeed=baud
942 where baud can be 115200, 230400, 250000 or 2000000 (2M). The
944 default is 2M baud for Bus Pirate hardware version 3.0 and
945 greater, and 115200 otherwise.
946 An optional pullups parameter specifies the use of the Bus Pi‐
948 rate internal pull-up resistors. This may be needed if you are
949 working with a flash ROM chip that you have physically removed
950 from the board. Syntax is
951 flashrom -p buspirate_spi:pullups=state
953 where state can be on or off. More information about the Bus
955 Pirate pull-up resistors and their purpose is available in a
956 guide by dangerousprototypes ⟨http://dangerousproto‐
957 types.com/docs/Practical_guide_to_Bus_Pirate_pull-up_resistors⟩.
958 The state of the Bus Pirate power supply pins is controllable
960 through an optional psus parameter. Syntax is
961 flashrom -p buspirate_spi:psus=state
963 where state can be on or off. This allows the bus pirate to
965 power the ROM chip directly. This may also be used to provide
966 the required pullup voltage (when using the pullups option), by
967 connecting the Bus Pirate's Vpu input to the appropriate Vcc
968 pin.
969 pickit2_spi programmer
971 An optional voltage parameter specifies the voltage the PICkit2
972 should use. The default unit is Volt if no unit is specified.
973 You can use mV, millivolt, V or Volt as unit specifier. Syntax
974 is
975 flashrom -p pickit2_spi:voltage=value
977 where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
979 An optional spispeed parameter specifies the frequency of the
981 SPI bus. Syntax is
982 flashrom -p pickit2_spi:spispeed=frequency
984 where frequency can be 250k, 333k, 500k or 1M (in Hz). The de‐
986 fault is a frequency of 1 MHz.
987 dediprog programmer
989 An optional voltage parameter specifies the voltage the Dediprog
990 should use. The default unit is Volt if no unit is specified.
991 You can use mV, milliVolt, V or Volt as unit specifier. Syntax
992 is
993 flashrom -p dediprog:voltage=value
995 where value can be 0V, 1.8V, 2.5V, 3.5V or the equivalent in mV.
997 An optional device parameter specifies which of multiple con‐
999 nected Dediprog devices should be used. Please be aware that
1000 the order depends on libusb's usb_get_busses() function and that
1001 the numbering starts at 0. Usage example to select the second
1002 device:
1003 flashrom -p dediprog:device=1
1005 An optional spispeed parameter specifies the frequency of the
1007 SPI bus. The firmware on the device needs to be 5.0.0 or newer.
1008 Syntax is
1009 flashrom -p dediprog:spispeed=frequency
1011 where frequency can be 375k, 750k, 1.5M, 2.18M, 3M, 8M, 12M or
1013 24M (in Hz). The default is a frequency of 12 MHz.
1014 An optional target parameter specifies which target chip should
1016 be used. Syntax is
1017 flashrom -p dediprog:target=value
1019 where value can be 1 or 2 to select target chip 1 or 2 respec‐
1021 tively. The default is target chip 1.
1022 rayer_spi programmer
1024 The default I/O base address used for the parallel port is 0x378
1025 and you can use the optional iobase parameter to specify an al‐
1026 ternate base I/O address with the
1027 flashrom -p rayer_spi:iobase=baseaddr
1029 syntax where baseaddr is base I/O port address of the parallel
1031 port, which must be a multiple of four. Make sure to not forget
1032 the "0x" prefix for hexadecimal port addresses.
1033 The default cable type is the RayeR cable. You can use the op‐
1035 tional type parameter to specify the cable type with the
1036 flashrom -p rayer_spi:type=model
1038 syntax where model can be rayer for the RayeR cable, byte‐
1040 blastermv for the Altera ByteBlasterMV, stk200 for the Atmel
1041 STK200/300, wiggler for the Macraigor Wiggler, xilinx for the
1042 Xilinx Parallel Cable III (DLC 5), or spi_tt for SPI Tiny Tools-
1043 compatible hardware.
