2013-11-24 11:09:47
Writing a flash chip with a programming cable
If you have a broken BIOS (BIOS update failed) or if you have "bricked" router then you need some kind of programming device to write a new firmware into the flash chip. Most of these chips are NOR flash chips which can be written by SPI.
I wanted to replace a 4 MB flash with a 8 MB chip and wanted to "burn" at least a boot loader (in this case U-Boot) to the virgin chip. I didn't want to buy a professional programmer like Batronix because I just wanted to write flash chips with SPI which is actually a most simple serial protocol. These were my specs:
- ready to use (no assembling of PCB and soldering)
- writing flash chips by SPI
- software available (also ready to use), with preference of open source software and support for some kind of unix os (Linux, BSD etc.)
- cheap
Searching the web I discovered some "open source" solutions like Openbiosprog-spi or RushSPI. Both projects are well done and even the hardware is published under a free license. Both projects don't offer software of their own but need the free software flashrom. Although the hardware is licensed under the free CC-BY-SA, is cheap and the PCB layouts are available online, they fail on one important spec: ready to use. But both projects use an FTDI chip. Searching FTDI's website I detected a very interesting cable: C232HM-DDHSL-0. Because the chip in this cable is the same chip like used in RushSPI you can also use flashrom as writing software.
I ordered the cable for ~ 20 EUR and connected the flash rom MX25L6406 via a self built adapter to the cable. This is the wiring:
C232HM-DDHSL-0 SPI-Flash SOP8
1 red ------ 8 Vcc
2 orange ------ 6 SCLK
3 yellow ------ 5 SI
4 green ------ 2 SO
5 brown ------ 1 /CS
6 grey ------ 3 /WP (with 4k7 Pullup)
7 purple ------ 7 /HOLD (with 4k7 Pullup)
10 black ------ 4 Gnd
After compiling flashrom (and libftdi) the software said that it couldn't detect a known chip. A quick search lead me to this page: ftdi-d2xx-linux-overcoming-big-problem. I just forgot my serial cable with the latest FTDI VCP serial driver! This "virtual com port" driver already knows the FT232H chip and is able to control these chips when they are connected to USB. After deactivating the support for the FT232H in the VCP driver I was able to "see", read and write my connected flash chip with flashrom and libftdi.
Here are some example commands:
# ./flashrom -p ft2232_spi:type=232H,port=A flashrom v0.9.7-r1711 on Darwin 8.11.0 (Power Macintosh) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on ft2232_spi. Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on ft2232_spi. Found Macronix flash chip "MX25L6445E" (8192 kB, SPI) on ft2232_spi. Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E" Please specify which chip definition to use with the -c <chipname> option.
# ./flashrom -p ft2232_spi:type=232H,port=A -V -c \ MX25L6406E/MX25L6436E flashrom v0.9.7-r1711 on Darwin 8.11.0 (Power Macintosh) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with GCC 4.0.1 (Apple Computer, Inc. build 5370), big endian Command line (5 args): ./flashrom -p ft2232_spi:type=232H, port=A -V -c MX25L6406E/MX25L6436E Calibrating delay loop... OS timer resolution is 1 usecs, 571M loops per second, 10 myus = 9 us, 100 myus = 92 us, 1000 myus = 923 us, 10000 myus = 9307 us, 4 myus = 4 us, OK. Initializing ft2232_spi programmer Using device type FTDI FT232H channel A. Disable divide-by-5 front stage Set clock divisor MPSSE clock: 60.000000 MHz, divisor: 2, SPI clock: 30.000000 MHz No loopback of TDI/DO TDO/DI Set data bits The following protocols are supported: SPI. Probing for Macronix MX25L6406E/MX25L6436E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017 Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on ft2232_spi. Chip status register is 0x00. Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set Chip status register: Bit 6 is not set Chip status register: Block Protect 3 (BP3) is not set Chip status register: Block Protect 2 (BP2) is not set Chip status register: Block Protect 1 (BP1) is not set Chip status register: Block Protect 0 (BP0) is not set Chip status register: Write Enable Latch (WEL) is not set Chip status register: Write In Progress (WIP/BUSY) is not set This chip may contain one-time programmable memory. flashrom cannot read and may never be able to write it, hence it may not be able to completely clone the contents of this chip (see man page for details). No operations were specified.
# time ./flashrom -p ft2232_spi:type=232H -c MX25L6406E/ \ X25L6436E -r dump.rom flashrom v0.9.7-r1711 on Darwin 8.11.0 (Power Macintosh) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on ft2232_spi. Reading flash... done. real 2m34.750s user 0m4.224s sys 0m8.098s(To use flashrom on MacOS PPC as shown above you must modify flashrom because it officially supports only Intel/PCI-Macs.)