flashrom December 2014

flashrom@flashrom.org

27 participants
72 discussions

Re: [flashrom] [PATCH] Fix handling of write protection at register space address +2.

by Roman Lebedev

Hi. I have tested it, it still produces same correct fw image (same md5), but i think that the message is still there (unless i horribly miss-apply patch, which is unlikely) # flashrom --programmer internal -r 1002.bin.patch2 -V flashrom v0.9.7-r1857 on Linux 3.16.0-4-686-pae (i686) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.2.1, GCC 4.9.2, little endian Command line (5 args): flashrom --programmer internal -r 1002.bin.patch2 -V Calibrating delay loop... OS timer resolution is 1 usecs, 572M loops per second, 10 myus = 11 us, 100 myus = 147 us, 1000 myus = 1094 us, 10000 myus = 10740 us, 4 myus = 7 us, OK. Initializing internal programmer No coreboot table found. Using Internal DMI decoder. DMI string chassis-type: "Desktop" DMI string system-manufacturer: "ASUSTeK COMPUTER INC." DMI string system-product-name: "PCH-DR" DMI string system-version: "1.XX " DMI string baseboard-manufacturer: "ASUSTek Computer INC." DMI string baseboard-product-name: "PCH-DR" DMI string baseboard-version: "1.XX " Found Winbond Super I/O, id 0x82 W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect. Active config mode, unknown reg 0x20 ID: 00. Please send the output of "flashrom -V -p internal" to flashrom(a)flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks. Found chipset "Intel 6300ESB" with PCI ID 8086:25a1. Enabling flash write... 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode disabled 0xffe00000/0xffa00000 FWH decode disabled 0xffd80000/0xff980000 FWH decode disabled 0xffd00000/0xff900000 FWH decode disabled 0xffc80000/0xff880000 FWH decode disabled 0xffc00000/0xff800000 FWH decode disabled 0xff700000/0xff300000 FWH decode disabled 0xff600000/0xff200000 FWH decode disabled 0xff500000/0xff100000 FWH decode disabled 0xff400000/0xff000000 FWH decode disabled Maximum FWH chip size: 0x100000 bytes BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled OK. The following protocols are supported: FWH. Probing for Atmel AT49LH002, 256 kB: probe_82802ab: id1 0x08, id2 0x14, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49LH00B4, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49LH004, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AB, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AC, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL002, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for PMC Pm49FL004, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH) mapped at physical address 0xfff80000. Probing for Sharp LHF00L04, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF002A/B, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF003A/B, 384 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF004A/B, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF004C, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008A, 1024 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF008C, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF016C, 2048 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040A, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 kB: probe_82802ab: id1 0x08, id2 0x14, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW016, 2048 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW040, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW080, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V040FA, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040FB, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040FC, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W49V002FA, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V080FA, 1024 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V080FA (dual mode), 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH). === This flash part has status UNTESTED for operations: ERASE WRITE The test status of this chip may have been updated in the latest development version of flashrom. If you are running the latest development version, please email a report to flashrom(a)flashrom.org if any of the above operations