1044 More information about the RayeR hardware is available at
1046 RayeR's website ⟨http://rayer.g6.cz/elektro/spipgm.htm⟩. The
1047 Altera ByteBlasterMV datasheet can be obtained from Altera
1048 ⟨http://www.altera.co.jp/literature/ds/dsbytemv.pdf⟩. For more
1049 information about the Macraigor Wiggler see their company
1050 homepage ⟨http://www.macraigor.com/wiggler.htm⟩. The schematic
1051 of the Xilinx DLC 5 was published in a Xilinx user guide
1052 ⟨http://www.xilinx.com/support/documentation/user_guides/xtp029.pdf⟩.
1053 raiden_debug_spi programmer
1055 The target of the SPI flashing mux must be specified with the
1056 target parameter with the
1057 flashrom -p raiden_debug_spi:target=chip
1059 syntax, where chip is either the ap or ec to flash, otherwise a
1061 unspecified target terminates at the end-point.
1062 The default is to use the first available servo. You can use the
1064 optional serial parameter to specify the servo USB device serial
1065 number to use specifically with
1066 flashrom -p raiden_debug_spi:serial=XXX
1068 The servo device serial number can be found via lsusb.
1070 Raiden will poll the ap target waiting for the system power to
1072 settle on the AP and EC flash devices.
1073 The optional custom_rst=true parameter changes the timeout value
1075 from 3ms to 10ms.
1076 flashrom -p raiden_debug_spi:custom_rst=<true|false>
1078 syntax, where custom_rst=false is the implicit default timeout
1080 of 3ms.
1081 More information about the ChromiumOS servo hardware is
1083 available at servo website
1084 ⟨https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/servo_v4.md⟩.
1085 pony_spi programmer
1087 The serial port (like /dev/ttyS0, /dev/ttyUSB0 on Linux or COM3
1088 on windows) is specified using the mandatory dev parameter. The
1089 adapter type is selectable between SI-Prog (used for SPI devices
1090 with PonyProg 2000) or a custom made serial bitbanging
1091 programmer named "serbang". The optional type parameter accepts
1092 the values "si_prog" (default) or "serbang".
1093 Information about the SI-Prog adapter can be found at its
1095 website ⟨http://www.lancos.com/siprogsch.html⟩.
1096 An example call to flashrom is
1098 flashrom -p pony_spi:dev=/dev/ttyS0,type=serbang
1100 Please note that while USB-to-serial adapters work under certain
1102 circumstances, this slows down operation considerably.
1103 ogp_spi programmer
1105 The flash ROM chip to access must be specified with the rom
1106 parameter.
1107 flashrom -p ogp_spi:rom=name
1109 Where name is either cprom or s3 for the configuration ROM and
1111 bprom or bios for the BIOS ROM. If more than one card supported
1112 by the ogp_spi programmer is installed in your system, you have
1113 to specify the PCI address of the card you want to use with the
1114 pci= parameter as explained in the nic3com et al. section above.
1115 linux_mtd programmer
1117 You may specify the MTD device to use with the
1118 flashrom -p linux_mtd:dev=/dev/mtdX
1120 syntax where /dev/mtdX is the Linux device node for your MTD
1122 device. If left unspecified the first MTD device found (e.g.
1123 /dev/mtd0) will be used by default.
1124 Please note that the linux_mtd driver only works on Linux.
1126 linux_spi programmer
1128 You have to specify the SPI controller to use with the
1129 flashrom -p linux_spi:dev=/dev/spidevX.Y
1131 syntax where /dev/spidevX.Y is the Linux device node for your
1133 SPI controller.
1134 In case the device supports it, you can set the SPI clock
1136 frequency with the optional spispeed parameter. The frequency is
1137 parsed as kilohertz. Example that sets the frequency to 8 MHz:
1138 flashrom -p linux_spi:dev=/dev/spidevX.Y,spispeed=8000
1140 Please note that the linux_spi driver only works on Linux.
1142 mstarddc_spi programmer
1144 The Display Data Channel (DDC) is an I2C bus present on VGA and
1145 DVI connectors, that allows exchanging information between a
1146 computer and attached displays. Its most common uses are getting
1147 display capabilities through EDID (at I2C address 0x50) and
1148 sending commands to the display using the DDC/CI protocol (at
1149 address 0x37). On displays driven by MSTAR SoCs, it is also
1150 possible to access the SoC firmware flash (connected to the Soc
1151 through another SPI bus) using an In-System Programming (ISP)
1152 port, usually at address 0x49. This flashrom module allows the
1153 latter via Linux's I2C driver.
