Difference between revisions of "Bus Pirate"

From flashrom
Jump to navigation Jump to search
 
(4 intermediate revisions by 2 users not shown)
Line 3: Line 3:
[[File:Lycom-pe115-flashrom-buspirate-2.jpg|thumb|right|<small>Recovering a bricked SPI based device using a Bus Pirate</small>]]
[[File:Lycom-pe115-flashrom-buspirate-2.jpg|thumb|right|<small>Recovering a bricked SPI based device using a Bus Pirate</small>]]


The [http://dangerousprototypes.com/docs/Bus_Pirate Bus Pirate] is an open source design for a multi-purpose chip-level serial protocol transceiver and debugger. Flashrom supports the Bus Pirate for [http://dangerousprototypes.com/bus-pirate-manual/bus-pirate-spi-guide/ SPI programming]. It also has  [http://dangerousprototypes.com/docs/Bus_Pirate_binary_SPI_sniffer_utility SPI sniffing] functionality, which may come in useful for analysing chip or programmer behaviour.
The [http://dangerousprototypes.com/docs/Bus_Pirate Bus Pirate] is an open source design for a multi-purpose chip-level serial protocol transceiver and debugger. Flashrom supports the Bus Pirate for [http://dangerousprototypes.com/docs/SPI SPI programming]. It also has  [http://dangerousprototypes.com/docs/Bus_Pirate_binary_SPI_sniffer_utility SPI sniffing] functionality, which may come in useful for analysing chip or programmer behaviour.


They are available for around US$30 from various sources.
They are available for around US$30 from various sources.
==Connections==
The table below shows how a typical SPI flash chip (sitting in the center of the table) needs to be connected (NB: not all flash chips feature all of the pins below, but in general you should always connect all input pins of ICs to some defined potential (usually GND or VCC), ideally with a pull-up/down resistor in between). Most SPI flash chips require a 3.3V supply voltage, but there exist some models that use e.g. 1.8V. Make sure the device in question is compatible before connecting any wires. <small>NB: Some rather rare SPI flash chips (e.g. Atmel AT45DB series) have a completely different layout, please beware.</small>
{| style="border-collapse: collapse; border: 1px solid black;" cellpadding="5";  border="1" align="center"
! Description
! Bus Pirate
! Dir.
! colspan="4"|Flash chip
! Dir.
! Bus Pirate
! Description
|-
| align="right" | (not) Chip Select    || CS    || <font size="+2">→</font> || style="background: #DDDDDD;" | 1 || align="left" style="background: #DDDDDD;" | /CS      || align="right" style="background: #DDDDDD;" | VCC        || style="background: #DDDDDD;" | 8 || <font size="+2">←</font> || +3.3v || align="left" | Supply
|-
| align="right" | Master In, Slave Out || MISO  || <font size="+2">←</font> || style="background: #DDDDDD;" | 2 || align="left" style="background: #DDDDDD;" | DO (IO1)  || align="right" style="background: #DDDDDD;" | /HOLD (IO3) || style="background: #DDDDDD;" | 7 || <font size="+2">←</font> || +3.3v || align="left" | (not) hold (see datasheets)
|-
| align="right" | (not) Write Protect  || +3.3v || <font size="+2">→</font> || style="background: #DDDDDD;" | 3 || align="left" style="background: #DDDDDD;" | /WP (IO2) || align="right" style="background: #DDDDDD;" | CLK        || style="background: #DDDDDD;" | 6 || <font size="+2">←</font> || CLK  || align="left" | The SPI clock
|-
| align="right" | Ground              || GND  || <font size="+2">→</font> || style="background: #DDDDDD;" | 4 || align="left" style="background: #DDDDDD;" | GND      || align="right" style="background: #DDDDDD;" | DI (IO0)    || style="background: #DDDDDD;" | 5 || <font size="+2">←</font> || MOSI  || align="left" | Master Out, Slave In
|-
|}


== Usage ==
== Usage ==
Line 15: Line 37:
  $ '''flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M'''
  $ '''flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M'''


== Trouble Shooting ==
== Troubleshooting ==
 
The Bus Pirate has various options for SPI communication. Many SPI chips support the JEDEC standard identify command, which can be issued from the Bus Pirate prompt like this:
 
[0x9f r:4]
 
You'll need to refer to the flash chip datasheet to see how it should respond to this.


In case of problems probing the chip with flashrom - especially when connecting chips still soldered in a system - please take a look at [[ISP|this page]].
In circuit programming it often possible, '''so long as no other devices on the SPI bus are trying to access the device'''.
In circuit programming it often possible, '''so long as no other devices on the SPI bus are trying to access the device'''.
See also [[ISP]] for more details about in-system flashing in general.


== Speedup ==
== Speedup ==

Latest revision as of 16:21, 3 April 2013

Bus Pirate v3, front
Bus Pirate v3, back
Recovering a bricked SPI based device using a Bus Pirate

The Bus Pirate is an open source design for a multi-purpose chip-level serial protocol transceiver and debugger. Flashrom supports the Bus Pirate for SPI programming. It also has SPI sniffing functionality, which may come in useful for analysing chip or programmer behaviour.

They are available for around US$30 from various sources.

Connections

The table below shows how a typical SPI flash chip (sitting in the center of the table) needs to be connected (NB: not all flash chips feature all of the pins below, but in general you should always connect all input pins of ICs to some defined potential (usually GND or VCC), ideally with a pull-up/down resistor in between). Most SPI flash chips require a 3.3V supply voltage, but there exist some models that use e.g. 1.8V. Make sure the device in question is compatible before connecting any wires. NB: Some rather rare SPI flash chips (e.g. Atmel AT45DB series) have a completely different layout, please beware.

Description Bus Pirate Dir. Flash chip Dir. Bus Pirate Description
(not) Chip Select CS → 1 /CS VCC 8 ← +3.3v Supply
Master In, Slave Out MISO ← 2 DO (IO1) /HOLD (IO3) 7 ← +3.3v (not) hold (see datasheets)
(not) Write Protect +3.3v → 3 /WP (IO2) CLK 6 ← CLK The SPI clock
Ground GND → 4 GND DI (IO0) 5 ← MOSI Master Out, Slave In

Usage

$ flashrom -p buspirate_spi:dev=/dev/device,spispeed=frequency

Example: 

$ flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M

Troubleshooting

In case of problems probing the chip with flashrom - especially when connecting chips still soldered in a system - please take a look at this page. In circuit programming it often possible, so long as no other devices on the SPI bus are trying to access the device.

Speedup

A beta firmware build exists, to speed up the buspirate. See this post on dangerousprototypes.com: http://dangerousprototypes.com/forum/viewtopic.php?f=40&t=3864&start=15#p41505

http://dangerousprototypes.com/docs/Bus_Pirate#Firmware_upgrades

Retrieved from "https://www.flashrom.org/index.php?title=Bus_Pirate&oldid=1811"