flashrom

flashrom@flashrom.org

5 participants
9161 discussions

Asus A78M-E eeprom not found
by Vinarz Balázs 29 Aug '15

29 Aug '15

Dear Devs, i've got a ASUS A78M-E mobo. Unfortunately its non-working at the moment. Please look at the file attached, maybe its helpful. Thanks

2 6

Re: [flashrom] FAILED: ASUS P4P800
by Idwer Vollering 29 Aug '15

29 Aug '15

2015-08-28 6:16 GMT+02:00 Alan Kirby <alankirby2(a)gmail.com>: > Hi Folks > > Had a result from flashrom that asked me to send this log to you guys. I'm > certainly thankful for that. > > The mainboard flash ROM had (probably still has) malware within it that is > persistent. Maybe it's lighteater. You can extract the chip's content, from file, using bios_extract: https://github.com/coreboot/bios_extract and/or radare: http://rada.re/ > Since I haven't fully diagnosed it, I've > attached a 64KiB file that is a dump of the boot block: F'0000 - F'FFFF. > One of the things it does is prevent afudos (engineer's version) from > overwriting the boot block. The bootblock, or in this case whole chip protection is put in place by the vendor BIOS. > Another thing it does : if you hit Enter at the > afudos command, then pull out the keyboard cable, the Disk Driver (INT 13h > handler) throws an error, saying there was a disk read error. That > shouldn't happen, so these interrupt handlers are checking up on each > other, in order to achieve overall persistence. BY ALL MEANS: THEN DON'T PULL OUT THE KEYBOARD CABLE? One could permanently break a mainboard, or at least its PS/2 port, by doing so. > > So, to get round these protections, I was attempting to shift away from > FreeDOS and flash the ROM from Linux - Ubuntu (Trust Tahr 6.0), in fact. > > I see the warning about the mainboard-specific code but I couldn't tally > that with any action I should take. I saw that the ASUS P4P800 is supported > and that it is autodetected. I also tried putting different strings after > mainboard, whilst simply probing the hardware: =ASUS, =P4P800, =ASUS > P4P800, =ASUS:P4P800. Each generated an error. Removing the = and > everything after it worked - the probe worked without error. That gave me > confidence that I'd understood the autodetect part. Which model of P4P800 is this? Is it the P4P800-VM? If I recall correctly, a newer release of flashrom (0.9.7 or 0.9.8) will detect the supported (sub)model. Source: I had an ASUS P4P800-VM. > > Regards > > Alan K HTH, Idwer > > # ./flashrom -p internal:mainboard -E > flashrom v0.9.6.1-r1563 on Linux 3.14.20 (i686) > flashrom is free software, get the source code at http://www.flashrom.org > > Calibrating delay loop... OK. > Found chipset "Intel ICH5/ICH5R". Enabling flash write... OK. > WARNING: Your mainboard is ASUS P4P800, but the mainboard-specific > code has not been tested, and thus will not be executed by default. > Depending on your hardware environment, erasing, writing or even probing > can fail without running the board specific code. > > Please see the man page (section PROGRAMMER SPECIFIC INFO, subsection > "internal programmer") for details. > Unhandled programmer parameters: mainboard > Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH) at physical address > 0xfff80000. > Erasing and writing flash chip... ERASE FAILED at 0x00001c40 ! > Expected=0xff, Read=0x44, failed byte count from 0x00001000-0x00001fff: > 0x3a2 > ERASE FAILED! > Reading current flash chip contents... done. ERASE FAILED at 0x00001c40 ! > Expected=0xff, Read=0x44, failed byte count from 0x00000000-0x0000ffff: > 0xe2c5 > ERASE FAILED! > Reading current flash chip contents... done. ERASE FAILED at 0x00001c40 ! > Expected=0xff, Read=0x44, failed byte count from 0x00000000-0x0007ffff: > 0x7a92c > ERASE FAILED! > FAILED! > Your flash chip is in an unknown state. > Get help on IRC at chat.freenode.net (channel #flashrom) or > mail flashrom(a)flashrom.org with the subject "FAILED: <your board name>"! > -------------------------------------------------------------------------- > DO NOT REBOOT OR POWEROFF! > > A non-text attachment MR-F0000.BIN has been stripped. > It is available at http://paste.flashrom.org/view.php?id=2783 > > _______________________________________________ > flashrom mailing list > flashrom(a)flashrom.org > http://www.flashrom.org/mailman/listinfo/flashrom