1154 IMPORTANT: Before using this programmer, the display MUST be in
1156 standby mode, and only connected to the computer that will run
1157 flashrom using a VGA cable, to an inactive VGA output. It
1158 absolutely MUST NOT be used as a display during the procedure!
1159 You have to specify the DDC/I2C controller and I2C address to
1161 use with the
1162 flashrom -p mstarddc_spi:dev=/dev/i2c-X:YY
1164 syntax where /dev/i2c-X is the Linux device node for your I2C
1166 controller connected to the display's DDC channel, and YY is the
1167 (hexadecimal) address of the MSTAR ISP port (address 0x49 is
1168 usually used). Example that uses I2C controller /dev/i2c-1 and
1169 address 0x49:
1170 flashrom -p mstarddc_spi:dev=/dev/i2c-1:49
1172 It is also possible to inhibit the reset command that is
1174 normally sent to the display once the flashrom operation is
1175 completed using the optional noreset parameter. A value of 1
1176 prevents flashrom from sending the reset command. Example that
1177 does not reset the display at the end of the operation:
1178 flashrom -p mstarddc_spi:dev=/dev/i2c-1:49,noreset=1
1180 Please note that sending the reset command is also inhibited if
1182 an error occurred during the operation. To send the reset
1183 command afterwards, you can simply run flashrom once more, in
1184 chip probe mode (not specifying an operation), without the
1185 noreset parameter, once the flash read/write operation you
1186 intended to perform has completed successfully.
1187 Please also note that the mstarddc_spi driver only works on
1189 Linux.
1190 ch341a_spi programmer
1192 The WCH CH341A programmer does not support any parameters currently.
1193 SPI frequency is fixed at 2 MHz, and CS0 is used as per the device.
1194 ni845x_spi programmer
1196 An optional voltage parameter could be used to specify the IO
1197 voltage. This parameter is available for the NI USB-8452 device.
1198 The default unit is Volt if no unit is specified. You can use
1199 mV, milliVolt, V or Volt as unit specifier. Syntax is
1200 flashrom -p ni845x_spi:voltage=value
1202 where value can be 1.2V, 1.5V, 1.8V, 2.5V, 3.3V or the
1204 equivalent in mV.
1205 In the case if none of the programmer's supported IO voltage is
1207 within the supported voltage range of the detected flash chip
1208 the flashrom will abort the operation (to prevent damaging the
1209 flash chip). You can override this behaviour by passing "yes"
1210 to the ignore_io_voltage_limits parameter (for e.g. if you are
1211 using an external voltage translator circuit). Syntax is
1212 flashrom -p ni845x_spi:ignore_io_voltage_limits=yes
1214 You can use the serial parameter to explicitly specify which
1216 connected NI USB-845x device should be used. You should use
1217 your device's 7 digit hexadecimal serial number. Usage example
1218 to select the device with 1230A12 serial number:
1219 flashrom -p ni845x_spi:serial=1230A12
1221 An optional spispeed parameter specifies the frequency of the
1223 SPI bus. Syntax is
1224 flashrom -p ni845x_spi:spispeed=frequency
1226 where frequency should a number corresponding to the desired
1228 frequency in kHz. The maximum frequency is 12 MHz (12000 kHz)
1229 for the USB-8451 and 50 MHz (50000 kHz) for the USB-8452. The
1230 default is a frequency of 1 MHz (1000 kHz).
1231 An optional cs parameter specifies which target chip select line
1233 should be used. Syntax is
1234 flashrom -p ni845x_spi:csnumber=value
1236 where value should be between 0 and 7 By default the CS0 is
1238 used.
1239 digilent_spi programmer
1241 An optional spispeed parameter specifies the frequency of the
1242 SPI bus. Syntax is
1243 flashrom -p digilent_spi:spispeed=frequency
1245 where frequency can be 62.5k, 125k, 250k, 500k, 1M, 2M or 4M (in
1247 Hz). The default is a frequency of 4 MHz.
1248 dirtyjtag_spi programmer
1250 An optional freq parameter specifies the frequency of the SPI
1252 bus. Syntax is
1253 flashrom -p dirtyjtag_spi:spispeed=frequency
1255 where spispeed can be
1257 anyvalueinhertz,kilohertzormegahertzsupportedbythe programmer.
