flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

Hi All!

I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only write to 
0x70000-0x80000. This includes both write and erase. Could you please help me 
to solve this? BTW, I don't yet have a backup chip so tested changes are 
preferred :)

Here is the probe output:

alex@tornado:~/bios$ sudo flashrom
flashrom v0.9.0+r544
No coreboot table found.
Found chipset "NVIDIA CK804", enabling flash write... OK.
Calibrating delay loop... OK.
Found chip "PMC Pm49FL004" (512 KB) at physical address 0xfff80000.
No operations were specified.

Here is the output of lshw:

*-firmware:0
          description: BIOS
          vendor: Award Software International, Inc.
          physical id: 0
          version: F4 (05/11/2006)
          size: 128KiB
          capacity: 448KiB
          capabilities: isa pci pnp apm upgrade shadowing cdboot bootselect 
socketedrom edd int13floppy360 int13floppy1200 int13floppy720 int13floppy2880 
int5printscreen int9keyboard int14serial int17printer int10video acpi usb 
ls120boot zipboot biosbootspecification
     *-firmware:1
          description: BIOS
          physical id: 20
          size: 1023KiB
          capabilities: apm bootselect socketedrom int13floppytoshiba 
int5printscreen

I hope this helps.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Paul Menzel]

Dear Alexander,

Am Sonntag, den 24.05.2009, 20:19 +0400 schrieb Alexander Gordeev:

[…]
> I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only write to 
> 0x70000-0x80000. This includes both write and erase. Could you please help me 
> to solve this? BTW, I don't yet have a backup chip so tested changes are 
> preferred :)
>
> Here is the probe output:

[…]

If I remember correctly `sudo flashrom -v` is helpful. But I do not have
much of a clue.

I would also recommend that you join the developers on IRC [1]. I hope
there will be some developers on Sunday.

Good luck,

Paul

[1] http://www.coreboot.org/IRC

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

Hi Paul,

On Sun, 24 May 2009 18:29:22 +0200
Paul Menzel  wrote:
> Dear Alexander,
>
> Am Sonntag, den 24.05.2009, 20:19 +0400 schrieb Alexander Gordeev:
>
> […]
> > I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only
> > write to 0x70000-0x80000. This includes both write and erase. Could
> > you please help me to solve this? BTW, I don't yet have a backup
> > chip so tested changes are preferred :)
> >
> > Here is the probe output:
>
> […]
>
> If I remember correctly `sudo flashrom -v` is helpful. But I do not
> have much of a clue.

I tried it and IMHO it provides no additional information. It only
prints lots of "Probing <model name> ...".
> I would also recommend that you join the developers on IRC [1]. I hope
> there will be some developers on Sunday.

Thanks for the link! Actually I prefer email but I can chat as well.
I'll try it later today when I get to the board.
> [1] http://www.coreboot.org/IRC

[Carl-Daniel Hailfinger]

Hi Alexander,

On 24.05.2009 18:19, Alexander Gordeev wrote:
> I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only write to 
> 0x70000-0x80000. This includes both write and erase.

Did you test erase separately?

If write/erase is only working on the top 64 kByte, we probably have to
unlock the rest of the chip as well. Since our Pm49FL004 code already
has unlocking routines, we probably need a board enable for you.

Do you have a multimeter or continuity tester?
> Could you please help me to solve this?

We can try.
> BTW, I don't yet have a backup chip so tested changes are 
> preferred :)

Sure.
> flashrom v0.9.0+r544
> Found chipset "NVIDIA CK804", enabling flash write... OK.
> Found chip "PMC Pm49FL004" (512 KB) at physical address 0xfff80000.

The P49FL004 should be supported just fine. CK804 is OK as well.
Definitely a board enable issue.

Regards,
Carl-Daniel

[Alexander Gordeev]

Hi Carl-Daniel,

On Tue, 26 May 2009 01:56:49 +0200
Carl-Daniel Hailfinger  wrote:
> Hi Alexander,
>
> On 24.05.2009 18:19, Alexander Gordeev wrote:
> > I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only
> > write to 0x70000-0x80000. This includes both write and erase.
>
> Did you test erase separately?

Yes, I tested every operation separately. I've also read contents of
the flash after an erase and compared it to the original image:
0-0x6ffff untouched and 0x70000-0x7ffff erased.
> If write/erase is only working on the top 64 kByte, we probably have
> to unlock the rest of the chip as well. Since our Pm49FL004 code
> already has unlocking routines, we probably need a board enable for
> you.
>
> Do you have a multimeter or continuity tester?

