[PROPOSAL] support for NIC RTL8139 onboard flashing
Hi all, a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is possible from DOS to flash PXE bootcode directly onboard provided you use ATMEL AT29C512 or AT29C010A flashs; here's the download of the Realtek flash program (see DOS section): http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&PFid=... unfortunately Realtek's flash utility only supports ATMEL flashs, and even more worse is the trap that you can only flash the chip if it is detected by the BIOS - if you just insert an empty chip then it didnt work for me; the chip needs at least the 55AA code at the beginning so that its memory is mapped into adapter space by the MB BIOS. Do you think that it is possible to add support for flashing these cards (omst likely the RTL8169 GB NICs work same) to flashrom? Günter.
Hi, Guenter schrieb:
a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is possible from DOS to flash PXE bootcode directly onboard provided you use ATMEL AT29C512 or AT29C010A flashs; here's the download of the Realtek flash program (see DOS section):
Many cards tie the "write enable" Pin to its logic "not enabled" state instead of connecting to the chip, so flash writes are impossible on _most_ card types I came across. YMMV.
http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&PFid=...
unfortunately Realtek's flash utility only supports ATMEL flashs, and even more worse is the trap that you can only flash the chip if it is detected by the BIOS - if you just insert an empty chip then it didnt work for me; the chip needs at least the 55AA code at the beginning so that its memory is mapped into adapter space by the MB BIOS. Do you think that it is possible to add support for flashing these cards (omst likely the RTL8169 GB NICs work same) to flashrom?
RTL8169 uses different addresses IIRC. Same problem with hard wired Write Enable pin - see above. I have still some not-really-working code from my earlier experiments. I could read the chip-id and erase the chip - but the erase test failed afterwards, though the cips' contents seemed to be all 0xFF. If you are still interested: The attached .c file contains details on how to talk to the flash chip on RTL 8139 NIC. -- J. Fischer /* * This file is part of the flashrom project. * * Copyright (C) 2009 Joerg Fischer <turboj@gmx.de> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ #include <stdlib.h> #include <string.h> #include <sys/types.h> #include "flash.h" #define PCI_VENDOR_ID_REALTEK 0x10ec #define PCI_VENDOR_ID_SMC1211 0x1113 #define BIOS_ROM_ADDR 0xD4 #define BIOS_ROM_DATA 0xD7 struct pcidev_status nics_realtek[] = { {0x10ec, 0x8139, PCI_OK, "Realtek","rtl8139b/c PCI 10/100 Mbps"}, {}, }; struct pcidev_status nics_smc1211[] = { {0x1113, 0x1211, PCI_OK, "SMC", "SMC 1211TX rtl8139 clone 10/100 Mbps"}, {} }; int nicrealtek_init(void) { get_io_perms(); io_base_addr = pcidev_init(PCI_VENDOR_ID_REALTEK, nics_realtek, programmer_param); buses_supported = CHIP_BUSTYPE_PARALLEL; return 0; } int nicsmc1211_init(void) { get_io_perms(); io_base_addr = pcidev_init(PCI_VENDOR_ID_SMC1211, nics_smc1211, programmer_param); buses_supported = CHIP_BUSTYPE_PARALLEL; return 0; } int nicrealtek_shutdown(void) { free(programmer_param); pci_cleanup(pacc); release_io_perms(); return 0; } void nicrealtek_chip_writeb(uint8_t val, chipaddr addr) { OUTL(((uint32_t)addr &0x01FFFF)|0x0A0000| (val << 24), io_base_addr + BIOS_ROM_ADDR); OUTL(((uint32_t)addr &0x01FFFF)|0x1E0000| (val << 24), io_base_addr + BIOS_ROM_ADDR); } uint8_t nicrealtek_chip_readb(const chipaddr addr) { OUTL(((uint32_t)addr & 0x01FFFF) | 0x060000, io_base_addr + BIOS_ROM_ADDR); return INB(io_base_addr + BIOS_ROM_DATA); }
On Mon, May 17, 2010 at 06:27:10PM +0200, Jörg Fischer wrote:
I have still some not-really-working code from my earlier experiments. I
Ditto, I have similar code from many months ago and ran into issues too, never got a working code or a suitable card, not sure. I'll probably look into it again soonish, but the bigger problem seems to be to find a card where this _can_ work. Well, or soldering and modifying the card. Uwe. -- http://hermann-uwe.de | http://sigrok.org http://randomprojects.org | http://unmaintained-free-software.org
Hi, Am 17.05.2010 23:28, schrieb Uwe Hermann:
On Mon, May 17, 2010 at 06:27:10PM +0200, Jörg Fischer wrote:
I have still some not-really-working code from my earlier experiments. I
Ditto, I have similar code from many months ago and ran into issues too, never got a working code or a suitable card, not sure.
I'll probably look into it again soonish, but the bigger problem seems to be to find a card where this _can_ work. Well, or soldering and modifying the card. As far as I can tell this worked once with a card which had a 28-pin socket, but I added the missing pins (layout was though complete) so it had then 32-pin; AFAICT it only works with 32-pin because 28-pin flash chips are not compatible to the 28-pin eprom pinout. I will check if I can get it working again with Realtek's flash writer from DOS, and one of my newer cards (f.e. Longshine) which came with 32-pin socket; have somewhere an ATMEL and also a SST laying around which should be good for this (the only two chip manufacturers which are supported by the Realtek writer).
thanks also for the posted code, will then take a look once I know for sure I have a card where it works with :) Gün.
Hi, On 17.05.2010 18:27, Jörg Fischer wrote:
Guenter schrieb:
a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is possible from DOS to flash PXE bootcode directly onboard provided you use ATMEL AT29C512 or AT29C010A flashs; here's the download of the Realtek flash program (see DOS section):
Many cards tie the "write enable" Pin to its logic "not enabled" state instead of connecting to the chip, so flash writes are impossible on _most_ card types I came across. YMMV.
Ouch. Not really a good way to use the cards as programmers.
I have still some not-really-working code from my earlier experiments. I could read the chip-id and erase the chip - but the erase test failed afterwards, though the cips' contents seemed to be all 0xFF.
Working ID and working erase, only with failing erase test? We had such issues on multiple programmers, and it turned out that the timing in flashrom was broken for the affected flash chips. This has since been fixed, so maybe your code now works fine?
If you are still interested: The attached .c file contains details on how to talk to the flash chip on RTL 8139 NIC.
IMHO any code which can at least get chip IDs is good enough to get merged (disabled by default until all issues are fixed). That will allow others to hack on the code and makes sure the code is not forgotten. Could you please resend it as a complete patch with a Signed-off-by line? Regards, Carl-Daniel -- http://www.hailfinger.org/
Hi, Carl-Daniel Hailfinger schrieb:
On 17.05.2010 18:27, Jörg Fischer wrote:
Guenter schrieb:
a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket [...]
Many cards tie the "write enable" Pin to its logic "not enabled" state instead of connecting to the chip, so flash writes are impossible on _most_ card types I came across. YMMV.
Ouch. Not really a good way to use the cards as programmers.
I have only 2 "known working" card types: SMC1211 TX with 10/100 RJ-54 AND 10Base-T (was quite expensive at its time), and "Longshine" cards with RTL8139C Chip.
I have still some not-really-working code from my earlier experiments. I could read the chip-id and erase the chip - but the erase test failed afterwards, though the cips' contents seemed to be all 0xFF.
Working ID and working erase, only with failing erase test? We had such issues on multiple programmers, and it turned out that the timing in flashrom was broken for the affected flash chips. This has since been fixed, so maybe your code now works fine?
Have not checked that for quite some time now.
If you are still interested: The attached .c file contains details on how to talk to the flash chip on RTL 8139 NIC.
IMHO any code which can at least get chip IDs is good enough to get merged (disabled by default until all issues are fixed). That will allow others to hack on the code and makes sure the code is not forgotten. Could you please resend it as a complete patch with a Signed-off-by line?
This may take some time, I am rather busy right now... -- J. Fischer
I would be very interested in this too. I have a few similar 28-pin boot ROM socketed cards spare and a device I'd like to re-program which uses 28 pin ROM chips. If there's a problem with the write enable pin, can this be worked around with another DIL holder with the correct pin bent, and a wire to connect that pin to the correct voltage? -- Andrew. On 16/05/2010 14:01, Guenter wrote:
Hi all, a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is possible from DOS to flash PXE bootcode directly onboard provided you use ATMEL AT29C512 or AT29C010A flashs; here's the download of the Realtek flash program (see DOS section): http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&PFid=...
unfortunately Realtek's flash utility only supports ATMEL flashs, and even more worse is the trap that you can only flash the chip if it is detected by the BIOS - if you just insert an empty chip then it didnt work for me; the chip needs at least the 55AA code at the beginning so that its memory is mapped into adapter space by the MB BIOS. Do you think that it is possible to add support for flashing these cards (omst likely the RTL8169 GB NICs work same) to flashrom?
participants (5)
-
Andrew Morgan -
Carl-Daniel Hailfinger -
Guenter -
Jörg Fischer -
Uwe Hermann