1258 The default is a frequency of 100 KHz.
1259 jlink_spi programmer
1263 This module supports SEGGER J-Link and compatible devices.
1264 The MOSI signal of the flash chip must be attached to TDI pin of
1266 the programmer, MISO to TDO and SCK to TCK. The chip select
1267 (CS) signal of the flash chip can be attached to different pins
1268 of the programmer which can be selected with the
1269 flashrom -p jlink_spi:cs=pin
1271 syntax where pin can be either TRST or RESET. The default pin
1273 for chip select is RESET. Note that, when using RESET, it is
1274 normal that the indicator LED blinks orange or red.
1275 Additionally, the VTref pin of the programmer must be attached
1276 to the logic level of the flash chip. The programmer measures
1277 the voltage on this pin and generates the reference voltage for
1278 its input comparators and adapts its output voltages to it.
1279 Pinout for devices with 20-pin JTAG connector:
1281 +-------+
1283 | 1 2 | 1: VTref 2:
1284 | 3 4 | 3: TRST 4: GND
1285 | 5 6 | 5: TDI 6: GND
1286 +-+ 7 8 | 7: 8: GND
1287 | 9 10 | 9: TCK 10: GND
1288 | 11 12 | 11: 12: GND
1289 +-+ 13 14 | 13: TDO 14:
1290 | 15 16 | 15: RESET 16:
1291 | 17 18 | 17: 18:
1292 | 19 20 | 19: PWR_5V 20:
1293 +-------+
1294 If there is more than one compatible device connected, you can
1296 select which one should be used by specifying its serial number
1297 with the
1298 flashrom -p jlink_spi:serial=number
1300 syntax where number is the serial number of the device (which
1302 can be found for example in the output of lsusb -v).
1303 The SPI speed can be selected by using the
1305 flashrom -p jlink_spi:spispeed=frequency
1307 syntax where frequency is the SPI clock frequency in kHz. The
1309 maximum speed depends on the device in use.
1310 The power=on option can be used to activate the 5 V power supply
1312 (PWR_5V) of the J-Link during a flash operation.
1313 stlinkv3_spi programmer
1315 This module supports SPI flash programming through the
1316 STMicroelectronics STLINK V3 programmer/debugger's SPI bridge
1317 interface
1318 flashrom -p stlinkv3_spi
1320 If there is more than one compatible device connected, you can
1322 select which one should be used by specifying its serial number
1323 with the
1324 flashrom -p stlinkv3_spi:serial=number
1326 syntax where number is the serial number of the device (which
1328 can be found for example in the output of lsusb -v).
1329 The SPI speed can be selected by using the
1331 flashrom -p stlinkv3_spi:spispeed=frequency
1333 syntax where frequency is the SPI clock frequency in kHz. If
1335 the passed frequency is not supported by the adapter the nearest
1336 lower supported frequency will be used.
1337 realtek_mst_i2c_spi , parade_lspcon ,and mediatek_i2c_spi programmers
1339 These programmers tunnel SPI commands through I2C-connected
1340 devices. The I2C bus over which communication occurs must be
1341 specified either by device path with the devpath option:
1342 flashrom -p realtek_mst_i2c_spi:devpath=/dev/i2c-8
1344 or by a bus number with the bus option, which implies a device
1346 path like /dev/i2c-N where N is the specified bus number:
1347 flashrom -p parade_lspcon:bus=8
1349 realtek_mst_i2c_spi programmer
1352 This programmer supports SPI flash programming for chips
1353 attached to Realtek DisplayPort MST hubs, themselves accessed
1354 through I2C (tunneling SPI flash commands through the MST hub's
1355 I2C connection with the host).
1356 In-system programming (ISP) mode
1358 The reset_mcu and enter_isp options provide control over device
1360 mode changes, where each can be set to 0 or 1 to enable or
1361 disable the corresponding mode transition.
1362 enter_isp defaults to 1, and if enabled will issue commands to
1364 the MST hub when beginning operation to put it into ISP mode.