Yes, I have one. What should I do?
> > Could you please help me to solve this?
>
> We can try.

Thanks :)
> > flashrom v0.9.0+r544
> > Found chipset "NVIDIA CK804", enabling flash write... OK.
> > Found chip "PMC Pm49FL004" (512 KB) at physical address 0xfff80000.
>
> The P49FL004 should be supported just fine. CK804 is OK as well.
> Definitely a board enable issue.

Ok, I see.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Luc Verhaegen]

On Tue, May 26, 2009 at 02:04:01PM +0400, Alexander Gordeev wrote:
> > > Could you please help me to solve this?
> >
> > We can try.

This is the board enable routine for this board (on top of the 
standard chipset enable):

tmp = inb(0x14bf + 0x22);
outb(tmp, 0xEB); /* delay */
tmp &= ~0x0F;
tmp |= 0x05;
outb(tmp, 0x14bf + 0x22);
outb(tmp, 0xEB); /* delay */

This is the same as another report (another nvidia board), except for a 
different IO offset (0x44C0 + 0x10): 
http://tracker.coreboot.org/trac/coreboot/ticket/131

Can you provide the output of lspci -vvnxxx so that we:
* get device/subsystem id pairs for the board enable table.
* can spot the location of the pmio base address and make this function 
  useful for both cases.

Thanks,

Luc Verhaegen.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Luc Verhaegen]

On Tue, May 26, 2009 at 12:19:26PM +0200, Luc Verhaegen wrote:
> This is the same as another report (another nvidia board), except for a 
> different IO offset (0x44C0 + 0x10): 
> http://tracker.coreboot.org/trac/coreboot/ticket/131

Can anyone with a trac account read the opensuse@... email address and 
include this person in CC. It would be nice the get the following from 
that guy as well:
> Can you provide the output of lspci -vvnxxx so that we:
> get device/subsystem id pairs for the board enable table.
> can spot the location of the pmio base address and make this function 
> useful for both cases.

Thanks,

Luc Verhaegen.

[coreboot] flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

Hi Luc,

On Tuesday 26 May 2009 14:19:26 you wrote:
> Can you provide the output of lspci -vvnxxx so that we:
> get device/subsystem id pairs for the board enable table.
> can spot the location of the pmio base address and make this function
> useful for both cases.

Sure, attached it.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Luc Verhaegen]

On Wed, May 27, 2009 at 02:42:15AM +0400, Alexander Gordeev wrote:
> Hi Luc,
>
> On Tuesday 26 May 2009 14:19:26 you wrote:
> > Can you provide the output of lspci -vvnxxx so that we:
> > get device/subsystem id pairs for the board enable table.
> > can spot the location of the pmio base address and make this function
> > useful for both cases.
>
> Sure, attached it.

Device: NVIDIA CK804 LPC
> 00:01.0 0601: 10de:0050 (rev a3)

Dump of some extra io resource areas in pci config space of the lpc:
> 60: 01 10 00 00 01 14 00 00 01 18 00 00 00 00 f9 ff

This is it:       ^^ ^^ ^^ ^^

Offset 0xE1 in this "System control area" is where we do our magic.

The one in the trac interface uses a different offset in probably the 
same resource, because it is mcp55 or younger.

I will write up a patch for this and send it in..

Luc Verhaegen

[coreboot] flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

On Tuesday 26 May 2009 03:56:49 Carl-Daniel Hailfinger wrote:
> Hi Alexander,
>
> On 24.05.2009 18:19, Alexander Gordeev wrote:
> > I've tried flashrom on my Gigabyte GA-K8N-SLI board but it can only write
> > to 0x70000-0x80000. This includes both write and erase.
>
> Did you test erase separately?
>
> If write/erase is only working on the top 64 kByte, we probably have to
> unlock the rest of the chip as well. Since our Pm49FL004 code already
> has unlocking routines, we probably need a board enable for you.
>
> Do you have a multimeter or continuity tester?
> > Could you please help me to solve this?
>
> We can try.
> > BTW, I don't yet have a backup chip so tested changes are
> > preferred :)
>
> Sure.
> > flashrom v0.9.0+r544
> > Found chipset "NVIDIA CK804", enabling flash write... OK.
> > Found chip "PMC Pm49FL004" (512 KB) at physical address 0xfff80000.
>
> The P49FL004 should be supported just fine. CK804 is OK as well.
> Definitely a board enable issue.

