[PROPOSAL] support for NIC RTL8139 onboard flashing

[Guenter]

Hi all,
a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is 
possible from DOS to flash PXE bootcode directly onboard provided you 
use ATMEL AT29C512 or AT29C010A flashs; here's the download of the 
Realtek flash program (see DOS section):
http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&a...
unfortunately Realtek's flash utility only supports ATMEL flashs, and 
even more worse is the trap that you can only flash the chip if it is 
detected by the BIOS - if you just insert an empty chip then it didnt 
work for me; the chip needs at least the 55AA code at the beginning so 
that its memory is mapped into adapter space by the MB BIOS.
Do you think that it is possible to add support for flashing these cards 
(omst likely the RTL8169 GB NICs work same) to flashrom?

Günter.

[Jörg Fischer]

Hi,
Guenter schrieb:
> a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is
> possible from DOS to flash PXE bootcode directly onboard provided you
> use ATMEL AT29C512 or AT29C010A flashs; here's the download of the
> Realtek flash program (see DOS section):

Many cards tie the "write enable" Pin to its logic "not enabled" state
instead of connecting to the chip, so flash writes are impossible on
_most_ card types I came across. YMMV.
> http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&a...
>
> unfortunately Realtek's flash utility only supports ATMEL flashs, and
> even more worse is the trap that you can only flash the chip if it is
> detected by the BIOS - if you just insert an empty chip then it didnt
> work for me; the chip needs at least the 55AA code at the beginning so
> that its memory is mapped into adapter space by the MB BIOS.
> Do you think that it is possible to add support for flashing these cards
> (omst likely the RTL8169 GB NICs work same) to flashrom?

RTL8169 uses different addresses IIRC. Same problem with hard wired
Write Enable pin - see above.

I have still some not-really-working code from my earlier experiments. I
 could read the chip-id and erase the chip - but the erase test failed
afterwards, though the cips' contents seemed to be all 0xFF.

If you are still interested: The attached .c file contains details on
how to talk to the flash chip on RTL 8139 NIC.

-- J. Fischer

/*
 * This file is part of the flashrom project.
 *
 * Copyright (C) 2009 Joerg Fischer 
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
 */

#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include "flash.h"

#define PCI_VENDOR_ID_REALTEK	0x10ec
#define PCI_VENDOR_ID_SMC1211	0x1113

#define BIOS_ROM_ADDR		0xD4
#define BIOS_ROM_DATA		0xD7

struct pcidev_status nics_realtek[] = {
    {0x10ec, 0x8139, PCI_OK, "Realtek","rtl8139b/c PCI 10/100 Mbps"},
    {},
};

struct pcidev_status nics_smc1211[] = {
    {0x1113, 0x1211, PCI_OK, "SMC", "SMC 1211TX rtl8139 clone 10/100 Mbps"},
    {}
};

int nicrealtek_init(void)
{
    get_io_perms();
    io_base_addr = pcidev_init(PCI_VENDOR_ID_REALTEK, nics_realtek, programmer_param);
    
    buses_supported = CHIP_BUSTYPE_PARALLEL;

return 0;
}

int nicsmc1211_init(void)
{
    get_io_perms();
    io_base_addr = pcidev_init(PCI_VENDOR_ID_SMC1211, nics_smc1211, programmer_param);
    
    buses_supported = CHIP_BUSTYPE_PARALLEL;

return 0;
}

int nicrealtek_shutdown(void)
{
    free(programmer_param);
    pci_cleanup(pacc);
    release_io_perms();
    return 0;
}

void nicrealtek_chip_writeb(uint8_t val, chipaddr addr)
{
    OUTL(((uint32_t)addr &0x01FFFF)|0x0A0000| (val << 24), io_base_addr + BIOS_ROM_ADDR);
    OUTL(((uint32_t)addr &0x01FFFF)|0x1E0000| (val << 24), io_base_addr + BIOS_ROM_ADDR);
}

uint8_t nicrealtek_chip_readb(const chipaddr addr)
{
    OUTL(((uint32_t)addr & 0x01FFFF) | 0x060000, io_base_addr + BIOS_ROM_ADDR);
    return INB(io_base_addr + BIOS_ROM_DATA);
}

[Uwe Hermann]

On Mon, May 17, 2010 at 06:27:10PM +0200, Jörg Fischer wrote:
> I have still some not-really-working code from my earlier experiments. I

Ditto, I have similar code from many months ago and ran into issues too,
never got a working code or a suitable card, not sure.

I'll probably look into it again soonish, but the bigger problem seems
to be to find a card where this _can_ work. Well, or soldering and
modifying the card.

Uwe.

[Guenter]

Hi,
Am 17.05.2010 23:28, schrieb Uwe Hermann:
> On Mon, May 17, 2010 at 06:27:10PM +0200, Jörg Fischer wrote:
> > I have still some not-really-working code from my earlier experiments. I
>
> Ditto, I have similar code from many months ago and ran into issues too,
> never got a working code or a suitable card, not sure.
>
> I'll probably look into it again soonish, but the bigger problem seems
> to be to find a card where this _can_ work. Well, or soldering and
> modifying the card.

As far as I can tell this worked once with a card which had a 28-pin 
socket, but I added the missing pins (layout was though complete) so it 
had then 32-pin; AFAICT it only works with 32-pin because 28-pin flash 
chips are not compatible to the 28-pin eprom pinout.
I will check if I can get it working again with Realtek's flash writer 
from DOS, and one of my newer cards (f.e. Longshine) which came with 
32-pin socket; have somewhere an ATMEL and also a SST laying around 
which should be good for this (the only two chip manufacturers which are 
supported by the Realtek writer).

thanks also for the posted code, will then take a look once I know for 
sure I have a card where it works with :)

Gün.

[Carl-Daniel Hailfinger]

Hi,

On 17.05.2010 18:27, Jörg Fischer wrote:
> Guenter schrieb:
> > a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket, and it is
> > possible from DOS to flash PXE bootcode directly onboard provided you
> > use ATMEL AT29C512 or AT29C010A flashs; here's the download of the
> > Realtek flash program (see DOS section):
>
> Many cards tie the "write enable" Pin to its logic "not enabled" state
> instead of connecting to the chip, so flash writes are impossible on
> _most_ card types I came across. YMMV.

Ouch. Not really a good way to use the cards as programmers.
> I have still some not-really-working code from my earlier experiments. I
> could read the chip-id and erase the chip - but the erase test failed
> afterwards, though the cips' contents seemed to be all 0xFF.

Working ID and working erase, only with failing erase test? We had such
issues on multiple programmers, and it turned out that the timing in
flashrom was broken for the affected flash chips. This has since been
fixed, so maybe your code now works fine?
> If you are still interested: The attached .c file contains details on
> how to talk to the flash chip on RTL 8139 NIC.

IMHO any code which can at least get chip IDs is good enough to get
merged (disabled by default until all issues are fixed). That will allow
others to hack on the code and makes sure the code is not forgotten.
Could you please resend it as a complete patch with a Signed-off-by line?

Regards,
Carl-Daniel

[Jörg Fischer]

Hi,
Carl-Daniel Hailfinger schrieb:
> On 17.05.2010 18:27, Jörg Fischer wrote:
> > Guenter schrieb:
> > > a lot of Realtek RTL8139 NICs have a DIL-32 bootrom socket [...]
> >
> > Many cards tie the "write enable" Pin to its logic "not enabled" state
> > instead of connecting to the chip, so flash writes are impossible on
> > _most_ card types I came across. YMMV.
>
> Ouch. Not really a good way to use the cards as programmers.

I have only 2 "known working" card types:
SMC1211 TX with 10/100 RJ-54 AND 10Base-T (was quite expensive at its
time), and "Longshine" cards with RTL8139C Chip.
> > I have still some not-really-working code from my earlier experiments. I
> > could read the chip-id and erase the chip - but the erase test failed
> > afterwards, though the cips' contents seemed to be all 0xFF.
>
> Working ID and working erase, only with failing erase test? We had such
> issues on multiple programmers, and it turned out that the timing in
> flashrom was broken for the affected flash chips. This has since been
> fixed, so maybe your code now works fine?

Have not checked that for quite some time now.
> > If you are still interested: The attached .c file contains details on
> > how to talk to the flash chip on RTL 8139 NIC.
>
> IMHO any code which can at least get chip IDs is good enough to get
> merged (disabled by default until all issues are fixed). That will allow
> others to hack on the code and makes sure the code is not forgotten.
> Could you please resend it as a complete patch with a Signed-off-by line?

This may take some time, I am rather busy right now...

-- J. Fischer

[Andrew Morgan]

I would be very interested in this too. I have a few similar 28-pin boot 
ROM socketed cards spare and a device I'd like to re-program which uses 
28 pin ROM chips.
If there's a problem with the write enable pin, can this be worked 
around with another DIL holder with the correct pin bent, and a wire to 
connect that pin to the correct voltage?