openbiosprog-spi, a DIY Open Hardware and Free Software USB-based SPI BIOS chip flasher using flashrom

openbiosprog-spi device

If you're following me on identi.ca you probably already know that I've been designing a small PCB for a USB-based SPI chip programmer named openbiosprog-spi.

The main use-case of the device is to help you recover easily from a failed BIOS upgrade (either due to using an incorrect BIOS image, due to power outages during the flashing progress, or whatever). The device only supports SPI chips, as used in recent mainboards (in DIP-8 form factor, or via manual wiring possibly also soldered-in SO-8 variants). It can identify, read, erase, or write the chips.

Of course the whole "toolchain" of software tools I used for creating the hardware is open-source, and the hardware itself (schematics and PCB layouts) are freely released under a Creative Commons license (i.e., it's an "Open Hardware" device). The user-space source code is part of flashrom (GPL, version 2), the schematics and PCB layouts are licensed under the CC-BY-SA 3.0 license and were created using the open-source Kicad EDA suite (GPL, version 2).

openbiosprog-spi schematics
openbiosprog-spi Kicad PCB layout

The schematics, PCB layouts, and other material is available from gitorious:

  $ git clone git://gitorious.org/openbiosprog/openbiosprog-spi.git

You can also download the final Gerber files (ZIP) for viewing them, or sending them to a PCB manufacturer.

Some more design notes:

  • The device uses the FTDI FT2232H chip as basis for USB as well as for handling the actual SPI protocol in hardware (MPSSE engine of the FT2232H).
  • Attaching the SPI chip:
    • There's a DIP-8 socket on the device so you can easily insert the SPI chip you want to read/erase/program.
    • Optionally, if you don't want a DIP-8 socket, you can solder in a pin-header with 8 pins, which allows you to connect the individual pins to the SPI chip via jumper wires or grippers/probes.
  • The PCB board dimensions are 44mm x 20mm, and it's a 2-layer board using mostly 0603 SMD components.

Basic usage example of the device on Linux (or other OSes supported by flashrom):

  $ flashrom -p ft2232_spi:type=2232H,port=A -r backup.bin (reads the current chip contents into a file)

openbiosprog-spi PCBs
openbiosprog-spi parts list

Over at the main projects page of openbiosprog-spi at

  http://randomprojects.org/wiki/Openbiosprog-spi

I have put up a lot more photos and information such as the bill of materials, the Kicad settings I used for creating the PCBs, the Gerber files and the Excellon drill files and so on.

The first few prototype boards I ordered at PCB-POOL.COM (but you can use any other PCB manufacturer of course), the bill of materials (BOM) lists the Mouser and CSD electronics part numbers and prices, but you can also buy the stuff elsewhere, of course (Digikey, Farnell, whatever).

I already hand-soldered one or two prototypes and tested the device. Both hardware and software worked fine basically, you just need a small one-liner patch to fix an issue in flashrom, but that should be merged upstream soonish.

In order to make it easy for interested users to get the PCBs I'll probably make them available in the BatchPCB Market Place soonish, so you can easily order them from there (you do still need to solder the components though). Note: I'm not making any money off of this, this is a pure hobby project.

All in all I have to say that this was a really fun little project, and a useful one too. This was my first hardware project using Kicad (I used gEDA/PCB, also an open-source EDA toolsuite, for another small project) and I must say it worked very nicely. I didn't even have to read any manual really, it was all pretty intuitive. Please consider not using Eagle (or other closed-source PCB software) for your next Open Hardware project, there are at least two viable open-source options (Kicad, gEDA/PCB) which both work just fine.

coreboot porting to jetway PA78VM5 have been 95% successful.

i am  glad to say that the Jetway PA78VM5 mainboard can run coreboot sucessfully. The configuration of Jetway PA78VM5 can be found at PA78VM5.the coreboot+filo can work fine. The kernel began booting, but the only problem is after kernel shows”jumping to **” the serial port stoped showing anything. And i have already set the kernel parameter with “console=ttyS0,115200”

First of all thank olsen provide me this mainboard.

The mainboard have an SPI flash W25X80A, my SF100+testchip SO08 can detect the flash type, but can not erase the flash correctly. After contacted with dediprog engineer. i remove the flash from the board, it seems fine, the programming is fine, but i can not use it with the mainboard unless i can bear removing the flash chip every time i need to rebuild the coreboot. After that, i replace that flash chip with an sst 080b. it worked pretty fine. 🙂

another problem is while the coreboot booting, it stoped while corebooting trying to extract the cbfs files. i debugged this for a long time, finally thanks to patrick, i take his advice remove the $(CBFS_COMPRESS_FLAG).it worked.

the latest problem is that amd famlily10 may have much problem with the current build version.

i should find out what difference between btdc and coreboot public version caused problems.

my next step may focus on this things merge the code, and find out why the kernel did not show the booting message.

i am so glad that coreboot can finally booting the Jetway PA78VM5

First successful Nvidia MCP6x/MCP7x SPI access

Since a few hours, my Nvidia MCP61/MCP65/MCP67/MCP73/MCP78S/MCP79 SPI driver is tested and it works well. Only probing for a flash chip was tested, but still… this means my SPI bitbanging code is correct, and Michael Karcher’s reverse engineered docs are correct, and my implementation of the Nvidia GPIO interface used for bitbanging SPI is correct as well.

This is big news because with this patch flashrom finally has 100% support for all x86 chipsets we saw in the last ten years.

Huge thanks go to Michael Karcher for reverse engineering the interface and writing up cleanroom documentation which I could use for implementing the interface.
Huge thanks to Johannes Sjolund for testing my patch on his hardware although it was completely untested before.

Get the patch here: http://patchwork.coreboot.org/patch/1520/ (click on the “patch” link on that page to get a download).
Continue reading First successful Nvidia MCP6x/MCP7x SPI access

flashrom 0.9.2 released — Open-Source, crossplatform BIOS / EEPROM / flash chip programmer

The long-pending 0.9.2 version of the open-source, cross-platform, commandline flashrom utility has been released.

From the announce:

New major user-visible features:
* Dozens of newly supported mainboards, chipsets and flash chips.
* Support for Dr. Kaiser PC-Waechter PCI devices (FPGA variant).
* Support for flashing SPI chips with the Bus Pirate.
* Support for the Dediprog SF100 external programmer.
* Selective blockwise erase for all flash chips.
* Automatic chip unlocking.
* Support for each programmer can be selected at compile time.
* Generic detection for unknown flash chips.
* Common mainboard features are now detected automatically.
* Mainboard matching via DMI strings.
* Laptop detection which triggers safety measures.
* Test flags for all part of flashrom operation.
* Windows support for USB-based and serial-based programmers.
* NetBSD support.
* DOS support.
* Slightly changed command line invocation. Please see the man page for details.

Experimental new features:
* Support for some NVIDIA graphics cards.
* Chip test pattern generation.
* Bit-banging SPI infrastructure.
* Nvidia MCP6*/MCP7* chipset detection.
* Support for Highpoint ATA/RAID controllers.

Infrastructural improvements and fixes:
* Lots of cleanups.
* Various bugfixes and workarounds for broken third-party software.
* Better error messages.
* Reliability fixes.
* Adjustable severity level for messages.
* Programmer-specific chip size limitation warnings.
* Multiple builtin frontends for flashrom are now possible.
* Increased strictness in board matching.
* Extensive selfchecks on startup to protect against miscompilation.
* Better timing precision for touchy flash chips.
* Do not rely on Linux kernel bugs for mapping memory.
* Improved documentation.
* Split frontend and backend functionality.
* Print runtime and build environment information.

The list of supported OSes and architectures is slowly getting longer, e.g. these have been tested: Linux, FreeBSD, NetBSD, DragonFly BSD, Nexenta, Solaris and Mac OS X. There's partial support for DOS (no USB/serial flashers) and Windows (no PCI flashers). Initial (partial) PowerPC and MIPS support has been merged, ARM support and other upcoming.

Also, the list of external (non-mainboard) programmers increases, e.g. there is support for NICs (3COM, Realtek, SMC, others upcoming), SATA/IDE cards from Silicon Image and Highpoint, some NVIDIA cards, and various USB- or parallelport- or serialport- programmers such as the Busirate, Dediprog SF100, FT2232-based SPI programmers and more.

More details at flashrom.org and in the list of supported chips, chipsets, baords, and programmers.

I uploaded an svn version slightly more recent than 0.9.2 to Debian unstable, which should reach Debian testing (and Ubuntu I guess) soonish.

weekly report #1

As the first week has already gone so soon, i spend the whole week to clear my thought, checking the xcompile configuration of libpayload. I also read some code of buildroot which wish could bring some ideas for me.

I know it may be a little wasting. But i began to write code in the weekend. Hope everything goes fine this week.

Jetway PA78VM5-H porting progress

firstly, thanks to Scott Olsen for supporting the mainboard. PA78VM5 is 780/700/ddr2.

The superio which it used is fintek f71863fg. I have already make all of the code done. but at last i found that i do not have the serial port convert which make me can connect to it.

