February 2025 - flashrom-gerrit

[L] Change in flashrom[main]: doc: Migrate collection of docs about board enable
by Anastasia Klimchuk (Code Review) 10 Feb '25

10 Feb '25

Attention is currently required from: Stefan Reinauer. Anastasia Klimchuk has posted comments on this change by Anastasia Klimchuk. ( https://review.coreboot.org/c/flashrom/+/86329?usp=email ) Change subject: doc: Migrate collection of docs about board enable ...................................................................... Patch Set 3: (1 comment) File doc/contrib_howtos/board_enable/index.rst: https://review.coreboot.org/c/flashrom/+/86329/comment/4a87e656_d08cc1e3?us… : PS1, Line 8: **Note the collection below was migrated from old website and the content >10yrs old** > I would remove that. A list doesn't really get out of date. The content it points to could. Done -- To view, visit https://review.coreboot.org/c/flashrom/+/86329?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Gerrit-Change-Number: 86329 Gerrit-PatchSet: 3 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Comment-Date: Sun, 09 Feb 2025 22:08:57 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Stefan Reinauer <stefan.reinauer(a)coreboot.org>

1 0

[L] Change in flashrom[main]: doc: Migrate collection of docs about board enable
by Anastasia Klimchuk (Code Review) 10 Feb '25

10 Feb '25

Attention is currently required from: Anastasia Klimchuk, Stefan Reinauer. Hello Stefan Reinauer, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/flashrom/+/86329?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Code-Review+2 by Stefan Reinauer, Verified+1 by build bot (Jenkins) Change subject: doc: Migrate collection of docs about board enable ...................................................................... doc: Migrate collection of docs about board enable Collection is gathered from these docs: https://wiki.flashrom.org/Board_Enable https://wiki.flashrom.org/Board_Testing_HOWTO https://wiki.flashrom.org/Finding_Board_Enable_by_Reverse_Engineering Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Signed-off-by: Anastasia Klimchuk <aklm(a)flashrom.org> --- A doc/contrib_howtos/board_enable/board_testing_howto.rst A doc/contrib_howtos/board_enable/index.rst A doc/contrib_howtos/board_enable/overview.rst A doc/contrib_howtos/board_enable/reverse_engineering.rst M doc/contrib_howtos/index.rst 5 files changed, 356 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/29/86329/3 -- To view, visit https://review.coreboot.org/c/flashrom/+/86329?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Gerrit-Change-Number: 86329 Gerrit-PatchSet: 3 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[L] Change in flashrom[main]: doc: Migrate collection of docs about board enable
by Stefan Reinauer (Code Review) 09 Feb '25

09 Feb '25

Attention is currently required from: Anastasia Klimchuk. Stefan Reinauer has posted comments on this change by Anastasia Klimchuk. ( https://review.coreboot.org/c/flashrom/+/86329?usp=email ) Change subject: doc: Migrate collection of docs about board enable ...................................................................... Patch Set 2: Code-Review+2 (1 comment) File doc/contrib_howtos/board_enable/index.rst: https://review.coreboot.org/c/flashrom/+/86329/comment/58c1325b_75f5fcdb?us… : PS1, Line 8: **Note the collection below was migrated from old website and the content >10yrs old** I would remove that. A list doesn't really get out of date. The content it points to could. -- To view, visit https://review.coreboot.org/c/flashrom/+/86329?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Gerrit-Change-Number: 86329 Gerrit-PatchSet: 2 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Comment-Date: Sun, 09 Feb 2025 17:25:30 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[L] Change in flashrom[main]: doc: Migrate collection of docs about board enable
by Anastasia Klimchuk (Code Review) 09 Feb '25

09 Feb '25

Attention is currently required from: Stefan Reinauer. Hello Stefan Reinauer, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/flashrom/+/86329?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by build bot (Jenkins) Change subject: doc: Migrate collection of docs about board enable ...................................................................... doc: Migrate collection of docs about board enable Collection is gathered from these docs: https://wiki.flashrom.org/Board_Enable https://wiki.flashrom.org/Board_Testing_HOWTO https://wiki.flashrom.org/Finding_Board_Enable_by_Reverse_Engineering Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Signed-off-by: Anastasia Klimchuk <aklm(a)flashrom.org> --- A doc/contrib_howtos/board_enable/board_testing_howto.rst A doc/contrib_howtos/board_enable/index.rst A doc/contrib_howtos/board_enable/overview.rst A doc/contrib_howtos/board_enable/reverse_engineering.rst M doc/contrib_howtos/index.rst 5 files changed, 358 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/29/86329/2 -- To view, visit https://review.coreboot.org/c/flashrom/+/86329?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Gerrit-Change-Number: 86329 Gerrit-PatchSet: 2 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>

