Zerocat Chipflasher  v0.4.10-732-9a3cc90b
Flash free firmware to BIOS chips, kick the Management Engine.
How To Use

Welcome

Thank you for purchasing — or having built — the Zerocat Chipflasher. We hope you will enjoy this cute tiny tool. Your feedback will be very much appreciated. Please contact zerocat@posteo.de for any questions or feedback and keep up to date with the Zerocat Chipflasher Git Repository.

The Zerocat Chipflasher is your free-design hardware tool for flashing free firmware to BIOS chips. Especially the chips, that are located on libreboot or coreboot compatible hardware are hopefully supported. See Supported Devices for details.

Zerocat Chipflasher, flashing a fully equipped Gigabyte GA-G41M-ES2L Desktop Board

Hardware Features

  • Parallax Propeller P8X32A free-design hardware controller

    The core of the chipflasher...

    • Talks to the host via RS232 serial data lines
    • Runs the SPI bus with 2.5MHz
    • Provides free-design hardware RAM that is used to hold the firmware
  • Onboard eeprom (non-free chip design)

    May be used optionally for long-term firmware storage.

  • Heavy Power Switch, Power Status LED and SPI Power LED

    The switch gives a good tactile feedback when powering the flasher and the LEDs clearly reflect the power status of the onboard regulators.

  • Software status LEDs
    • yellow: No SPI-Plug is attached.
    • orange: Controller’s RST Pin is muted and allows starting from RAM.
    • green: Reflects the menu status. The LED is continuously on if no input is requested, otherwise a pulse train is emitted according to the current input level.
  • SPI-Bus Status LED (red)

    When powered, the SPI-Bus is in use and the SPI chip is powered. Do not disconnect the SPI-Plug or test-clip if this LED is active!

  • Variable pull-up, allows to drive the SPI-CE#-line with a dedicated strength. Initially, use a screw-driver clockwise to adjust the pull-up to its highest value, thus resulting in the weakest driver strength.
  • USB powered, typical load: 1.000mA maximum
    • In order to delimit power dissipation, an input voltage of 5VDC is recommended. Do not use any input voltages above 6VDC.
    • The typical load current won't exceed 1.000mA. Note the chipflasher board uses a Polyfuse which will shut off the board if drawing currents in excess of 1.500mA.
  • Data connection: RS232, +/-6VDC, pinheader-5x2
  • SPI connection: +3.3VDC/GND, pinheader-9x1
  • Reliable contacts due to handmade soldering
  • Handy dimensions (lenght x width x height) approx. 100 x 80 x 80mm
  • Detailed layout info for each connector right on the chipflasher’s front panel.
  • Complete set of DIY accessoiries
    • Y-USB-Power-Cable Plug-A to Plug-A
    • RS232-cable with SUBD-9 connector
    • universal SPI-Cable with four pinheader connectors
    • 8Pin-DIL Socket for non-soldered BIOS chips

Recommended Add-Ons in Case of Purchase

  • Standard add-ons
    • a secure package with ESD protection
    • CD with chipflasher’s source code
    • SOIC16 clip, to be used with chips in situ
    • Sn99.3 Cu0.7 leadfree soldering
    • product information paper
  • Options upon request
    • SOIC8 clip, to be used with chips in situ
    • Solder Kit with pinheader and flying wires for WSON chips
    • external USB Power Adapter 5V@1000mA
    • Host computer with RS232 port, running with libreboot or blobless coreboot BIOS

Typical Setup

For now, the chipflasher board doesn't provide its USB port for data, it is used for power only. So, the typical setup is with a host that has an RS232 serial port available. We recommend to use a ThinkPad X60/X60s with pre-flashed libreboot or blobless coreboot BIOS. These machines can be flashed with the flashrom user space utility and the serial port is part of their docking station.

A typical setup looks like this:

  1. Computer with RS232 port, i.e.:
    • ThinkPad X60 with Docking Station and coreboot/libreboot firmware
    • Intel D945GCLF board with coreboot, no blobs required (not fully tested)
    • other blobless desktop boards like GA-945GCM-S2L and GA-G41M-ES2L (untested)
  2. The Zerocat Chipflasher
  3. supported SPI flash chip, a single one or one soldered in place on its sysboard (see Supported Devices)
  4. external USB-Power-Adapter (5V @ 1000mA) or at least two USB-ports from the computer.