1365 reset_mcu defaults to 0, and if enabled will issue a reset
1367 command to the MST hub on programming completion, causing it to
1368 exit ISP mode and to reload its own firmware from flash.
1369 allow_brick defaults to no, however must be set explicitly to
1371 "yes" to allow the driver to run if you are sure you have a MST
1372 chip.
1373 The hub must be in ISP mode for SPI flash access to be possible,
1375 so it is usually only useful to disable enter_isp if an earlier
1376 invocation avoided resetting it on completion. For instance, to
1377 erase the flash and rewrite it with the contents of a file
1378 without resetting in between (which could render it
1379 nonfunctional if attempting to load firmware from a blank
1380 flash):
1381 flashrom -p realtek_mst_i2c_spi:bus=0,enter_isp=1,reset_mcu=0
1383 -E
1384 flashrom -p realtek_mst_i2c_spi:bus=0,enter_isp=0,reset_mcu=1
1385 -w new.bin
1386 parade_lspcon programmer
1388 This programmer supports SPI flash programming for chips
1389 attached to Parade Technologies DisplayPort-to-HDMI level
1390 shifter/protocol converters (LSPCONs), e.g. the PS175.
1391 Communication to the SPI flash is tunneled through the LSPCON
1392 over I2C.
1393 mediatek_i2c_spi programmer
1396 This programmer supports SPI flash programming for chips
1397 attached to some Mediatek display controllers, themselves
1398 accessed through I2C (tunneling SPI flash commands through an
1399 I2C connection with the host).
1400 The programmer is designed to support the TSUMOP82JUQ integrated
1402 display driver and scaler as used in the Google Meet Series One
1403 Desk 27 (which runs a version of ChromeOS and uses flashrom in
1404 its tsum-scaler-updater scripts that ship with the OS). Other
1405 chips may use compatible protocols but have not been tested with
1406 this programmer, and external chip IOs may need to be controlled
1407 through other non-flashrom means to configure the chip in order
1408 for it to operate as expected.
1409 devpath and bus options select the I2C bus to use, as described
1411 previously. allow_brick defaults to no, and must explicitly be
1412 set to "yes" in order for the programmer to operate. This is
1413 required because there is no mechanism in the driver to
1414 positively identify that a given I2C bus is actually connected
1415 to a supported device.
1416
1419 To back up and update your BIOS, run
1420 flashrom -p internal -r backup.rom -o backuplog.txt
1422 flashrom -p internal -w newbios.rom -o writelog.txt
1423 Please make sure to copy backup.rom to some external media before you
1425 try to write. That makes offline recovery easier.
1426 If writing fails and flashrom complains about the chip being in an
1427 unknown state, you can try to restore the backup by running
1428 flashrom -p internal -w backup.rom -o restorelog.txt
1430 If you encounter any problems, please contact us and supply
1432 backuplog.txt, writelog.txt and restorelog.txt. See section BUGS for
1433 contact info.
1434
1436 flashrom exits with 0 on success, 1 on most failures but with 3 if a
1437 call to mmap() fails.
1438
1440 flashrom needs different access permissions for different programmers.
1441 internal needs raw memory access, PCI configuration space access, raw
1443 I/O port access (x86) and MSR access (x86).
1444 atavia needs PCI configuration space access.
1446 nic3com, nicrealtek and nicnatsemi need PCI configuration space read
1448 access and raw I/O port access.
1449 atahpt needs PCI configuration space access and raw I/O port access.
1451 gfxnvidia, drkaiser and it8212 need PCI configuration space access and
1453 raw memory access.
1454 rayer_spi needs raw I/O port access.
1456 raiden_debug_spi need access to the respective USB device via libusb
1458 API version 1.0.
1459 satasii, nicintel, nicintel_eeprom and nicintel_spi need PCI
1461 configuration space read access and raw memory access.
1462 satamv and atapromise need PCI configuration space read access, raw I/O
1464 port access and raw memory access.
1465 serprog needs TCP access to the network or userspace access to a serial
1467 port.
1468 buspirate_spi needs userspace access to a serial port.
1470 ft2232_spi, usbblaster_spi and pickit2_spi need access to the
1472 respective USB device via libusb API version 0.1.