The following week may be used to 1)extract the vbios. 2)make the linux booting…

i am pretty looking forward that.

flashrom progress report #1

Getting the flashrom 0.9.2 release out of the door was a really labor-intensive process because we wanted to make 0.9.2 the 1000th commit in the repository. That worked and 0.9.2 is a really nice release with no known regressions, but a lot more features and improved reliability. Speaking from experience of the last 3 releases, acting as release manager is really a full-time job and will not leave any spare time for developing cool features.

flashrom GSoC development is right on track. So far, I have posted patches for:
Continue reading flashrom progress report #1

flashrom 0.9.2 released

The flashrom developers are happy to announce the release of flashrom 0.9.2.

flashrom is a utility for reading, writing, erasing and verifying flash ROM chips.

flashrom is designed to update BIOS/EFI/coreboot/firmware/optionROM images on mainboards, network/graphics/storage controller cards, and various programmer devices. It can do so without any special boot procedures and from your normal working environment.

After over nine years of development and constant improvement, we have added support for every BIOS flash ROM technology present on x86 mainboards and every flash ROM chip we ever saw in the wild.

Highlights of flashrom:
Continue reading flashrom 0.9.2 released

coreboot / flashrom in GSOC 2010 — student application deadline today!

GSoC 2010 logo

As you may know there's a Google Summer of Code program again this year.

The deadline for student applications is April 9th at 19:00 UTC, so if you're a student and you want to work on a coreboot (open-source BIOS / PC firmware) or flashrom (open-source BIOS chip flasher) project, please apply in time.

The following coreboot/flashrom GSOC project ideas have been proposed so far (but you can also suggest your own ideas, of course):

  • Infrastructure for automatic code checking
  • TianoCore on coreboot
  • coreboot port to Marvell ARM SOCs with PCIe
  • coreboot port to AMD 800 series chipsets
  • coreboot mass-porting to AMD 780 series mainboards
  • coreboot panic room
  • coreboot cheap testing rig
  • coreboot GeodeLX port from v3 to v4
  • Drivers for libpayload
  • Board config infrastructure
  • Refactor AMD code
  • Payload infrastructure
  • flashrom: Multiple GUIs for flashrom
  • flashrom: Recovery of dead boards and onboard flash updates
  • flashrom: SPI bitbanging hardware support
  • flashrom: Generic flashrom infrastructure improvements
  • flashrom: Laptop support

See this wiki page for why and how to apply for a coreboot/flashrom project.

A simple DLP-USB1232H based JTAG programmer with OpenOCD support

DLP-USB1232H and OpenOCD based JTAG adapter

Here's a quick introduction to using a cheap FTDI FT2232H based module (left-hand side on the photo) as a JTAG programmer together with the OpenOCD JTAG software for ARM and MIPS devices. The module I am using for thіs purpose is a DLP Design DLP-USB1232H, which is available from various sources (Digikey, Mouser, Saelig, and probably others) for 20-30 bucks plus shipping, depending on where you live.

By properly connecting the correct pins of the DLP-USB1232H to the target JTAG
device (I used an Olimex STM32-H103 eval board for testing) you can easily abuse the DLP-USB1232H as JTAG programmer. As I chose the proper DLP-USB1232H GPIOs for the TRST and (S)RST pins, OpenOCD even worked out of the box, without having to change a single line of code.

The only thing that's required is to provide OpenOCD with an interface config file that uses the usbjtag "layout". I have already submitted that config file upstream, I guess it should be merged soonish.

The usage is then pretty simple:

  $ openocd -f interface/dlp-usb1232h.cfg -f board/olimex_stm32_h103.cfg

And in another xterm:

  $ telnet localhost 4444
  > init
  > reset halt
  > flash write_image erase fancyblink.bin 0x08000000
  > reset

This flashes the given fancyblink.bin image onto the STM32-H103 eval board via the DLP-USB1232H JTAG programmer, where fancyblink.bin is an example program from my libopenstm32 project (that aims to create a full-blown firmware library for ST STM32 microcontrollers, similar to what avr-libc does for AVRs). Contributions for libopenstm32 (license is GPLv3 or later) are highly welcome btw., hint hint...

  $ git clone git://libopenstm32.git.sourceforge.net/gitroot/libopenstm32/libopenstm32

Full schematics, datasheets, and detailed instructions for the JTAG programmer are available from a small page I created in my Random Projects wiki, which is intended for the various smaller projects I'm working on that don't warrant getting their own domain, wiki, etc:

The Random Projects wiki is open-for-all btw, feel free to use it for any freeish, software or hardware projects of your own if you want.

Anyway, the DLP-USB1232H is a really nice device as it can also be used for many other purposes, such as USB-to-Serial or SPI BIOS chip programming, but more on that in another blog post...