1 0

[M] Change in flashrom[main]: doc: Migrate doc about raspberry pi
by Stefan Reinauer (Code Review) 09 Feb '25

09 Feb '25

Attention is currently required from: Anastasia Klimchuk. Stefan Reinauer has posted comments on this change by Anastasia Klimchuk. ( https://review.coreboot.org/c/flashrom/+/86312?usp=email ) Change subject: doc: Migrate doc about raspberry pi ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://review.coreboot.org/c/flashrom/+/86312?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ie3b7f2ed31f0b756815de055a2c58602263dac66 Gerrit-Change-Number: 86312 Gerrit-PatchSet: 1 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Comment-Date: Sat, 08 Feb 2025 22:14:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in flashrom[main]: doc: Migrate collection of docs about board enable
by Anastasia Klimchuk (Code Review) 08 Feb '25

08 Feb '25

Anastasia Klimchuk has uploaded this change for review. ( https://review.coreboot.org/c/flashrom/+/86329?usp=email ) Change subject: doc: Migrate collection of docs about board enable ...................................................................... doc: Migrate collection of docs about board enable Collection is gathered from these docs: https://wiki.flashrom.org/Board_Enable https://wiki.flashrom.org/Board_Testing_HOWTO https://wiki.flashrom.org/Finding_Board_Enable_by_Reverse_Engineering Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Signed-off-by: Anastasia Klimchuk <aklm(a)flashrom.org> --- A doc/contrib_howtos/board_enable/board_testing_howto.rst A doc/contrib_howtos/board_enable/index.rst A doc/contrib_howtos/board_enable/overview.rst A doc/contrib_howtos/board_enable/reverse_engineering.rst M doc/contrib_howtos/index.rst 5 files changed, 358 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/29/86329/1 diff --git a/doc/contrib_howtos/board_enable/board_testing_howto.rst b/doc/contrib_howtos/board_enable/board_testing_howto.rst new file mode 100644 index 0000000..1847156 --- /dev/null +++ b/doc/contrib_howtos/board_enable/board_testing_howto.rst @@ -0,0 +1,72 @@ +=================== +Board Testing HOWTO +=================== + +**Note the document below was migrated from old website and the content >10yrs old** +Patches to add/update documentation are very much appreciated. + +This page gives you mainly hints on how to test flashrom support on mainboards. +Testing for graphics / network / SATA cards and external programmer devices is similar but less dangerous. + +.. container:: danger, admonition + + Important information + + DO NOT ATTEMPT TO FOLLOW THESE INSTRUCTIONS UNLESS YOU KNOW WHAT YOU ARE DOING! + THIS CAN RENDER YOUR MAINBOARD TOTALLY UNUSABLE! YOU HAVE BEEN WARNED! + +* If you have a laptop/notebook/netbook, please do NOT try flashrom because interactions + with the EC on these machines might crash your machine during flashing. + flashrom tries to detect if a machine is a laptop, but not all laptops follow the standard, + so this is not 100% reliable. + +* To check whether flashrom knows about your chipset and ROM chip, run ``flashrom -p internal``. + +* If it says ``"Found chipset CHIPSETNAME..."`` and ``"CHIPNAME found at..."`` that's a good first sign. + +* To check if you can read the existing BIOS image from the chip, run ``flashrom -p internal -r backup.bin``. + Make sure that backup.bin contains a useful BIOS image (some chipsets will return 0xff for large areas + of flash without any error messages, but there might be actually large areas of 0xff in the original image as well). + +* Now the really important part, checking if *writing* an image on the chip works: + + * First, if the board has a flash socket and you have spare chips, + make sure you have a backup chip containing the original BIOS. + Also, you should have verified that it actually boots your system successfully. + Put away that backup chip somewhere safe and insert a chip which you can safely + overwrite (e.g. an empty one you bought). + + * If that is not possible make sure you have some other way for complete recovery, + e.g. an external programmer that can do :doc:`/user_docs/in_system` on the board in question. + + * Then write an image onto the chip, which is different from what's on the chip right now: + ``flashrom -p internal -w new.bin``. If the image is equal you will get a notice since r1680. + If this works and flashrom reports "VERIFIED" your board is supported by flashrom. + + * If not, you might try to enable the "Enable BIOS Update" or "Write-protect BIOS" + or similar options in your BIOS menu first, or set a jumper on your board + (this is highly board-dependent). Also, you might have to use the flashrom --mainboard + switch for some boards. + + * If none of the above helps (but flashrom still *does* detect your chipset and ROM chip), + there's quite likely a board-specific initialization required in flashrom, + which is non-trivial to add (e.g. toggling certain custom GPIO lines etc). + In that case, contact us as we may be able to help. + + * If you can't risk a write on a given chip and if the chip is SPI, the following guidelines may help: + + * Try probing. + + * For ICH/VIA SPI, lockdown can mean probe works, but write/erase or even read doesn't. + It can also mean that probe does not work, but write/read/erase (or any subset thereof) would work. + For all other SPI chipsets, there is no such