work correctly for you with this flash chip. Please include the flashrom log file for all operations you tested (see the man page for details), and mention which mainboard or programmer you tested in the subject line. Thanks for your help! Invalid locking change from 0xf9 to 0xf8 requested at 0xb73cf002! Please report a bug at flashrom(a)flashrom.org Reading flash... done. Restoring PCI config space for 00:1f:0 reg 0x4e Roman. On Fri, Dec 12, 2014 at 3:25 AM, Stefan Tauner < stefan.tauner(a)alumni.tuwien.ac.at> wrote: > > Previously we added the offset of the virtual register in several > functions cumulatively, which produced segfaults. This patch renames > a few parameters hence the rather big diff. > > Thanks to Roman Lebedev for reporting this issue and testing the patch. > > Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> > --- > > Roman, if you got some time could you please retest this refined version > of the patch (it is against r1857)? It should behave pretty much the same > on your setup apart from not showing the message you saw with the last > version. > > chipdrivers.h | 1 - > jedec.c | 65 > +++++++++++++++++++++++++++-------------------------------- > 2 files changed, 30 insertions(+), 36 deletions(-) > > diff --git a/chipdrivers.h b/chipdrivers.h > index 8529c74..cac94f3 100644 > --- a/chipdrivers.h > +++ b/chipdrivers.h > @@ -150,7 +150,6 @@ int unlock_regspace2_uniform_32k(struct flashctx > *flash); > int unlock_regspace2_uniform_64k(struct flashctx *flash); > int unlock_regspace2_block_eraser_0(struct flashctx *flash); > int unlock_regspace2_block_eraser_1(struct flashctx *flash); > -int unlock_regspace2_block(const struct flashctx *flash, chipaddr off); > int printlock_regspace2_uniform_64k(struct flashctx *flash); > int printlock_regspace2_block_eraser_0(struct flashctx *flash); > int printlock_regspace2_block_eraser_1(struct flashctx *flash); > diff --git a/jedec.c b/jedec.c > index 1345b89..6de6745 100644 > --- a/jedec.c > +++ b/jedec.c > @@ -589,11 +589,10 @@ static int regspace2_walk_unlockblocks(const struct > flashctx *flash, const struc > #define REG2_LOCKDOWN (1 << 1) > #define REG2_MASK (REG2_RWLOCK | REG2_LOCKDOWN) > > -static int printlock_regspace2_block(const struct flashctx *flash, > chipaddr offset) > +static int printlock_regspace2_block(const struct flashctx *flash, > chipaddr lockreg) > { > - chipaddr wrprotect = flash->virtual_registers + offset + 2; > - uint8_t state = chip_readb(flash, wrprotect); > - msg_cdbg("Lock status of block at 0x%0*" PRIxPTR " is ", > PRIxPTR_WIDTH, offset); > + uint8_t state = chip_readb(flash, lockreg); > + msg_cdbg("Lock status of block at 0x%0*" PRIxPTR " is ", > PRIxPTR_WIDTH, lockreg); > switch (state & REG2_MASK) { > case 0: > msg_cdbg("Full Access.\n"); > @@ -656,47 +655,44 @@ int printlock_regspace2_block_eraser_1(struct > flashctx *flash) > return regspace2_walk_unlockblocks(flash, unlockblocks, > &printlock_regspace2_block); > } > > -static int changelock_regspace2_block(const struct flashctx *flash, > chipaddr offset, uint8_t new_bits) > +static int changelock_regspace2_block(const struct flashctx *flash, > chipaddr lockreg, uint8_t old, uint8_t new) > { > - chipaddr wrprotect = flash->virtual_registers + offset + 2; > - uint8_t old; > - > - if (new_bits & ~REG2_MASK) { > - msg_cerr("Invalid locking change 0x%02x requested at > 0x%0*" PRIxPTR "! " > + if (((old ^ new) & REG2_MASK) != 0) { > + msg_cerr("Invalid locking change from 0x%02x to 0x%02x > requested at 0x%0*" PRIxPTR "!\n" > "Please report a bug at flashrom(a)flashrom.org\n", > - new_bits, PRIxPTR_WIDTH, offset); > + old, new, PRIxPTR_WIDTH, lockreg); > return -1; > } > - old = chip_readb(flash, wrprotect); > /* Early exist if no change (of read/write/lockdown) was > requested. */ > - if (((old ^ new_bits) & REG2_MASK) == 0) { > - msg_cdbg2("Locking status at 0x%0*" PRIxPTR " not > changed\n", PRIxPTR_WIDTH, offset); > + if (((old ^ new) & REG2_MASK) == 0) { > + msg_cdbg2("Locking status at 0x%0*" PRIxPTR " not > changed\n", PRIxPTR_WIDTH, lockreg); > return 0; > } > /* Normally lockdowns can not be cleared. Try nevertheless if > requested. */ > - if ((old & REG2_LOCKDOWN) && !