You will use three cables for connection:

  • the USB cable for 5V power supply of the chipflasher board

    (If you use two USB ports for power, use an Y-USB cable.)

  • RS232 data cable for data transfer between host and chipflasher
  • SPI-cable (8 wires, about 20cm) with 8pin-DIL-socket or SMD-test-clip to attach the target SPI flash chip

Setup with external USB power adapter

+------------+                +-------------+           +·············+
| Host, i.e. |                | Zerocat     |           +---------+   :
|  X60 +     |                | Chipflasher |---+3.3V-->| SPI     |   :
|  Docking   |<--RS232-data-->|             |<---SPI--->|  Chip   |   :
|            |                | firmware:   |           +---------+   :
| software:  |      +--+5V--->|  'kick'     |           :             :
| 'connect'  |      |         +-------------+           : Systemboard :
+------------+      |                                   : without     :
                +--------------------+                  : Battery     :
                | External USB Power |                  : nor Power   :
                |  5V @ 1000mA       |                  +·············+
                +--------------------+

Setup with non-standard Y-USB-cable

+------------+                +-------------+           +·············+
| Host, i.e. |                | Zerocat     |           +---------+   :
|  X60 +     |<--RS232 data-->| Chipflasher |---+3.3V-->| SPI     |   :
|  Docking   |                |             |<---SPI--->|  Chip   |   :
|            |----+-+5V-USB-->| firmware:   |           +---------+   :
| software:  |   /            |  'kick'     |           :             :
| 'connect'  |--+             +-------------+           : Systemboard :
|            |                                          : without     :
+----------- +                                          : Battery     :
                                                        : nor Power   :
                                                        +·············+
Zerocat Chipflasher, typical setup with an Y-USB-Cable

Power Supply

Warning
Proceed on your own risk. You will brick your hardware. You will kill yourself.
  1. Discharge your body (touch any grounded metal like a water pipe) and make sure your are not electrostatically charged.
  2. If you are flashing a sysboard:
    • Do not power the sysboard on, nor connect any power plug.
    • Remove the main battery
    • Unplug the small coin-battery
  3. Power and GND will be applied to the SPI-chip by the chipflasher board only.
    Make sure you have not mixed these wires! See cables.sch.png for pinouts.
  4. To power the chipflasher:
    • You may safely use your computer’s USB port according to official specs if you are going to flash a single desoldered chip.
    • In case of flashing chips in situ, soldered onto sysboards, please use an external USB-Power-Adapter (5VDC @ 1.000mA).
    • As a workaround, you may try a non-standard Y-USB-Cable which should work well in many cases, as the maximal requested current per USB port typically won't exceed 500mA. See doc/power-profiles.md to get into details.

Clock Quality

The Zerocat Chipflasher is a handmade tool with long wires that may catch or generate electromagnetic interference. To give you an idea about clock pulse quality and speed, we probed the signals right at the test-clip for you. The maximal SPI clock speed is about 2.5MHz.

Zerocat Chipflasher, typical clock pulse quality (100ns/500mV per div), here: 2.2MHz

Precautions

The software connect and the firmware kick are talking to each other via the serial RS232 lines. Occasional transmission errors will be repaired automatically. However, if you encounter severe connection problems that render you helpless when trying to verify your data, boot the host with WLAN and network switched off, make sure that no other resource demanding process will start up (e.g. browser), and try again.

As long as the SPI-Bus Status LED (red) is not active, the SPI-Chip is not powered and you may feel free to connect/disconnect your target. However, if the LED is active, don't touch the connection!

If the system hangs for any reason, you should be save to kill the chipflasher’s power, because all SPI bus pins are configured to enter a harmless tristate mode right at brown-out or power-off. However, you might notice some flickering of the SPI-Power LED, so better do not rely on that procedure.

Prerequisites

You should have installed all essential tools according to README, section “Prerequisites”.

Build the Software

  1. Open a terminal and enter the chipflasher repository, i.e:
    $ cd ~/zerocat/projects/chipflasher/
  2. Change into host/src/.
  3. To build the software, type make.

Test Your Setup

Connect host and chipflasher with each other, i.e. attach the Y-USB-power-cable to two USB-Ports, attach the RS232-data-cable.