1 0

Programmers
by Keith Emery 29 Aug '15

29 Aug '15

G'day I read recently you were interested in expanding the list of programmers supported by flashrom. I would recommend supporting those that appear on ebay; as they are cheap and readily available. In Particular the following as it happens to be the one I already own. :) http://www.ebay.com/itm/XTW100-Programmer-USB-Motherboard-BIOS-SPI-FLASH-24… lsusb -v is as follows: Bus 004 Device 002: ID 16c0:05dc Van Ooijen Technische Informatica shared ID for use with libusb Couldn't open device, some information will be missing Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 1.10 bDeviceClass 255 Vendor Specific Class Couldn't open device, some information will be missing bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x16c0 Van Ooijen Technische Informatica idProduct 0x05dc shared ID for use with libusb bcdDevice 1.00 iManufacturer 1 iProduct 2 iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 18 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x40 (Missing must-be-set bit!) Self Powered MaxPower 20mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 0 (Defined at Interface level) bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0

2 3

[PATCH] WIP: Add support for continious SPI reads
by Nico Huber 28 Aug '15

28 Aug '15

Rebased this old, rotting patch. Not tested in the last two years, but might help to speed up some things (ftdi got pretty fast with this). It has to be enabled per chip (see WINBOND/W25Q64.V for example). --- chipdrivers.h | 1 + cli_common.c | 14 +++++++++++--- flash.h | 23 ++++++++++++++--------- flashchips.c | 4 ++-- spi.c | 5 ++++- spi25.c | 18 ++++++++++++++++++ 6 files changed, 50 insertions(+), 15 deletions(-) diff --git a/chipdrivers.h b/chipdrivers.h index cac94f3..f79195c 100644 --- a/chipdrivers.h +++ b/chipdrivers.h @@ -59,6 +59,7 @@ int spi_byte_program(struct flashctx *flash, unsigned int addr, uint8_t databyte int spi_nbyte_program(struct flashctx *flash, unsigned int addr, const uint8_t *bytes, unsigned int len); int spi_nbyte_read(struct flashctx *flash, unsigned int addr, uint8_t *bytes, unsigned int len); int spi_read_chunked(struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len, unsigned int chunksize); +int spi_read_unbound(struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len, unsigned int chunksize); int spi_write_chunked(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len, unsigned int chunksize); /* spi25_statusreg.c */ diff --git a/cli_common.c b/cli_common.c index 71cc2dd..289d56a 100644 --- a/cli_common.c +++ b/cli_common.c @@ -73,17 +73,22 @@ void print_chip_support_status(const struct flashchip *chip) if ((chip->tested.probe == BAD) || (chip->tested.probe == NT) || (chip->tested.read == BAD) || (chip->tested.read == NT) || (chip->tested.erase == BAD) || (chip->tested.erase == NT) || - (chip->tested.write == BAD) || (chip->tested.write == NT)){ + (chip->tested.write == BAD) || (chip->tested.write == NT) || + ((chip->feature_bits & FEATURE_UNBOUND_READ) && + chip->tested.uread == BAD || chip->tested.uread == NT)) { msg_cinfo("===\n"); if ((chip->tested.probe == BAD) || (chip->tested.read == BAD) || (chip->tested.erase == BAD) || - (chip->tested.write == BAD)) { + (chip->tested.write == BAD) || + ((chip->feature_bits & FEATURE_UNBOUND_READ) && chip->tested.uread == BAD)) { msg_cinfo("This flash part has status NOT WORKING for operations:"); if (chip->tested.probe == BAD) msg_cinfo(" PROBE"); if (chip->tested.read == BAD) msg_cinfo(" READ"); + if ((chip->feature_bits & FEATURE_UNBOUND_READ) && chip->tested.uread == BAD) + msg_cinfo(" UNBOUND_READ"); if (chip->tested.erase == BAD) msg_cinfo(" ERASE"); if (chip->tested.write == BAD) @@ -93,12 +98,15 @@ void print_chip_support_status(const struct flashchip *chip) if ((chip->tested.probe == NT) || (chip->tested.read == NT) || (chip->tested.erase == NT) || - (chip->tested.write == NT)) { + (chip->tested.write == NT) || + ((chip->feature_bits & FEATURE_UNBOUND_READ) && chip->tested.uread == NT)) { msg_cinfo("This flash part has status UNTESTED for operations:"); if (chip->tested.probe == NT) msg_cinfo(" PROBE"); if (chip->tested.read == NT) msg_cinfo(" READ"); + if ((chip->feature_bits & FEATURE_UNBOUND_READ) && chip->tested.uread == NT) + msg_cinfo(" UNBOUND_READ"); if (chip->tested.erase == NT) msg_cinfo(" ERASE"); if (chip->tested.write == NT) diff --git a/flash.h b/flash.h index 2c2839f..b3962ee 100644 --- a/flash.h +++ b/flash.h @@ -122,6 +122,7 @@ enum write_granularity { #define FEATURE_WRSR_EITHER (FEATURE_WRSR_EWSR | FEATURE_WRSR_WREN) #define FEATURE_OTP (1 << 8) #define FEATURE_QPI (1 << 9) +#define FEATURE_UNBOUND_READ (1 << 10) enum test_state { OK = 0, @@ -131,17 +132,20 @@ enum test_state { NA, /* Not applicable (e.g. write support on ROM chips) */ }; -#define TEST_UNTESTED (struct tested){ .probe = NT, .read = NT, .erase = NT, .write = NT } +#define TEST_UNTESTED (struct tested){ .probe = NT, .read = NT, .uread = NT, .erase = NT, .write = NT } -#define TEST_OK_PROBE (struct tested){ .probe = OK, .read = NT, .erase = NT, .write = NT } -#define TEST_OK_PR (struct tested){ .probe = OK, .read = OK, .erase = NT, .write = NT } -#define TEST_OK_PRE (struct tested){ .probe = OK, .read = OK, .erase = OK, .write = NT } -#define TEST_OK_PREW (struct tested){ .probe = OK, .read = OK, .erase = OK, .write = OK } +#define TEST_OK_PROBE (struct tested){ .probe = OK, .read = NT, .uread = NT, .erase = NT, .write = NT } +#define TEST_OK_PR (struct tested){ .probe = OK, .read = OK, .uread = NT, .erase = NT, .write = NT } +#define TEST_OK_PRU (struct tested){ .probe = OK, .read = OK, .uread = OK, .erase = NT, .write = NT } +#define TEST_OK_PRE (struct tested){ .probe = OK, .read = OK, .uread = NT, .erase = OK, .write = NT } +#define TEST_OK_PRUE (struct tested){ .probe = OK, .read = OK, .uread = OK, .erase = OK, .write = NT } +#define TEST_OK_PREW (struct tested){ .probe = OK, .read = OK, .uread = NT, .erase = OK, .write = OK } +#define TEST_OK_PRUEW (struct tested){ .probe = OK, .read = OK, .uread = OK, .erase = OK, .write = OK } -#define TEST_BAD_PROBE (struct tested){ .probe = BAD, .read = NT, .erase = NT, .write = NT } -#define TEST_BAD_PR (struct tested){ .probe = BAD, .read = BAD, .erase = NT, .write = NT } -#define TEST_BAD_PRE (struct tested){ .probe = BAD, .read = BAD, .erase = BAD, .write = NT } -#define TEST_BAD_PREW (struct tested){ .probe = BAD, .read = BAD, .erase = BAD, .write = BAD } +#define TEST_BAD_PROBE (struct tested){ .probe = BAD, .read = NT, .uread = NT, .erase = NT, .write = NT } +#define TEST_BAD_PR (struct tested){ .probe = BAD, .read = BAD, .uread = NT, .erase = NT, .write = NT } +#define TEST_BAD_PRE (struct tested){ .probe = BAD, .read = BAD, .uread = NT, .erase = BAD, .write = NT } +#define TEST_BAD_PREW (struct tested){ .probe = BAD, .read = BAD, .uread = NT, .erase = BAD, .write = BAD } struct flashctx; typedef int (erasefunc_t)(struct flashctx *flash, unsigned int addr, unsigned int blocklen); @@ -170,6 +174,7 @@ struct flashchip { struct tested { enum test_state probe; enum test_state read; + enum test_state uread; enum test_state erase; enum test_state write; } tested; diff --git a/flashchips.c b/flashchips.c index 574ad74..be6383b 100644 --- a/flashchips.c +++ b/flashchips.c @@ -13961,8 +13961,8 @@ const struct flashchip flashchips[] = { .page_size = 256, /* supports SFDP */ /* OTP: 1024B total, 256B reserved; read 0x48; write 0x42, erase 0x44, read ID 0x4B */ - .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP, - .tested = TEST_OK_PREW, + .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP | FEATURE_UNBOUND_READ, + .tested = TEST_OK_PRUEW, .probe = probe_spi_rdid, .probe_timing = TIMING_ZERO, .block_erasers = diff --git a/spi.c b/spi.c index 894f73f..a7da50a 100644 --- a/spi.c +++ b/spi.c @@ -85,7 +85,10 @@ int default_spi_read(struct flashctx *flash, uint8_t *buf, unsigned int start, "flashrom(a)flashrom.org\n", __func__); return 1; } - return spi_read_chunked(flash, buf, start, len, max_data); + if (flash->chip->feature_bits & FEATURE_UNBOUND_READ) + return spi_read_unbound(flash, buf, start, len, max_data); + else + return spi_read_chunked(flash, buf, start, len, max_data); } int default_spi_write_256(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len) diff --git a/spi25.c b/spi25.c index af4b6db..34fd7d5 100644 --- a/spi25.c +++ b/spi25.c @@ -978,6 +978,24 @@ int spi_read_chunked(struct flashctx *flash, uint8_t *buf, unsigned int start, } /* + * Read a part of the flash chip. + * Ignore pages as we shall read the data continuously. The only bound is the chunksize. + */ +int spi_read_unbound(struct flashctx *flash, uint8_t *buf, unsigned int start, + unsigned int len, unsigned int chunksize) +{ + int rc = 0; + unsigned int i; + + for (i = start; i < (start + len); i += chunksize) { + rc = spi_nbyte_read(flash, i, buf + (i - start), min(chunksize, start + len - i)); + if (rc) + break; + } + return rc; +} + +/* * Write a part of the flash chip. * FIXME: Use the chunk code from Michael Karcher instead. * Each page is written separately in chunks with a maximum size of chunksize. -- 2.4.6