I'm sending you /proc/ioports and full dmesg as suggested on IRC.

I also found the SuperIO pin, which is connected to WE pin of flash: it is pin 
71, PSIN/GP45 as I've learned from the datasheet. However, I was only able to 
find it8712f datasheet which may be a bit different from it8712f-a.
You can obtain a foto of the chip from here: 
http://lvk.cs.msu.su/~lasaine/it8712f-a.png
The pin is marked.

I'll be happy to provide any additional information if needed.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Carl-Daniel Hailfinger]

On 27.05.2009 21:31, Alexander Gordeev wrote:
> I also found the SuperIO pin, which is connected to WE pin of flash: it is pin 
> 71, PSIN/GP45 as I've learned from the datasheet. However, I was only able to 
> find it8712f datasheet which may be a bit different from it8712f-a.
> You can obtain a foto of the chip from here: 
> http://lvk.cs.msu.su/~lasaine/it8712f-a.png
> The pin is marked.

Wow, that's very precise and helpful information. Thanks!
> I'll be happy to provide any additional information if needed.

Can you please run
superiotool -de
and post the output to the list? That will help me use the correct
polarity for the write enable routine.

Regards,
Carl-Daniel

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

On Thursday 28 May 2009 15:58:16 Carl-Daniel Hailfinger wrote:
> On 27.05.2009 21:31, Alexander Gordeev wrote:
> > I also found the SuperIO pin, which is connected to WE pin of flash: it
> > is pin 71, PSIN/GP45 as I've learned from the datasheet. However, I was
> > only able to find it8712f datasheet which may be a bit different from
> > it8712f-a. You can obtain a foto of the chip from here:
> > http://lvk.cs.msu.su/~lasaine/it8712f-a.png
> > The pin is marked.
>
> Wow, that's very precise and helpful information. Thanks!

I did my best :)
> > I'll be happy to provide any additional information if needed.
>
> Can you please run
> superiotool -de
> and post the output to the list? That will help me use the correct
> polarity for the write enable routine.

Sure, attached.

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Carl-Daniel Hailfinger]

On 28.05.2009 21:04, Alexander Gordeev wrote:
> On Thursday 28 May 2009 15:58:16 Carl-Daniel Hailfinger wrote:
> > On 27.05.2009 21:31, Alexander Gordeev wrote:
> > > I also found the SuperIO pin, which is connected to WE pin of flash: it
> > > is pin 71, PSIN/GP45 as I've learned from the datasheet. However, I was
> > > only able to find it8712f datasheet which may be a bit different from
> > > it8712f-a. You can obtain a foto of the chip from here:
> > > http://lvk.cs.msu.su/~lasaine/it8712f-a.png
> > > The pin is marked.
> >
> > Wow, that's very precise and helpful information. Thanks!
>
> I did my best :)

Could you also trace the WP# (and TBL#) pin? It seems that my first
attempt to guess the right pin was incorrect.
> > > I'll be happy to provide any additional information if needed.
> >
> > Can you please run
> > superiotool -de
> > and post the output to the list? That will help me use the correct
> > polarity for the write enable routine.
>
> Sure, attached.

Great, thanks!

Decode follows.
GPIOs: 11(SIO), 12(inverted), 13, 14(SIO), 16(SIO), 17(SIO), 35(pullup),
40(pullup), 53
all SIOs are Input
SIO base: 0x0800

That leads me to the assumption that the WP# pin is probably not
connected to the SuperIO and the WE# pin may be connected to the
SuperIO, but without function.

Regards,
Carl-Daniel

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

On Fri, 29 May 2009 13:40:41 +0200
Carl-Daniel Hailfinger  wrote:
> On 28.05.2009 21:04, Alexander Gordeev wrote:
> > On Thursday 28 May 2009 15:58:16 Carl-Daniel Hailfinger wrote:
> > > On 27.05.2009 21:31, Alexander Gordeev wrote:
> > > > I also found the SuperIO pin, which is connected to WE pin of
> > > > flash: it is pin 71, PSIN/GP45 as I've learned from the
> > > > datasheet. However, I was only able to find it8712f datasheet
> > > > which may be a bit different from it8712f-a. You can obtain a
> > > > foto of the chip from here:
> > > > http://lvk.cs.msu.su/~lasaine/it8712f-a.png The pin is marked.
> > >
> > > Wow, that's very precise and helpful information. Thanks!
> >
> > I did my best :)
>
> Could you also trace the WP# (and TBL#) pin? It seems that my first
> attempt to guess the right pin was incorrect.