lockdown, so you can issue any erase/write/read command. + + * However, some SPI chips have a WP# pin which causes the block protection bits to become readonly. + Now if flashrom has a generic block protection checker for your chip, we're able to figure out + if write/erase is possible. Basically, you can check if you need a board enable + by setting all block protection bits, then unsetting them. If either of the operations fail, + you need a board enable. If they succeed, erase and write are guaranteed to work. + +Please tell us about your results by sending the output of flashrom commands you ran, +the exact board manufacturer and model name, and all of your observations and test results +to the flashrom :ref:`mailing list`. diff --git a/doc/contrib_howtos/board_enable/index.rst b/doc/contrib_howtos/board_enable/index.rst new file mode 100644 index 0000000..1d8be46 --- /dev/null +++ b/doc/contrib_howtos/board_enable/index.rst @@ -0,0 +1,17 @@ +======================= +Board enable collection +======================= + +The term "board enable" describes mainboard specific code to make +flash rom write access possible on this mainboard. + +**Note the collection below was migrated from old website and the content >10yrs old** + +Patches to add/update documentation are very much appreciated. + +.. toctree:: + :maxdepth: 1 + + overview + board_testing_howto + reverse_engineering diff --git a/doc/contrib_howtos/board_enable/overview.rst b/doc/contrib_howtos/board_enable/overview.rst new file mode 100644 index 0000000..98e1748 --- /dev/null +++ b/doc/contrib_howtos/board_enable/overview.rst @@ -0,0 +1,161 @@ +===================== +Board Enable Overview +===================== + +**Note the document below was migrated from old website and the content >10yrs old** +Patches to add/update documentation are very much appreciated. + +The term "board enable" describes mainboard specific code to make flash rom +write access possible on this mainboard. Usually this means programming some +directly programmable output pin (usually called general purpose I/O or GPIO for short) +of the chipset that is connect to a write protect input of the BIOS ROM chip to release write protection. + +How to find the board enable procedure on your board +==================================================== + +The reverse engineering method at the end is preferred because it has a bit lower risk. + +Try & Error method on GPIO pins +------------------------------- + +The following is a mail from Ron: + +we just had the need to find a flash write enable on some servers. +These are Dell S1850s and we're tired of having a non-Linux-based Flash tool, +and, still worse, one to which we do not have source. Flashrom would be great, +save that it can't get the flash to write. We decided to see if it was the classic +GPIO-enabled FLASH write pin, which is the standard it seems in PC hardware. + +In this note I am just describing a program that I wrote long ago at LANL +and have used from time to time when I could not get the info I needed on enabling FLASH write. + +One thing we have found over the past 10 years: the single most common write enable control +is a GPIO attached to a southbridge. Don't know why it always seems to be this way, but there it is. + +This leads to a simple strategy to test for a GPIO enable, and to find which one it is. + +First, we find the southbridge, which in this case is an ICH5. +The GPIO programming on this part is little changed from earlier parts. + +Then we find the pci function which has the GPIOs. It's usually the LPC bridge. + +So for ICH5: + +00:1f.0 ISA bridge: Intel Corporation 82801EB/ER (ICH5/ICH5R) LPC Interface Bridge (rev 02) + +it's that one. + +So, to make it easy, rather than look at the BAR for the GPIO, just ``cat /proc/ioports`` and find this:: + + 0880-08bf : 0000:00:1f.0 + 0880-08bf : pnp 00:06 + +OK, we are about ready to go. The base address of the GPIOs is 0x880. +If you're paranoid confirm it with setpci:: + + [root@tn4 ~]# setpci -s 0:1f.0 58.l + 00000881 + [root@tn4 ~]# + +You need to look up the IO space mappings of SOME of the registers, +but for this simple program, not ALL. In fact all we're going to do is +read in the GPIO data level register, complement it, write it out, +then run flashrom to see if it works. But, you ask: + +* what if you read inputs and write them out nothing, so don't worry. They're inputs. +* you change GPIO pins that do some other thing well, it gets harder in that case. + For instance, some laptops use a GPIO pin to enable DRAM power. + Don't worry, you'll find out if they do. + +In that case, you'll have to do 32 boot/test cycles in the worst case, +instead of the five we do here. It actually can be instructive on a laptop +to change output GPIO levels and see what happens, so this is a fun test to do anyway. + +First, though, do this: ``flashrom -r factory.img`` + +Then ``emacs factory.img`` , (Go into OVRWRT mode!) and look for a string like this:: + + F2 = Setup + +I changed it to:: + + F2 = FIXup + +I may have used some other F-based words, as time went on, but that's another story. + +You want to make sure that if you really do rewrite it that it is easy to tell! +With this change, as soon as the BIOS splash screen comes up, you will know. + +OK, some code: Just set a few things up we think we'll need.:: + + #include <stdio.h> + #include <sys/io.h> + + #define LVL 0xc + +LVL is the level register for the GPIO. Now let's go to work.:: + + int main(int argc, char *argv[]) + { + unsigned long gpioport = 0x880; + unsigned long gpioval; + iopl(3); + /* first simple test: read in all GPIOs, complement them, + * output them, see if flashrom works */ + gpioval = inl(gpioport + LVL); + printf("GPIO is 0x%x (default 0x1f1f0000)\n", gpioval); + /* invert */ + gpioval = ~gpioval; + printf("GPIO will be set to 0x%x \n", gpioval); + outl(gpioval, gpioport + LVL); + gpioval = inl(gpioport + LVL); + printf("GPIO is 0x%x \n", gpioval); + } + +OK, call this program 'one'. At this point, you want to try a flashrom run. +As it happens this works and is sufficient to allow us to use flashrom! + +How to finish the task? It's actually a fairly simple newtonian search. + +First try ``gpioval ^= 0xffff0000;`` + +If that works, then try 0xff000000, etc. etc. Even if you get it wrong, +which I did, it still doesn't take long to find it. + +Warning, though: each time you try, be sure to change the FIXup string in the rom image, +to be very very sure that you really did rewrite it. You need to be careful about this step. + +Anyway, hope that is a little useful. It really is a very simple process to find a GPIO enable. +That's one reason that vendors are going to make this much, much harder on future systems. +GPIO enables are not a security feature, in spite of what you may have heard; +they are really accident protection in case some piece of software goes insane +and starts writing to random memory locations. + +Reverse Engineering your BIOS +----------------------------- + +Reverse engineering the BIOS is more straight-forward than just poking around all GPIO pins, +but in itself a quite advanced topic, so it is explained in detail in :doc:`reverse_engineering`. +It basically is about analyzing what the BIOS or the vendor tool does to update the flash rom. + +How to add the board enable to flashrom +======================================= + +First, find out whether the board enable method you found out is already used for another mainboard. +In the case that it is just raising or lowering one GPIO pin, it could be quite possible that this is the case. +As we don't like code duplication, reuse that function. If it is named something like "board_vendor_model" +but really just changes a single pin (board_epox_ep_bx3 is an example in r803), rename it to what it does, +which would be intel_piix4_gpo22_raise in this case. Add a comment to the function that it also works on your board. + +If you don't find a function that does what you want, write it yourself, +also trying to reuse codes for parts of what you have to do. +Add a comment mentioning the board name and the involved chips in this case too. + +After having written an enable function, you just need to add it to the board enable table +(board_pciids_enables). This table maps PCI IDs found on the board to the correct enabling functions. +Be sure to write a good match (which mostly means that you have to choose onboard chips +that have vendor-assigned subsystem IDs that are unique for each board that vendor produced). +If a unique match is not possible at all, provide vendor and model name (short form, usually lower case only) +as "coreboot IDs" for use with the "-m" option, which means that the board won't be autodetected +but can be selected by hand. The board name and vendor name following the coreboot ID strings are freeform +and should disply vendor and model name in their preferred form. diff --git a/doc/contrib_howtos/board_enable/reverse_engineering.rst b/doc/contrib_howtos/board_enable/reverse_engineering.rst new file mode 100644 index 0000000..7a5de1d --- /dev/null +++ b/doc/contrib_howtos/board_enable/reverse_engineering.rst @@ -0,0 +1,107 @@ +=========================================== +Finding Board Enable by Reverse Engineering +=========================================== + +**Note the document below was migrated from old website and the content >10yrs old** +Patches to add/update documentation are very much appreciated. + +Finding the board enable code inside the flash rom seems like looking for a needle in a haystack, +but using the right search method might be as easy as finding a magnetic needle using a strong magnet. +This page explains approaches to find the board enable code in different vendor BIOSes. + +Useful Tools +============ + +For free/open source reverse engineering tools, take a look at objdump and ndisasm. + +For objdump, use:: + + objdump -b binary -m i386 -M i8086,intel --disassemble-all datafile.bin + +(you might want to leave off the "intel" option if you prefer the AT&T assembler syntax) + +But as all free tools we know of are not comparable to the commercial tool `IDA Pro <http://www.hex-rays.com/idapro/>`_ +which has free-as-in-beer version for non-commercial use `IDA 4.9 Freeware <http://www.hex-rays.com/idapro/idadownfreeware.htm>`_ +which has all features needed for BIOS analysis, it should be mentioned here, too. + +General Hints +============= + +* Get an lspci of that board before you start. Best way is to request it from the board owner, + but you might find it on Google. Everest Reports of systems include an hexdump of config space at the end. + +* Get used to the binary PCI address specification: Device/function ID is combined into one