- flashrom - mail.coreboot.org

Successful READ and WRITE, Asrock P4i65G
by R F 07 Oct '16

07 Oct '16

Using a legacy board as a flasher, flashrom nagged me to submit a report. Nice software, thanks.

1 0

Success flashrom on Wyse C10LE
by Romain MARIADASSOU - Service Informatique 06 Oct '16

06 Oct '16

Machine : Wyse C10LE Should work on Wyse C50LE Command line used : flashrom -w bios2012.img -V -p internal:laptop=this_is_not_a_laptop Log file attached -- Cordialement, CIAS à l'Ouest de Rennes *Romain MARIADASSOU* /Pôle Ressources/ - /Service Informatique/ CIAS à l'Ouest de Rennes Place Toulouse Lautrec - BP 31 - 35310 MORDELLES Tél : 02 23 41 28 00 - Fax : 02 23 41 28 09 Site : http://www.cias-ouest-rennes.fr Mail : informatique(a)cias-ouest-rennes.fr <mailto:informatique@cias-ouest-rennes.fr>

1 0

Jetway NF9G-QM77 test success
by Nick M 04 Oct '16

04 Oct '16

Greetings, Fortune was on my side when I extracted the same spi flash chip from my junk collection that this mini itx uses. A freshly downloaded bios image was flashed with external ft2232h to recycled flash and swapped with original chip. I followed the suggested methodology to test unknown hardware, output of hardware probing was piped to attached text files. Read, write, erase and probe work as intended. Diff returned no file differences and pc booted as expected using A07, A08 and backup binary images. Thanks, -- Nick

1 0

Re: [flashrom] [coreboot] Support for Gigabyte ga-ma78gm-us2h?
by Mike Banon 03 Oct '16

03 Oct '16

Get a hardware programmer for BIOS chips (e.g. cheap CH341A) together with SOIC8 test clip (if your type of BIOS chip is indeed SOIC8, I just looked at some photos of your board online...) and do In-System Programming with a flashrom. Thanks to a test clip you will not need to solder your board in order to flash a BIOS. Nothing can stop a hardware programmer ;) You could backup both of your current BIOSes and replace everything with coreboot to get rid of original BIOS warnings/checksums , and if you would like to restore the original BIOS back it will be really easy. Now, what could be tried if a current revision of coreboot does not work for you? 1) Check what is the date of last successful board status report. At your case, I see that nobody submitted a report for your board, so you probably need to choose this day as the day of support addition ( Aug 17 13:22:40 2010 ) and test if it worked at this time or maybe 1 month after this time (if a full support has been added gradually) 2) You divide the time between current date and "1)" date by 2 - to get a "test date" - then download a coreboot/seabios repositories at this "test date", build and test it. If it works --> you go forward in time, if it does not work --> you go back in time; again, dividing the remaining range by two. You have to go through a long history in your case, 2000 days, but if you are always dividing by two its less than 2048 = 2^11 so you could find the last day it worked in 11 tries 3) So you found the last day, and then the last commit when it worked. Now you see what commit broke a support for your board, and could either live with old coreboot stuff, or figure out what changes need to be made to newer coreboot - so that your board works, while not breaking a support for other boards (IMPORTANT) Best regards, Mike Banon > > Thanks a lot for the help, but now I don't even get to the black screen. > Whenever I flash coreboot and reboot the computer, after a few seconds of > black-screen the backup BIOS complains about a checksum fail from the main > bios chip and resets the contents to the original BIOS. I have a few ideas > to try tonight, so I'll try that. Hopefully I'll be able to achieve > something. > > Cheers, > Alberto > 2016-09-28 15:10 GMT-03:00 Zoran Stojsavljevic < zoran.stojsavljevic at gmail.com>: > *"Приветствую!* > *Если я правильно понял, то у меня была схожая проблема, когда я пытался > запустить coreboot на Asus m4a785-m. Я потратил 2 месяца на ее решение, а > решение оказалось простым.* > *Проблема в вызовах printk() до инициализации консоли. Видимо > переполняется кэш процессора."* > > Translation for the above is the following (maybe this also can help): > > Hello, > > If I correctly understand, I had very similar problem, when I > struggled/tried to bring up Coreboot on Asus m4a785-m. I lost two months > for solution finding, and solution appeared to be simplistic. > Problem is by calling printk() before console init. Apparently CPU cache > is overloading. > > (love Russian language, could not resist)! > > Zoran > > On Wed, Sep 28, 2016 at 5:54 PM, Alexey Borovikov via coreboot < > coreboot at coreboot.org> wrote: > >> Hi! >> May be the problems in call printk() before console_init(). Two way: >> 1. To comment printk in function which call before console_init. >> 2. Call console_init first in function cache_as_ram_main. >> May be this help. >> >> /* >> Приветствую! >> Если я правильно понял, то у меня была схожая проблема, когда я пытался >> запустить coreboot на Asus m4a785-m. Я потратил 2 месяца на ее решение, а >> решение оказалось простым. >> Проблема в вызовах printk() до инициализации консоли. Видимо >> переполняется кэш процессора. >> Для решения два пути: >> 1. Закомментировать все вызовы printk до вызова console_init >> 2. Попробовать вызвать console_init как можно раньше в функции >> cache_as_ram_main (файл romstage.c). >> Возможно это поможет. >> */ >> >> >> *From:* Alberto Simón Francés <alberto at simon.ph> >> *Sent:* Sunday, September 25, 2016 6:07 PM >> *To:* coreboot at coreboot.org >> *Subject:* [coreboot] Support for Gigabyte ga-ma78gm-us2h? >> >> >> Hello, >> >> I've been trying to make this board boot and I haven't had much success. >> Sometimes I've been able to get it to POST, but it's not something that >> happens consistently. Since I can't find much info other than it being >> listed, I'm asking here to see if by any chance there's something that I'm >> missing, because I feel like I'm just trying random things to see what >> sticks. >> >> Thankfully the board has dual bios, so it's easy to go back if I mess >> something up. Please, help. >> >> Best regards, >> Albert >> >> ------------------------------ >> -- >> coreboot mailing list: coreboot at coreboot.org >> https://www.coreboot.org/mailman/listinfo/coreboot >> >> >> -- >> coreboot mailing list: coreboot at coreboot.org >> https://www.coreboot.org/mailman/listinfo/coreboot >> > >

1 0

Upgrade MS-7519 / MSI P45 NEO
by Jelle Martijn Kok 01 Oct '16

01 Oct '16

The bios of this board upgraded perfectly. 2 things to note: * I received several nasty "Trying to unmap a nonexisting mapping!" messages.("-c W25X80" prevented these) * I need to clear the BIOS setup using the jumper Enclosed is the log for the probe (with "-V") Jelle Martijn -- ------------------------------------------------------------------------ You/Com Audiocommunicatie BV Motorenweg 5k 2623CR Delft The Netherlands tel. : (+31)15 262 59 55 fax. : (+31)15 257 15 95 mail : jmkok(a)youcom.nl http : http://www.youcom.nl/ ------------------------------------------------------------------------

1 0

Re: [flashrom] ENE KB9012 patches: new test results
by Paul Kocialkowski 01 Oct '16

01 Oct '16

Hi, I got your emails just fine, I just didn't have time to sit down and write a proper reply but I'm very enthusiasic about working with you ! Cheers, Paul Kocialkowski Le vendredi 23 septembre 2016 à 03:16 +0300, mikeb mikeb a écrit : > Good day! I just tried reading from KB9012 and encountered exactly the same > problem as Joerg Albert has ( https://www.flashrom.org/pipermail/flashrom/2016 > -May/014653.html ) - chip is detected only every second time. This is not > caused by cabling. While it is recommended for SPI that the wires should be > shorter than 20cm, my wires are 11 cm: 8 cm of which is 12 strands high > quality copper and only 3 cm are ordinary aluminium inside the 30 pin 0.5mm > pitch keyboard-like connector This is interesting! I still haven't been able to reproduce the issue (but haven't tried so hard either). Could you indicate whether you are: * grounding pin 42 to go into test mode * powering the mainboard Thanks! > NOTE: it was much easier and safer to solder 1P wires to this connector rather > than to motherboard, and you could remove/insert it at any time - what a great > convenience! The only 1P wire I had to solder to motherboard is to > motherboard's ground, - to make it possible to unite three grounds > (motherboard s, KB9012 s and programmer s) - and that was really easy because > at least one of these orange circle grounds has a great distance between it > and motherboard's elements so it is difficult to screw up there :) Going to > share photos and write some manuals about connectivity, hopefully helpful to > the people like me who want to participate in Origami EC project - creation of > open source firmware for KB9012 which in case of success will be a HUGE step > towards Lenovo G505S liberation (AMD laptop with coreboot support) . > Discovered Paul's presentation talk by pure accident - > https://www.youtube.com/watch?v=B708jdCiW7o > > So I tried using two SPI programmers: 1) CH341A . 2) Bus Pirate v4 . The only > observed difference is a speed: for CH341A read takes 13-14 minutes, while for > BPv4 - despite the latest 7.0 firmware with level 3 optimizations ( http://dan > gerousprototypes.com/docs/Bus_Pirate#Download ) and SPI speed is 8 MHz - it > takes 40 minutes to read! Checksums of the files are the same and the files > have almost the same contains as KB9012 image for LA-A091P G505S that I found > online (same except the area 0x1d000 - 0x1e0f0, their image is filled with > 0xff there, mine has many 0x00 with a few 0xff and also data - probably > encoded serial number and similar stuff) , so I am pretty sure these > programmers both are reading without errors in my setup, just at the different > speeds for some weird reason > > Patches applied before testing: > 1) https://patchwork.coreboot.org/patch/4412/ > 2) https://patchwork.coreboot.org/patch/4413/ > 3) https://patchwork.coreboot.org/patch/4414/ > > This problem with 1/2 detection rate is not a blocker, more like a small > inconvenience, so I strongly believe that these patches should be merged as > soon as possible! Paul Kocialkowski has committed them almost a year ago, such > a major feature and still not merged?? > > Below you could see some -VVV detection logs. > > After reading this really inspiring article ( http://code.paulk.fr/article25/a > n-incentive-for-liberating-computers-my-own-use-case ) I guess that Paul's > motherboard is LA-A092P, very similar to LA-A091P but no extra GPU. Could that > be a reason he is not getting a detection problem? Just a wild guess... > > Yours sincerely, > Mikeb > > 1) Common part of "2) and "3)" - CH341A tries to detect: > sudo ./flashrom -p ch341a_spi -c "KB9012 (EDI)" -VVV > flashrom v0.9.9-r1954 on Linux 4.4.0-36-generic (x86_64) > flashrom is free software, get the source code at https://flashrom.org > flashrom was built with libpci 3.3.1, GCC 5.4.0 20160609, little endian > Command line (5 args): ./flashrom -p ch341a_spi -c KB9012 (EDI) -VVV > > 2) FAIL: > Calibrating delay loop... OS timer resolution is 1 usecs, 578M loops per > second, 10 myus = 11 us, 100 myus = 92 us, 1000 myus = 914 us, 10000 myus = > 9661 us, 4 myus = 5 us, OK. > Initializing ch341a_spi programmer, Device revision is 3.0.4 > Wrote 3 bytes: aa 61 00 > Wrote 4 bytes: ab b7 7f 20 > The following protocols are supported: SPI. > Probing for ENE KB9012 (EDI), 128 kB: programmer_map_flash_region: mapping > KB9012 (EDI) from 0x00000000fffe0000 to 0x0000000000000000 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 00 ff ff ff > Read 7 bytes: ff ff ff ff 00 00 00 > programmer_unmap_flash_region: unmapped 0x0000000000000000 > No EEPROM/flash device found. > Note: flashrom can never write if the flash chip isn't found automatically. > Wrote 4 bytes: ab b7 40 20 > > 3) SUCCESS: > Calibrating delay loop... OS timer resolution is 1 usecs, 629M loops per > second, 10 myus = 11 us, 100 myus = 100 us, 1000 myus = 994 us, 10000 myus = > 9974 us, 4 myus = 4 us, OK. > Initializing ch341a_spi programmer, Device revision is 3.0.4 > Wrote 3 bytes: aa 61 00 > Wrote 4 bytes: ab b7 7f 20 > The following protocols are supported: SPI. > Probing for ENE KB9012 (EDI), 128 kB: programmer_map_flash_region: mapping > KB9012 (EDI) from 0x00000000fffe0000 to 0x0000000000000000 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 00 ff ff ff > Read 7 bytes: 00 00 00 00 fa 0a c3 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 24 ff ff ff > Read 7 bytes: 00 00 00 00 fa 0a 20 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 28 ff ff ff > Read 7 bytes: 00 00 00 00 fa 0a 00 > Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 ff 28 80 > Read 5 bytes: 00 00 00 00 00 > Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on ch341a_spi. > programmer_unmap_flash_region: unmapped 0x0000000000000000 > No operations were specified. > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 28 ff ff ff > Read 7 bytes: 00 00 00 00 fa 0a 80 > Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 ff 28 00 > Read 5 bytes: 00 00 00 00 00 > Wrote 34 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 cf > Read 1 bytes: 00 > Wrote 4 bytes: ab b7 40 20 > > 4) Small part of Bus Pirate v4 reading log: > buspirate_sendrecv: write 9, read 4 Sending 0x04 0x00 0x04 0x00 0x03 0x30 0x00 > 0xfe 0xab, receiving 0x01 0x5f 0x50 0x90 > buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 > 0x00 0xfe 0xa8 0xc6, receiving 0x01 > buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 > 0x00 0xfe 0xac 0x03, receiving 0x01 > buspirate_sendrecv: write 9, read 4 Sending 0x04 0x00 0x04 0x00 0x03 0x30 0x00 > 0xfe 0xab, receiving 0x01 0x5f 0x50 0xec > buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 > 0x00 0xfe 0xa8 0xc7, receiving 0x01 > buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 > 0x00 0xfe 0xac 0x03, receiving 0x01 > > 5) Small part of CH341A reading log: > Read 5 bytes: 00 00 00 00 00 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 7f d5 ff ff ff > Read 7 bytes: 00 00 00 00 fa 0a ff > Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 7f 15 fb > Read 5 bytes: 00 00 00 00 00 > Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 7f 35 c0 > Read 5 bytes: 00 00 00 00 00 > Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 7f d5 ff ff ff > -- Paul Kocialkowski, developer of low-level free software for embedded devices Website: https://www.paulk.fr/ Coding blog: https://code.paulk.fr/ Git repositories: https://git.paulk.fr/ https://git.code.paulk.fr/ -- Envoyé de mon appareil Android avec K-9 Mail. Veuillez excuser ma brièveté.

2 1

Flashrom error with request to report
by Thomas Köhn 29 Sep '16

29 Sep '16

Calibrating delay loop... OK. Found Spansion flash chip "S25FL164K" (8192 kB, SPI) on ft2232_spi. Reading old flash chip contents... done. Erasing and writing flash chip... FAILED at 0x00000000! Expected=0xff, Found=0xbd, failed byte count from 0x00000000-0x00000fff: 0x2fb ERASE FAILED! Reading current flash chip contents... ftdi_write_data: -110, usb bulk write failed send_buf failed at end: 1 Can't read anymore! Aborting. FAILED! Uh oh. Erase/write failed. Checking if anything has changed. Reading current flash chip contents... ftdi_write_data: -110, usb bulk write failed send_buf failed at end: 1 Can't even read anymore! Your flash chip is in an unknown state. Please report this on IRC at chat.freenode.net (channel #flashrom) or mail flashrom(a)flashrom.org, thanks!

1 0

acer aspire 7750g
by Torsten Heins 28 Sep '16

28 Sep '16

At acer aspire 7750g flashrom doesn't function.

2 1

Flashrom try while logged in
by john 25 Sep '16

25 Sep '16

I tried the flashEROm for an older computer A7V266, at the moment it has the 1011 flash installed, I am intending to try the 1015: only to see if there are any features that provide more options, such as boot from USB or set NUMLOCK, which at the moment it does have for either one (USB or NUMLOCK) The last flash offer available from global server, not the USA support site, although the link was provided for other locations..