1473 ch341a_spi and dediprog need access to the respective USB device via
1475 libusb API version 1.0.
1476 dummy needs no access permissions at all.
1478 internal, nic3com, nicrealtek, nicnatsemi, gfxnvidia, drkaiser,
1480 satasii, satamv, atahpt, atavia and atapromise have to be run as
1481 superuser/root, and need additional raw access permission.
1482 serprog, buspirate_spi, dediprog, usbblaster_spi, ft2232_spi,
1484 pickit2_spi, ch341a_spi, digilent_spi and dirtyjtag_spi can be run as
1485 normal user on most operating systems if appropriate device permissions
1486 are set.
1487 ogp needs PCI configuration space read access and raw memory access.
1489 realtek_mst_i2c_spi and parade_lspcon need userspace access to the
1491 selected I2C bus.
1492 On OpenBSD, you can obtain raw access permission by setting
1494 securelevel=-1 in /etc/rc.securelevel and rebooting, or rebooting into
1495 single user mode.
1496
1498 You can report bugs, ask us questions or send success reports via our
1499 communication channels listed here: https://www.flashrom.org/Contact.
1500 Also, we provide a pastebin service ⟨https://paste.flashrom.org⟩ that
1502 is very useful to share logs without spamming the communication
1503 channels.
1504 Laptops
1506 Using flashrom on older laptops is dangerous and may easily make your
1507 hardware unusable. flashrom will attempt to detect if it is running on
1508 a susceptible laptop and restrict flash-chip probing for safety
1509 reasons. Please see the detailed discussion of this topic and
1510 associated flashrom options in the Laptops paragraph in the internal
1511 programmer subsection of the PROGRAMMER-SPECIFIC INFORMATION section
1512 and the information in our wiki ⟨https://flashrom.org/Laptops⟩.
1513 One-time programmable (OTP) memory and unique IDs
1515 Some flash chips contain OTP memory often denoted as "security
1516 registers". They usually have a capacity in the range of some bytes to
1517 a few hundred bytes and can be used to give devices unique IDs etc.
1518 flashrom is not able to read or write these memories and may therefore
1519 not be able to duplicate a chip completely. For chip types known to
1520 include OTP memories a warning is printed when they are detected.
1521 Similar to OTP memories are unique, factory programmed, unforgeable
1523 IDs. They are not modifiable by the user at all.
1524
1526 flashrom is covered by the GNU General Public License (GPL), version 2.
1527 Some files are additionally available under any later version of the
1528 GPL.
1529
1531 Please see the individual files.
1532
1534 Andrew Morgan
1535 Anastasia Klimchuk
1536 Carl-Daniel Hailfinger
1537 Claus Gindhart
1538 David Borg
1539 David Hendricks
1540 Dominik Geyer
1541 Edward O'Callaghan
1542 Eric Biederman
1543 Giampiero Giancipoli
1544 Helge Wagner
1545 Idwer Vollering
1546 Joe Bao
1547 Joerg Fischer
1548 Joshua Roys
1549 Kyösti Mälkki
1550 Luc Verhaegen
1551 Li-Ta Lo
1552 Mark Marshall
1553 Markus Boas
1554 Mattias Mattsson
1555 Michael Karcher
1556 Nikolay Petukhov
1557 Patrick Georgi
1558 Peter Lemenkov
1559 Peter Stuge
1560 Reinder E.N. de Haan
1561 Ronald G. Minnich
1562 Ronald Hoogenboom
1563 Sean Nelson
1564 Stefan Reinauer
1565 Stefan Tauner
1566 Stefan Wildemann
1567 Stephan Guilloux
1568 Steven James
1569 Urja Rannikko
1570 Uwe Hermann
1571 Wang Qingpei
1572 Yinghai Lu
1573 some others, please see the flashrom git history for details.
1574 All still active authors can be reached via the mailing list
1575 ⟨flashrom@flashrom.org⟩.
1576 This manual page was written by Uwe Hermann ⟨uwe@hermann-uwe.de⟩, Carl-
1578 Daniel Hailfinger, Stefan Tauner and others. It is licensed under the
1579 terms of the GNU GPL (version 2 or later).
15801.3.0 2022-12-13 FLASHROM(8)