Attach the SPI-cable, but omit the target board (or chip) for now!

  1. Switch the chipflasher board on and verify that the power status LED is bright.
  2. Change into host/start/ and type make startram in order to initiate the firmware upload into the onboard RAM, and to start the connect utility in the same go.

    Note
    Root priviledges should not be required, as long as you are a fully priviledged member of the “dialout” group. On Debian based systems, perform sudo adduser <user> dialout. On GNU Guix System, edit your OS configuration file and add “"dialout"” to your user account’s list of supplementary groups, then perform sudo guix system reconfigure my-os-config.scm.

    The Zerocat Chipflasher menu should appear on screen.
    Success! Your setup is ready.

    Hit “q” to quit and switch off the chipflasher board.

    Invocation Example with immediate quit.

Operate the Chipflasher

The flasher is operated via two terminal windows in parallel:

  • Terminal#1 is used to start and operate the flasher via menu.
  • Terminal#2 is used to monitor and process in- and outgoing chip data.

Open host/start/ in each terminal and type make help in order to get familiar with host/start/Makefile.

Feel free to switch between terminals as required.

Try a Real Target (Terminal#1)

  1. Use a screwdriver to adjust the flasher’s CE# pull-up resistor to its CW-most position, that is to its biggest value.
  2. Switch the chipflasher board on.
  3. Start the Menu

    Type make startram in order to upload the firmware into the flasher’s onboard free-design RAM, and to start the connect utility in the same go.
    The flasher’s menu should arise on screen.

  4. Attach the free pinheader connectors of the SPI-cable to the SPI-Chip...

    • by using the 8-pin DIL-socket for discrete chips,
    • by using a test-clip for chips in situ,
    • or by connecting previously soldered, flying wires.
    Warning
    You must not mix wires!
    See cables.sch.png and check pinouts in advance.
  5. Select “[d] detect chip” in order to probe the BIOS-chip.

    Use a screwdriver in CCW direction to adjust the CE# pull-up resistor to smaller values until your chip gets clearly detected.
    See Supported Devices.

  6. Select “[c] read chip” in order to store chip’s content in your first chip2file.txt.

    Warning
    Consider to create backups between read operations, as file chip2file.txt gets overwritten without warning!
  7. Switch to the other terminal (i.e. Terminal#2) to monitor and to manipulate in- and outgoing chip data.
    • You can do so, manually (See Data Transfer), or
    • use predefined targets of host/start/Makefile, for instance:
      • Type make workflow-chip-read to get a short list of typical read steps.
      • Type make workflow-chip-write to get a short list of typical write steps.
      • Type make list to get I/O files listed.
  8. Continue to Operate the Flasher via Menu

    You may now use the menu for dumping, erasing, flashing and verifying your chip.

    Warning
    Proceed with care, you may brick your machine!
    Potentially dangerous hotkeys are all upper case, thus protecting you from accidental key hits as long as <CAPS-LOCK> is inactive.

    When using the menu, wait until your selected procedure finishes.
    With “[q] (SPI off)/cancel/quit” you may cancel it at any time.

  9. When done, hit “q” in order to quit connect.

    Note
    In case the SPI bus has been left powered after chip detection due to volatile bits in status registers, it is powered off as an intermediate step before you actually quit the program with an additional “q”.
  10. Detach the SPI-cables from the target SPI-chip and power off the chipflasher board.
    Remember to plug a systemboard’s coin-battery back in.

Done!

Onboard EEPROM

Until now, we have taken care to always start from free-design RAM using the make startram command.
The pre-flashed firmware in the onboard EEPROM has not been touched, yet.
If you want to try the pre-flashed firmware, just issue a single make start.
If you want to upload a newly built firmware and make things permanent, use make startrom once.

Custom Invocation of Connect

Alternatively, you might invoke the connect utility manually:

Change into host/src/ and type ./connect ../start/chip2file.txt ../start/file2chip.txt /dev/ttyS0 B115200.

This would allow you to pass individual parameters to connect.
Remember to update ROOT_HOST_IO, CHIP2FILE and FILE2CHIP within host/start/Makefile in case you have passed non-default filenames.
In case you want to pass a different baudrate, modify firmware/start/board.cfg first and run make -C ../../firmware/start/ loadram.
Adapt firmware/start/tty-port-pointer in case you use a non-default port.