(new_bits & REG2_LOCKDOWN)) { > - chip_writeb(flash, old & ~REG2_LOCKDOWN, wrprotect); > - if (chip_readb(flash, wrprotect) != (old & > ~REG2_LOCKDOWN)) { > - msg_cerr("Lockdown can't be removed at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + if ((old & REG2_LOCKDOWN) && !(new & REG2_LOCKDOWN)) { > + chip_writeb(flash, old & ~REG2_LOCKDOWN, lockreg); > + if (chip_readb(flash, lockreg) != (old & ~REG2_LOCKDOWN)) { > + msg_cerr("Lockdown can't be removed at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, lockreg); > return -1; > } > } > /* Change read or write lock? */ > - if ((old ^ new_bits) & REG2_RWLOCK) { > + if ((old ^ new) & REG2_RWLOCK) { > /* Do not lockdown yet. */ > - msg_cdbg("Changing locking status at 0x%0*" PRIxPTR " to > 0x%02x\n", PRIxPTR_WIDTH, offset, new_bits & REG2_RWLOCK); > - chip_writeb(flash, new_bits & REG2_RWLOCK, wrprotect); > - if (chip_readb(flash, wrprotect) != (new_bits & > REG2_RWLOCK)) { > - msg_cerr("Locking status change FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + msg_cdbg("Changing locking status at 0x%0*" PRIxPTR " to > 0x%02x\n", > + PRIxPTR_WIDTH, lockreg, new & REG2_RWLOCK); > + chip_writeb(flash, new & REG2_RWLOCK, lockreg); > + if (chip_readb(flash, lockreg) != (new & REG2_RWLOCK)) { > + msg_cerr("Locking status change FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, lockreg); > return -1; > } > } > /* Enable lockdown if requested. */ > - if (!(old & REG2_LOCKDOWN) && (new_bits & REG2_LOCKDOWN)) { > - msg_cdbg("Enabling lockdown at 0x%0*" PRIxPTR "\n", > PRIxPTR_WIDTH, offset); > - chip_writeb(flash, new_bits, wrprotect); > - if (chip_readb(flash, wrprotect) != new_bits) { > - msg_cerr("Enabling lockdown FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + if (!(old & REG2_LOCKDOWN) && (new & REG2_LOCKDOWN)) { > + msg_cdbg("Enabling lockdown at 0x%0*" PRIxPTR "\n", > PRIxPTR_WIDTH, lockreg); > + chip_writeb(flash, new, lockreg); > + if (chip_readb(flash, lockreg) != new) { > + msg_cerr("Enabling lockdown FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, lockreg); > return -1; > } > } > @@ -704,19 +700,18 @@ static int changelock_regspace2_block(const struct > flashctx *flash, chipaddr off > return 0; > } > > -int unlock_regspace2_block(const struct flashctx *flash, chipaddr off) > +static int unlock_regspace2_block_generic(const struct flashctx *flash, > chipaddr lockreg) > { > - chipaddr wrprotect = flash->virtual_registers + off + 2; > - uint8_t old = chip_readb(flash, wrprotect); > + uint8_t old = chip_readb(flash, lockreg); > /* We don't care for the lockdown bit as long as the RW locks are > 0 after we're done */ > - return changelock_regspace2_block(flash, off, old & ~REG2_RWLOCK); > + return changelock_regspace2_block(flash, lockreg, old, old & > ~REG2_RWLOCK); > } > > static int unlock_regspace2_uniform(struct flashctx *flash, unsigned long > block_size) > { > const unsigned int elems = flash->chip->total_size * 1024 / > block_size; > struct unlockblock blocks[2] = {{.size = block_size, .count = > elems}}; > - return regspace2_walk_unlockblocks(flash, blocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, blocks, > &unlock_regspace2_block_generic); > } > > int unlock_regspace2_uniform_64k(struct flashctx *flash) > @@ -734,7 +729,7 @@ int unlock_regspace2_block_eraser_0(struct flashctx > *flash) > // FIXME: this depends on the eraseblocks not to be filled up > completely (i.e. to be null-terminated). > const struct unlockblock *unlockblocks = > (const struct unlockblock > *)flash->chip->block_erasers[0].eraseblocks; > - return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block_generic); > } > > int unlock_regspace2_block_eraser_1(struct flashctx *flash) > @@ -742,6 +737,6 @@ int unlock_regspace2_block_eraser_1(struct flashctx > *flash) > // FIXME: this depends on the eraseblocks not to be filled up > completely (i.e. to be null-terminated). > const struct unlockblock *unlockblocks = > (const struct unlockblock > *)flash->chip->block_erasers[1].eraseblocks; > - return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block_generic); > } > > -- > Kind regards, Stefan Tauner > >

5 years, 7 months

Intel 28F001BN/BX-T erase/write operation verified on 3C905B-TXNM

by Lu Xie

Hi, I tried programming Intel 28F001BN/BX-T on 3C905B-TXNM but it failed at erase/write. I checked that chip's datasheet and it says PIN 1 and 30 must be pulled to 12V to accept erase/write operation, but the card can only offer 5V at PIN 1 and NC at PIN 30. So I wired 12V to the two pins and then flashrom erased/wrote the chip successfully. Please check the attached output files for the two attempts. Lu

5 years, 7 months

[commit] r1858 - trunk

by repository service

Author: stefanct Date: Fri Dec 12 01:32:03 2014 New Revision: 1858 URL: http://flashrom.org/trac/flashrom/changeset/1858 Log: Add support for Spansion S25FL127S. This flash chip can be configured (one time) to use 64 KiB or 256 KiB sectors. Additionally, in the 64 KiB mode it supports 16 4 KiB sub-sectors that can be (one time) programmed to be on the top or bottom of the device. The sub-sectors can be erased with the 0x20 opcode but because this opcode does not work with the remaining sectors and flashrom can not cope with that the 0x20 opcode is not supported yet. This patch adds two definitions, one for the 64 KiB and 256 KiB configuration respectively. The device also shares the RDID with the various S25FL128 devices so we have to increase the maximum number of successfully probed chips to 8. The 64 KiB mode was tested on real hardware. Signed-off-by: Jernej Škrabec <jernej.skrabec(a)planet.si> Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/cli_classic.c trunk/flashchips.c trunk/flashchips.h Modified: trunk/cli_classic.c ============================================================================== --- trunk/cli_classic.c Sun Dec 7 22:57:53 2014 (r1857) +++ trunk/cli_classic.c Fri Dec 12 01:32:03 2014 (r1858) @@ -91,9 +91,9 @@ int main(int argc, char *argv[]) { - /* Probe for up to three flash chips. */ const struct flashchip *chip = NULL; - struct flashctx flashes[6] = {{0}}; + /* Probe for up to eight flash chips. */ + struct flashctx flashes[8] = {{0}}; struct flashctx *fill_flash; const char *name; int namelen, opt, i, j; Modified: trunk/flashchips.c ============================================================================== --- trunk/flashchips.c Sun Dec 7 22:57:53 2014 (r1857) +++ trunk/flashchips.c Fri Dec 12 01:32:03 2014 (r1858) @@ -10464,6 +10464,83 @@ { .vendor = "Spansion", + .name = "S25FL127S-64kB", /* hybrid: 32 (top or bottom) 4 kB sub-sectors + 64 kB sectors */ + .bustype = BUS_SPI, + .manufacture_id = SPANSION_ID, + .model_id = SPANSION_S25FL128, + .total_size = 16384, + .page_size = 256, + /* supports 4B addressing */ + /* OTP: 1024B total, 32B reserved; read 0x4B; write 0x42 */ + .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP, + .tested = TEST_OK_PREW, + /* FIXME: we should distinguish the configuration on probing time like we do for AT45DB chips */ + .probe = probe_spi_rdid, + .probe_timing = TIMING_ZERO, + .block_erasers = { + { + /* This chip supports erasing of 32 so-called "parameter sectors" with + * opcode 0x20 which may be configured to be on top or bottom of the address + * space. Trying to access an address outside these 4kB blocks does have no + * effect on the memory contents, e.g. + .eraseblocks = { + {4 * 1024, 32}, + {64 * 1024, 254} // inaccessible + }, + .block_erase = spi_block_erase_20, + }, { */ + .eraseblocks = { { 64 * 1024, 256} }, + .block_erase = spi_block_erase_d8, + }, { + .eraseblocks = { { 16384 * 1024, 1} }, + .block_erase = spi_block_erase_60, + }, { + .eraseblocks = { { 16384 * 1024, 1} }, + .block_erase = spi_block_erase_c7, + } + }, + .printlock = spi_prettyprint_status_register_bp2_srwd, + .unlock = spi_disable_blockprotect_bp2_srwd, /* #WP pin write-protects SRWP bit. */ + .write = spi_chip_write_256, /* Multi I/O supported */ + .read = spi_chip_read, /* Fast read (0x0B) and multi I/O supported */ + .voltage = {2700, 3600}, + }, + + { + .vendor = "Spansion", + .name = "S25FL127S-256kB", /* uniform 256kB sectors */ + .bustype = BUS_SPI, + .manufacture_id = SPANSION_ID, + .model_id = SPANSION_S25FL128, + .total_size = 16384, + .page_size = 512, + /* supports 4B addressing */ + /* OTP: 1024B total, 32B reserved; read 0x4B; write 0x42 */ + .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP, + .tested = TEST_UNTESTED, + .probe = probe_spi_rdid, + .probe_timing = TIMING_ZERO, + .block_erasers = { + { + .eraseblocks = { {256 * 1024, 64} }, + .block_erase = spi_block_erase_d8, + }, { + .eraseblocks = { { 16384 * 1024, 1} }, + .block_erase = spi_block_erase_60, + }, { + .eraseblocks = { { 16384 * 1024, 1} }, + .block_erase = spi_block_erase_c7, + } + }, + .printlock = spi_prettyprint_status_register_bp2_srwd, + .unlock = spi_disable_blockprotect_bp2_srwd, /* #WP pin write-protects SRWP bit. */ + .write = spi_chip_write_256, /* Multi I/O supported */ + .read = spi_chip_read, /* Fast read (0x0B) and multi I/O supported */ + .voltage = {2700, 3600}, + }, + + { + .vendor = "Spansion", .name = "S25FL128P......0", /* uniform 64 kB sectors */ .bustype = BUS_SPI, .manufacture_id = SPANSION_ID, Modified: trunk/flashchips.h ============================================================================== --- trunk/flashchips.h Sun Dec 7 22:57:53 2014 (r1857) +++ trunk/flashchips.h Fri Dec 12 01:32:03 2014 (r1858) @@ -600,7 +600,7 @@ #define SPANSION_S25FL016A 0x0214 #define SPANSION_S25FL032A 0x0215 /* Same as S25FL032P, but the latter supports EDI and CFI */ #define SPANSION_S25FL064A 0x0216 /* Same as S25FL064P, but the latter supports EDI and CFI */ -#define SPANSION_S25FL128 0x2018 /* Same ID for various S25FL128P, S25FL128S and S25FL129P (including dual-die S70FL256P) variants (EDI supported) */ +#define SPANSION_S25FL128 0x2018 /* Same ID for various S25FL127S, S25FL128P, S25FL128S and S25FL129P (including dual-die S70FL256P) variants (EDI supported) */ #define SPANSION_S25FL256 0x0219 #define SPANSION_S25FL512 0x0220 #define SPANSION_S25FL204 0x4013

5 years, 7 months

Re: [flashrom] [PATCH] Fix handling of write protection at register space address +2.

by Stefan Tauner

On Wed, 10 Dec 2014 21:24:27 +0400 Roman Lebedev <lebedev.ri(a)gmail.com> wrote: > Invalid locking change 0xf8 requested at 0xb7323002! Please report a bug at > flashrom(a)flashrom.org Thanks for testing Roman! Carl-Daniel, do you have any idea why we do the "new_bits & ~REG2_MASK" in changelock_regspace2_block() in jedec.c at all? It is essentially your code, c.f. http://patchwork.coreboot.org/patch/3412/ I propose to use "(old ^ new) & ~REG2_MASK" instead, i.e. check if the caller requests a change of bits not related to the write protection. I guess that was your original intention anyway, is that correct? -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

5 years, 7 months

PCI BAR access thru sysfs

by Ed Swierk

Various kernel options are known to interfere with flashrom's attempts to access physical memory through /dev/mem. Some (like CONFIG_STRICT_DEVMEM) are important security measures that cannot be disabled without recompiling the kernel, and are likely to be used more widely over time. However, complete access to physical memory is unnecessary for some use cases. For example, the SPI interface on an Intel NIC can be accessed by mmapping a BAR resource file in the PCI device directory in sysfs. Has anyone considered implementing such an alternative access method for PCI devices in flashrom? --Ed

5 years, 7 months

Re: [flashrom] [PATCH] Fix handling of write protection at register space address +2.

by Roman Lebedev

Hi. Sorry for not replying, i got buried with other stuff. So, after some hassle with svn, i managed to apply that patch (patch -l -m -i ../flashrom.patch) ontop of current svn tip (r1857) That indeed fixed flash reading (-r), md5 of files generated with this patch, and with r1832 match. Here is the output, also do note "Invalid locking change 0xf8 requested" at the end!!! # flashrom --programmer internal -r 1002.bin.patch -V flashrom v0.9.7-r1857 on Linux 3.16.0-4-686-pae (i686) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.2.1, GCC 4.9.2, little endian Command line (5 args): flashrom --programmer internal -r 1002.bin.patch -V Calibrating delay loop... OS timer resolution is 1 usecs, 534M loops per second, 10 myus = 10 us, 100 myus = 100 us, 1000 myus = 999 us, 10000 myus = 10002 us, 4 myus = 4 us, OK. Initializing internal programmer No coreboot table found. Using Internal DMI decoder. DMI string chassis-type: "Desktop" DMI string system-manufacturer: "ASUSTeK COMPUTER INC." DMI string system-product-name: "PCH-DR" DMI string system-version: "1.XX " DMI string baseboard-manufacturer: "ASUSTek Computer INC." DMI string baseboard-product-name: "PCH-DR" DMI string baseboard-version: "1.XX " Found Winbond Super I/O, id 0x82 W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect. Active config mode, unknown reg 0x20 ID: 00. Please send the output of "flashrom -V -p internal" to flashrom(a)flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks. Found chipset "Intel 6300ESB" with PCI ID 8086:25a1. Enabling flash write... 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode disabled 0xffe00000/0xffa00000 FWH decode disabled 0xffd80000/0xff980000 FWH decode disabled 0xffd00000/0xff900000 FWH decode disabled 0xffc80000/0xff880000 FWH decode disabled 0xffc00000/0xff800000 FWH decode disabled 0xff700000/0xff300000 FWH decode disabled 0xff600000/0xff200000 FWH decode disabled 0xff500000/0xff100000 FWH decode disabled 0xff400000/0xff000000 FWH decode disabled Maximum FWH chip size: 0x100000 bytes BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled OK. The following protocols are supported: FWH. Probing for Atmel AT49LH002, 256 kB: probe_82802ab: id1 0x08, id2 0x14, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49LH00B4, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49LH004, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AB, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AC, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL002, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for PMC Pm49FL004, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH) mapped at physical address 0xfff80000. Probing for Sharp LHF00L04, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF002A/B, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF003A/B, 384 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF004A/B, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF004C, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008A, 1024 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF008C, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF016C, 2048 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040A, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 kB: probe_82802ab: id1 0x08, id2 0x14, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW016, 2048 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW040, 512 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW080, 1024 kB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V040FA, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040FB, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040FC, 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W49V002FA, 256 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V080FA, 1024 kB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V080FA (dual mode), 512 kB: probe_jedec_common: id1 0x9d, id2 0x6e Found PMC flash chip "Pm49FL004" (512 kB, LPC, FWH). === This flash part has status UNTESTED for operations: ERASE WRITE The test status of this chip may have been updated in the latest development version of flashrom. If you are running the latest development version, please email a report to flashrom(a)flashrom.org if any of the above operations work correctly for you with this flash chip. Please include the flashrom log file for all operations you tested (see the man page for details), and mention which mainboard or programmer you tested in the subject line. Thanks for your help! Invalid locking change 0xf8 requested at 0xb7323002! Please report a bug at flashrom(a)flashrom.org Reading flash... done. # Roman. On Sun, Dec 7, 2014 at 2:06 AM, Stefan Tauner < stefan.tauner(a)alumni.tuwien.ac.at> wrote: > Previously we added the offset of the virtual register in several > functions, which produced segfaults. This patch renames a few > parameters hence the rather big diff. > > Thanks to Roman Lebedev for reporting this issue. > > Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> > --- > chipdrivers.h | 1 - > jedec.c | 54 ++++++++++++++++++++++++------------------------------ > 2 files changed, 24 insertions(+), 31 deletions(-) > > diff --git a/chipdrivers.h b/chipdrivers.h > index 8529c74..cac94f3 100644 > --- a/chipdrivers.h > +++ b/chipdrivers.h > @@ -150,7 +150,6 @@ int unlock_regspace2_uniform_32k(struct flashctx > *flash); > int unlock_regspace2_uniform_64k(struct flashctx *flash); > int unlock_regspace2_block_eraser_0(struct flashctx *flash); > int unlock_regspace2_block_eraser_1(struct flashctx *flash); > -int unlock_regspace2_block(const struct flashctx *flash, chipaddr off); > int printlock_regspace2_uniform_64k(struct flashctx *flash); > int printlock_regspace2_block_eraser_0(struct flashctx *flash); > int printlock_regspace2_block_eraser_1(struct flashctx *flash); > diff --git a/jedec.c b/jedec.c > index 1345b89..944f9d0 100644 > --- a/jedec.c > +++ b/jedec.c > @@ -589,11 +589,10 @@ static int regspace2_walk_unlockblocks(const struct > flashctx *flash, const struc > #define REG2_LOCKDOWN (1 << 1) > #define REG2_MASK (REG2_RWLOCK | REG2_LOCKDOWN) > > -static int printlock_regspace2_block(const struct flashctx *flash, > chipaddr offset) > +static int printlock_regspace2_block(const struct flashctx *flash, > chipaddr wrprotect) > { > - chipaddr wrprotect = flash->virtual_registers + offset + 2; > uint8_t state = chip_readb(flash, wrprotect); > - msg_cdbg("Lock status of block at 0x%0*" PRIxPTR " is ", > PRIxPTR_WIDTH, offset); > + msg_cdbg("Lock status of block at 0x%0*" PRIxPTR " is ", > PRIxPTR_WIDTH, wrprotect); > switch (state & REG2_MASK) { > case 0: > msg_cdbg("Full Access.\n"); > @@ -656,47 +655,43 @@ int printlock_regspace2_block_eraser_1(struct > flashctx *flash) > return regspace2_walk_unlockblocks(flash, unlockblocks, > &printlock_regspace2_block); > } > > -static int changelock_regspace2_block(const struct flashctx *flash, > chipaddr offset, uint8_t new_bits) > +static int changelock_regspace2_block(const struct flashctx *flash, > chipaddr wrprotect, uint8_t old, uint8_t new) > { > - chipaddr wrprotect = flash->virtual_registers + offset + 2; > - uint8_t old; > - > - if (new_bits & ~REG2_MASK) { > + if (new & ~REG2_MASK) { > msg_cerr("Invalid locking change 0x%02x requested at > 0x%0*" PRIxPTR "! " > "Please report a bug at flashrom(a)flashrom.org\n", > - new_bits, PRIxPTR_WIDTH, offset); > + new, PRIxPTR_WIDTH, wrprotect); > return -1; > } > - old = chip_readb(flash, wrprotect); > /* Early exist if no change (of read/write/lockdown) was > requested. */ > - if (((old ^ new_bits) & REG2_MASK) == 0) { > - msg_cdbg2("Locking status at 0x%0*" PRIxPTR " not > changed\n", PRIxPTR_WIDTH, offset); > + if (((old ^ new) & REG2_MASK) == 0) { > + msg_cdbg2("Locking status at 0x%0*" PRIxPTR " not > changed\n", PRIxPTR_WIDTH, wrprotect); > return 0; > } > /* Normally lockdowns can not be cleared. Try nevertheless if > requested. */ > - if ((old & REG2_LOCKDOWN) && !(new_bits & REG2_LOCKDOWN)) { > + if ((old & REG2_LOCKDOWN) && !(new & REG2_LOCKDOWN)) { > chip_writeb(flash, old & ~REG2_LOCKDOWN, wrprotect); > if (chip_readb(flash, wrprotect) != (old & > ~REG2_LOCKDOWN)) { > - msg_cerr("Lockdown can't be removed at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + msg_cerr("Lockdown can't be removed at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, wrprotect); > return -1; > } > } > /* Change read or write lock? */ > - if ((old ^ new_bits) & REG2_RWLOCK) { > + if ((old ^ new) & REG2_RWLOCK) { > /* Do not lockdown yet. */ > - msg_cdbg("Changing locking status at 0x%0*" PRIxPTR " to > 0x%02x\n", PRIxPTR_WIDTH, offset, new_bits & REG2_RWLOCK); > - chip_writeb(flash, new_bits & REG2_RWLOCK, wrprotect); > - if (chip_readb(flash, wrprotect) != (new_bits & > REG2_RWLOCK)) { > - msg_cerr("Locking status change FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + msg_cdbg("Changing locking status at 0x%0*" PRIxPTR " to > 0x%02x\n", PRIxPTR_WIDTH, wrprotect, new & REG2_RWLOCK); > + chip_writeb(flash, new & REG2_RWLOCK, wrprotect); > + if (chip_readb(flash, wrprotect) != (new & REG2_RWLOCK)) { > + msg_cerr("Locking status change FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, wrprotect); > return -1; > } > } > /* Enable lockdown if requested. */ > - if (!(old & REG2_LOCKDOWN) && (new_bits & REG2_LOCKDOWN)) { > - msg_cdbg("Enabling lockdown at 0x%0*" PRIxPTR "\n", > PRIxPTR_WIDTH, offset); > - chip_writeb(flash, new_bits, wrprotect); > - if (chip_readb(flash, wrprotect) != new_bits) { > - msg_cerr("Enabling lockdown FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, offset); > + if (!(old & REG2_LOCKDOWN) && (new & REG2_LOCKDOWN)) { > + msg_cdbg("Enabling lockdown at 0x%0*" PRIxPTR "\n", > PRIxPTR_WIDTH, wrprotect); > + chip_writeb(flash, new, wrprotect); > + if (chip_readb(flash, wrprotect) != new) { > + msg_cerr("Enabling lockdown FAILED at 0x%0*" > PRIxPTR "!\n", PRIxPTR_WIDTH, wrprotect); > return -1; > } > } > @@ -704,19 +699,18 @@ static int changelock_regspace2_block(const struct > flashctx *flash, chipaddr off > return 0; > } > > -int unlock_regspace2_block(const struct flashctx *flash, chipaddr off) > +static int unlock_regspace2_block_generic(const struct flashctx *flash, > chipaddr wrprotect) > { > - chipaddr wrprotect = flash->virtual_registers + off + 2; > uint8_t old = chip_readb(flash, wrprotect); > /* We don't care for the lockdown bit as long as the RW locks are > 0 after we're done */ > - return changelock_regspace2_block(flash, off, old & ~REG2_RWLOCK); > + return changelock_regspace2_block(flash, wrprotect, old, old & > ~REG2_RWLOCK); > } > > static int unlock_regspace2_uniform(struct flashctx *flash, unsigned long > block_size) > { > const unsigned int elems = flash->chip->total_size * 1024 / > block_size; > struct unlockblock blocks[2] = {{.size = block_size, .count = > elems}}; > - return regspace2_walk_unlockblocks(flash, blocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, blocks, > &unlock_regspace2_block_generic); > } > > int unlock_regspace2_uniform_64k(struct flashctx *flash) > @@ -734,7 +728,7 @@ int unlock_regspace2_block_eraser_0(struct flashctx > *flash) > // FIXME: this depends on the eraseblocks not to be filled up > completely (i.e. to be null-terminated). > const struct unlockblock *unlockblocks = > (const struct unlockblock > *)flash->chip->block_erasers[0].eraseblocks; > - return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block_generic); > } > > int unlock_regspace2_block_eraser_1(struct flashctx *flash) > @@ -742,6 +736,6 @@ int unlock_regspace2_block_eraser_1(struct flashctx > *flash) > // FIXME: this depends on the eraseblocks not to be filled up > completely (i.e. to be null-terminated). > const struct unlockblock *unlockblocks = > (const struct unlockblock > *)flash->chip->block_erasers[1].eraseblocks; > - return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block); > + return regspace2_walk_unlockblocks(flash, unlockblocks, > &unlock_regspace2_block_generic); > } > > -- > Kind regards, Stefan Tauner > >

5 years, 7 months

Re: [flashrom] updating Coreboot

by Stefan Tauner

On Fri, 5 Dec 2014 18:26:46 +0100 Mathilde <allatoja(a)gmail.com> wrote: > Hello, > > Being not an informatician, I need help for updating my BIOS Coreboot (on a > Thinkpad X60), because of heat issues. > > I dowloaded the last release here http://libreboot.org/docs/release.html, > and installed the build dependencies. Could you explain me step by step > what to do now? > > I did'nt understand whether I am to compile flashrom or not. In advance > thank you very much! Hi, you probably want to ask the libreboot guys not us ;) Please see the contact information on http://libreboot.org at the bottom. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

5 years, 7 months

Flashrom Serprog Arduino Uno Winbond 25Q32BVSIG

by Paulo Ribeiro

I finally managed to get the chip recognised by flashrom using the following circuit: Chip --- Arduino 1 10 2 12 3 3.3V 4 GND 5 11 6 13 7 3.3V 8 3.3V The problem now is with the reading. With the flag -VVVr I get the following: Reading flash... serprog_spi_send_command, writecnt=4, readcnt=65536 serprog_spi_send_command, writecnt=4, readcnt=65536 serprog_spi_send_command, writecnt=4, readcnt=65536 serprog_spi_send_command, writecnt=4, readcnt=65536 serprog_spi_send_command, writecnt=4, readcnt=65536 serprog_spi_send_command, writecnt=4, readcnt=65536 It outputs a different number of lines each time but always stops. Any idea what the problem may be? Any help will be greatly appreciated. Best regards, Paulo Ribeiro

5 years, 7 months

Chip working

by Markus Hirsch

Hi, I have successfully flashed a EN25Q64 that was rated untested. It was for an 8MB version of openWRT. My setup was a Raspberry Pi with flashrom 0.9.5.2-r1546 and Linux 3.12.22+. I made a little SMD adapter like shown in the picture that plugs directly in the Pi header. Regards Markus

5 years, 7 months

Re: [flashrom] rayer_spi

by Stefan Tauner

On Tue, 23 Sep 2014 20:29:55 +0330 Arman Khodabande <amal555(a)gmail.com> wrote: > Hello > As I checked Supported hardware on the Flashrom website the chip > EN25F32 has unknown status. I wanted to inform you that successfully > tested the Read and Write operations of this chip on a Rayer_spi > programmer. The EN25F32 chip acts as the Bios in the Dell XPS L502 > Laptops. Here's the log with (-V): > > […] > > Perhaps the verification process failed which maybe because of > programmer disconnection or fault. It may have been succeeded. So I'm > unsure. > > Verifying flash... VERIFY FAILED at 0x00008134! Expected=0xed, > Read=0xef, failed byte count from 0x00000000-0x003fffff: 0xbe54 > Your flash chip is in an unknown state. > Get help on IRC at chat.freenode.net (channel #flashrom) or > mail flashrom(a)flashrom.org with the subject "FAILED: "! > > I verified the chip with another program called SPIPGM and it showed > no errors. so the READ and WRITE process was fine by flashrom. Hello Arman, thanks for your report! I'll pretend the verification errors never happened, because the LPT-based programmers are usually to blame and not flashrom itself. Thus I have marked the flash chip as fully tested and will commit that later together with other small changes. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

5 years, 7 months

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom December 2014