Sure! Unfortunately there is a big chance that I won't be able to do
this until Monday.

An excerpt from the Pm49FL004 datasheet:

The Pm49FL002 has a 16 Kbyte top boot block and the
Pm49FL004 has a 64 Kbyte top boot block. When work-
ing in-system, the memory hardware write protection fea-
ture can be activated by two control pins - Top Block
Lock (TBL#) and Write Protection (WP#) for both FWH
and LPC modes. When TBL# is pulled low (VIL), the boot
block is hardware write protected. A sector erase, block
erase, or byte program command attempts to erase or
program the boot block will be ignored. When WP# is
pulled low (VIL), the Block 0 ~ Block 14 of Pm49FL002,
or the Block 0 ~ Block 6 of Pm49FL004 (except the boot
block) are hardware write protected. Any attemp to erase
or program a sector or block within this area will be ig-
nored.

So it seems the right way this time: when WP# is pulled low and TBL# is
high leads to exactly the same situation as I have.
> > > > I'll be happy to provide any additional information if needed.
> > >
> > > Can you please run
> > > superiotool -de
> > > and post the output to the list? That will help me use the correct
> > > polarity for the write enable routine.
> >
> > Sure, attached.
>
> Great, thanks!
>
> Decode follows.
> GPIOs: 11(SIO), 12(inverted), 13, 14(SIO), 16(SIO), 17(SIO),
> 35(pullup), 40(pullup), 53
> all SIOs are Input
> SIO base: 0x0800
>
> That leads me to the assumption that the WP# pin is probably not
> connected to the SuperIO and the WE# pin may be connected to the
> SuperIO, but without function.

I hope WP# is connected...

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Carl-Daniel Hailfinger]

On 29.05.2009 14:41, Alexander Gordeev wrote:
> So it seems the right way this time: when WP# is pulled low and TBL# is
> high leads to exactly the same situation as I have.

Yes. I looked at the wrong data sheet when I requested WE# information.
Sorry.
> On Fri, 29 May 2009 13:40:41 +0200
> Carl-Daniel Hailfinger  wrote:
> > GPIOs: 11(SIO), 12(inverted), 13, 14(SIO), 16(SIO), 17(SIO),
> > 35(pullup), 40(pullup), 53
> > all SIOs are Input
> > SIO base: 0x0800
> >
> > That leads me to the assumption that the WP# pin is probably not
> > connected to the SuperIO and the WE# pin may be connected to the
> > SuperIO, but without function.
>
> I hope WP# is connected...

It may be connected to the southbridge instead. That would make adding
code for it very difficult unless we find someone with specs.

Regards,
Carl-Daniel

flashrom touches only 0x70000-0x80000 addresses of my bios flash

[Alexander Gordeev]

On Fri, 29 May 2009 15:22:33 +0200
Carl-Daniel Hailfinger  wrote:
> On 29.05.2009 14:41, Alexander Gordeev wrote:
> > So it seems the right way this time: when WP# is pulled low and
> > TBL# is high leads to exactly the same situation as I have.
>
> Yes. I looked at the wrong data sheet when I requested WE#
> information. Sorry.

Not a problem at all :)
> > On Fri, 29 May 2009 13:40:41 +0200
> > Carl-Daniel Hailfinger  wrote:
> > > GPIOs: 11(SIO), 12(inverted), 13, 14(SIO), 16(SIO), 17(SIO),
> > > 35(pullup), 40(pullup), 53
> > > all SIOs are Input
> > > SIO base: 0x0800
> > >
> > > That leads me to the assumption that the WP# pin is probably not
> > > connected to the SuperIO and the WE# pin may be connected to the
> > > SuperIO, but without function.
> >
> > I hope WP# is connected...
>
> It may be connected to the southbridge instead. That would make adding
> code for it very difficult unless we find someone with specs.

I've checked several times and there are no signs that WP or TBL are
connected to the SuperIO. So they should be connected to southbridge
indeed. And I don't have specs as well. May be I can just cut WP# pin
off to disable protection?

Thanks for your help!