byte, + the device ID (0..31) is multiplied by eight and added/ored with the function ID (0..7). + Most PCI addresses in the BIOS have the resulting byte hardcoded. + So if this byte is 0xF9 for example, it is 1f.1 in lspci syntax. + +* In/Out to fixed I/O addresses above 0x400 is usually accessing GPIO pins. + The base address can usually be found in PCI config space, but many BIOS vendors hard-code + the address as they know what address their own BIOS configures the GPIO address to. + Typical base values are 0x400 or 0x800 on Intel ICH and 0x4400 on nVidia MCP. + Check the GPIO setting function for the chipset on the board early to recognize patterns + in the assembly code (you *did* get the lspci before you started, + so you can easily look up which chipset and which GPIO method is used, didn't you?) + +Vendor-specific Hints +===================== + +Award BIOS +---------- + +First, you need the runtime BIOS, this is the 128KB thats available at the addresses E0000-FFFFF +when the system is running. You can either obtain it by dumping from a running system, +or by running "lha x bios.bin" on a BIOS image as it gets written to the chip. + +From the 128KB you only need the second half (the f-segment). In this segment, look for the text "AWDFLASH". +This signature is followed by eleven 16-bit procedure offsets (all these procedures reside in the segment F000). +The second procedure offset points to the board/chipset enable function. +The third procedure offset points to the board/chipset disable function. + +Useful hints: + +* PCI register manipulation is common. If you find a procedure that outputs something to port CF8, + it accesses PCI configuration space. If a second out instruction follows, it is a PCI config write, + if an in instruction follows, it's a PCI config read. In AWARD BIOS code, + the Device/Function ID is passed in CH, the config space address in CL. Bus number + (if used at all, check the procedure called) in BH or BL. Data is exchanged via AL/AX/EAX + +AMI BIOS +-------- + +Get the runtime F-segment of the BIOS. Currently there is no automated extraction method +available than dumping from a running machine. Flashing is handled through Int 16 +(entry point at F000:E82E, look for AH=E0, usually catched in the very beginning), +but can also be found in a different way. For each similar group of flash chips, +there is a call table with three 16 bit offsets for identifying, erasing and writing the chip. +In most AMI biosses, this table is quite closely followed by a pointer to the flash chip name +and a list of strings containing all flash chip names in this group. The identification procedure +adjusts the pointer to point to the right string. Finding flashing procedures can be done by searching +for magic constants like 0x2AA, 0xAAA, 0x2AAA and looking at the code. All low-level-flashing code +for one group is quite close together, so poking around to find the main entry points is feasible. + +There is a table at some other place that (amongs other data) contains the offset +of the call table for each group. The offset of this table is referenced in the generic flashing code +that tends to be shortly before the group-specific code. Usually, on detection the address of one group +call table is stored in a "current group" pointer, which in the running system points to one +of the group entries, too. There will be a function that references this current group pointer +and calls the erase function [bx+2] (maybe via a looping helper function) and the write function +[bx+4] in quick succession. The function called before the erase function is the flash enable function. + +If you go the forward route, trace Int 16, AX=E025 which should call the erase procedure. + +Useful hints: + +* PCI access in AMI commonly uses a bit fiddling function. This function takes the bus number in DH, + the device/function number in DL, a bit mask in BH, bits to be set in BL, and the config space address in AH. + It clears all bits set in BH and sets the bit set in BL. It returns the old value (all bits) in AL, + and sets the zero flag if all bits in BH were already clear. This function is wrapped by a generic bit setting + and a generic bit clearing function. These functions take a bit mask (usually only one bit set) in AL. + The bit setting function calls the bit manipulation function with BH=0 and BL=AL, + the bit clearing function calls the bit manipulation function with BH=AL and BL=0. + +FOSDEM presentation +=================== + +Luc Verhaegen talked at FOSDEM 2010 about reverse engineering board enables. +The slides are `here <http://people.freedesktop.org/~libv/flash_enable_bios_reverse_engineering_(…>`_ diff --git a/doc/contrib_howtos/index.rst b/doc/contrib_howtos/index.rst index 3df2fac..bbdb9a7 100644 --- a/doc/contrib_howtos/index.rst +++ b/doc/contrib_howtos/index.rst @@ -8,6 +8,7 @@ how_to_mark_chip_tested how_to_add_unit_test laptops_and_ec + board_enable/index ../how_to_add_docs ../how_to_support_flashrom -- To view, visit https://review.coreboot.org/c/flashrom/+/86329?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I0aaa39679514f667c70ba50f6b726e8d1bd07825 Gerrit-Change-Number: 86329 Gerrit-PatchSet: 1 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[M] Change in flashrom[main]: libflashrom: Update the API for progress callback
by Sergii Dmytruk (Code Review) 07 Feb '25

07 Feb '25

Attention is currently required from: Anastasia Klimchuk, Peter Marheine, Richard Hughes. Sergii Dmytruk has posted comments on this change by Anastasia Klimchuk. ( https://review.coreboot.org/c/flashrom/+/86031?usp=email ) Change subject: libflashrom: Update the API for progress callback ...................................................................... Patch Set 5: (1 comment) File include/libflashrom.h: https://review.coreboot.org/c/flashrom/+/86031/comment/c95bd432_9c631356?us… : PS2, Line 90: * @deprecated Use flashrom_set_progress_callback_v1 instead > So, just to clarify: do you think it is unavoidable to keep the old deprecated function code, and two callbacks in flash context? It depends on how stable the API is supposed to be. If no promises are made, then can just update the code keeping nothing of original implementation. If it's supposed to be stable until flashrom v2 release (breaking changes require major version bump), then I would say 2 callbacks must be kept. I don't really know what's the policy in case of `libflashrom` is, but I prefer to err on the side of compatibility to not cause unnecessary breakage. > Also who are the users for whom it makes a difference, is that the users who build with old header and new code? Any existing code which uses old callback regardless of the header version. You can't really know what's the effect of not calling that callback might be, client application can do something more important than managing progress in it (e.g., running some kind of event loop). That said, I have no idea about the number of applications linking against `libflashrom`, the actual impact of the change might be negligible. -- To view, visit https://review.coreboot.org/c/flashrom/+/86031?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ia8cc0461c449b7e65888a64cdc594c55b81eae7a Gerrit-Change-Number: 86031 Gerrit-PatchSet: 5 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Reviewer: Richard Hughes <richard(a)hughsie.com> Gerrit-Reviewer: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Richard Hughes <richard(a)hughsie.com> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Comment-Date: Fri, 07 Feb 2025 13:50:04 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Anastasia Klimchuk <aklm(a)chromium.org> Comment-In-Reply-To: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>