1 0

ENE KB9012 patches: new test results
by mikeb mikeb 23 Sep '16

23 Sep '16

Good day! I just tried reading from KB9012 and encountered exactly the same problem as Joerg Albert has ( https://www.flashrom.org/pipermail/flashrom/2016-May/014653.html ) - chip is detected only every second time. This is not caused by cabling. While it is recommended for SPI that the wires should be shorter than 20cm, my wires are 11 cm: 8 cm of which is 12 strands high quality copper and only 3 cm are ordinary aluminium inside the 30 pin 0.5mm pitch keyboard-like connector NOTE: it was much easier and safer to solder 1P wires to this connector rather than to motherboard, and you could remove/insert it at any time - what a great convenience! The only 1P wire I had to solder to motherboard is to motherboard's ground, - to make it possible to unite three grounds (motherboard s, KB9012 s and programmer s) - and that was really easy because at least one of these orange circle grounds has a great distance between it and motherboard's elements so it is difficult to screw up there :) Going to share photos and write some manuals about connectivity, hopefully helpful to the people like me who want to participate in Origami EC project - creation of open source firmware for KB9012 which in case of success will be a HUGE step towards Lenovo G505S liberation (AMD laptop with coreboot support) . Discovered Paul's presentation talk by pure accident - https://www.youtube.com/watch?v=B708jdCiW7o So I tried using two SPI programmers: 1) CH341A . 2) Bus Pirate v4 . The only observed difference is a speed: for CH341A read takes 13-14 minutes, while for BPv4 - despite the latest 7.0 firmware with level 3 optimizations ( http://dangerousprototypes.com/docs/Bus_Pirate#Download ) and SPI speed is 8 MHz - it takes 40 minutes to read! Checksums of the files are the same and the files have almost the same contains as KB9012 image for LA-A091P G505S that I found online (same except the area 0x1d000 - 0x1e0f0, their image is filled with 0xff there, mine has many 0x00 with a few 0xff and also data - probably encoded serial number and similar stuff) , so I am pretty sure these programmers both are reading without errors in my setup, just at the different speeds for some weird reason Patches applied before testing: 1) https://patchwork.coreboot.org/patch/4412/ 2) https://patchwork.coreboot.org/patch/4413/ 3) https://patchwork.coreboot.org/patch/4414/ This problem with 1/2 detection rate is not a blocker, more like a small inconvenience, so I strongly believe that these patches should be merged as soon as possible! Paul Kocialkowski has committed them almost a year ago, such a major feature and still not merged?? Below you could see some -VVV detection logs. After reading this really inspiring article ( http://code.paulk.fr/article25/an-incentive-for-liberating-computers-my-own… ) I guess that Paul's motherboard is LA-A092P, very similar to LA-A091P but no extra GPU. Could that be a reason he is not getting a detection problem? Just a wild guess... Yours sincerely, Mikeb 1) Common part of "2) and "3)" - CH341A tries to detect: sudo ./flashrom -p ch341a_spi -c "KB9012 (EDI)" -VVV flashrom v0.9.9-r1954 on Linux 4.4.0-36-generic (x86_64) flashrom is free software, get the source code at https://flashrom.org flashrom was built with libpci 3.3.1, GCC 5.4.0 20160609, little endian Command line (5 args): ./flashrom -p ch341a_spi -c KB9012 (EDI) -VVV 2) FAIL: Calibrating delay loop... OS timer resolution is 1 usecs, 578M loops per second, 10 myus = 11 us, 100 myus = 92 us, 1000 myus = 914 us, 10000 myus = 9661 us, 4 myus = 5 us, OK. Initializing ch341a_spi programmer, Device revision is 3.0.4 Wrote 3 bytes: aa 61 00 Wrote 4 bytes: ab b7 7f 20 The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: programmer_map_flash_region: mapping KB9012 (EDI) from 0x00000000fffe0000 to 0x0000000000000000 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 00 ff ff ff Read 7 bytes: ff ff ff ff 00 00 00 programmer_unmap_flash_region: unmapped 0x0000000000000000 No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. Wrote 4 bytes: ab b7 40 20 3) SUCCESS: Calibrating delay loop... OS timer resolution is 1 usecs, 629M loops per second, 10 myus = 11 us, 100 myus = 100 us, 1000 myus = 994 us, 10000 myus = 9974 us, 4 myus = 4 us, OK. Initializing ch341a_spi programmer, Device revision is 3.0.4 Wrote 3 bytes: aa 61 00 Wrote 4 bytes: ab b7 7f 20 The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: programmer_map_flash_region: mapping KB9012 (EDI) from 0x00000000fffe0000 to 0x0000000000000000 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 00 ff ff ff Read 7 bytes: 00 00 00 00 fa 0a c3 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 24 ff ff ff Read 7 bytes: 00 00 00 00 fa 0a 20 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 28 ff ff ff Read 7 bytes: 00 00 00 00 fa 0a 00 Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 ff 28 80 Read 5 bytes: 00 00 00 00 00 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on ch341a_spi. programmer_unmap_flash_region: unmapped 0x0000000000000000 No operations were specified. Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 ff 28 ff ff ff Read 7 bytes: 00 00 00 00 fa 0a 80 Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 ff 28 00 Read 5 bytes: 00 00 00 00 00 Wrote 34 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 cf Read 1 bytes: 00 Wrote 4 bytes: ab b7 40 20 4) Small part of Bus Pirate v4 reading log: buspirate_sendrecv: write 9, read 4 Sending 0x04 0x00 0x04 0x00 0x03 0x30 0x00 0xfe 0xab, receiving 0x01 0x5f 0x50 0x90 buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 0x00 0xfe 0xa8 0xc6, receiving 0x01 buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 0x00 0xfe 0xac 0x03, receiving 0x01 buspirate_sendrecv: write 9, read 4 Sending 0x04 0x00 0x04 0x00 0x03 0x30 0x00 0xfe 0xab, receiving 0x01 0x5f 0x50 0xec buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 0x00 0xfe 0xa8 0xc7, receiving 0x01 buspirate_sendrecv: write 10, read 1 Sending 0x04 0x00 0x05 0x00 0x00 0x40 0x00 0xfe 0xac 0x03, receiving 0x01 5) Small part of CH341A reading log: Read 5 bytes: 00 00 00 00 00 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 7f d5 ff ff ff Read 7 bytes: 00 00 00 00 fa 0a ff Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 7f 15 fb Read 5 bytes: 00 00 00 00 00 Wrote 38 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 00 7f 35 c0 Read 5 bytes: 00 00 00 00 00 Wrote 40 bytes: ab b7 b7 b7 b6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 0c 00 7f d5 ff ff ff

1 0

Re: [flashrom] Issue programming SPI flash
by Stefan Tauner 21 Sep '16

21 Sep '16

On Tue, 20 Sep 2016 23:00:15 +0000 Steve Burks <steve.burks(a)us.kontron.com> wrote: > Hi, > I have been flashing Macronix SPI with device ID MX25L12805D. We now have a new Numonyx SPI with device ID N25Q128..3E. However, when I try to flash the device it says that no flash device was found. But when I do the -p internal it clearly shows the device ID N25Q128..3E > > I have attached the verbose output from when I ran the command. I appreciate any assistance that you can provide. > > Thank you. > > Stephen Burks Hi Stephen, you have a Winbond W25Q128 there. All of these three are interchangeable so I guess someone swapped it without telling you :) In any case you should not use the -c parameter unless you have to and really know what chip is on there. Without it flashrom will find the right chip itself if it can. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

1 0

Issue programming SPI flash
by Steve Burks 21 Sep '16

21 Sep '16

Hi, I have been flashing Macronix SPI with device ID MX25L12805D. We now have a new Numonyx SPI with device ID N25Q128..3E. However, when I try to flash the device it says that no flash device was found. But when I do the -p internal it clearly shows the device ID N25Q128..3E I have attached the verbose output from when I ran the command. I appreciate any assistance that you can provide. Thank you. Stephen Burks Manager, Manufacturing Engineering - USA Manufacturing Engineering and Material Data Management Kontron 14118 Stowe Drive | Poway, CA 92064 | USA P: + 1 (858) 677-0877 x3266 | M: + 1 (858) 699-4690 Steve.Burks(a)us.kontron.com<mailto:Steve.Burks@us.kontron.com> Website<http://www.kontron.com/> | Blog<http://blog.kontron.com/> | Twitter<https://twitter.com/Kontron> | LinkedIn<https://www.linkedin.com/company/kontron> | YouTube<https://www.youtube.com/channel/UCXkp_1gJbG0Um1vzdowlqww> | Facebook<https://www.facebook.com/kontron> Kontron America Please find our mandatory legal statements here<http://www.kontron.com/additional/disclaimer>. By opening this email you are agreeing to Kontron's Electronic Communications Policy<http://www.kontron.com/additional/legal-and-copyright-information>.

1 0

[PATCH] add board enable for apple iMac5,2
by Arthur Heymans 19 Sep '16

19 Sep '16

Hi This patch adds the apple iMac5,2 to board enable. The hardware is very similar to the apple macbook2,1.

2 4

untested chipset intel
by Jan van Roessel 19 Sep '16

19 Sep '16

Marked as untested chipset Intel NUC, see attached log Met vriendelijke groet, Jan van Roessel

1 0

testing my A7V333
by Elmar Stellnberger 17 Sep '16

17 Sep '16

Today I have also tested my A7V333 mainboard with the latest flashrom from svn; and see it could read an image (log in the attachement). It said that write and erase would still need to be tested; however the following message does not raise my confidence: Changing lock bits failed at 0xb7305002! New value: 0xff. Basically I would also be ready to test erase & write on this board though it would likely be a good idea to have the error/log messages checked first.

1 2

Unable to detect SPI-Flash connected to RT5350 using flashrom.
by Pradeep Ch 17 Sep '16

17 Sep '16

We are using flashrom tool to program SPI flash on a RT5350 chipset board. We are able to program if we directly connect Jtag to the SPI -Serial Flash. The RT5350 has a Jtag interface pins. Can we connect a Jtag connector to connect to this interface and program SPI-Serial flash using flashrom. Rgds, Pradeep Ch.

1 0

Re: [flashrom] W836xx: L372N1 / GC Frontman (flashrom: unknown reg 0x20 ID: ea)
by Elmar Stellnberger 14 Sep '16

14 Sep '16

Here come the message files for erase & write: P.S.: re-sent to the mailinglist from 2016-09-11 since I did not get a response by Jim for some days. Am 2016-09-11 um 12:57 schrieb Elmar Stellnberger: > Hi Jim Rowan, > Hi Readers of the Flashrom List, > > Today I have re-tried it with the newest flashrom and the patch at > http://patchwork.coreboot.org/patch/4127 > - and see it worked (attachement). > > board name: Gericom Frontman, L372N1 ( EON EN29F040A ) > > Regards, > Elmar > > > Am 2016-09-02 um 23:04 schrieb Elmar Stellnberger: >> Today I have tried flashrom on a rather old L372N1 computer (PIV 2,8Ghz, >> GC Frontman): >> ------------------------------------------------------------ >> flashrom v0.9.7-r1711 on Linux 3.14.50-std460-i586 (i686) >> flashrom is free software, get the source code at http://www.flashrom.org >> >> Calibrating delay loop... OK. >> Active config mode, unknown reg 0x20 ID: ea. >> Please send the output of "flashrom -V" to >> flashrom(a)flashrom.org with W836xx: your board name: flashrom -V >> as the subject to help us finish support for your Super I/O. Thanks. >> Found chipset "SiS 645DX". Enabling flash write... OK. >> No EEPROM/flash device found. >> Note: flashrom can never write if the flash chip isn't found >> automatically. >> ------------------------------------------------------------ >> >> The BIOS Chip on the mainboard can be accessed easily; it is placed >> inside a special hanger and appears to be replacable. There is a sticker >> on the BIOS Chip saying: >> >> 686 >> AMIBIOS >> NBEC(c)2000 >> BA31 >> 8603 >> >> installed BIOS: Amibios v1.54, 10/15/2003, Version 1.08G >> >> The current BIOS there has some disadvantages like support with old >> style disks up to a maximum of 160GB (manual Cylinder-Head-Sector >> configuration); today I have tried it with a 64GB SSD IDE disk and the >> BIOS can not boot from it ( CD + floppy boot is o.k.). >> >> How do you believe are the chances to get flashrom running on that >> machine or to exchange the BIOS with a newer one? >> >> Elmar >> >> >> P.S.: I have attached some more information about the system as I was >> unsure which one would help you.

1 0

W836xx: L372N1 / GC Frontman (flashrom: unknown reg 0x20 ID: ea)
by Elmar Stellnberger 14 Sep '16

14 Sep '16

Today I have tried flashrom on a rather old L372N1 computer (PIV 2,8Ghz, GC Frontman): ------------------------------------------------------------ flashrom v0.9.7-r1711 on Linux 3.14.50-std460-i586 (i686) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Active config mode, unknown reg 0x20 ID: ea. Please send the output of "flashrom -V" to flashrom(a)flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks. Found chipset "SiS 645DX". Enabling flash write... OK. No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. ------------------------------------------------------------ The BIOS Chip on the mainboard can be accessed easily; it is placed inside a special hanger and appears to be replacable. There is a sticker on the BIOS Chip saying: 686 AMIBIOS NBEC(c)2000 BA31 8603 installed BIOS: Amibios v1.54, 10/15/2003, Version 1.08G The current BIOS there has some disadvantages like support with old style disks up to a maximum of 160GB (manual Cylinder-Head-Sector configuration); today I have tried it with a 64GB SSD IDE disk and the BIOS can not boot from it ( CD + floppy boot is o.k.). How do you believe are the chances to get flashrom running on that machine or to exchange the BIOS with a newer one? Elmar P.S.: I have attached some more information about the system as I was unsure which one would help you.

1 1

[Patch]ignore-read-error
by Tommy.Lo 13 Sep '16

13 Sep '16

Dear Maintainers , This patch is for the following description: Transaction is failed and errors are shown when flashrom try to read region that locked by Intel ME. This patch simply disable code to check error (will read 0xff) then flashrom will continue to read the rest. And only ignore the error when read op. It will output a warning message to stderr like: Transaction (READ) error at address 0x001000-0x7fffff, ignored To avoid a lot of similar error messages, it shows error at end of locked region. Thanks! Sign-off-by: Tommy Lo < tommy.lo(a)advantech.com.tw > Index: ichspi.c =================================================================== --- ichspi.c (revision 1955) +++ ichspi.c (working copy) @@ -178,6 +178,9 @@ static void *ich_spibar = NULL; +/* keep last addr of read error */ +static uint32_t last_read_warn_addr = 0xFFFFFFFF; + typedef struct _OPCODE { uint8_t opcode; //This commands spi opcode uint8_t spi_type; //This commands spi type @@ -946,14 +949,38 @@ /* FIXME make sure we do not needlessly cause transaction errors. */ temp32 = REGREAD32(ICH9_REG_SSFS); if (temp32 & SSFS_FCERR) { - msg_perr("Transaction error!\n"); - prettyprint_ich9_reg_ssfs(temp32); - prettyprint_ich9_reg_ssfc(temp32); - /* keep reserved bits */ - temp32 &= SSFS_RESERVED_MASK | SSFC_RESERVED_MASK; - /* Clear the transaction error. */ - REGWRITE32(ICH9_REG_SSFS, temp32 | SSFS_FCERR); - return 1; + if (ichspi_lock && op.spi_type == SPI_OPCODE_TYPE_READ_WITH_ADDRESS) { + /* keep reserved bits */ + temp32 &= SSFS_RESERVED_MASK | SSFC_RESERVED_MASK; + /* Clear the transaction error. */ + REGWRITE32(ICH9_REG_SSFS, temp32 | SSFS_FCERR); + if (last_read_warn_addr != 0xFFFFFFFF) { + if (last_read_warn_addr == (offset - 1)) { + /* continuing */ + last_read_warn_addr = offset + datalength - 1; + } else { + msg_pdbg("-0x%06x, ignored\n", last_read_warn_addr); + last_read_warn_addr = 0xFFFFFFFF; + } + } else { + msg_pdbg("Transaction (READ) error at address 0x%06x", offset); + last_read_warn_addr = offset + datalength - 1; + } + } else { + prettyprint_ich9_reg_ssfs(temp32); + prettyprint_ich9_reg_ssfc(temp32); + /* keep reserved bits */ + temp32 &= SSFS_RESERVED_MASK | SSFC_RESERVED_MASK; + /* Clear the transaction error. */ + REGWRITE32(ICH9_REG_SSFS, temp32 | SSFS_FCERR); + msg_perr("Transaction error!\n"); + return 1; + } + } else { + if (last_read_warn_addr != 0xFFFFFFFF) { + msg_pdbg("-0x%06x, ignored\n", last_read_warn_addr); + last_read_warn_addr = 0xFFFFFFFF; + } } if ((!write_cmd) && (datalength != 0))

1 0

flashrom stops/hangs
by joshj23 07 Sep '16

07 Sep '16

while trying to flash a chip (winbond W25Q32.v), on a arduino uno r3, the TX and RX led's will be on while flashrom is running normally, but will almost always turn off and flashrom in the terminal will stop all activity any suggestions? -- *Josh*

