• Using a Raspberry Pi to read and write to a 8-pin chip using flashrom

• Raspberry Pi ^{1) 2)}
• Raspbian ³⁾
• flashrom ⁴⁾
• Pomona SOIC Clip Model 5250, 8 Pin ^{5) 6)}
• Male to Female Breadboard wires ⁷⁾
• TODO: Separate notes for 16-pin if needed

• Install Raspbian
• Update Raspbian packages
• Enable SPI ⁸⁾

• The physical numbering and order of the pins on a Pi
• [ ] represents a pin
• O represents a mounting hole
• The ASCII art assumes the I/O ports are on the right-side and the pins are at the top
• 1, 2, 3, 4, 37, 38, 39, and 40 are unused and only provided for reference as to pin order

 -----------------------------------------------------------------------------------------------------   ----------
| [ 2] [ 4] [  ] [  ] [  ] [  ] [  ] [  ] [  ] [  ] [  ] [24] [  ] [  ] [  ] [  ] [  ] [  ] [38] [40] | |          |
O [ 1] [ 3] [  ] [  ] [  ] [  ] [  ] [  ] [17] [19] [21] [23] [25] [  ] [  ] [  ] [  ] [  ] [37] [39] O |   USB    |
|                                                                                                     | |          |
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV (chips and other stuff below) VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV

• https://www.raspberrypi.org/documentation/usage/gpio/images/gpio-numbers-pi2.png
• The GPIO numbering and order of the pins on a Pi
• [ ] represents a pin
• O represents a mounting hole
• The ASCII art assumes the I/O ports are on the right-side and the pins are at the top
• 5v, far-left 3.3v, 21, and far-right GND are unused and only provided for reference

 -----------------------------------------------------------------------------------------------------------   ----------
| [5v  ] [  ] [  ] [  ] [  ] [  ] [  ] [  ] [    ] [  ] [  ] [ 8] [   ] [  ] [  ] [  ] [  ] [  ] [  ] [21 ] | |          |
O [3.3V] [  ] [  ] [  ] [  ] [  ] [  ] [  ] [3.3V] [10] [ 9] [11] [GND] [  ] [  ] [  ] [  ] [  ] [  ] [GND] O |   USB    |
|                                                                                                           | |          |
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV (chips and other stuff below) VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV

• Spec Sheet
• This chip is commonly used as a BIOS chip on computer motherboards
• Detects as a W25Q64.V in flashrom
• On a XPS 13, the chip identifies as a W25Q256.V and follows the same pin layout and instructions ⁹⁾

• Numbering of the pins on the chip according to the spec sheet

      --------
[1]__|O       |__[8]
[2]__|  Chip  |__[7]
[3]__|        |__[6]
[4]__|        |__[5]
      --------

• What the pins on the chip do

        --------
[/CS]__|O       |__[VCC]
 [DO]__|  Chip  |__[/HOLD]
[/WP]__|        |__[CLK]
[GND]__|        |__[DI]
        --------

• The \ \ represents the springs on the clip
• This image assumes the clip's pins are on the left and right side in the same orientation as the above pictures ¹⁰⁾
• The numbers here refer to the physical pins on the Pi and their numbering, not GPIO pin numbers

[24]      [17]
[21] \ \  [  ]
[  ]  \ \ [23]
[25]      [19]

• As of 2018/04/27, this supports a W25Q64FV
• As of 2018/12/09, this does not support a W25Q256.V ¹¹⁾

sudo apt install 'flashrom'

sudo apt install libpci-dev libftdi-dev libusb-1.0-0-dev git-core build-essential

rm -Rf ~/'flashrom' && git clone -b 'master' 'https://github.com/flashrom/flashrom.git' ~/'flashrom' --depth '1'

cd ~/'flashrom' && make --jobs='4' && sync

• Assumes the SOIC clip is connected to the Pi correctly and that SPI is enabled
• All 3 md5sums need to match to ensure consistent read/write to the chip
• spispeed=8000 is necessary for reading from a W25Q64FV chip

sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --read ~/'test1.bin' && sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --read ~/'test2.bin' && sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --read ~/'test3.bin' && sync

md5sum ~/'test1.bin' && md5sum ~/'test2.bin' && md5sum ~/'test3.bin'

rm -fv ~/'test2.bin' ~/'test3.bin' && sync

• Super-important to have a checksum-verified back-up to fall-back to when doing BIOS modifications
• Back this up somewhere external before doing anything else
• To be extra safe, also md5sum it and compare to above tests
• spispeed=8000 is necessary for reading from a W25Q64FV chip

sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --read ~/'backup-original.bin' && sync

md5sum ~/'test1.bin' && md5sum ~/'backup-original.bin'

rm -fv ~/'test1.bin' && sync

• Change x to the location of the new ROM you want flashed
• spispeed=8000 is necessary for writing to a W25Q64FV chip
• Change spispeed as-needed

sync && sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --write x

• TODO: Is ifdtool better for HAP bit?

git clone -b 'master' 'https://github.com/corna/me_cleaner.git' ~/'me_cleaner' --depth '1'

python ~/'me_cleaner/me_cleaner.py' --check ~/'backup-original.bin'

• https://github.com/corna/me_cleaner/blob/master/me_cleaner.py#L478

• --descriptor caused an Acer laptop to not boot; remove if it causes problems
• --soft-disable-only can be used to set the MeAltDisable or HAP bit only and not remove partitions ¹²⁾
• Use no arguments in order to remove partitions and not touch MeAltDisable or HAP bit

python ~/'me_cleaner/me_cleaner.py' --soft-disable --descriptor --output ~/'me_cleaner-soft-disable-descriptor.bin' ~/'backup-original.bin'

• Change spispeed as-needed

sync && sudo flashrom --programmer 'linux_spi':'dev=/dev/spidev0.0,spispeed=8000' --write ~/'me_cleaner-soft-disable-descriptor.bin'

cd ~ && rm -Rf ~/'flashrom' && sync

• TODO: Involves MEManuf and -VERBOSE flag

• Need Coreboot sources for some utilities

cd ~ && mkdir -p ~/'Projects' && rm -Rf ~/'Projects/coreboot/src' && git clone --branch 'master' --depth '1' 'https://github.com/coreboot/coreboot.git' ~/'Projects/coreboot/src' && sync

• Fedora Workstation

sudo dnf install 'pciutils-devel'

cd ~/'Projects/coreboot/src/util/intelmetool' && make --jobs='3' && sync

cd ~/'Projects/coreboot/src/util/intelmetool' && sudo ~/'Projects/coreboot/src/util/intelmetool/intelmetool' --help

• Fedora Workstation

sudo dnf install 'pciutils-devel'

cd ~/'Projects/coreboot/src/util/ifdtool' && make --jobs='3' && sync

• Can be used to set the HAP bit, similar to me_cleaner's --soft-disable-only
• Can be used to dump information about ME on a BIOS image, good for checking if it's a valid dump like me_cleaner's --check option
• Can unlock R/W on chip areas much more thoroughly than me_cleaner

cd ~/'Projects/coreboot/src/util/ifdtool' && ~/'Projects/coreboot/src/util/ifdtool/ifdtool' --help