Hello,
The flash part in my MSI ms-7021 (KT6V) mainboard wasn't recognized. After peeling the label off, the markings on the chip showed: MX 29F040QC-90 This is a Macronix MX29F040C (Q=PLCC; C=0C..70C; 90=90ns)
The software commands in the datasheet seem to match those of the AMD Am29F040B and ST M29F040B. I copied the configuration and performed some tests. Probe, read, erase and write all work (see below for code and results).
Since the software commands for a different Macronix part (MX29LV040C) also appear to be the same, I copied the configuration for that part and performed some more tests. Probe, read, erase and write all work and writing is about twice as fast. I'm not sure why the code writes to address 0x5555 and 0x2AAA instead of 0x555 and 0x2AA as specified in the datasheet, but it seems to work.
Maybe someone with more knowledge about these flash parts knows what's the best way to support this MX29F040C part? Please let me know if you need more information (i.e. -V debug output).
MX29F040C with *_29f040b probe, erase and write functions:
Index: flashchips.c =================================================================== --- flashchips.c (revision 602) +++ flashchips.c (working copy) @@ -1403,6 +1403,22 @@
{ .vendor = "Macronix", + .name = "MX29F040C", + .bustype = CHIP_BUSTYPE_NONSPI, + .manufacture_id = MX_ID, + .model_id = MX_29F040C, + .total_size = 512, + .page_size = 64 * 1024, + .tested = TEST_OK_PREW, + .probe = probe_29f040b, + .probe_timing = TIMING_IGNORED, /* routine don't use probe_timing (am29f040b.c) */ + .erase = erase_29f040b, + .write = write_29f040b, + .read = read_memmapped, + }, + + { + .vendor = "Macronix", .name = "MX29LV040C", .bustype = CHIP_BUSTYPE_NONSPI, .manufacture_id = MX_ID,
# dd if=/dev/urandom of=random.bin bs=1024 count=512 ; time ./flashrom -w random.bin ; time ./flashrom -v random.bin 512+0 records in 512+0 records out 524288 bytes (524 kB) copied, 0.182563 s, 2.9 MB/s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Programming page 0007 at address: 0x0007ffff COMPLETE.
real 0m27.706s user 0m11.657s sys 0m0.020s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Verifying flash... VERIFIED.
real 0m2.757s user 0m2.740s sys 0m0.016s
# time ./flashrom -E ; time ./flashrom -r empty.bin ; hexdump -C empty.bin flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Erasing flash chip... SUCCESS.
real 0m7.647s user 0m7.640s sys 0m0.008s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Reading flash... done.
real 0m2.761s user 0m2.748s sys 0m0.016s 00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00080000
MX29F040C with *_29f002 probe, erase and write functions:
Index: flashchips.c =================================================================== --- flashchips.c (revision 602) +++ flashchips.c (working copy) @@ -1403,6 +1403,22 @@
{ .vendor = "Macronix", + .name = "MX29F040C", + .bustype = CHIP_BUSTYPE_NONSPI, + .manufacture_id = MX_ID, + .model_id = MX_29F040C, + .total_size = 512, + .page_size = 64 * 1024, + .tested = TEST_OK_PREW, + .probe = probe_29f002, + .probe_timing = TIMING_IGNORED, /* routine don't use probe_timing (mx29f002.c) */ + .erase = erase_29f002, + .write = write_29f002, + .read = read_memmapped, + }, + + { + .vendor = "Macronix", .name = "MX29LV040C", .bustype = CHIP_BUSTYPE_NONSPI, .manufacture_id = MX_ID,
# dd if=/dev/urandom of=random.bin bs=1024 count=512 ; time ./flashrom -w random.bin ; time ./flashrom -v random.bin 512+0 records in 512+0 records out 524288 bytes (524 kB) copied, 0.180451 s, 2.9 MB/s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Programming page: address: 0x0007f000 COMPLETE.
real 0m14.711s user 0m14.669s sys 0m0.004s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Verifying flash... VERIFIED.
real 0m2.766s user 0m2.748s sys 0m0.016s
# time ./flashrom -E ; time ./flashrom -r empty.bin ; hexdump -C empty.bin flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Erasing flash chip... SUCCESS.
real 0m7.636s user 0m7.628s sys 0m0.008s flashrom v0.9.0-r602 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... OK. Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. Reading flash... done.
real 0m2.756s user 0m2.732s sys 0m0.016s 00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00080000
Hi Arjen,
thanks for your patch and the detailed analysis. Could you reply to this mail with a Signed-off-by statement as explained in http://www.coreboot.org/Development_Guidelines#Sign-off_Procedure ? That will allow us to commit your patch. Thanks.