1 0

output of "flashrom -V" / board: ECS MCP73VT-PM
by Paolo Gozzini 06 Sep '16

06 Sep '16

utente@server:~$ sudo flashrom -p internal -V flashrom v0.9.6.1-r1563 on Linux 3.19.0-68-generic (x86_64) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.1.9, GCC 4.7.1, little endian Command line (3 args): flashrom -p internal -V Calibrating delay loop... OS timer resolution is 1 usecs, 2932M loops per second, 10 myus = 10 us, 100 myus = 100 us, 1000 myus = 1002 us, 10000 myus = 10000 us, 4 myus = 4 us, OK. Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "Packard Bell BV" DMI string system-product-name: "MCP73VT-PM" DMI string system-version: "1.0" DMI string baseboard-manufacturer: "Packard Bell BV" DMI string baseboard-product-name: "MCP73VT-PM" DMI string baseboard-version: "1.0" DMI string chassis-type: "Desktop" Found ITE Super I/O, ID 0x8718 on port 0x2e Found chipset "NVIDIA MCP73" with PCI ID 10de:07d7. Enabling flash write... This chipset is not really supported yet. Guesswork... ISA/LPC bridge reg 0x8a contents: 0x40, bit 6 is 1, bit 5 is 0 Flash bus type is SPI SPI on this chipset is WIP. Please report any success or failure by mailing us the verbose output to flashrom(a)flashrom.org, thanks! Found SMBus device 10de:07d8 at 00:03:1 MCP SPI BAR is at 0xfec80000 Mapping NVIDIA MCP6x SPI at 0xfec80000, unaligned size 0x544. SPI control is 0xc012, req=0, gnt=0 Please send the output of "flashrom -V" to flashrom(a)flashrom.org with your board name: flashrom -V as the subject to help us finish support for your chipset. Thanks. OK. No IT87* serial flash segment enabled. The following protocols are supported: SPI. Probing for AMIC A25L05PT, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L05PU, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L10PT, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L10PU, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L20PT, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L20PU, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L40PT, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L40PU, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L80P, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L16PT, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L16PU, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L512, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L010, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L020, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L040, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L080, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L016, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25L032, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for AMIC A25LQ032, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF021, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF041A, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF081, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF081A, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF161, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF321, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF321A, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DF641(A), 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25DQ161, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25F512B, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25FS010, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT25FS040, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT26DF041, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT26DF081A, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT26DF161, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT26DF161A, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT26F004, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45CS1282, 16896 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB011D, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB021D, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB041D, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB081D, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB161D, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB321C, 4224 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB321D, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel AT45DB642D, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for EMST F25L008A, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B05, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B05T, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B10, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B10T, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B20T, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B40T, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B80T, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B16T, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B32T, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25B64T, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F05, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F10, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25F32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q80(A), 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q32(A/B), 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25Q128, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25QH16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon EN25QH32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for GigaDevice GD25Q128, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L512, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L1005, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L2005, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L4005, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L8005, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L1605, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L1635D, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L1635E, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L3205, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L3235D, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L6405, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix MX25L12805, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx M25PE10, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx M25PE20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx M25PE40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx M25PE80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx M25PE16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Numonyx N25Q064, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV010, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV016B, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV020, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV040, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV080B, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC Pm25LV512, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Sanyo LF25FW203A, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Spansion S25FL004A, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Spansion S25FL008A, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Spansion S25FL016A, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Spansion S25FL032A, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Spansion S25FL064A, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST SST25LF040A, 512 kB: probe_spi_res2: id1 0x13, id2 0x13 Probing for SST SST25LF080A, 1024 kB: probe_spi_res2: id1 0x13, id2 0x13 Probing for SST SST25VF010, 128 kB: probe_spi_rems: id1 0xef, id2 0x13 Probing for SST SST25VF016B, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST SST25VF032B, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST SST25VF064C, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST SST25VF040, 512 kB: probe_spi_rems: id1 0xef, id2 0x13 Probing for SST SST25VF040B, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST SST25VF040B.REMS, 512 kB: probe_spi_rems: id1 0xef, id2 0x13 Probing for SST SST25VF080B, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P05-A, 64 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P05, 64 kB: Ignoring RES in favour of RDID. Probing for ST M25P10-A, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P10, 128 kB: Ignoring RES in favour of RDID. Probing for ST M25P20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P40-old, 512 kB: Ignoring RES in favour of RDID. Probing for ST M25P80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25P128, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25PX16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25PX32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST M25PX64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25Q80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25Q16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25Q32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25Q64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25Q128, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X10, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X40, 512 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X80, 1024 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Chip status register is 00 Found Winbond flash chip "W25X80" (1024 kB, SPI) at physical address 0xfff00000. Probing for Winbond W25X16, 2048 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X32, 4096 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Winbond W25X64, 8192 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Unknown SFDP-capable chip, 0 kB: No SFDP signature found. Probing for AMIC unknown AMIC SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Atmel unknown Atmel SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Eon unknown Eon SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Macronix unknown Macronix SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for PMC unknown PMC SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for SST unknown SST SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for ST unknown ST SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Sanyo unknown Sanyo SPI chip, 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Generic unknown SPI chip (RDID), 0 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3014 Probing for Generic unknown SPI chip (REMS), 0 kB: probe_spi_rems: id1 0xef, id2 0x13 Found Winbond flash chip "W25X80" (1024 kB, SPI). No operations were specified.

1 0

Re: [flashrom] GSoC conclusion
by Stefan Tauner 01 Sep '16

01 Sep '16

Hello Hatim, no worries! Life happens, mistakes were made and lessons learned on both sides. David and me where somewhat absent due to our workload, so we didn't check in with you as often as we should have. Ultimately the goal of GSoC is to help students such as yourself become members of the open source community. Your work in the first months and good standing with the community certainly helped making the decision easier for us, and we look forward to working with you in the flashrom community in the future. If it helps I can install znc (the IRC bouncer I am using myself) on a host and create an account for you but it's somewhat different from IRCCloud. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

1 0

Re: [flashrom] [PATCH 3/3] ENE Embedded Debug Interface (EDI) and ENE KB9012 EC internal flash support
by David Wren 01 Sep '16

01 Sep '16

https://reservice.pro/upload/Datasheets/kb9012qf.pdf Lenovo g505s full datasheet!

1 0

GSoC conclusion
by Hatim Kanchwala 01 Sep '16

01 Sep '16

Hello! The GSoC results are out and my mentors have let me pass. I sincerely thank my mentors, Stefan and David, for giving me the opportunity to work with flashrom and giving me the benefit of doubt in the final evaluation. In the final 2-3 weeks my communication towards my mentors had fallen. I had been suffering from Typhoid which adversely affected my work, but I had failed to communicate this to my mentor. I had decided then that I could manage to work without letting my illness affect me. In part it was over-estimation of my well being and in part it was the shame of not having worked sufficiently that prevented me from communicating. While I am thankfully fully recovered by now, I accept that it was a grave mistake on my part and I take responsibility for that. I hold immense respect for Stefan and David not only as my mentors but as very nice individuals, and having disappointed them is an utter failure for me. I have promised earlier, and I would like to re-iterate that I am committed to contributing to flashrom. I understand that no matter what I write or promise any further, I cannot regain that trust of my mentors, and of the community, unless I start delivering on those. On this I will finally say that flashrom is an endeavour I will continue to pursue, that I shall communicate better and that I shall regularly work on patches. David, I have received emails for your feedback on GitHub. Thanks for sending them in and I'll soon begin incorporating those as well. In the spirit of full disclosure, I will also add that since I was afflicted with the illness I have also missed several of my classes and labs in college. I have been trying to clear the backlog and midterm college exams are staring at me at a week's distance. I have allocated time for flashrom, but it may fluctuate. I shall be able to devote a bigger chunk of my time and be more consistent in a week or two. For the past few days I have been facing difficulty in connecting to IRC via IRCCloud, which offers persistent connections. So, if there were any messages directed to me, I apologize for having missed them. Once again I'd like to thank my mentors and the community. I have been able to flourish professionally and more importantly to me, I have built friendships (which I will work hard to renew and regain). It is difficult for me to express in words my gratitude and experience. Thanks for your time. Bye, Hatim

1 0

Re: [flashrom] W25Q64 write protect range cleared on reboot (Acer C720): Feature or bug?
by David Hendricks 31 Aug '16

31 Aug '16

Hi Brishchik, This is actually the management engine at play and is a known issue. You'll have to ask Intel about this logic to judge whether it's a feature or a bug... On Wed, Aug 31, 2016 at 7:49 AM, Brishchik Gupta <brishchik(a)mail.com> wrote: > Device: Acer C720-3605 Chromebook (Haswell) with Winbond W25Q64 8MB > firmware flash > > Description of issue --- The following behavior is observed: > > 1. If write protect is disabled (either in hardware i.e. screw removed, or > in software i.e. status.srp0 == 0 == status.srp1, or in both hardware and > software) AND there is a non-null write protect range (set by status > register bits BP0/BP1/BP2/TB/SEC), then upon power cycled reboot, the > status registers get completely cleared (to 0x0000). > > 2. If write protect is disabled in hardware but not in software and the > write protect range is null (so status registers == 0x0080), then a power > cycled reboot preserves the status registers (i.e. the value is still > 0x0080 after reboot). > > Is the above behavior a feature or a bug? > > I can post logs (e.g. outputs of "flashrom --wp-status") if necessary. > > Best regards, > > Brishchik Gupta > > > _______________________________________________ > flashrom mailing list > flashrom(a)flashrom.org > https://www.flashrom.org/mailman/listinfo/flashrom > -- David Hendricks (dhendrix) Systems Software Engineer, Google Inc.

1 0

W25Q64 write protect range cleared on reboot (Acer C720): Feature or bug?
by Brishchik Gupta 31 Aug '16

31 Aug '16

Device: Acer C720-3605 Chromebook (Haswell) with Winbond W25Q64 8MB firmware flash Description of issue --- The following behavior is observed: 1. If write protect is disabled (either in hardware i.e. screw removed, or in software i.e. status.srp0 == 0 == status.srp1, or in both hardware and software) AND there is a non-null write protect range (set by status register bits BP0/BP1/BP2/TB/SEC), then upon power cycled reboot, the status registers get completely cleared (to 0x0000). 2. If write protect is disabled in hardware but not in software and the write protect range is null (so status registers == 0x0080), then a power cycled reboot preserves the status registers (i.e. the value is still 0x0080 after reboot). Is the above behavior a feature or a bug? I can post logs (e.g. outputs of "flashrom --wp-status") if necessary. Best regards, Brishchik Gupta

1 0

W25Q64 write protect range cleared on reboot (Acer C720): Feature or bug?
by Brishchik Gupta 31 Aug '16

31 Aug '16

1 0

error flashrom output
by Wladimir Goruenow 29 Aug '16

29 Aug '16

flashrom v0.9.6.1-r1563 on Linux 3.19.0-32-generic (x86_64) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.1.9, GCC 4.7.1, little endian Command line (3 args): flashrom --programmer internal -V Calibrating delay loop... OS timer resolution is 1 usecs, 1273M loops per second, 10 myus = 10 us, 100 myus = 100 us, 1000 myus = 999 us, 10000 myus = 10003 us, 4 myus = 10 us, OK. Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "LENOVO" DMI string system-product-name: "80LK" DMI string system-version: "Lenovo B51-30" DMI string baseboard-manufacturer: "LENOVO" DMI string baseboard-product-name: "Lenovo B51-30" DMI string baseboard-version: "SDK0J40679 WIN" DMI string chassis-type: "Notebook" Laptop detected via DMI. W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect. Active config mode, unknown reg 0x20 ID: fc. Please send the output of "flashrom -V" to flashrom(a)flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks.

1 0

Impedance match of input wires: by resistors or capacitors
by Rudolf Dovičín 28 Aug '16

28 Aug '16

Hello. I try to reprogram BIOS of ThinkPad X200 notebook "in situ" by OrangePi PC (its SPI bus). I cannot read it consistently even if on low frequency 32 kHz. I use 100 mm short wires. On the help page: https://Flashrom.org/Common_problems there is recommendation about matching the impedance of inputs & wires: "The impedances of the wires/traces do not match the impedances of the input pins (of either the circuit/chip on the mainboard or the external programmer). Try using shorter wires, adding small (<100 Ohm) series resistors or parallel capacitors (<20pF) as near as possible to the input pins (this includes also the MISO line which ends near the programmer) and/or ask someone who has experience with high frequency electronics." I know basic of electrical engineering & a bit about electronic, but I am very very far from expert. I try to search this mailing list archives for words "capacitor" or "capacitors", but with no demanded answer. I try google it, e. g. : (ROM|PROM|EPROM|EEPROM)(flashing|program|rewrite)("ISP"|"in situ"|"in system")(capacitor|impedance)"input" -crystal -oscillator but it found me only articles about https://en.Wikipedia.org/wiki/Decoupling_capacitor which I think that I quite understand, yet or documentation from Actel, Advanced Micro Devices, Altera, Atmel, CheckSum, CML Microcircuits, Cypress Semiconductor, Elnec, LAPIS Semiconductor, Lattice Semiconductor, Microchip Technology, Microsemi, Numonyx, Silicon Labs, STMicroelectronics, Texas Instruments, Xilinx etc. sometimes about In-System Programming, but never about these capacitors. What is better, resistor or capacitor (or combination)? How to connect them? (Resistor is clear - in series with the wire. But what about capacitor? Parallel with which?) P.S. On page (bottom "Notes about stability") there is recommendation about foiled twisted pair with link to image http://i.Imgur.com/qHGxKpj.jpg - should not be second wire of the pair respectively foil connected to the ground? -- Rudolf Dovičín Partizánska 1506/92-34 957 01 Bánovce nad Bebravou 1 SLOVENSKO mailto:Rudolf.Dovicin@Gmail.com xmpp:ruwolf@jabbim.sk (cellular: +421 940 872 846, short messages only)

1 0

25F16 and 25f80
by Hr Vr 27 Aug '16

27 Aug '16

Hi, I have little problem And I would like to ask for help if is possible. I need flash 2 types of eeprom, and I bought cheap Ch341A programmer as I see that he "supports" EON 25F16 and EON 25F80 but I have Issue I try with windows and with flashrom but I canno't get detection of ic's. I check Connection of every pin between eeprom flash and ch341A and it is GOOD. in windows I use software that I get with it but only that I get working is detection of ch341a nothing more. Always i get eepron not found or manufactures id FF or memory id FF hope you get point. So I read in datasheet that eon ic's have protection blocks for write read like 512 bit sometnig. Is it there any way to shoot that command for enabling write read or is it programmer(CH341A) Fault . Thanks, H

1 0

Re: [flashrom] [RFC] [PATCH] Add ability to lock bootblock on Winbond Flash ROMs
by Hatim Kanchwala 26 Aug '16

26 Aug '16

Hello Timothy and David, I have attached a patch that adds support for W25Q128BV and W25Q128FV chips (I noticed Timothy needed these chips;) so I added only these for now). This patch should be applied on top of all my most recent patches. Instead of downloading and locally applying all those patches and then applying the attached one, I recommend you clone my fork of flashrom (dev branch) from GitHub (https://github.com/hatimak/flashrom/tree/dev). I have already pushed the attached patch there ;) Now, on how to use it. Once you compile and install it, have a look at the man page and the --help output. If you run --wp-list, you can see the access protection table. For you particular case you will need --wp-set-range start=0xfff000,len=4. This will lock the top 4kB of either or W25Q128BV or W25Q128FV. The man page will explain how you can set status register write protection if you need that. If it happens that you need OTP support for these chips, that is available as well :) The CLI is arguably not the best, but this is a more general solution than what you sent. I hope this is sufficient and helps you out. Feel free to reach out for any comments/feedback/help over mail or IRC (hatim on #flashrom). Thanks, Hatim On Wednesday 24 August 2016 05:42 AM, David Hendricks wrote: > Hi Timothy, > Check out Hatim's GSOC work for manipulating status register and write protect bits: > https://patchwork.coreboot.org/patch/4471/ > https://patchwork.coreboot.org/patch/4472/ > https://patchwork.coreboot.org/patch/4469/ > https://patchwork.coreboot.org/patch/4467/ > https://patchwork.coreboot.org/patch/4468/ > https://patchwork.coreboot.org/patch/4470/ > > There's also similar work done in Chromium.org fork of flashrom which might do what you need (--wp-enable command): https://chromium.googlesource.com/chromiumos/third_party/flashrom/ > Thanks David for your reply :) Seeing my work being used and recommended feels extraordinarily happy ;) > > On Tue, Aug 23, 2016 at 2:32 PM, Timothy Pearson <tpearson(a)raptorengineering.com <mailto:tpearson@raptorengineering.com>> wrote: > > RFC PATCH > > TPM-enabled systems require an immutable (or at least very difficult to modify) CRTM, which can be provided via a locked bootblock sector. > > Add initial support for locking the upper 4K sector on Winbond Flash ROMs. Unlocking the sector after it has been locked requires hardware access to the write protect pin, satisfying the above requirements for many use cases. > > To use, pass the --lock flag to Flashrom. This flag can be used in isolation, or as part of a normal read / write / verify cycle. > Timothy, thanks for your patch :) Hope what I explained above is helpful to you. And I would gently point out that you forgot the "Signed-off-by" tag in your patch :) > Index: spi25_statusreg.c > =================================================================== > --- spi25_statusreg.c (revision 1955) > +++ spi25_statusreg.c (working copy) > @@ -123,6 +123,78 @@ > return readarr[0]; > } > > +static uint8_t spi_read_status_register_2(struct flashctx *flash) > +{ > + static const unsigned char cmd[JEDEC_RDSR_OUTSIZE] = { JEDEC_RDSR2 }; > + /* FIXME: No workarounds for driver/hardware bugs in generic code. */ > + unsigned char readarr[2]; /* JEDEC_RDSR2_INSIZE=1 but wbsio needs 2 */ > + int ret; > + > + /* Read Status Register */ > + ret = spi_send_command(flash, sizeof(cmd), sizeof(readarr), cmd, readarr); > + if (ret) > + msg_cerr("RDSR2 failed!\n"); > + > + return readarr[0]; > +} > + > +/* Winbond sector protection enable that tries to set the status register bits given. */ > +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const uint8_t status_flags) > +{ > + uint8_t status, status2; > + int result; > + uint8_t lock_mask = 0x80; > + uint8_t lock2_mask = 0x1; > + > + status = spi_read_status_register(flash); > + status2 = spi_read_status_register_2(flash); > + if ((status & lock_mask) != 0) { > + msg_cdbg("\n\tNeed to disable the register lock first... "); > + if ((status2 & lock2_mask) != 0) { > + msg_cerr("Hardware protection is active, enabling write protection is impossible.\n"); > + return 1; > + } > + /* All bits except the register lock bit (often called SPRL, SRWD, WPEN) are readonly. */ > + result = spi_write_status_register(flash, status & ~lock_mask); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & lock_mask) != 0) { > + msg_cerr("Unsetting lock bit(s) failed.\n"); > + return 1; > + } > + msg_cdbg("done.\n"); > + } > + > + /* Set requested protect bits */ > + result = spi_write_status_register(flash, status | (status_flags << 2) ); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & (status_flags << 2)) != (status_flags << 2)) { > + msg_cerr("Setting lock bit(s) failed.\n"); > + return 1; > + } > + > + /* Set lock bit */ > + result = spi_write_status_register(flash, status | lock_mask); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & lock_mask) == 0) { > + msg_cerr("Setting lock bit(s) failed.\n"); > + return 1; > + } > + > + return 0; > +} > + > /* A generic block protection disable. > * Tests if a protection is enabled with the block protection mask (bp_mask) and returns success otherwise. > * Tests if the register bits are locked with the lock_mask (lock_mask). > Index: flashrom.c > =================================================================== > --- flashrom.c (revision 1955) > +++ flashrom.c (working copy) > @@ -1977,7 +1977,7 @@ > * Besides that, the function itself is a textbook example of abysmal code flow. > */ > int doit(struct flashctx *flash, int force, const char *filename, int read_it, > - int write_it, int erase_it, int verify_it) > + int write_it, int erase_it, int verify_it, int lock_it) > { > uint8_t *oldcontents; > uint8_t *newcontents; > @@ -2129,6 +2129,13 @@ > msg_cinfo("VERIFIED.\n"); > } > > + if (lock_it && flash->chip->lock) { > + msg_cinfo("Locking upper 4K (bootblock)... "); > + ret = flash->chip->lock(flash, 0x11); > + if (!ret) > + msg_cinfo("LOCKED.\n"); > + } > + > out: > free(oldcontents); > free(newcontents); > Index: cli_classic.c > =================================================================== > --- cli_classic.c (revision 1955) > +++ cli_classic.c (working copy) > @@ -49,6 +49,7 @@ > " -r | --read <file> read flash and save to <file>\n" > " -w | --write <file> write <file> to flash\n" > " -v | --verify <file> verify flash against <file>\n" > + " -u | --lock lock upper Flash region (typically the 4K bootblock)\n" > " -E | --erase erase flash memory\n" > " -V | --verbose more verbose output\n" > " -c | --chip <chipname> probe only for specified flash chip\n" > @@ -101,18 +102,19 @@ > #if CONFIG_PRINT_WIKI == 1 > int list_supported_wiki = 0; > #endif > - int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0; > + int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0, lock_it = 0; > int dont_verify_it = 0, list_supported = 0, operation_specified = 0; > enum programmer prog = PROGRAMMER_INVALID; > int ret = 0; > > - static const char optstring[] = "r:Rw:v:nVEfc:l:i:p:Lzho:"; > + static const char optstring[] = "r:Rw:v:nuVEfc:l:i:p:Lzho:"; > static const struct option long_options[] = { > {"read", 1, NULL, 'r'}, > {"write", 1, NULL, 'w'}, > {"erase", 0, NULL, 'E'}, > {"verify", 1, NULL, 'v'}, > {"noverify", 0, NULL, 'n'}, > + {"lock", 0, NULL, 'u'}, > {"chip", 1, NULL, 'c'}, > {"verbose", 0, NULL, 'V'}, > {"force", 0, NULL, 'f'}, > @@ -187,6 +189,9 @@ > } > dont_verify_it = 1; > break; > + case 'u': > + lock_it = 1; > + break; > case 'c': > chip_to_probe = strdup(optarg); > break; > @@ -522,7 +527,7 @@ > goto out_shutdown; > } > > - if (!(read_it | write_it | verify_it | erase_it)) { > + if (!(read_it | write_it | verify_it | erase_it | lock_it)) { > msg_ginfo("No operations were specified.\n"); > goto out_shutdown; > } > @@ -542,7 +547,7 @@ > * Give the chip time to settle. > */ > programmer_delay(100000); > - ret |= doit(fill_flash, force, filename, read_it, write_it, erase_it, verify_it); > + ret |= doit(fill_flash, force, filename, read_it, write_it, erase_it, verify_it, lock_it); > > unmap_flash(fill_flash); > out_shutdown: > Index: flashchips.c > =================================================================== > --- flashchips.c (revision 1955) > +++ flashchips.c (working copy) > @@ -14581,6 +14581,7 @@ > }, > .printlock = spi_prettyprint_status_register_plain, /* TODO: improve */ > .unlock = spi_disable_blockprotect, > + .lock = spi_enable_sectorprotect_winbond, > .write = spi_chip_write_256, > .read = spi_chip_read, > .voltage = {2700, 3600}, > Index: chipdrivers.h > =================================================================== > --- chipdrivers.h (revision 1955) > +++ chipdrivers.h (working copy) > @@ -73,6 +73,7 @@ > int spi_prettyprint_status_register_bp4_srwd(struct flashctx *flash); > int spi_prettyprint_status_register_bp2_bpl(struct flashctx *flash); > int spi_prettyprint_status_register_bp2_tb_bpl(struct flashctx *flash); > +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const uint8_t status_flags); > int spi_disable_blockprotect(struct flashctx *flash); > int spi_disable_blockprotect_bp1_srwd(struct flashctx *flash); > int spi_disable_blockprotect_bp2_srwd(struct flashctx *flash); > Index: flash.h > =================================================================== > --- flash.h (revision 1955) > +++ flash.h (working copy) > @@ -200,6 +200,7 @@ > } block_erasers[NUM_ERASEFUNCTIONS]; > > int (*printlock) (struct flashctx *flash); > + int (*lock) (struct flashctx *flash, const uint8_t status_flags); > int (*unlock) (struct flashctx *flash); > int (*write) (struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len); > int (*read) (struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len); > @@ -281,7 +282,7 @@ > void print_banner(void); > void list_programmers_linebreak(int startcol, int cols, int paren); > int selfcheck(void); > -int doit(struct flashctx *flash, int force, const char *filename, int read_it, int write_it, int erase_it, int verify_it); > +int doit(struct flashctx *flash, int force, const char *filename, int read_it, int write_it, int erase_it, int verify_it, int lock_it); > int read_buf_from_file(unsigned char *buf, unsigned long size, const char *filename); > int write_buf_to_file(const unsigned char *buf, unsigned long size, const char *filename); > > Index: spi.h > =================================================================== > --- spi.h (revision 1955) > +++ spi.h (working copy) > @@ -121,6 +121,11 @@ > #define JEDEC_RDSR_OUTSIZE 0x01 > #define JEDEC_RDSR_INSIZE 0x01 > > +/* Read Status Register 2 */ > +#define JEDEC_RDSR2 0x35 > +#define JEDEC_RDSR2_OUTSIZE 0x01 > +#define JEDEC_RDSR2_INSIZE 0x01 > + > /* Status Register Bits */ > #define SPI_SR_WIP (0x01 << 0) > #define SPI_SR_WEL (0x01 << 1) > > _______________________________________________ > flashrom mailing list > flashrom(a)flashrom.org <mailto:flashrom@flashrom.org> > https://www.flashrom.org/mailman/listinfo/flashrom <https://www.flashrom.org/mailman/listinfo/flashrom> > > > > > -- > David Hendricks (dhendrix) > Systems Software Engineer, Google Inc.

1 0

Re: [flashrom] Multiple vs. No flash chip; depends on -c parameter
by Stefan Tauner 25 Aug '16

25 Aug '16

On Thu, 25 Aug 2016 19:41:33 +0200 Rudolf Dovičín <rudolf.dovicin(a)gmail.com> wrote: > Hello flashers. :-) > > I try rewrite BIOS on ThinkPad X200 by instructions on: > https://Libreboot.org/docs/install/x200_external.html > > I use OrangePi PC instead of BeagleBone Black. > > When I try to read from chip with command: > flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r factory_1.rom > I get reply with "Multiple flash chip definitions match the detected chip...". > > When I try to add any of detected chips to command line parameter, e. g. > flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r factory_1.rom > -c "MX25L6405" > I get error "No EEPROM/flash device found." > > Please, where can be the problem? Hi Rudolf, what you are seeing is just an artifact of the bad connection between the programmer and the chip/board. If you look at the verbose log output you will see that the RDID replies will vary (although they should always be the same). Flashing the X200 is annoying. With some hacks you might improve the result though. One example for another programmer can be found here: https://patchwork.coreboot.org/patch/4322/ -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

1 0

Multiple vs. No flash chip; depends on -c parameter
by Rudolf Dovičín 25 Aug '16

25 Aug '16

Hello flashers. :-) I try rewrite BIOS on ThinkPad X200 by instructions on: https://Libreboot.org/docs/install/x200_external.html I use OrangePi PC instead of BeagleBone Black. When I try to read from chip with command: flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r factory_1.rom I get reply with "Multiple flash chip definitions match the detected chip...". When I try to add any of detected chips to command line parameter, e. g. flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r factory_1.rom -c "MX25L6405" I get error "No EEPROM/flash device found." Please, where can be the problem? -- Rudolf Dovičín Partizánska 1506/92-34 957 01 Bánovce nad Bebravou 1 SLOVENSKO mailto:Rudolf.Dovicin@Gmail.com xmpp:ruwolf@jabbim.sk (cellular: +421 940 872 846, short messages only)

1 0

Re: [flashrom] [RFC] [PATCH] Add ability to lock bootblock on Winbond Flash ROMs
by David Hendricks 24 Aug '16

24 Aug '16

Hi Timothy, Check out Hatim's GSOC work for manipulating status register and write protect bits: https://patchwork.coreboot.org/patch/4471/ https://patchwork.coreboot.org/patch/4472/ https://patchwork.coreboot.org/patch/4469/ https://patchwork.coreboot.org/patch/4467/ https://patchwork.coreboot.org/patch/4468/ https://patchwork.coreboot.org/patch/4470/ There's also similar work done in Chromium.org fork of flashrom which might do what you need (--wp-enable command): https://chromium.googlesource.com/chromiumos/third_party/flashrom/ On Tue, Aug 23, 2016 at 2:32 PM, Timothy Pearson < tpearson(a)raptorengineering.com> wrote: > RFC PATCH > > TPM-enabled systems require an immutable (or at least very difficult to > modify) CRTM, which can be provided via a locked bootblock sector. > > Add initial support for locking the upper 4K sector on Winbond Flash > ROMs. Unlocking the sector after it has been locked requires hardware > access to the write protect pin, satisfying the above requirements for many > use cases. > > To use, pass the --lock flag to Flashrom. This flag can be used in > isolation, or as part of a normal read / write / verify cycle. > > Index: spi25_statusreg.c > =================================================================== > --- spi25_statusreg.c (revision 1955) > +++ spi25_statusreg.c (working copy) > @@ -123,6 +123,78 @@ > return readarr[0]; > } > > +static uint8_t spi_read_status_register_2(struct flashctx *flash) > +{ > + static const unsigned char cmd[JEDEC_RDSR_OUTSIZE] = { JEDEC_RDSR2 > }; > + /* FIXME: No workarounds for driver/hardware bugs in generic code. > */ > + unsigned char readarr[2]; /* JEDEC_RDSR2_INSIZE=1 but wbsio needs > 2 */ > + int ret; > + > + /* Read Status Register */ > + ret = spi_send_command(flash, sizeof(cmd), sizeof(readarr), cmd, > readarr); > + if (ret) > + msg_cerr("RDSR2 failed!\n"); > + > + return readarr[0]; > +} > + > +/* Winbond sector protection enable that tries to set the status register > bits given. */ > +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const > uint8_t status_flags) > +{ > + uint8_t status, status2; > + int result; > + uint8_t lock_mask = 0x80; > + uint8_t lock2_mask = 0x1; > + > + status = spi_read_status_register(flash); > + status2 = spi_read_status_register_2(flash); > + if ((status & lock_mask) != 0) { > + msg_cdbg("\n\tNeed to disable the register lock first... > "); > + if ((status2 & lock2_mask) != 0) { > + msg_cerr("Hardware protection is active, enabling > write protection is impossible.\n"); > + return 1; > + } > + /* All bits except the register lock bit (often called > SPRL, SRWD, WPEN) are readonly. */ > + result = spi_write_status_register(flash, status & > ~lock_mask); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & lock_mask) != 0) { > + msg_cerr("Unsetting lock bit(s) failed.\n"); > + return 1; > + } > + msg_cdbg("done.\n"); > + } > + > + /* Set requested protect bits */ > + result = spi_write_status_register(flash, status | (status_flags > << 2) ); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & (status_flags << 2)) != (status_flags << 2)) { > + msg_cerr("Setting lock bit(s) failed.\n"); > + return 1; > + } > + > + /* Set lock bit */ > + result = spi_write_status_register(flash, status | lock_mask); > + if (result) { > + msg_cerr("spi_write_status_register failed.\n"); > + return result; > + } > + status = spi_read_status_register(flash); > + if ((status & lock_mask) == 0) { > + msg_cerr("Setting lock bit(s) failed.\n"); > + return 1; > + } > + > + return 0; > +} > + > /* A generic block protection disable. > * Tests if a protection is enabled with the block protection mask > (bp_mask) and returns success otherwise. > * Tests if the register bits are locked with the lock_mask (lock_mask). > Index: flashrom.c > =================================================================== > --- flashrom.c (revision 1955) > +++ flashrom.c (working copy) > @@ -1977,7 +1977,7 @@ > * Besides that, the function itself is a textbook example of abysmal > code flow. > */ > int doit(struct flashctx *flash, int force, const char *filename, int > read_it, > - int write_it, int erase_it, int verify_it) > + int write_it, int erase_it, int verify_it, int lock_it) > { > uint8_t *oldcontents; > uint8_t *newcontents; > @@ -2129,6 +2129,13 @@ > msg_cinfo("VERIFIED.\n"); > } > > + if (lock_it && flash->chip->lock) { > + msg_cinfo("Locking upper 4K (bootblock)... "); > + ret = flash->chip->lock(flash, 0x11); > + if (!ret) > + msg_cinfo("LOCKED.\n"); > + } > + > out: > free(oldcontents); > free(newcontents); > Index: cli_classic.c > =================================================================== > --- cli_classic.c (revision 1955) > +++ cli_classic.c (working copy) > @@ -49,6 +49,7 @@ > " -r | --read <file> read flash and save to > <file>\n" > " -w | --write <file> write <file> to > flash\n" > " -v | --verify <file> verify flash against > <file>\n" > + " -u | --lock lock upper Flash > region (typically the 4K bootblock)\n" > " -E | --erase erase flash memory\n" > " -V | --verbose more verbose output\n" > " -c | --chip <chipname> probe only for > specified flash chip\n" > @@ -101,18 +102,19 @@ > #if CONFIG_PRINT_WIKI == 1 > int list_supported_wiki = 0; > #endif > - int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0; > + int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0, > lock_it = 0; > int dont_verify_it = 0, list_supported = 0, operation_specified = > 0; > enum programmer prog = PROGRAMMER_INVALID; > int ret = 0; > > - static const char optstring[] = "r:Rw:v:nVEfc:l:i:p:Lzho:"; > + static const char optstring[] = "r:Rw:v:nuVEfc:l:i:p:Lzho:"; > static const struct option long_options[] = { > {"read", 1, NULL, 'r'}, > {"write", 1, NULL, 'w'}, > {"erase", 0, NULL, 'E'}, > {"verify", 1, NULL, 'v'}, > {"noverify", 0, NULL, 'n'}, > + {"lock", 0, NULL, 'u'}, > {"chip", 1, NULL, 'c'}, > {"verbose", 0, NULL, 'V'}, > {"force", 0, NULL, 'f'}, > @@ -187,6 +189,9 @@ > } > dont_verify_it = 1; > break; > + case 'u': > + lock_it = 1; > + break; > case 'c': > chip_to_probe = strdup(optarg); > break; > @@ -522,7 +527,7 @@ > goto out_shutdown; > } > > - if (!(read_it | write_it | verify_it | erase_it)) { > + if (!(read_it | write_it | verify_it | erase_it | lock_it)) { > msg_ginfo("No operations were specified.\n"); > goto out_shutdown; > } > @@ -542,7 +547,7 @@ > * Give the chip time to settle. > */ > programmer_delay(100000); > - ret |= doit(fill_flash, force, filename, read_it, write_it, > erase_it, verify_it); > + ret |= doit(fill_flash, force, filename, read_it, write_it, > erase_it, verify_it, lock_it); > > unmap_flash(fill_flash); > out_shutdown: > Index: flashchips.c > =================================================================== > --- flashchips.c (revision 1955) > +++ flashchips.c (working copy) > @@ -14581,6 +14581,7 @@ > }, > .printlock = spi_prettyprint_status_register_plain, > /* TODO: improve */ > .unlock = spi_disable_blockprotect, > + .lock = spi_enable_sectorprotect_winbond, > .write = spi_chip_write_256, > .read = spi_chip_read, > .voltage = {2700, 3600}, > Index: chipdrivers.h > =================================================================== > --- chipdrivers.h (revision 1955) > +++ chipdrivers.h (working copy) > @@ -73,6 +73,7 @@ > int spi_prettyprint_status_register_bp4_srwd(struct flashctx *flash); > int spi_prettyprint_status_register_bp2_bpl(struct flashctx *flash); > int spi_prettyprint_status_register_bp2_tb_bpl(struct flashctx *flash); > +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const > uint8_t status_flags); > int spi_disable_blockprotect(struct flashctx *flash); > int spi_disable_blockprotect_bp1_srwd(struct flashctx *flash); > int spi_disable_blockprotect_bp2_srwd(struct flashctx *flash); > Index: flash.h > =================================================================== > --- flash.h (revision 1955) > +++ flash.h (working copy) > @@ -200,6 +200,7 @@ > } block_erasers[NUM_ERASEFUNCTIONS]; > > int (*printlock) (struct flashctx *flash); > + int (*lock) (struct flashctx *flash, const uint8_t status_flags); > int (*unlock) (struct flashctx *flash); > int (*write) (struct flashctx *flash, const uint8_t *buf, unsigned > int start, unsigned int len); > int (*read) (struct flashctx *flash, uint8_t *buf, unsigned int > start, unsigned int len); > @@ -281,7 +282,7 @@ > void print_banner(void); > void list_programmers_linebreak(int startcol, int cols, int paren); > int selfcheck(void); > -int doit(struct flashctx *flash, int force, const char *filename, int > read_it, int write_it, int erase_it, int verify_it); > +int doit(struct flashctx *flash, int force, const char *filename, int > read_it, int write_it, int erase_it, int verify_it, int lock_it); > int read_buf_from_file(unsigned char *buf, unsigned long size, const char > *filename); > int write_buf_to_file(const unsigned char *buf, unsigned long size, const > char *filename); > > Index: spi.h > =================================================================== > --- spi.h (revision 1955) > +++ spi.h (working copy) > @@ -121,6 +121,11 @@ > #define JEDEC_RDSR_OUTSIZE 0x01 > #define JEDEC_RDSR_INSIZE 0x01 > > +/* Read Status Register 2 */ > +#define JEDEC_RDSR2 0x35 > +#define JEDEC_RDSR2_OUTSIZE 0x01 > +#define JEDEC_RDSR2_INSIZE 0x01 > + > /* Status Register Bits */ > #define SPI_SR_WIP (0x01 << 0) > #define SPI_SR_WEL (0x01 << 1) > > _______________________________________________ > flashrom mailing list > flashrom(a)flashrom.org > https://www.flashrom.org/mailman/listinfo/flashrom > -- David Hendricks (dhendrix) Systems Software Engineer, Google Inc.

1 0

[RFC] [PATCH] Add ability to lock bootblock on Winbond Flash ROMs
by Timothy Pearson 23 Aug '16

23 Aug '16

RFC PATCH TPM-enabled systems require an immutable (or at least very difficult to modify) CRTM, which can be provided via a locked bootblock sector. Add initial support for locking the upper 4K sector on Winbond Flash ROMs. Unlocking the sector after it has been locked requires hardware access to the write protect pin, satisfying the above requirements for many use cases. To use, pass the --lock flag to Flashrom. This flag can be used in isolation, or as part of a normal read / write / verify cycle. Index: spi25_statusreg.c =================================================================== --- spi25_statusreg.c (revision 1955) +++ spi25_statusreg.c (working copy) @@ -123,6 +123,78 @@ return readarr[0]; } +static uint8_t spi_read_status_register_2(struct flashctx *flash) +{ + static const unsigned char cmd[JEDEC_RDSR_OUTSIZE] = { JEDEC_RDSR2 }; + /* FIXME: No workarounds for driver/hardware bugs in generic code. */ + unsigned char readarr[2]; /* JEDEC_RDSR2_INSIZE=1 but wbsio needs 2 */ + int ret; + + /* Read Status Register */ + ret = spi_send_command(flash, sizeof(cmd), sizeof(readarr), cmd, readarr); + if (ret) + msg_cerr("RDSR2 failed!\n"); + + return readarr[0]; +} + +/* Winbond sector protection enable that tries to set the status register bits given. */ +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const uint8_t status_flags) +{ + uint8_t status, status2; + int result; + uint8_t lock_mask = 0x80; + uint8_t lock2_mask = 0x1; + + status = spi_read_status_register(flash); + status2 = spi_read_status_register_2(flash); + if ((status & lock_mask) != 0) { + msg_cdbg("\n\tNeed to disable the register lock first... "); + if ((status2 & lock2_mask) != 0) { + msg_cerr("Hardware protection is active, enabling write protection is impossible.\n"); + return 1; + } + /* All bits except the register lock bit (often called SPRL, SRWD, WPEN) are readonly. */ + result = spi_write_status_register(flash, status & ~lock_mask); + if (result) { + msg_cerr("spi_write_status_register failed.\n"); + return result; + } + status = spi_read_status_register(flash); + if ((status & lock_mask) != 0) { + msg_cerr("Unsetting lock bit(s) failed.\n"); + return 1; + } + msg_cdbg("done.\n"); + } + + /* Set requested protect bits */ + result = spi_write_status_register(flash, status | (status_flags << 2) ); + if (result) { + msg_cerr("spi_write_status_register failed.\n"); + return result; + } + status = spi_read_status_register(flash); + if ((status & (status_flags << 2)) != (status_flags << 2)) { + msg_cerr("Setting lock bit(s) failed.\n"); + return 1; + } + + /* Set lock bit */ + result = spi_write_status_register(flash, status | lock_mask); + if (result) { + msg_cerr("spi_write_status_register failed.\n"); + return result; + } + status = spi_read_status_register(flash); + if ((status & lock_mask) == 0) { + msg_cerr("Setting lock bit(s) failed.\n"); + return 1; + } + + return 0; +} + /* A generic block protection disable. * Tests if a protection is enabled with the block protection mask (bp_mask) and returns success otherwise. * Tests if the register bits are locked with the lock_mask (lock_mask). Index: flashrom.c =================================================================== --- flashrom.c (revision 1955) +++ flashrom.c (working copy) @@ -1977,7 +1977,7 @@ * Besides that, the function itself is a textbook example of abysmal code flow. */ int doit(struct flashctx *flash, int force, const char *filename, int read_it, - int write_it, int erase_it, int verify_it) + int write_it, int erase_it, int verify_it, int lock_it) { uint8_t *oldcontents; uint8_t *newcontents; @@ -2129,6 +2129,13 @@ msg_cinfo("VERIFIED.\n"); } + if (lock_it && flash->chip->lock) { + msg_cinfo("Locking upper 4K (bootblock)... "); + ret = flash->chip->lock(flash, 0x11); + if (!ret) + msg_cinfo("LOCKED.\n"); + } + out: free(oldcontents); free(newcontents); Index: cli_classic.c =================================================================== --- cli_classic.c (revision 1955) +++ cli_classic.c (working copy) @@ -49,6 +49,7 @@ " -r | --read <file> read flash and save to <file>\n" " -w | --write <file> write <file> to flash\n" " -v | --verify <file> verify flash against <file>\n" + " -u | --lock lock upper Flash region (typically the 4K bootblock)\n" " -E | --erase erase flash memory\n" " -V | --verbose more verbose output\n" " -c | --chip <chipname> probe only for specified flash chip\n" @@ -101,18 +102,19 @@ #if CONFIG_PRINT_WIKI == 1 int list_supported_wiki = 0; #endif - int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0; + int read_it = 0, write_it = 0, erase_it = 0, verify_it = 0, lock_it = 0; int dont_verify_it = 0, list_supported = 0, operation_specified = 0; enum programmer prog = PROGRAMMER_INVALID; int ret = 0; - static const char optstring[] = "r:Rw:v:nVEfc:l:i:p:Lzho:"; + static const char optstring[] = "r:Rw:v:nuVEfc:l:i:p:Lzho:"; static const struct option long_options[] = { {"read", 1, NULL, 'r'}, {"write", 1, NULL, 'w'}, {"erase", 0, NULL, 'E'}, {"verify", 1, NULL, 'v'}, {"noverify", 0, NULL, 'n'}, + {"lock", 0, NULL, 'u'}, {"chip", 1, NULL, 'c'}, {"verbose", 0, NULL, 'V'}, {"force", 0, NULL, 'f'}, @@ -187,6 +189,9 @@ } dont_verify_it = 1; break; + case 'u': + lock_it = 1; + break; case 'c': chip_to_probe = strdup(optarg); break; @@ -522,7 +527,7 @@ goto out_shutdown; } - if (!(read_it | write_it | verify_it | erase_it)) { + if (!(read_it | write_it | verify_it | erase_it | lock_it)) { msg_ginfo("No operations were specified.\n"); goto out_shutdown; } @@ -542,7 +547,7 @@ * Give the chip time to settle. */ programmer_delay(100000); - ret |= doit(fill_flash, force, filename, read_it, write_it, erase_it, verify_it); + ret |= doit(fill_flash, force, filename, read_it, write_it, erase_it, verify_it, lock_it); unmap_flash(fill_flash); out_shutdown: Index: flashchips.c =================================================================== --- flashchips.c (revision 1955) +++ flashchips.c (working copy) @@ -14581,6 +14581,7 @@ }, .printlock = spi_prettyprint_status_register_plain, /* TODO: improve */ .unlock = spi_disable_blockprotect, + .lock = spi_enable_sectorprotect_winbond, .write = spi_chip_write_256, .read = spi_chip_read, .voltage = {2700, 3600}, Index: chipdrivers.h =================================================================== --- chipdrivers.h (revision 1955) +++ chipdrivers.h (working copy) @@ -73,6 +73,7 @@ int spi_prettyprint_status_register_bp4_srwd(struct flashctx *flash); int spi_prettyprint_status_register_bp2_bpl(struct flashctx *flash); int spi_prettyprint_status_register_bp2_tb_bpl(struct flashctx *flash); +int spi_enable_sectorprotect_winbond(struct flashctx *flash, const uint8_t status_flags); int spi_disable_blockprotect(struct flashctx *flash); int spi_disable_blockprotect_bp1_srwd(struct flashctx *flash); int spi_disable_blockprotect_bp2_srwd(struct flashctx *flash); Index: flash.h =================================================================== --- flash.h (revision 1955) +++ flash.h (working copy) @@ -200,6 +200,7 @@ } block_erasers[NUM_ERASEFUNCTIONS]; int (*printlock) (struct flashctx *flash); + int (*lock) (struct flashctx *flash, const uint8_t status_flags); int (*unlock) (struct flashctx *flash); int (*write) (struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len); int (*read) (struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len); @@ -281,7 +282,7 @@ void print_banner(void); void list_programmers_linebreak(int startcol, int cols, int paren); int selfcheck(void); -int doit(struct flashctx *flash, int force, const char *filename, int read_it, int write_it, int erase_it, int verify_it); +int doit(struct flashctx *flash, int force, const char *filename, int read_it, int write_it, int erase_it, int verify_it, int lock_it); int read_buf_from_file(unsigned char *buf, unsigned long size, const char *filename); int write_buf_to_file(const unsigned char *buf, unsigned long size, const char *filename); Index: spi.h =================================================================== --- spi.h (revision 1955) +++ spi.h (working copy) @@ -121,6 +121,11 @@ #define JEDEC_RDSR_OUTSIZE 0x01 #define JEDEC_RDSR_INSIZE 0x01 +/* Read Status Register 2 */ +#define JEDEC_RDSR2 0x35 +#define JEDEC_RDSR2_OUTSIZE 0x01 +#define JEDEC_RDSR2_INSIZE 0x01 + /* Status Register Bits */ #define SPI_SR_WIP (0x01 << 0) #define SPI_SR_WEL (0x01 << 1)

1 0

W836xx: 0C522T: flashrom -V
by upen 23 Aug '16

23 Aug '16

flashrom v0.9.8-r1888 on Linux 4.4.6-gentoo (x86_64) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.4.1, GCC 4.9.3, little endian Command line (3 args): flashrom -V -p internal Calibrating delay loop... OS timer resolution is 1 usecs, 1715M loops per second, 10 myus = 10 us, 100 myus = 111 us, 1000 myus = 1016 us, 10000 myus = 9999 us, 4 myus = 4 us, OK. Initializing internal programmer No coreboot table found. Using Internal DMI decoder. DMI chassis-type is not specific enough. DMI string system-manufacturer: "Dell Inc." DMI string system-product-name: "OptiPlex 980 " DMI string system-version: "Not Specified" DMI string baseboard-manufacturer: "Dell Inc." DMI string baseboard-product-name: "0C522T" DMI string baseboard-version: "A00" ======================================================================== WARNING! You may be running flashrom on an unsupported laptop. We could not detect this for sure because your vendor has not setup the SMBIOS tables correctly. You can enforce execution by adding '-p internal:laptop=this_is_not_a_laptop' to the command line, but please read the following warning if you are not sure. Laptops, notebooks and netbooks are difficult to support and we recommend to use the vendor flashing utility. The embedded controller (EC) in these machines often interacts badly with flashing. See the manpage and http://www.flashrom.org/Laptops for details. If flash is shared with the EC, erase is guaranteed to brick your laptop and write may brick your laptop. Read and probe may irritate your EC and cause fan failure, backlight failure and sudden poweroff. You have been warned. ======================================================================== Aborting. Error: Programmer initialization failed. -- upen, emerge -uD life (Upgrade Life with dependencies)

1 0

[PATCH] Add dummy chips GD25Q128C, EN25QH128 and W25Q40.V
by Hatim Kanchwala 23 Aug '16

23 Aug '16

Hello, In addition to new dummy chip definitions, this squashes a few bugs left over in CLI (--read-otp, --write-otp and --lock-otp) and in otp.c (Eon specific). These 3 chips should completely emulate all kinds of new functionality added. Thanks Hatim P.S. Sorry I had to send the email in this form, there seems to be a problem with my mail configuration which I was sadly unable to resolve. -- GD25Q128C - - 3 status registers each with separate read and write opcodes for corresponding SRs - 3 security registers each of 512 bytes EN25QH128 - - Single status register - OTP sector of 512 bytes W25Q40.V (W25Q40BL) - - 2 status registers each with separate read but with single write opcode - 3 security registers each of 256 bytes Signed-off-by: Hatim Kanchwala <hatim(a)hatimak.me> --- cli_classic.c | 10 +- dummyflasher.c | 618 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- otp.c | 4 +- 3 files changed, 615 insertions(+), 17 deletions(-) diff --git a/cli_classic.c b/cli_classic.c index 146750e..300560c 100644 --- a/cli_classic.c +++ b/cli_classic.c @@ -459,36 +459,38 @@ int main(int argc, char *argv[]) "specified. Aborting.\n"); cli_classic_abort_usage(); } write_otp_opt = strdup(optarg); filename = extract_param(&write_otp_opt, "file", ","); write_otp = 1; break; case LONGOPT_ERASE_OTP: if (++operation_specified > 1) { fprintf(stderr, "More than one operation " "specified. Aborting.\n"); cli_classic_abort_usage(); } - erase_otp_opt = strdup(optarg); + if (optarg) + erase_otp_opt = strdup(optarg); erase_otp = 1; break; case LONGOPT_LOCK_OTP: if (++operation_specified > 1) { fprintf(stderr, "More than one operation " "specified. Aborting.\n"); cli_classic_abort_usage(); } - lock_otp_opt = strdup(optarg); + if (optarg) + lock_otp_opt = strdup(optarg); lock_otp = 1; break; default: cli_classic_abort_usage(); break; } } if (optind < argc) { fprintf(stderr, "Error: Extra parameter found.\n"); cli_classic_abort_usage(); } @@ -909,52 +911,52 @@ int main(int argc, char *argv[]) msg_gdbg("Writing OTP memory done\n"); // FIXME(hatim): Verify written contents } else cli_infra_support(fill_flash, "OTP"); goto out_shutdown; } if (erase_otp) { verbose_screen++; if (fill_flash->chip->otp) { char *otp_region_opt = NULL; enum otp_region otp_region = OTP_REG_1; - if (!erase_otp_opt && (otp_region_opt = extract_param(&read_otp_opt, "reg", ","))) { + if (!erase_otp_opt && (otp_region_opt = extract_param(&erase_otp_opt, "reg", ","))) { char *endptr = NULL; // FIXME(hatim): Implement error-checking (?) otp_region = (uint8_t)strtoul(otp_region_opt, &endptr, 0) - 1; } else msg_gdbg("OTP region not specified, using default region 1\n"); msg_gdbg("Erasing OTP memory ...\n"); ret = fill_flash->chip->otp->erase(fill_flash, otp_region); if (ret) { msg_gerr("Erasing OTP memory failed\n"); goto out_shutdown; } msg_gdbg("Erasing OTP memory done\n"); } else cli_infra_support(fill_flash, "OTP"); goto out_shutdown; } if (lock_otp) { verbose_screen++; if (fill_flash->chip->otp) { char *otp_region_opt = NULL; enum otp_region otp_region = OTP_REG_1; - if (!lock_otp_opt && (otp_region_opt = extract_param(&read_otp_opt, "reg", ","))) { + if (!lock_otp_opt && (otp_region_opt = extract_param(&lock_otp_opt, "reg", ","))) { char *endptr = NULL; // FIXME(hatim): Implement error-checking (?) otp_region = (uint8_t)strtoul(otp_region_opt, &endptr, 0) - 1; } else msg_gdbg("OTP region not specified, using default region 1\n"); msg_gdbg("Trying to lock OTP memory...\n"); ret = fill_flash->chip->otp->lock(fill_flash, otp_region); if (ret) { msg_gerr("Failed to lock\n"); goto out_shutdown; } msg_gdbg("OTP memory locked\n"); diff --git a/dummyflasher.c b/dummyflasher.c index f171128..20f6ba5 100644 --- a/dummyflasher.c +++ b/dummyflasher.c @@ -1,17 +1,18 @@ /* * This file is part of the flashrom project. * * Copyright (C) 2009,2010 Carl-Daniel Hailfinger + * Copyright (C) 2016 Hatim Kanchwala <hatim(a)hatimak.me> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; version 2 of the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA @@ -31,49 +32,68 @@ #if EMULATE_SPI_CHIP #define EMULATE_CHIP 1 #include "spi.h" #endif #if EMULATE_CHIP #include <sys/types.h> #include <sys/stat.h> #endif #if EMULATE_CHIP static uint8_t *flashchip_contents = NULL; +static uint8_t *gd25q128c_otp_1_contents = NULL; +static uint8_t *gd25q128c_otp_2_contents = NULL; +static uint8_t *gd25q128c_otp_3_contents = NULL; +static uint8_t *en25qh128_otp_contents = NULL; +static uint8_t *w25q40v_otp_1_contents = NULL; +static uint8_t *w25q40v_otp_2_contents = NULL; +static uint8_t *w25q40v_otp_3_contents = NULL; enum emu_chip { EMULATE_NONE, EMULATE_ST_M25P10_RES, EMULATE_SST_SST25VF040_REMS, EMULATE_SST_SST25VF032B, EMULATE_MACRONIX_MX25L6436, + EMULATE_GIGADEVICE_GD25Q128C, + EMULATE_EON_EN25QH128, + EMULATE_WINBOND_W25Q40_V, }; static enum emu_chip emu_chip = EMULATE_NONE; static char *emu_persistent_image = NULL; static unsigned int emu_chip_size = 0; #if EMULATE_SPI_CHIP static unsigned int emu_max_byteprogram_size = 0; static unsigned int emu_max_aai_size = 0; static unsigned int emu_jedec_se_size = 0; static unsigned int emu_jedec_be_52_size = 0; static unsigned int emu_jedec_be_d8_size = 0; static unsigned int emu_jedec_ce_60_size = 0; static unsigned int emu_jedec_ce_c7_size = 0; unsigned char spi_blacklist[256]; unsigned char spi_ignorelist[256]; int spi_blacklist_size = 0; int spi_ignorelist_size = 0; -static uint8_t emu_status = 0; +static uint32_t emu_status = 0; +static char *emu_persistent_gd25_otp_1_image = NULL; +static char *emu_persistent_gd25_otp_2_image = NULL; +static char *emu_persistent_gd25_otp_3_image = NULL; +static char *emu_persistent_en25_otp_image = NULL; +static char *emu_persistent_w25_otp_1_image = NULL; +static char *emu_persistent_w25_otp_2_image = NULL; +static char *emu_persistent_w25_otp_3_image = NULL; +static uint8_t read_only_bits = 0; +static uint8_t en25qh128_otp_mode = 0, en25qh128_otp_bit = 0; /* A legit complete SFDP table based on the MX25L6436E (rev. 1.8) datasheet. */ static const uint8_t sfdp_table[] = { 0x53, 0x46, 0x44, 0x50, // @0x00: SFDP signature 0x00, 0x01, 0x01, 0xFF, // @0x04: revision 1.0, 2 headers 0x00, 0x00, 0x01, 0x09, // @0x08: JEDEC SFDP header rev. 1.0, 9 DW long 0x1C, 0x00, 0x00, 0xFF, // @0x0C: PTP0 = 0x1C (instead of 0x30) 0xC2, 0x00, 0x01, 0x04, // @0x10: Macronix header rev. 1.0, 4 DW long 0x48, 0x00, 0x00, 0xFF, // @0x14: PTP1 = 0x48 (instead of 0x60) 0xFF, 0xFF, 0xFF, 0xFF, // @0x18: hole. 0xE5, 0x20, 0xC9, 0xFF, // @0x1C: SFDP parameter table start 0xFF, 0xFF, 0xFF, 0x03, // @0x20 0x00, 0xFF, 0x08, 0x6B, // @0x24 @@ -81,26 +101,28 @@ static const uint8_t sfdp_table[] = { 0xEE, 0xFF, 0xFF, 0xFF, // @0x2C 0xFF, 0xFF, 0x00, 0x00, // @0x30 0xFF, 0xFF, 0x00, 0xFF, // @0x34 0x0C, 0x20, 0x0F, 0x52, // @0x38 0x10, 0xD8, 0x00, 0xFF, // @0x3C: SFDP parameter table end 0xFF, 0xFF, 0xFF, 0xFF, // @0x40: hole. 0xFF, 0xFF, 0xFF, 0xFF, // @0x44: hole. 0x00, 0x36, 0x00, 0x27, // @0x48: Macronix parameter table start 0xF4, 0x4F, 0xFF, 0xFF, // @0x4C 0xD9, 0xC8, 0xFF, 0xFF, // @0x50 0xFF, 0xFF, 0xFF, 0xFF, // @0x54: Macronix parameter table end }; +// TODO(hatim): Add SFDP table for GD25Q128C, EN25QH128 and W25Q40.V + #endif #endif static unsigned int spi_write_256_chunksize = 256; static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr); static int dummy_spi_write_256(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len); static void dummy_chip_writeb(const struct flashctx *flash, uint8_t val, chipaddr addr); static void dummy_chip_writew(const struct flashctx *flash, uint16_t val, chipaddr addr); static void dummy_chip_writel(const struct flashctx *flash, uint32_t val, chipaddr addr); static void dummy_chip_writen(const struct flashctx *flash, const uint8_t *buf, chipaddr addr, size_t len); @@ -135,26 +157,81 @@ enum chipbustype dummy_buses_supported = BUS_NONE; static int dummy_shutdown(void *data) { msg_pspew("%s\n", __func__); #if EMULATE_CHIP if (emu_chip != EMULATE_NONE) { if (emu_persistent_image) { msg_pdbg("Writing %s\n", emu_persistent_image); write_buf_to_file(flashchip_contents, emu_chip_size, emu_persistent_image); free(emu_persistent_image); emu_persistent_image = NULL; } free(flashchip_contents); + if (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) { + if (emu_persistent_gd25_otp_1_image) { + msg_pdbg("Writing %s\n", emu_persistent_gd25_otp_1_image); + write_buf_to_file(gd25q128c_otp_1_contents, 512, emu_persistent_gd25_otp_1_image); + free(emu_persistent_gd25_otp_1_image); + emu_persistent_gd25_otp_1_image = NULL; + } + if (emu_persistent_gd25_otp_2_image) { + msg_pdbg("Writing %s\n", emu_persistent_gd25_otp_2_image); + write_buf_to_file(gd25q128c_otp_2_contents, 512, emu_persistent_gd25_otp_2_image); + free(emu_persistent_gd25_otp_2_image); + emu_persistent_gd25_otp_2_image = NULL; + } + if (emu_persistent_gd25_otp_3_image) { + msg_pdbg("Writing %s\n", emu_persistent_gd25_otp_3_image); + write_buf_to_file(gd25q128c_otp_3_contents, 512, emu_persistent_gd25_otp_3_image); + free(emu_persistent_gd25_otp_3_image); + emu_persistent_gd25_otp_3_image = NULL; + } + free(gd25q128c_otp_1_contents); + free(gd25q128c_otp_2_contents); + free(gd25q128c_otp_3_contents); + } + if (emu_chip == EMULATE_EON_EN25QH128) { + if (emu_persistent_en25_otp_image) { + msg_pdbg("Writing %s\n", emu_persistent_en25_otp_image); + write_buf_to_file(en25qh128_otp_contents, 512, emu_persistent_en25_otp_image); + free(emu_persistent_en25_otp_image); + emu_persistent_en25_otp_image = NULL; + } + free(en25qh128_otp_contents); + } + if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + if (emu_persistent_w25_otp_1_image) { + msg_pdbg("Writing %s\n", emu_persistent_w25_otp_1_image); + write_buf_to_file(w25q40v_otp_1_contents, 256, emu_persistent_w25_otp_1_image); + free(emu_persistent_w25_otp_1_image); + emu_persistent_w25_otp_1_image = NULL; + } + if (emu_persistent_w25_otp_2_image) { + msg_pdbg("Writing %s\n", emu_persistent_w25_otp_2_image); + write_buf_to_file(w25q40v_otp_2_contents, 256, emu_persistent_w25_otp_2_image); + free(emu_persistent_w25_otp_2_image); + emu_persistent_w25_otp_2_image = NULL; + } + if (emu_persistent_w25_otp_3_image) { + msg_pdbg("Writing %s\n", emu_persistent_w25_otp_3_image); + write_buf_to_file(w25q40v_otp_3_contents, 256, emu_persistent_w25_otp_3_image); + free(emu_persistent_w25_otp_3_image); + emu_persistent_w25_otp_3_image = NULL; + } + free(w25q40v_otp_1_contents); + free(w25q40v_otp_2_contents); + free(w25q40v_otp_3_contents); + } } #endif return 0; } int dummy_init(void) { char *bustext = NULL; char *tmp = NULL; int i; #if EMULATE_SPI_CHIP char *status = NULL; #endif @@ -324,84 +401,311 @@ int dummy_init(void) if (!strcmp(tmp, "MX25L6436")) { emu_chip = EMULATE_MACRONIX_MX25L6436; emu_chip_size = 8 * 1024 * 1024; emu_max_byteprogram_size = 256; emu_max_aai_size = 0; emu_jedec_se_size = 4 * 1024; emu_jedec_be_52_size = 32 * 1024; emu_jedec_be_d8_size = 64 * 1024; emu_jedec_ce_60_size = emu_chip_size; emu_jedec_ce_c7_size = emu_chip_size; msg_pdbg("Emulating Macronix MX25L6436 SPI flash chip (RDID, " "SFDP)\n"); } + if (!strcmp(tmp, "GD25Q128C")) { + emu_chip = EMULATE_GIGADEVICE_GD25Q128C; + emu_chip_size = 16 * 1024 * 1024; + emu_max_byteprogram_size = 256; + emu_max_aai_size = 0; + emu_jedec_se_size = 4 * 1024; + emu_jedec_be_52_size = 32 * 1024; + emu_jedec_be_d8_size = 64 * 1024; + emu_jedec_ce_60_size = emu_chip_size; + emu_jedec_ce_c7_size = emu_chip_size; + msg_pdbg("Emulating GigaDevice GD25Q128C SPI flash chip (RDID)\n"); + } + if (!strcmp(tmp, "EN25QH128")) { + emu_chip = EMULATE_EON_EN25QH128; + emu_chip_size = 16 * 1024 * 1024; + emu_max_byteprogram_size = 256; + emu_max_aai_size = 0; + emu_jedec_se_size = 4 * 1024; + emu_jedec_be_52_size = 32 * 1024; + emu_jedec_be_d8_size = 64 * 1024; + emu_jedec_ce_60_size = emu_chip_size; + emu_jedec_ce_c7_size = emu_chip_size; + msg_pdbg("Emulating Eon EN25QH128 SPI flash chip (RDID)\n"); + } + if (!strcmp(tmp, "W25Q40.V")) { + emu_chip = EMULATE_WINBOND_W25Q40_V; + emu_chip_size = 512 * 1024; + emu_max_byteprogram_size = 256; + emu_max_aai_size = 0; + emu_jedec_se_size = 4 * 1024; + emu_jedec_be_52_size = 32 * 1024; + emu_jedec_be_d8_size = 64 * 1024; + emu_jedec_ce_60_size = emu_chip_size; + emu_jedec_ce_c7_size = emu_chip_size; + msg_pdbg("Emulating Winbond W25Q40.V SPI flash chip (RDID)\n"); + } #endif if (emu_chip == EMULATE_NONE) { msg_perr("Invalid chip specified for emulation: %s\n", tmp); free(tmp); return 1; } free(tmp); flashchip_contents = malloc(emu_chip_size); if (!flashchip_contents) { msg_perr("Out of memory!\n"); return 1; } + /* Allocate memory for each of the 512 bytes Security Register of GD25Q128C. */ + if (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) { + gd25q128c_otp_1_contents = malloc(512); + if (!gd25q128c_otp_1_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + gd25q128c_otp_2_contents = malloc(512); + if (!gd25q128c_otp_2_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + gd25q128c_otp_3_contents = malloc(512); + if (!gd25q128c_otp_3_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + } + + /* Allocate memory for the 512 byte security sector of EN25QH128. */ + if (emu_chip == EMULATE_EON_EN25QH128) { + en25qh128_otp_contents = malloc(512); + if (!en25qh128_otp_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + } + + /* Allocate memory for each of the 256 bytes Security Register of GD25Q128C. */ + if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + w25q40v_otp_1_contents = malloc(256); + if (!w25q40v_otp_1_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + w25q40v_otp_2_contents = malloc(256); + if (!w25q40v_otp_2_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + w25q40v_otp_3_contents = malloc(256); + if (!w25q40v_otp_3_contents) { + msg_perr("Out of memory!\n"); + return 1; + } + } + #ifdef EMULATE_SPI_CHIP status = extract_programmer_param("spi_status"); if (status) { char *endptr; errno = 0; emu_status = strtoul(status, &endptr, 0); free(status); if (errno != 0 || status == endptr) { msg_perr("Error: initial status register specified, " "but the value could not be converted.\n"); return 1; } - msg_pdbg("Initial status register is set to 0x%02x.\n", + if (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) { + msg_pdbg("Initial status registers -\n" + "\tSR1 is set to 0x%02x\n" + "\tSR2 is set to 0x%02x\n" + "\tSR3 is set to 0x%02x\n", + emu_status & 0xff, (emu_status >> 8) & 0xff, (emu_status >> 16) & 0xff); + } else if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + msg_pdbg("Initial status registers -\n" + "\tSR1 is set to 0x%02x\n" + "\tSR2 is set to 0x%02x\n", + emu_status & 0xff, (emu_status >> 8) & 0xff); + } else { + msg_pdbg("Initial status register is set to 0x%02x.\n", emu_status); + } } #endif msg_pdbg("Filling fake flash chip with 0xff, size %i\n", emu_chip_size); memset(flashchip_contents, 0xff, emu_chip_size); /* Will be freed by shutdown function if necessary. */ emu_persistent_image = extract_programmer_param("image"); - if (!emu_persistent_image) { - /* Nothing else to do. */ - goto dummy_init_out; - } /* We will silently (in default verbosity) ignore the file if it does not exist (yet) or the size does * not match the emulated chip. */ - if (!stat(emu_persistent_image, &image_stat)) { + if (emu_persistent_image && !stat(emu_persistent_image, &image_stat)) { msg_pdbg("Found persistent image %s, %jd B ", emu_persistent_image, (intmax_t)image_stat.st_size); if (image_stat.st_size == emu_chip_size) { msg_pdbg("matches.\n"); msg_pdbg("Reading %s\n", emu_persistent_image); read_buf_from_file(flashchip_contents, emu_chip_size, emu_persistent_image); } else { msg_pdbg("doesn't match.\n"); } } + + /* Each OTP image will be freed by shutdown function, if necessary. GD25Q128C has 3 Security Registers + * each of 512 bytes. + * We will silently (in default verbosity) ignore the file(s) if it does not exist (yet) + * or the size does not match the security register size on chip. */ + if (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) { + msg_pdbg("Filling fake security register 1, 2 and 3 with 0xff, size 512 bytes each\n"); + memset(gd25q128c_otp_1_contents, 0xff, 512); + memset(gd25q128c_otp_2_contents, 0xff, 512); + memset(gd25q128c_otp_3_contents, 0xff, 512); + + emu_persistent_gd25_otp_1_image = extract_programmer_param("otp_1"); + emu_persistent_gd25_otp_2_image = extract_programmer_param("otp_2"); + emu_persistent_gd25_otp_3_image = extract_programmer_param("otp_3"); + + if (emu_persistent_gd25_otp_1_image && !stat(emu_persistent_gd25_otp_1_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 1, ", + emu_persistent_gd25_otp_1_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 512) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_gd25_otp_1_image); + read_buf_from_file(gd25q128c_otp_1_contents, 512, + emu_persistent_gd25_otp_1_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + if (emu_persistent_gd25_otp_2_image && !stat(emu_persistent_gd25_otp_2_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 2, ", + emu_persistent_gd25_otp_2_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 512) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_gd25_otp_2_image); + read_buf_from_file(gd25q128c_otp_2_contents, 512, + emu_persistent_gd25_otp_2_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + if (emu_persistent_gd25_otp_3_image && !stat(emu_persistent_gd25_otp_3_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 3, ", + emu_persistent_gd25_otp_3_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 512) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_gd25_otp_3_image); + read_buf_from_file(gd25q128c_otp_3_contents, 512, + emu_persistent_gd25_otp_3_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + } + + /* Eon EN25QH128 has a security sector of 512 bytes. OTP image will be freed by shutdown + * function, if necessary. We will silently (in default verbosity) ignore the file(s) + * if it does not exist (yet) or the size does not match the security register size on chip. */ + if (emu_chip == EMULATE_EON_EN25QH128) { + msg_pdbg("Filling fake security sector with 0xff, size 512 bytes\n"); + memset(en25qh128_otp_contents, 0xff, 512); + emu_persistent_en25_otp_image = extract_programmer_param("otp"); + if (emu_persistent_en25_otp_image && !stat(emu_persistent_en25_otp_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security sector, ", + emu_persistent_en25_otp_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 512) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_en25_otp_image); + read_buf_from_file(en25qh128_otp_contents, 512, + emu_persistent_en25_otp_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + } + + /* W25Q40.V has 3 Security Registers each of 256 bytes. */ + if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + msg_pdbg("Filling fake security register 1, 2 and 3 with 0xff, size 256 bytes each\n"); + memset(w25q40v_otp_1_contents, 0xff, 256); + memset(w25q40v_otp_2_contents, 0xff, 256); + memset(w25q40v_otp_3_contents, 0xff, 256); + + emu_persistent_w25_otp_1_image = extract_programmer_param("otp_1"); + emu_persistent_w25_otp_2_image = extract_programmer_param("otp_2"); + emu_persistent_w25_otp_3_image = extract_programmer_param("otp_3"); + + if (emu_persistent_w25_otp_1_image && !stat(emu_persistent_w25_otp_1_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 1, ", + emu_persistent_w25_otp_1_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 256) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_w25_otp_1_image); + read_buf_from_file(w25q40v_otp_1_contents, 256, + emu_persistent_w25_otp_1_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + if (emu_persistent_w25_otp_2_image && !stat(emu_persistent_w25_otp_2_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 2, ", + emu_persistent_w25_otp_2_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 256) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_w25_otp_2_image); + read_buf_from_file(w25q40v_otp_2_contents, 256, + emu_persistent_w25_otp_2_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + if (emu_persistent_w25_otp_3_image && !stat(emu_persistent_w25_otp_3_image, &image_stat)) { + msg_pdbg("Found persistent image %s, %jd B for security register 3, ", + emu_persistent_w25_otp_3_image, (intmax_t)image_stat.st_size); + if (image_stat.st_size == 256) { + msg_pdbg("matches.\n"); + msg_pdbg("Reading %s\n", emu_persistent_w25_otp_3_image); + read_buf_from_file(w25q40v_otp_3_contents, 256, + emu_persistent_w25_otp_3_image); + } else { + msg_pdbg("doesn't match.\n"); + } + } + } #endif dummy_init_out: if (register_shutdown(dummy_shutdown, NULL)) { free(flashchip_contents); + if (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) { + free(gd25q128c_otp_1_contents); + free(gd25q128c_otp_2_contents); + free(gd25q128c_otp_3_contents); + } + if (emu_chip == EMULATE_EON_EN25QH128) { + free(en25qh128_otp_contents); + } + if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + free(w25q40v_otp_1_contents); + free(w25q40v_otp_2_contents); + free(w25q40v_otp_3_contents); + } return 1; } if (dummy_buses_supported & (BUS_PARALLEL | BUS_LPC | BUS_FWH)) register_par_master(&par_master_dummy, dummy_buses_supported & (BUS_PARALLEL | BUS_LPC | BUS_FWH)); if (dummy_buses_supported & BUS_SPI) register_spi_master(&spi_master_dummyflasher); return 0; } void *dummy_map(const char *descr, uintptr_t phys_addr, size_t len) { @@ -457,36 +761,40 @@ static uint32_t dummy_chip_readl(const struct flashctx *flash, const chipaddr ad { msg_pspew("%s: addr=0x%" PRIxPTR ", returning 0xffffffff\n", __func__, addr); return 0xffffffff; } static void dummy_chip_readn(const struct flashctx *flash, uint8_t *buf, const chipaddr addr, size_t len) { msg_pspew("%s: addr=0x%" PRIxPTR ", len=0x%zx, returning array of 0xff\n", __func__, addr, len); memset(buf, 0xff, len); return; } #if EMULATE_SPI_CHIP + static int emulate_spi_chip_response(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { unsigned int offs, i, toread; static int unsigned aai_offs; const unsigned char sst25vf040_rems_response[2] = {0xbf, 0x44}; const unsigned char sst25vf032b_rems_response[2] = {0xbf, 0x4a}; const unsigned char mx25l6436_rems_response[2] = {0xc2, 0x16}; + const unsigned char gd25q128c_rems_response[2] = {0xc8, 0x17}; + const unsigned char en25qh128_rems_response[2] = {0x1c, 0x17}; + const unsigned char w25q40v_rems_response[2] = {0xef, 0x12}; if (writecnt == 0) { msg_perr("No command sent to the chip!\n"); return 1; } /* spi_blacklist has precedence over spi_ignorelist. */ for (i = 0; i < spi_blacklist_size; i++) { if (writearr[0] == spi_blacklist[i]) { msg_pdbg("Refusing blacklisted SPI command 0x%02x\n", spi_blacklist[i]); return SPI_INVALID_OPCODE; } } @@ -525,101 +833,241 @@ static int emulate_spi_chip_response(unsigned int writecnt, break; case EMULATE_SST_SST25VF040_REMS: for (i = 0; i < readcnt; i++) readarr[i] = sst25vf040_rems_response[(offs + i) % 2]; break; case EMULATE_SST_SST25VF032B: for (i = 0; i < readcnt; i++) readarr[i] = sst25vf032b_rems_response[(offs + i) % 2]; break; case EMULATE_MACRONIX_MX25L6436: if (readcnt > 0) memset(readarr, 0x16, readcnt); break; + case EMULATE_GIGADEVICE_GD25Q128C: + if (readcnt > 0) + memset(readarr, 0x17, readcnt); + break; + case EMULATE_EON_EN25QH128: + if (readcnt > 0) + memset(readarr, 0x17, readcnt); + break; + case EMULATE_WINBOND_W25Q40_V: + if (readcnt > 0) + memset(readarr, 0x12, readcnt); + break; default: /* ignore */ break; } break; case JEDEC_REMS: /* REMS response has wraparound and uses an address parameter. */ if (writecnt < JEDEC_REMS_OUTSIZE) break; offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; offs += writecnt - JEDEC_REMS_OUTSIZE; switch (emu_chip) { case EMULATE_SST_SST25VF040_REMS: for (i = 0; i < readcnt; i++) readarr[i] = sst25vf040_rems_response[(offs + i) % 2]; break; case EMULATE_SST_SST25VF032B: for (i = 0; i < readcnt; i++) readarr[i] = sst25vf032b_rems_response[(offs + i) % 2]; break; case EMULATE_MACRONIX_MX25L6436: for (i = 0; i < readcnt; i++) readarr[i] = mx25l6436_rems_response[(offs + i) % 2]; break; + case EMULATE_GIGADEVICE_GD25Q128C: + for (i = 0; i < readcnt; i++) + readarr[i] = gd25q128c_rems_response[(offs + i) % 2]; + break; + case EMULATE_EON_EN25QH128: + for (i = 0; i < readcnt; i++) + readarr[i] = en25qh128_rems_response[(offs + i) % 2]; + break; + case EMULATE_WINBOND_W25Q40_V: + for (i = 0; i < readcnt; i++) + readarr[i] = w25q40v_rems_response[(offs + i) % 2]; + break; default: /* ignore */ break; } break; case JEDEC_RDID: switch (emu_chip) { case EMULATE_SST_SST25VF032B: if (readcnt > 0) readarr[0] = 0xbf; if (readcnt > 1) readarr[1] = 0x25; if (readcnt > 2) readarr[2] = 0x4a; break; case EMULATE_MACRONIX_MX25L6436: if (readcnt > 0) readarr[0] = 0xc2; if (readcnt > 1) readarr[1] = 0x20; if (readcnt > 2) readarr[2] = 0x17; break; + case EMULATE_GIGADEVICE_GD25Q128C: + if (readcnt > 0) + readarr[0] = 0xc8; + if (readcnt > 1) + readarr[1] = 0x40; + if (readcnt > 2) + readarr[2] = 0x18; + break; + case EMULATE_EON_EN25QH128: + if (readcnt > 0) + readarr[0] = 0x1c; + if (readcnt > 1) + readarr[1] = 0x70; + if (readcnt > 2) + readarr[2] = 0x18; + break; + case EMULATE_WINBOND_W25Q40_V: + if (readcnt > 0) + readarr[0] = 0xef; + if (readcnt > 1) + readarr[1] = 0x40; + if (readcnt > 2) + readarr[2] = 0x13; + break; default: /* ignore */ break; } break; case JEDEC_RDSR: + if (emu_chip == EMULATE_EON_EN25QH128 && en25qh128_otp_mode) { + memset(readarr, (emu_status & 0x7F) | (en25qh128_otp_bit << 7), readcnt); + break; + } memset(readarr, emu_status, readcnt); break; + case JEDEC_RDSR2: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C && emu_chip != EMULATE_WINBOND_W25Q40_V) + break; + memset(readarr, (emu_status >> 8) & 0xff, readcnt); + break; + case JEDEC_RDSR3: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C) + break; + memset(readarr, (emu_status >> 16) & 0xff, readcnt); + break; /* FIXME: this should be chip-specific. */ case JEDEC_EWSR: case JEDEC_WREN: emu_status |= SPI_SR_WEL; break; - case JEDEC_WRSR: + case JEDEC_WRSR1: + if (!(emu_status & SPI_SR_WEL)) { + msg_perr("WRSR1 attempted, but WEL is 0!\n"); + break; + } + if (emu_chip == EMULATE_EON_EN25QH128 && en25qh128_otp_mode) { + en25qh128_otp_bit = 1; + msg_pdbg("OTP bit set...\n"); + break; + } + if (emu_chip == EMULATE_WINBOND_W25Q40_V) { + /* Make sure reserved bits and read-only bits are not set. + * For W25Q40.V, SUS (bit_7) and reserved (bit_2) bits in SR2 are read-only. */ + read_only_bits = 0x84; + /* If any of the Lock Bits in SR2, LB[1..3] are set, then they are read-only. */ + if (emu_status & 0x00ff00 & (1 << 3)) + read_only_bits |= 1 << 3; + if (emu_status & 0x00ff00 & (1 << 4)) + read_only_bits |= 1 << 4; + if (emu_status & 0x00ff00 & (1 << 5)) + read_only_bits |= 1 << 5; + if (writecnt == 3) + emu_status |= ((writearr[2] & ~read_only_bits) & 0xff) << 8; + else + emu_status &= 0x00ff; + } + /* FIXME: add some reasonable simulation of the busy flag */ + emu_status |= (writearr[1] & ~SPI_SR_WIP) & 0xffff; + msg_pdbg2("WRSR1 wrote 0x%02x.\n", emu_status & 0xffff); + break; + case JEDEC_WRSR2: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C) + break; if (!(emu_status & SPI_SR_WEL)) { - msg_perr("WRSR attempted, but WEL is 0!\n"); + msg_perr("WRSR2 attempted, but WEL is 0!\n"); break; } /* FIXME: add some reasonable simulation of the busy flag */ - emu_status = writearr[1] & ~SPI_SR_WIP; - msg_pdbg2("WRSR wrote 0x%02x.\n", emu_status); + /* Make sure reserved bits and read-only bits are not set. + * For GD25Q128C, SUS1 (bit_7) and SUS2 (bit_2) bits in SR2 are read-only. */ + read_only_bits = 0x84; + /* If any of the Lock Bits, LB[1..3] are set, then they are read-only. */ + if (emu_status & 0x00ff00 & (1 << 3)) + read_only_bits |= 1 << 3; + if (emu_status & 0x00ff00 & (1 << 4)) + read_only_bits |= 1 << 4; + if (emu_status & 0x00ff00 & (1 << 5)) + read_only_bits |= 1 << 5; + emu_status |= (writearr[1] & ~read_only_bits) & 0xff00; + break; + case JEDEC_WRSR3: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C) + break; + if (!(emu_status & SPI_SR_WEL)) { + msg_perr("WRSR3 attempted, but WEL is 0!\n"); + break; + } + /* FIXME: add some reasonable simulation of the busy flag */ + /* Make sure reserved bits and read-only bits are not set. + * For GD25Q128C, bit_{0, 1, 3, 4} in SR3 are reserved. */ + read_only_bits = 0x1b; + emu_status |= (writearr[1] & ~read_only_bits) &0xff0000; break; case JEDEC_READ: offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (emu_chip == EMULATE_EON_EN25QH128 && en25qh128_otp_mode) { + if (en25qh128_otp_bit) { + msg_perr("OTP bit is set, cannot erase OTP sector anymore\n"); + break; + } + if ((~(offs >> 12) & 0xfff) || (offs & 0xfff) >= 0x200) { + msg_perr("Address out of range\n"); + break; + } + memcpy(readarr, en25qh128_otp_contents + (offs & 0xfff), readcnt); + break; + } /* Truncate to emu_chip_size. */ offs %= emu_chip_size; if (readcnt > 0) memcpy(readarr, flashchip_contents + offs, readcnt); break; case JEDEC_BYTE_PROGRAM: offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (emu_chip == EMULATE_EON_EN25QH128 && en25qh128_otp_mode) { + if (en25qh128_otp_bit) { + msg_perr("OTP bit is set, cannot program OTP sector anymore\n"); + break; + } + if ((~(offs >> 12) & 0xfff) || (offs & 0xfff) >= 0x200) { + msg_perr("Address out of range\n"); + break; + } + memcpy(en25qh128_otp_contents + (offs & 0xfff), writearr + 4, writecnt - 4); + break; + } /* Truncate to emu_chip_size. */ offs %= emu_chip_size; if (writecnt < 5) { msg_perr("BYTE PROGRAM size too short!\n"); return 1; } if (writecnt - 4 > emu_max_byteprogram_size) { msg_perr("Max BYTE PROGRAM size exceeded!\n"); return 1; } memcpy(flashchip_contents + offs, writearr + 4, writecnt - 4); break; case JEDEC_AAI_WORD_PROGRAM: @@ -651,39 +1099,53 @@ static int emulate_spi_chip_response(unsigned int writecnt, } if (writecnt > JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE) { msg_perr("Continuation AAI WORD PROGRAM size " "too long!\n"); return 1; } memcpy(flashchip_contents + aai_offs, writearr + 1, 2); aai_offs += 2; } break; case JEDEC_WRDI: if (emu_max_aai_size) emu_status &= ~SPI_SR_AAI; + if (emu_chip == EMULATE_EON_EN25QH128) + en25qh128_otp_mode = 0; break; case JEDEC_SE: if (!emu_jedec_se_size) break; if (writecnt != JEDEC_SE_OUTSIZE) { msg_perr("SECTOR ERASE 0x20 outsize invalid!\n"); return 1; } if (readcnt != JEDEC_SE_INSIZE) { msg_perr("SECTOR ERASE 0x20 insize invalid!\n"); return 1; } offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (emu_chip == EMULATE_EON_EN25QH128 && en25qh128_otp_mode) { + if (en25qh128_otp_bit) { + msg_perr("OTP bit is set, cannot erase OTP sector anymore\n"); + break; + } + if ((~(offs >> 12) & 0xfff) || (offs & 0xfff) >= 0x200) { + msg_perr("Address out of range\n"); + break; + } + memset(en25qh128_otp_contents, 0xff, 512); + break; + } if (offs & (emu_jedec_se_size - 1)) msg_pdbg("Unaligned SECTOR ERASE 0x20: 0x%x\n", offs); offs &= ~(emu_jedec_se_size - 1); memset(flashchip_contents + offs, 0xff, emu_jedec_se_size); break; case JEDEC_BE_52: if (!emu_jedec_be_52_size) break; if (writecnt != JEDEC_BE_52_OUTSIZE) { msg_perr("BLOCK ERASE 0x52 outsize invalid!\n"); return 1; } if (readcnt != JEDEC_BE_52_INSIZE) { @@ -734,26 +1196,27 @@ static int emulate_spi_chip_response(unsigned int writecnt, if (writecnt != JEDEC_CE_C7_OUTSIZE) { msg_perr("CHIP ERASE 0xc7 outsize invalid!\n"); return 1; } if (readcnt != JEDEC_CE_C7_INSIZE) { msg_perr("CHIP ERASE 0xc7 insize invalid!\n"); return 1; } /* JEDEC_CE_C7_OUTSIZE is 1 (no address) -> no offset. */ /* emu_jedec_ce_c7_size is emu_chip_size. */ memset(flashchip_contents, 0xff, emu_jedec_ce_c7_size); break; case JEDEC_SFDP: + // TODO(hatim): SFDP for GD25Q128C, EN25QH128 and W25Q40.V if (emu_chip != EMULATE_MACRONIX_MX25L6436) break; if (writecnt < 4) break; offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; /* SFDP expects one dummy byte after the address. */ if (writecnt == 4) { /* The dummy byte was not written, make sure it is read instead. * Shifting and shortening the read array does achieve this goal. */ readarr++; readcnt--; @@ -768,26 +1231,156 @@ static int emulate_spi_chip_response(unsigned int writecnt, * This is a reasonable implementation choice in hardware because it saves a few gates. */ if (offs >= sizeof(sfdp_table)) { msg_pdbg("Wrapping the start address around the SFDP table boundary (using 0x%x " "instead of 0x%x).\n", (unsigned int)(offs % sizeof(sfdp_table)), offs); offs %= sizeof(sfdp_table); } toread = min(sizeof(sfdp_table) - offs, readcnt); memcpy(readarr, sfdp_table + offs, toread); if (toread < readcnt) msg_pdbg("Crossing the SFDP table boundary in a single " "continuous chunk produces undefined results " "after that point.\n"); break; + case JEDEC_READ_SEC_REG: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C && emu_chip != EMULATE_WINBOND_W25Q40_V) + break; + if (writecnt != JEDEC_READ_SEC_REG_OUTSIZE) { + msg_perr("READ SECURITY REGISTER size not proper!\n"); + break; + } + /* writearr[1..3] holds the address, writearr[1] must be 0x00, + * (writearr[2..3] & 01ff) holds the byte address pointing to within + * the security register range, and (writearr[2] & 0xf0) must be either + * of 0x01, 0x02 or 0x03 corresponding to security register 1, 2 or 3 resp. */ + if (writearr[1] || (writearr[2] & 0x0e)) + break; + offs = (writearr[2] & 0x01) << 8 | writearr[3]; + /* Truncate to security register size, i.e., 512 bytes for GD25Q128C, + * or 256 bytes for W25Q40.V. */ + offs %= (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? 512 : 256; + if (readcnt > 0) { + switch ((writearr[2] & 0xf0) >> 4) { + case 0x01: + memcpy(readarr, ((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_1_contents : w25q40v_otp_1_contents) + offs, readcnt); + break; + case 0x02: + memcpy(readarr, ((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_2_contents : w25q40v_otp_2_contents) + offs, readcnt); + break; + case 0x03: + memcpy(readarr, ((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_3_contents : w25q40v_otp_3_contents) + offs, readcnt); + break; + default: + break; + } + } + break; + case JEDEC_PROG_BYTE_SEC_REG: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C && emu_chip != EMULATE_WINBOND_W25Q40_V) + break; + if (writecnt < JEDEC_PROG_BYTE_SEC_REG_OUTSIZE) { + msg_perr("PROGRAM SECURITY REGISTER size too short!\n"); + break; + } + /* writearr[1..3] holds the address, writearr[1] must be 0x00, + * (writearr[2..3] & 01ff) holds the byte address pointing to within + * the security register range, and (writearr[2] & 0xf0) must be either + * of 0x01, 0x02 or 0x03 corresponding to security register 1, 2 or 3 resp. */ + if (writearr[1] || (writearr[2] & 0x0e)) + break; + offs = (writearr[2] & 0x01) << 8 | writearr[3]; + /* Truncate to security register size, i.e., 512 bytes for GD25Q128C, + * or 256 bytes for W25Q40.V. */ + offs %= (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? 512 : 256; + /* If corresponding Lock Bits are set then the register is locked against + * any further write attempts. */ + switch ((writearr[2] & 0xf0) >> 4) { + case 0x01: + /* LB1 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 3))) + memcpy(((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_1_contents : w25q40v_otp_1_contents) + offs, + writearr + 4, writecnt - 4); + break; + case 0x02: + /* LB2 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 4))) + memcpy(((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_2_contents : w25q40v_otp_2_contents) + offs, + writearr + 4, writecnt - 4); + break; + case 0x03: + /* LB3 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 5))) + memcpy(((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_3_contents : w25q40v_otp_3_contents) + offs, + writearr + 4, writecnt - 4); + break; + default: + break; + } + break; + case JEDEC_ERASE_SEC_REG: + if (emu_chip != EMULATE_GIGADEVICE_GD25Q128C && emu_chip != EMULATE_WINBOND_W25Q40_V) + break; + if (writecnt != JEDEC_ERASE_SEC_REG_OUTSIZE) { + msg_perr("ERASE SECURITY REGISTER size not proper!\n"); + break; + } + /* writearr[1..3] holds the address, writearr[1] must be 0x00, + * (writearr[2..3] & 01ff) holds the byte address pointing to within + * the security register range, and (writearr[2] & 0xf0) must be either + * of 0x01, 0x02 or 0x03 corresponding to security register 1, 2 or 3 resp. */ + if (writearr[1] || (writearr[2] & 0x0e)) + break; + /* If corresponding Lock Bits are set then the register is locked against + * any further erase attempts. */ + switch ((writearr[2] & 0xf0) >> 4) { + case 0x01: + /* LB1 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 3))) + memset((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_1_contents : w25q40v_otp_1_contents, 0xff, + (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? 512 : 256); + break; + case 0x02: + /* LB2 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 4))) + memset((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_2_contents : w25q40v_otp_2_contents, 0xff, + (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? 512 : 256); + break; + case 0x03: + /* LB3 is NOT set */ + if (!(emu_status & 0x00ff00 & (1 << 5))) + memset((emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? + gd25q128c_otp_3_contents : w25q40v_otp_3_contents, 0xff, + (emu_chip == EMULATE_GIGADEVICE_GD25Q128C) ? 512 : 256); + break; + default: + break; + } + break; + case JEDEC_ENTER_OTP: + /* Eon chip specific opcode, not observed in other + * manufacturers (yet, please update this when required). */ + if (emu_chip != EMULATE_EON_EN25QH128) + break; + en25qh128_otp_mode = 1; + msg_pdbg("Entered OTP mode...\n"); + break; default: /* No special response. */ break; } if (writearr[0] != JEDEC_WREN && writearr[0] != JEDEC_EWSR) emu_status &= ~SPI_SR_WEL; return 0; } #endif static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, @@ -799,26 +1392,29 @@ static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt, msg_pspew(" writing %u bytes:", writecnt); for (i = 0; i < writecnt; i++) msg_pspew(" 0x%02x", writearr[i]); /* Response for unknown commands and missing chip is 0xff. */ memset(readarr, 0xff, readcnt); #if EMULATE_SPI_CHIP switch (emu_chip) { case EMULATE_ST_M25P10_RES: case EMULATE_SST_SST25VF040_REMS: case EMULATE_SST_SST25VF032B: case EMULATE_MACRONIX_MX25L6436: + case EMULATE_GIGADEVICE_GD25Q128C: + case EMULATE_EON_EN25QH128: + case EMULATE_WINBOND_W25Q40_V: if (emulate_spi_chip_response(writecnt, readcnt, writearr, readarr)) { msg_pdbg("Invalid command sent to flash chip!\n"); return 1; } break; default: break; } #endif msg_pspew(" reading %u bytes:", readcnt); for (i = 0; i < readcnt; i++) msg_pspew(" 0x%02x", readarr[i]); diff --git a/otp.c b/otp.c index 4af4b84..20a8f84 100644 --- a/otp.c +++ b/otp.c @@ -124,52 +124,52 @@ int eon_print_status_generic(struct flashctx *flash) { } /* Read len bytes of the security register (corresponding to otp_region) into buf, * starting from start_byte. */ int eon_read_generic(struct flashctx *flash, uint8_t *buf, enum otp_region otp_region, uint32_t start_byte, uint32_t len) { int result = otp_error_check(flash, otp_region, start_byte, len); if (result) { msg_cerr("%s failed\n", __func__); return result; } enter_otp_mode(flash); - result = flash->chip->read(flash, buf, start_byte, len); + result = flash->chip->read(flash, buf, flash->chip->otp->region[otp_region].addr | start_byte, len); exit_otp_mode(flash); if (result) msg_cerr("%s failed\n", __func__); return result; } /* Write len bytes to the security register (corresponding to otp_region) form buf, * starting from start_byte. */ int eon_write_generic(struct flashctx *flash, const uint8_t *buf, enum otp_region otp_region, uint32_t start_byte, uint32_t len) { int result = otp_error_check(flash, otp_region, start_byte, len); if (result) { msg_cerr("%s failed\n", __func__); return result; } if (flash->chip->otp->status(flash, otp_region)) { msg_cdbg("OTP memory region %d is permanently locked and cannot be written to\n", otp_region + 1); msg_cerr("%s failed\n", __func__); return 1; } enter_otp_mode(flash); - result = flash->chip->write(flash, buf, start_byte, len); + result = flash->chip->write(flash, buf, flash->chip->otp->region[otp_region].addr | start_byte, len); exit_otp_mode(flash); if (result) msg_cerr("%s failed\n", __func__); return result; } /* Erase the security register corresponding to otp_region. */ int eon_erase_generic(struct flashctx *flash, enum otp_region otp_region) { int result = otp_error_check(flash, otp_region, 0x000000, 0); if (result) { msg_cerr("%s failed\n", __func__); return result; -- 2.7.4

1 0

Skylake Support
by Jason La Mont 21 Aug '16

21 Aug '16

Does anyone know if work is ongoing for skylake support? Lee

1 0

erase algorithm on Macronix MX25L6406E
by Arian Sanusi 21 Aug '16

21 Aug '16

Hi all, I have a T420 with Macronix MX25L6406E flash. flashrom's first erase algorithm fails, the second succeeds, which is obviously not fatal, but means an unimportant (internal flasher), annoying (raspi) to painful (arduino) delay. Would be awesome if the second erase algorithm could be default for this chip! best regards, Arian bad quality pictures: https://semioptimal.net/t420_flash_side.jpg https://semioptimal.net/t420_onlyflash.jpg relevant flashrom output: Found Macronix flash chip "MX25L6405" (8192 kB, SPI) mapped at physical address 0x00000000ff800000. Reading old flash chip contents... done. Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0x1653 ERASE FAILED! Reading current flash chip contents... done. Looking for another erase function. Erase/write done. Verifying flash... VERIFIED.

2 3

Unsupported Lenovo Thinkpad X200
by Alexander Waldmann 21 Aug '16

21 Aug '16

Basically what it says on the tin. One of my X200 systems works with flashrom's internal programmer, as expected, but a recently acquired one does not, I get the error about unsupported laptop. Using the laptop:force_I_want_a_brick option seems to work, I've used it to update a few times. Attached are the requested command outputs, dmidecode and lspci -nn. System is currently running Libreboot beta. Flashrom version tested was 0.9.9 on several distros. If there's any other info required feel free to request it. Thanks.

2 2

Skylake support
by Jason La Mont 20 Aug '16

20 Aug '16

Is there a plan or timeline on skylake support? Thanks, Lee Sent from my iPhone

1 0

Re: [flashrom] Windows Help
by Jason Jacobs 12 Aug '16

12 Aug '16

Urja, Thanks so much. I will give this a try. Thanks, Jason Jacobs -----Original Message----- From: Urja Rannikko [mailto:urjaman@gmail.com] Sent: Friday, August 12, 2016 11:31 AM To: Jason Jacobs <Jason.Jacobs(a)FIRSTSOLAR.COM> Cc: flashrom(a)flashrom.org Subject: Re: [flashrom] Windows Help On Fri, Aug 12, 2016 at 6:09 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > The link on the flashrom page takes me to here: > http://ra.openbios.org/~idwer/flashrom/mingw/ > > The windows flashrom exe on that page is from 2014 so I assume that is very old. Where do I download version 0.9.9? > Oh the wiki should be fixed. I dunno in what direction, but atleast to mark that as obsolete. The entire windows page is kinda in need of updating. We dont have any official windows binary releases (thus I assumed you had cross-compiled yours from source on linux), but since the buildbot does test win32 and win64, I made a static build for windows: http://buildbot.flashrom.org/buildresults/flashrom-000478-pe5/win32/flashro… (or win64 http://buildbot.flashrom.org/buildresults/flashrom-000478-pe5/win64/flashro… ).

1 0

Re: [flashrom] Windows Help
by Urja Rannikko 12 Aug '16

12 Aug '16

On Fri, Aug 12, 2016 at 6:09 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > The link on the flashrom page takes me to here: http://ra.openbios.org/~idwer/flashrom/mingw/ > > The windows flashrom exe on that page is from 2014 so I assume that is very old. Where do I download version 0.9.9? > Oh the wiki should be fixed. I dunno in what direction, but atleast to mark that as obsolete. The entire windows page is kinda in need of updating. We dont have any official windows binary releases (thus I assumed you had cross-compiled yours from source on linux), but since the buildbot does test win32 and win64, I made a static build for windows: http://buildbot.flashrom.org/buildresults/flashrom-000478-pe5/win32/flashro… (or win64 http://buildbot.flashrom.org/buildresults/flashrom-000478-pe5/win64/flashro… ).

1 0

Re: [flashrom] Windows Help
by Jason Jacobs 12 Aug '16

12 Aug '16

Urja, The link on the flashrom page takes me to here: http://ra.openbios.org/~idwer/flashrom/mingw/ The windows flashrom exe on that page is from 2014 so I assume that is very old. Where do I download version 0.9.9? Thanks, Jason Jacobs -----Original Message----- From: Urja Rannikko [mailto:urjaman@gmail.com] Sent: Friday, August 12, 2016 11:05 AM To: Jason Jacobs <Jason.Jacobs(a)FIRSTSOLAR.COM> Cc: flashrom(a)flashrom.org Subject: Re: [flashrom] Windows Help On Fri, Aug 12, 2016 at 5:56 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > Urja, > > Thanks for the response. The issue I am having is setting the baud in Windows to 20000000, it gets rounded down to 115200. I have been unsuccessful in all the attempts to get around this. There is a way to alias a baud in the FTDI drivers so that when you set the baud to 300 for instance, it is actually 2000000. I tried this, and it didn’t work in flashrom but I did verify that the port is actually being set to 2000000 and data is being send to the Arduino at 2000000. > > My question is, does flashrom do anything with the baud rate setting other than just set the port? Is it used for timing internally? If so, that would explain why flashrom doesn’t work with aliasing when I set the baud to 300 (which is actually 20000000). You should use the newest flashrom (0.9.9), flashrom has supported arbitrary baudrates (anything the driver supports) on windows since svn revision 1909... (it is then also possible to omit specifying the baudrate... IIRC the result is that the one selected in device manager would be used...). -- Urja Rannikko

1 0

Re: [flashrom] Windows Help
by Urja Rannikko 12 Aug '16

12 Aug '16

On Fri, Aug 12, 2016 at 5:56 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > Urja, > > Thanks for the response. The issue I am having is setting the baud in Windows to 20000000, it gets rounded down to 115200. I have been unsuccessful in all the attempts to get around this. There is a way to alias a baud in the FTDI drivers so that when you set the baud to 300 for instance, it is actually 2000000. I tried this, and it didn’t work in flashrom but I did verify that the port is actually being set to 2000000 and data is being send to the Arduino at 2000000. > > My question is, does flashrom do anything with the baud rate setting other than just set the port? Is it used for timing internally? If so, that would explain why flashrom doesn’t work with aliasing when I set the baud to 300 (which is actually 20000000). You should use the newest flashrom (0.9.9), flashrom has supported arbitrary baudrates (anything the driver supports) on windows since svn revision 1909... (it is then also possible to omit specifying the baudrate... IIRC the result is that the one selected in device manager would be used...). -- Urja Rannikko

1 0

Re: [flashrom] Windows Help
by Jason Jacobs 12 Aug '16

12 Aug '16

Urja, Thanks for the response. The issue I am having is setting the baud in Windows to 20000000, it gets rounded down to 115200. I have been unsuccessful in all the attempts to get around this. There is a way to alias a baud in the FTDI drivers so that when you set the baud to 300 for instance, it is actually 2000000. I tried this, and it didn’t work in flashrom but I did verify that the port is actually being set to 2000000 and data is being send to the Arduino at 2000000. My question is, does flashrom do anything with the baud rate setting other than just set the port? Is it used for timing internally? If so, that would explain why flashrom doesn’t work with aliasing when I set the baud to 300 (which is actually 20000000). Thanks Jason -----Original Message----- From: Urja Rannikko [mailto:urjaman@gmail.com] Sent: Friday, August 12, 2016 10:23 AM To: Jason Jacobs <Jason.Jacobs(a)FIRSTSOLAR.COM> Cc: flashrom(a)flashrom.org Subject: Re: [flashrom] Windows Help Hi, On Thu, Aug 11, 2016 at 4:41 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > Hello, > > > > First, thanks for the awesome software and all the time you put into this. > I am trying to use it on windows with serprog. I installed libusb and > setup my device with libusb and installed the driver. How do I tell > flashrom to use my libusb device now? I tried > serprog:dev=<devicenameindevicemanager>:2000000 but it didn’t work. I > have been searching a ton on how to do this but can’t figure it out. For serprog, you shouldnt be installing a libusb driver for the device, but just a normal serial port driver (an .ini is needed for CDC ACM ports before win10, or an FTDI provided driver for ftdi devices, etc) , then use -p serprog:dev=COMx:2000000 where x is the COM port number in device manager for the serial port. (Also, be aware that this all works better on linux since thats where most of the developer resources are.)

1 0

Re: [flashrom] Windows Help
by Urja Rannikko 12 Aug '16

12 Aug '16

Hi, On Thu, Aug 11, 2016 at 4:41 PM, Jason Jacobs <Jason.Jacobs(a)firstsolar.com> wrote: > Hello, > > > > First, thanks for the awesome software and all the time you put into this. > I am trying to use it on windows with serprog. I installed libusb and setup > my device with libusb and installed the driver. How do I tell flashrom to > use my libusb device now? I tried > serprog:dev=<devicenameindevicemanager>:2000000 but it didn’t work. I have > been searching a ton on how to do this but can’t figure it out. For serprog, you shouldnt be installing a libusb driver for the device, but just a normal serial port driver (an .ini is needed for CDC ACM ports before win10, or an FTDI provided driver for ftdi devices, etc) , then use -p serprog:dev=COMx:2000000 where x is the COM port number in device manager for the serial port. (Also, be aware that this all works better on linux since thats where most of the developer resources are.)

1 0

Windows Help
by Jason Jacobs 11 Aug '16

11 Aug '16

Hello, First, thanks for the awesome software and all the time you put into this. I am trying to use it on windows with serprog. I installed libusb and setup my device with libusb and installed the driver. How do I tell flashrom to use my libusb device now? I tried serprog:dev=<devicenameindevicemanager>:2000000 but it didn't work. I have been searching a ton on how to do this but can't figure it out. Thanks Jason

1 0

Release numbering and branches
by Nico Huber 11 Aug '16

11 Aug '16

Hi folks, now that we have a git repository [1] ready (thanks Stefan!), I've visited again the flashrom development guidelines [2]. I stumbled there over a very long, exemplary version number: "0.9.10.1". IMHO, two things are wrong here: 1st there are too many dots for my taste, and 2nd the former two numbers are meaningless. To avert that, I call for naming the next release "1.0". If necessary it would get point releases "1.0.1", "1.0.2" etc, of course. Regarding the naming of release tags and branches, I really like what the Linux people do. In their naming scheme the tag for "1.0" would be named `v1.0` and the branch `flashrom-1.0.y`. With different pre- fixes for tags/branches it's always obvious what is referred to, and with a wildcard (here the `y`) in the branch name the ongoing develop- ment is emphasized. Opinions? other proposals? Nico [1] https://www.flashrom.org/git/flashrom.git/ [2] https://www.flashrom.org/Development_Guidelines

3 2

Skylarks chipsets
by Jason La Mont 10 Aug '16

10 Aug '16

Hi, Is there, or are there plans to, support the Intel skylake CM236 PCH? Thanks, Lee Sent from my iPhone

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom