Flashrom

From Leo's Notes
Last edited on 30 December 2021, at 00:48.

Flashrom is a utility to read flash.

Cheat sheet

Task Command
Dump a ROM connected via SPI flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r dump.bin
Dump a ROM via SPI using a specific chip definition flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=600 -c "MX25L12835F/MX25L12845E/MX25L12865E" -w dump.bin
Write a ROM via SPI flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w new-data-to-rom.bin

Using flashrom with a Raspberry Pi

Compile and install

# apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev
# git clone https://github.com/flashrom/flashrom.git
# cd flashrom
# make CONFIG_ENABLE_LIBUSB1_PROGRAMMERS=no

Pinouts

Raspberry Pi GPIO Header
Raspberry Pi GPIO Header

Refer to the table below and the diagram on the right for the pinouts to your Raspberry Pi and the SPI rom device.

RPi header SPI Function MX25L 16-Pin SOP HM25Q 8-Pin SOP
25 GND 10 4
24 CS 7 1
23 SCK (CLK) 16 6
21 DO (MISO) 8 2
19 DI (MOSI) 15 5
17 VCC 3.3v 2 8
WP# 9 3
HOLD# / RESET# 3 7

The MX25L - WriteProtect (WP#, pin 9) should be connected to GND according to the datasheet. Leaving it floating still seems to work.


The Raspberry Pi should have SPI enabled by adding this line to /boot/config.txt:

dtparam=spi=on

The /dev/spidev0.0 device should exist and flashrom should be able to detect the flash chip.

[root@alarmpi alarm]# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1000
flashrom v1.0 on Linux 4.14.92-1-ARCH (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L12805D", "MX25L12835F/MX25L12845E/MX25L12865E"
Please specify which chip definition to use with the -c <chipname> option.

Dump the data using -r filename.

[root@alarmpi alarm]# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=300 -c "MX25L12835F/MX25L12845E/MX25L12865E" -r dump7.dat
flashrom v1.0 on Linux 4.14.92-1-ARCH (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Reading flash... done.

Troubleshooting

Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on linux_spi.

I connected a T25S80 to the Raspberry Pi but when I run flashrom, I get a "unknown SPI chip" message:

# flashrom  -p linux_spi:dev=/dev/spidev0.0,spispeed=1000
flashrom v1.2 on Linux 5.10.63-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on linux_spi.

Running with -VVV prints a bit more information:

...
Probing for Winbond unknown Winbond (ex Nexcom) SPI chip, 0 kB: RDID returned 0x5e 0x32 0x14. probe_spi_rdid_generic: id1 0x5e, id2 0x3214
Probing for Generic unknown SPI chip (RDID), 0 kB: RDID returned 0x5e 0x32 0x14. probe_spi_rdid_generic: id1 0x5e, id2 0x3214
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on linux_spi.
Probing for Generic unknown SPI chip (REMS), 0 kB: REMS returned 0x5e 0x13. probe_spi_rems: id1 0x5e, id2 0x13
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI).

The message shows the RDID value as being 0x5e 0x32 0x14.

Knowing that the chip I'm dealing with is virtually identical to the NANTRONICS N25S80, I went ahead and edited flashchips.h such that the ID and chip identifiers matched 0x5e and 0x3214:

#define NANTRONICS_ID_NOPREFIX          0x5E  
#define NANTRONICS_N25S10               0x3011
#define NANTRONICS_N25S20               0x3012
#define NANTRONICS_N25S40               0x3013
#define NANTRONICS_N25S80               0x3214
#define NANTRONICS_N25S16               0x3015

Recompile flashrom and try again:

# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1600
flashrom v1.2-555-g073e205-dirty on Linux 5.10.63-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Nantronics flash chip "N25S80" (1024 kB, SPI) on linux_spi.

I was then able to dump the flash. Yippie.