1 0

[M] Change in flashrom[main]: doc: Migrate doc about raspberry pi
by Anastasia Klimchuk (Code Review) 07 Feb '25

07 Feb '25

Anastasia Klimchuk has uploaded this change for review. ( https://review.coreboot.org/c/flashrom/+/86312?usp=email ) Change subject: doc: Migrate doc about raspberry pi ...................................................................... doc: Migrate doc about raspberry pi Old doc: https://wiki.flashrom.org/RaspberryPi Change-Id: Ie3b7f2ed31f0b756815de055a2c58602263dac66 Signed-off-by: Anastasia Klimchuk <aklm(a)flashrom.org> --- M doc/user_docs/index.rst A doc/user_docs/raspberry_pi.rst 2 files changed, 57 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/12/86312/1 diff --git a/doc/user_docs/index.rst b/doc/user_docs/index.rst index e03789e..7c56a28 100644 --- a/doc/user_docs/index.rst +++ b/doc/user_docs/index.rst @@ -12,6 +12,7 @@ misc_intel in_system msi_jspi1 + raspberry_pi misc_notes .. Keep misc notes last diff --git a/doc/user_docs/raspberry_pi.rst b/doc/user_docs/raspberry_pi.rst new file mode 100644 index 0000000..db0e75f --- /dev/null +++ b/doc/user_docs/raspberry_pi.rst @@ -0,0 +1,56 @@ +=========== +RaspberryPi +=========== + +`RaspberryPi <http://www.raspberrypi.org/faqs>`_ is a cheap single-board computer developed in the UK +by the Raspberry Pi Foundation with the intention of stimulating the teaching of basic computer science in schools. +It can run a fully-functional GNU/Linux distribution and exposes SPI, I2C and several GPIOs on its expansion header. + +Prerequisites +============= + +Use latest Raspbian (or any other distribution with a recent kernel). +Run the following commands (or make sure these kernel modules are loaded successfully):: + + modprobe spi_bcm2835 # If that fails you may wanna try the older spi_bcm2708 module instead + modprobe spidev + +Connecting the flash chip +========================= + +To learn more about the RPi's expansion header refer to http://elinux.org/Rpi_Low-level_peripherals . +If you use one of the first A or B models, please make sure to not draw more than 50mA from the 3.3V pin. +Official numbers for newer models are hard to find but they use a switching regulator +that should provide a much higher margin. If the flash chip is still placed in a foreign circuit +(e.g. soldered to a PC mainboard) please refer to :doc:`/user_docs/in_system` for further details. + +========== ======================= +RPi header SPI flash +========== ======================= +25 GND +24 /CS +23 SCK +21 DO +19 DI +17 VCC 3.3V (+ /HOLD, /WP) +========== ======================= + +.. container:: danger, admonition + + Always connect all input pins of integrated circuits (not only flash chips). + +In general the other pins (usually pin 3 is /WP and pin 7 is /HOLD) should be connected to Vcc +unless they are required to be floating or connected to GND (both extremely uncommon for SPI flash chips). +Please consult the datasheet for the flash chip in question. + +If your flash chip is detected but your read/write/verify operations tend to fail, try to add decoupling capacitors (one 100nF and one 4.7uF ceramic capacitor is preferred) close to the flash chip's power pin. + +Running flashrom +================ + +Flashrom uses the Linux-native SPI driver, which is implemented by flashrom's linux_spi programmer. +To use the RaspberryPi with flashrom, you have to specify that programmer. You should always tell +it at what speed the SPI bus should run; you specify that with the spispeed parameter (given in kHz). +You also have to specify the Linux SPI device, e.g.:: + + flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1000 -- To view, visit https://review.coreboot.org/c/flashrom/+/86312?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ie3b7f2ed31f0b756815de055a2c58602263dac66 Gerrit-Change-Number: 86312 Gerrit-PatchSet: 1 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[M] Change in flashrom[main]: libflashrom: Update the API for progress callback
by Anastasia Klimchuk (Code Review) 07 Feb '25

07 Feb '25

Attention is currently required from: Peter Marheine, Richard Hughes, Sergii Dmytruk. Anastasia Klimchuk has posted comments on this change by Anastasia Klimchuk. ( https://review.coreboot.org/c/flashrom/+/86031?usp=email ) Change subject: libflashrom: Update the API for progress callback ...................................................................... Patch Set 5: (4 comments) Patchset: PS1: > A comment for me to add item to "Recent development" doc after the review Done Patchset: PS3: > I think this warrants an entry in the release notes too, since it's a user-visible change. Yes, I added a comment to myself to do this :) and now I resolved both comments File include/libflashrom.h: https://review.coreboot.org/c/flashrom/+/86031/comment/7a6329f6_26c5c243?us… : PS2, Line 90: * @deprecated Use flashrom_set_progress_callback_v1 instead > The old version was usable but required global state. […] This is so clever! I didn't realise there was such a way of using the old API. I even mentioned this in the recent development notes :) So, just to clarify: do you think it is unavoidable to keep the old deprecated function code, and two callbacks in flash context? One callback is better than two: but my main goal is to have a new API, so if keeping the old is a required step, I will do it. Also who are the users for whom it makes a difference, is that the users who build with old header and new code? File libflashrom.c: https://review.coreboot.org/c/flashrom/+/86031/comment/e9295642_5f760a0e?us… : PS3, Line 71: msg_gerr("%s deprecated, use flashrom_set_progress_callback_v2 instead\n", __func__); > This message will probably be shown to users more often than developers (who should see the warning […] Done -- To view, visit https://review.coreboot.org/c/flashrom/+/86031?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ia8cc0461c449b7e65888a64cdc594c55b81eae7a Gerrit-Change-Number: 86031 Gerrit-PatchSet: 5 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Reviewer: Richard Hughes <richard(a)hughsie.com> Gerrit-Reviewer: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Richard Hughes <richard(a)hughsie.com> Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Attention: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Comment-Date: Fri, 07 Feb 2025 08:11:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Anastasia Klimchuk <aklm(a)chromium.org> Comment-In-Reply-To: Peter Marheine <pmarheine(a)chromium.org> Comment-In-Reply-To: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com>

1 0

[M] Change in flashrom[main]: libflashrom: Update the API for progress callback
by Anastasia Klimchuk (Code Review) 07 Feb '25

07 Feb '25

Attention is currently required from: Anastasia Klimchuk, Richard Hughes. Hello Peter Marheine, Richard Hughes, Sergii Dmytruk, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/flashrom/+/86031?usp=email to look at the new patch set (#5). Change subject: libflashrom: Update the API for progress callback ...................................................................... libflashrom: Update the API for progress callback The initial version of API for progress callback would require the callback function to make a second call to get the needed data about progress state (current, total etc). This patch changes the callback API, so that callback function gets all needed data straight away as parameters, and with this, callback has all the data to do its job. Since the initial version was submitted and it was in the tree for a while, the change needs to add a _v1 suffix for new thing and deprecated attribute for old thing. Testing: both unit tests and cli are libflashrom clients. All unit tests run successfully, for the cli all scenarios from commit 75dc0655b95dde91f1426a7e5aecfc04d7b8d631 run successfully. Change-Id: Ia8cc0461c449b7e65888a64cdc594c55b81eae7a Signed-off-by: Anastasia Klimchuk <aklm(a)flashrom.org> --- M cli_classic.c M cli_output.c M doc/release_notes/devel.rst M include/cli_output.h M include/flash.h M include/libflashrom.h M libflashrom.c M libflashrom.map M tests/chip.c M tests/spi25.c 10 files changed, 91 insertions(+), 68 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/31/86031/5 -- To view, visit https://review.coreboot.org/c/flashrom/+/86031?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ia8cc0461c449b7e65888a64cdc594c55b81eae7a Gerrit-Change-Number: 86031 Gerrit-PatchSet: 5 Gerrit-Owner: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Reviewer: Richard Hughes <richard(a)hughsie.com> Gerrit-Reviewer: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Richard Hughes <richard(a)hughsie.com> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

flashrom-gerrit February 2025