2 1

FAILED: ASUS P4P800
by Alan Kirby 28 Aug '15

28 Aug '15

Hi Folks Had a result from flashrom that asked me to send this log to you guys. I'm certainly thankful for that. The mainboard flash ROM had (probably still has) malware within it that is persistent. Maybe it's lighteater. Since I haven't fully diagnosed it, I've attached a 64KiB file that is a dump of the boot block: F'0000 - F'FFFF. One of the things it does is prevent afudos (engineer's version) from overwriting the boot block. Another thing it does : if you hit Enter at the afudos command, then pull out the keyboard cable, the Disk Driver (INT 13h handler) throws an error, saying there was a disk read error. That shouldn't happen, so these interrupt handlers are checking up on each other, in order to achieve overall persistence. So, to get round these protections, I was attempting to shift away from FreeDOS and flash the ROM from Linux - Ubuntu (Trust Tahr 6.0), in fact. I see the warning about the mainboard-specific code but I couldn't tally that with any action I should take. I saw that the ASUS P4P800 is supported and that it is autodetected. I also tried putting different strings after mainboard, whilst simply probing the hardware: =ASUS, =P4P800, =ASUS P4P800, =ASUS:P4P800. Each generated an error. Removing the = and everything after it worked - the probe worked without error. That gave me confidence that I'd understood the autodetect part. Regards Alan K # ./flashrom -p internal:mainboard -E flashrom v0.9.6.1-r1563 on Linux 3.14.20 (i686) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found chipset "Intel ICH5/ICH5R". Enabling flash write... OK. WARNING: Your mainboard is ASUS P4P800, but the mainboard-specific code has not been tested, and thus will not be executed by default. Depending on your hardware environment, erasing, writing or even probing can fail without running the board specific code. Please see the man page (section PROGRAMMER SPECIFIC INFO, subsection "internal programmer") for details. Unhandled programmer parameters: mainboard Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH) at physical address 0xfff80000. Erasing and writing flash chip... ERASE FAILED at 0x00001c40 ! Expected=0xff, Read=0x44, failed byte count from 0x00001000-0x00001fff: 0x3a2 ERASE FAILED! Reading current flash chip contents... done. ERASE FAILED at 0x00001c40 ! Expected=0xff, Read=0x44, failed byte count from 0x00000000-0x0000ffff: 0xe2c5 ERASE FAILED! Reading current flash chip contents... done. ERASE FAILED at 0x00001c40 ! Expected=0xff, Read=0x44, failed byte count from 0x00000000-0x0007ffff: 0x7a92c ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at chat.freenode.net (channel #flashrom) or mail flashrom(a)flashrom.org with the subject "FAILED: <your board name>"! -------------------------------------------------------------------------- DO NOT REBOOT OR POWEROFF! A non-text attachment MR-F0000.BIN has been stripped. It is available at http://paste.flashrom.org/view.php?id=2783