On 17.06.2009 21:11, Arjan Koers wrote:
The flash part in my MSI ms-7021 (KT6V) mainboard wasn't recognized. After peeling the label off, the markings on the chip showed: MX 29F040QC-90 This is a Macronix MX29F040C (Q=PLCC; C=0C..70C; 90=90ns)
The software commands in the datasheet seem to match those of the AMD Am29F040B and ST M29F040B. I copied the configuration and performed some tests. Probe, read, erase and write all work (see below for code and results).
Since the software commands for a different Macronix part (MX29LV040C) also appear to be the same, I copied the configuration for that part and performed some more tests. Probe, read, erase and write all work and writing is about twice as fast. I'm not sure why the code writes to address 0x5555 and 0x2AAA instead of 0x555 and 0x2AA as specified in the datasheet, but it seems to work.
The MX29F040C data sheet says: "Address bit A11~A18=X=Don't care for all address commands except...program". That means as long as the low 10 bits of your command addresses are 0x2AA/0x555, the upper bits are ignored.
If would be very interesting to see if probe_jedec works for your chip. AFAICS it should, but you may need to change the timing definition to TIMING_ZERO (at least the data sheet suggests that). If it works, probe_jedec is definitely preferable.
Maybe someone with more knowledge about these flash parts knows what's the best way to support this MX29F040C part? Please let me know if you need more information (i.e. -V debug output).
MX29F040C with *_29f040b probe, erase and write functions: [Slow write]
MX29F040C with *_29f002 probe, erase and write functions: [Fast write]
Basically, the write functions are identical except for one detail: _29f040b uses sector erase (slower) and _29f002 uses chip erase (faster). This difference will be factored out once my generic sector erase patch is merged.
To summarize: - Please test with probe_jedec as detailed above. - Your choice which write/erase function to pick.
Regards, Carl-Daniel
Hello Carl-Daniel,
Carl-Daniel Hailfinger wrote:
Hi Arjen,
thanks for your patch and the detailed analysis. Could you reply to this mail with a Signed-off-by statement as explained in http://www.coreboot.org/Development_Guidelines#Sign-off_Procedure ? That will allow us to commit your patch. Thanks.
The patch has been attached...
The MX29F040C data sheet says: "Address bit A11~A18=X=Don't care for all address commands except...program". That means as long as the low 10 bits of your command addresses are 0x2AA/0x555, the upper bits are ignored.
The MX29F040C data sheet I downloaded (REV. 2.0, MAY. 26, 2009) doesn't contain that information. I've found another datasheet for the MX29F040 (REV. 2.3, DEC. 10, 2004) that confirms what you wrote (only the 11 lowest bits are used).
If would be very interesting to see if probe_jedec works for your chip. AFAICS it should, but you may need to change the timing definition to TIMING_ZERO (at least the data sheet suggests that). If it works, probe_jedec is definitely preferable.
It works.
With probe_timing = TIMING_IGNORED: # ./flashrom -V flashrom v0.9.0-r605 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... 633M loops per second, 100 myus = 163 us. OK. .... Probing for Macronix MX29F040C, 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS probe_jedec: id1 0xc2, id2 0xa4 Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. .... No operations were specified.
With probe_timing = TIMING_ZERO: # ./flashrom -V flashrom v0.9.0-r605 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. Calibrating delay loop... 631M loops per second, 100 myus = 162 us. OK. .... Probing for Macronix MX29F040C, 512 KB: probe_jedec: id1 0xc2, id2 0xa4 Found chip "Macronix MX29F040C" (512 KB) at physical address 0xfff80000. .... No operations were specified.
To summarize:
- Please test with probe_jedec as detailed above.
- Your choice which write/erase function to pick.
I've chosen the 29f040b functions, because the addresses match those in the datasheet. This should be less confusing. Programming will be slower, but you explained that's only temporarily.
-
Arjan Koers -
Carl-Daniel Hailfinger