1 0

ECS 15-V09-011012: flashrom -V
by Markus Flür 25 Aug '15

25 Aug '15

(Chipset : NVIDIA MCP67) flashrom v0.9.6.1-r1563 on Linux 3.16.0-38-generic (x86_64) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.1.9, GCC 4.7.1, little endian Command line (1 args): flashrom -V Please select a programmer with the --programmer parameter. Valid choices are: internal, dummy, nic3com, nicrealtek, gfxnvidia, drkaiser, satasii, ft2232_spi, serprog, buspirate_spi, rayer_spi, pony_spi, nicintel, nicintel_spi, ogp_spi, satamv

1 0

Report on Flashing chip
by Евгений Черкашин 24 Aug '15

24 Aug '15

Hi! I saw Your notification when flashing my Motherboard BIOS. It said that flashing is successful Base Board Information Manufacturer: ASUSTeK Computer INC. Product Name: P5GD1-VM Version: Rev 1.xx Serial Number: MB-1234567890 Reboot was successful too. CHIP ID: W39V040FA Best regards, Evgeny Cherkashin.

1 0

Phoenix BIOS with NVIDIA MCP55 ROM MAC Address Help Needed
by compevo communications 21 Aug '15

21 Aug '15

We have a huge batch of these servers that our client has hosted with us. 1. They are Dell CS24-NV5 with a Dell rebranded GA-3CESL-RH Motherboard and asked us to update the firmware. 2. They have asked us to help them update their firmware to support 6-core CPUs. 3. The problem is that no support or firmware files seem to be available from Dell (the Gigabyte BIOS is not suitable because it does not recognize or control the chassis fans). 4. flashrom has been great in that we had access to machines with the newer BIOS. We read it with flashrom but and wrote it back to one of their machines. 5. The problem is that it seems the MAC address is stored in the BIOS as well, so it copied the MAC address of the source machine. We cannot have multiple servers with duplicate MAC's for obvious reasons. *What we have tried:* 1.) All the tools mentioned online such as CBROM, Phoenix Mod, etc... have been unsuccessful (they cannot seem to properly access or open these files). *What we need help with:* 1. Can someone make a perl or python script to replace the MAC addresses in the attached ROM? Does it help if we know the MAC addresses currently in the ROM? 2. Or if someone happens to have the 1.89a factory flash for a Dell CS24-NV7 that is even better. 3. Or if someone can modify this ROM to remove the NIC/MCP55 LAN module that contains the MAC addresses (we attempted with CBROM but it cannot read the ROM). Any help would be appreciated. We are willing to pay someone if necessary. Cheers -- compevo communications http://compevo.com Toll-Free: 1-877-347-5238 Vancouver, Canada: 604-484-9873 Hong Kong: 852 5808-3267 Singapore: 6531581387 San Francisco, USA: 415-704-7591

2 2

Gigabyte GA-Z97MX Gaming 5
by XVilka Haos of System 20 Aug '15

20 Aug '15

Hello! Trying to make flashrom working on the Gigabyte GA-Z97MX Gaming 5 mainboard. It has ITE IT8620E Super I/O chip, DualBIOS configuration, thus 2 MXIC MX25L6473E chips. Attaching some logs: http://paste.flashrom.org/view.php?id=2779 Kind regards, XVilka.

1 0

BP4 Open-Drain command line Option
by Cosimo Orlando 19 Aug '15

19 Aug '15

Dear Flashrom Team, I'd like to add a simple feature to your BP4 support to allow the user to set up an open-drain SPI on command line exactly as for pullups option! Enable the pullups without an open-drain setting into configuration is useless, instead with it is very easy to flash an 1.8v eeprom. All details into the topic right here Could you add this feature? Or release a patch? Thanks. Regards, Cosimo Orlando P.S. Many users are looking for a solution right this into Dangerous Prototypes forum. -- *IT engineer in Electronics, Embedded Software Developer & C/D Blogger*

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom