flashrom

flashrom@flashrom.org

1 participants
9155 discussions

Erase failed on different chips using v0.9.1-r790
by joe black 18 Jan '10

18 Jan '10

Hi all, don't really know if it is the right list but I'll give it a shot (sorry for your inconvenient). I am doing research on different bios chips envolving rewriting of the flash chip. As time goes by, I stumbled into the same problem over and over again (increasing rapidly). At the beginning I thought it might be a Write Protection error but it seems to me that this error is too common to be a write protection kinda crap (as far as I know most of the boards nowadays don't come with write protection enabled by default). here is a couple of flashrom trys output on different chips: After finding out the right chipset and flash chip: "Intel ICH5/ICH5R" "Winbond W49V002FA" (256 KB, FWH) at physical address 0xfffc0000. I get (about) the same error when trying to write: ERASE FAILED at 0x00000000! Expected=0xff, Read-0x25, failed byte cout from 0x00000000-0x0003ffff: 0x35e74 ERASE FAILED! ERASE FAILED! FAILED! on most of the time it fails at 0x000000000 About the same error happend on: "Intel ICH6/ICH6R" "SST SST49LF003A/B" (384 KB, FWH) at physical address 0xfffa0000 page: 0000 at address: 0x00000000>>>>>>>>>0001 at address: 0x00010000>>>>>>>>>0002 at address: 0x00020000 ERASE FAILED at 0x00020000! Expected=0xff, read=0xdb, failed byte count from 0x00020000-0x0002ffff: 0xfee5 ERASE FAILED! ERASE FAILED! FAILED! Same goes for this one: "VIA VT8237" "PMC Pm49FL004" (512 KB, LPC,FWH) at physical address 0xfff80000 ERASE FAILED at 0x00000000! Expected=0xff, Read-0x49, failed byte cout from 0x00000000-0x0000ffff: 0x463 ERASE FAILED! ERASE FAILED! FAILED! Would really like some help, Thanks ahead!

1 0

[PATCH] Fix wiki erase/write columns
by Carl-Daniel Hailfinger 18 Jan '10

18 Jan '10

The write and erase column in the --list-supported-wiki output were swapped. Thanks to Michael Karcher for noticing. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-print_wiki_swap_erase_write/print_wiki.c =================================================================== --- flashrom-print_wiki_swap_erase_write/print_wiki.c (Revision 860) +++ flashrom-print_wiki_swap_erase_write/print_wiki.c (Arbeitskopie) @@ -75,7 +75,7 @@ ! align=\"left\" | Device\n! align=\"left\" | Size / KB\n\ ! align=\"left\" | Type\n! align=\"left\" colspan=\"4\" | Status\n\n\ |- bgcolor=\"#6699ff\"\n| colspan=\"4\" |  \n\ -| Probe\n| Read\n| Write\n| Erase\n\n"; +| Probe\n| Read\n| Erase\n| Write\n\n"; const char *programmer_section = "\ \n== Supported programmers ==\n\nThis is a list \ -- Developer quote of the year: "We are juggling too many chainsaws and flaming arrows and tigers."

2 2

[commit] r863 - trunk
by svn＠flashrom.org 18 Jan '10

18 Jan '10

Author: hailfinger Date: 2010-01-18 08:02:19 +0100 (Mon, 18 Jan 2010) New Revision: 863 Modified: trunk/print_wiki.c Log: The write and erase column in the --list-supported-wiki output were swapped. Thanks to Michael Karcher for noticing. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Uwe Hermann <uwe(a)hermann-uwe.de> Modified: trunk/print_wiki.c =================================================================== --- trunk/print_wiki.c 2010-01-12 23:29:30 UTC (rev 862) +++ trunk/print_wiki.c 2010-01-18 07:02:19 UTC (rev 863) @@ -75,7 +75,7 @@ ! align=\"left\" | Device\n! align=\"left\" | Size / KB\n\ ! align=\"left\" | Type\n! align=\"left\" colspan=\"4\" | Status\n\n\ |- bgcolor=\"#6699ff\"\n| colspan=\"4\" |  \n\ -| Probe\n| Read\n| Write\n| Erase\n\n"; +| Probe\n| Read\n| Erase\n| Write\n\n"; const char *programmer_section = "\ \n== Supported programmers ==\n\nThis is a list \

1 0

flashrom v0.9.1-r706 works with "Intel ICH10R" chipset and "Eon EN25F80" chip :)
by cam_daw＠fastmail.fm 18 Jan '10

18 Jan '10

Hello, This is to report that flashrom v0.9.1-r706 worked flawlessly for me - and as it is a system that has an unknown status in http://www.flashrom.org/Supported_hardware, could you please update flashrom to confirm that it now works. Details are as follows:- flashrom version: v0.9.1-r706 (that's in Ubuntu 9.10 x86_64 repositories) Board Manufacturer: Shuttle Board Model: SX58H7 Chipset: "Intel ICH10R" Chip: "Eon EN25F80" (1024 KB, SPI) at physical address 0xfff00000 The following flashrom commands work:- flashrom -V flashrom -rV saved.rom flashrom -EV flashrom -wV new.rom I've attached the output of these commands to this email. Note that the output from the "flashrom -wV new.rom" command generated a very large text file (1.8MB), but worked successfully as I verified my computer functioning with the new bios update past a cold boot. Also, after reading the updated bios rom to a file, and comparing the md5sums of the extracted rom and downloaded-from-the-web rom, the file's checksums match. So it wrote and read the rom files fine. Thanks for your excellent application flashrom - it's saved me a lot of time :) Regards, Cameron Dawdy -- cam_daw(a)fastmail.fm -- http://www.fastmail.fm - Does exactly what it says on the tin

1 0

Re: [flashrom] [PATCH] Support Intel 82F004BE/BV-T chip
by Sean Nelson 17 Jan '10

17 Jan '10

On 1/16/2010 4:21 PM, Michael Karcher wrote: > This chip is found in the ThinkPad T20. Implementation is from datasheet only, > test welcome. Be prepared for eventual failures, and do not reboot if > verify after write fails. > > Signed-off-by: Michael Karcher<flashrom(a)mkarcher.dialup.fu-berlin.de> > --- > Makefile | 2 +- > chipdrivers.h | 4 ++ > flashchips.c | 31 +++++++++++++++++++ > flashchips.h | 2 + > i28f00x.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > 5 files changed, 129 insertions(+), 1 deletions(-) > create mode 100644 i28f00x.c > > diff --git a/Makefile b/Makefile > index cdd45d1..2b882d4 100644 > --- a/Makefile > +++ b/Makefile > @@ -44,7 +44,7 @@ endif > CHIP_OBJS = jedec.o stm50flw0x0x.o w39v080fa.o sharplhf00l04.o w29ee011.o \ > sst28sf040.o am29f040b.o mx29f002.o m29f400bt.o pm29f002.o w39v040c.o \ > w49f002u.o 82802ab.o pm49fl00x.o sst49lf040.o en29f002a.o m29f002.o \ > - sst49lfxxxc.o sst_fwhub.o flashchips.o spi.o > + sst49lfxxxc.o sst_fwhub.o flashchips.o spi.o i28f00x.o > > LIB_OBJS = layout.o > > diff --git a/chipdrivers.h b/chipdrivers.h > index e7261e0..be1d00b 100644 > --- a/chipdrivers.h > +++ b/chipdrivers.h > @@ -52,11 +52,15 @@ int spi_nbyte_read(int addr, uint8_t *bytes, int len); > int spi_read_chunked(struct flashchip *flash, uint8_t *buf, int start, int len, int chunksize); > int spi_aai_write(struct flashchip *flash, uint8_t *buf); > > +/* i28f00x.c */ > +int write_28f00x(struct flashchip *flash, uint8_t *buf); > + > /* 82802ab.c */ > uint8_t wait_82802ab(chipaddr bios); > int probe_82802ab(struct flashchip *flash); > int erase_82802ab(struct flashchip *flash); > int erase_82802ab_block(struct flashchip *flash, unsigned int page, unsigned int pagesize); > +void write_page_82802ab(chipaddr bios, uint8_t *src, chipaddr dst, int page_size); > int write_82802ab(struct flashchip *flash, uint8_t *buf); > > /* am29f040b.c */ > diff --git a/flashchips.c b/flashchips.c > index 8e90d2a..3698c8c 100644 > --- a/flashchips.c > +++ b/flashchips.c > @@ -2385,6 +2385,37 @@ struct flashchip flashchips[] = { > > { > .vendor = "Intel", > + .name = "28F004BV/BE-T", > + .bustype = CHIP_BUSTYPE_PARALLEL, > + .manufacture_id = INTEL_ID, > + .model_id = P28F004BT, > + .total_size = 512, > + .page_size = 128 * 1024, /* for write_i28f00x: maximal block size */ > + .tested = TEST_UNTESTED, > + .probe = probe_jedec, > + .probe_timing = TIMING_ZERO, /* Datasheet has no timing info specified */ > + .erase = NULL, > + .block_erasers = > + { > + { > + /* Keep this the first block_erasers > + entry. The write functions spies here to > + get the chip layout */ > + .eraseblocks = { > + {128 * 1024, 3}, > + {96 * 1024, 1}, > + {8 * 1024, 2}, > + {16 * 1024, 1}, > + }, > + .block_erase = erase_82802ab_block, > + }, > + }, > + .write = write_28f00x, > + .read = read_memmapped, > + }, > + > + { > + .vendor = "Intel", > .name = "82802AB", > .bustype = CHIP_BUSTYPE_FWH, > .manufacture_id = INTEL_ID, > diff --git a/flashchips.h b/flashchips.h > index 2a4d93b..21d7ad5 100644 > --- a/flashchips.h > +++ b/flashchips.h > @@ -256,6 +256,8 @@ > #define I_82802AC 0xAC > #define P28F001BXT 0x94 /* 28F001BX-T */ > #define P28F001BXB 0x95 /* 28F001BX-B */ > +#define P28F004BT 0x78 /* 28F004BV/BE-T */ > +#define P28F004BB 0x79 /* 28F004BV/BE-B */ > #define SHARP_LH28F008SA 0xA2 /* Sharp chip, Intel Vendor ID */ > #define SHARP_LH28F008SC 0xA6 /* Sharp chip, Intel Vendor ID */ > > diff --git a/i28f00x.c b/i28f00x.c > new file mode 100644 > index 0000000..f312fb1 > --- /dev/null > +++ b/i28f00x.c > @@ -0,0 +1,91 @@ > +/* > + * This file is part of the flashrom project. > + * > + * Copyright (C) 2010 Michael Karcher<flashrom(a)mkarcher.dialup.fu-berlin.de> > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License as published by > + * the Free Software Foundation; either version 2 of the License, or > + * (at your option) any later version. > + * > + * This program is distributed in the hope that it will be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > + * GNU General Public License for more details. > + * > + * You should have received a copy of the GNU General Public License > + * along with this program; if not, write to the Free Software > + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA > + */ > + > +/* based on the Intel 82802A/B code which is > + * Copyright (C) 2000 Silicon Integrated System Corporation > + */ > + > +/* > + * Datasheet: > + * - Name: 4-Mbit (256K x 16, 512K x 8) SmartVoltage DataSheet > + * - URL: http://www.intel.com/design/archives/flash/docs/290530.HTM > + * - PDF: http://download.intel.com/design/archives/flash/docs/29053006.pdf > + * - Order number: 290430-006 > + */ > + > +#include<stdio.h> > +#include<stdlib.h> > +#include<string.h> > +#include "flash.h" > +#include "chipdrivers.h" > + > +int write_28f00x(struct flashchip *flash, uint8_t *buf) > +{ > + int i, j, blocknum; > + chipaddr bios = flash->virtual_memory; > + int blockoffset = 0; > + uint8_t *tmpbuf = malloc(flash->page_size); > + struct eraseblock * blocks = flash->block_erasers[0].eraseblocks; > + > + if (!tmpbuf) { > + printf("Could not allocate memory!\n"); > + exit(1); > + } > + printf("Programming block: \n"); > + blocknum = 0; > + for (i = 0; blocks[i].size != 0; i++) { > + for(j = 0; j< blocks[i].count; j++) { > + printf("\b\b\b\b\b\b\b\b\b\b\b\b\b\b" > + "\b\b\b\b\b\b\b\b\b\b\b\b\b"); > + printf("%04d at address: 0x%08x", blocknum, > + blockoffset); > + > + /* Auto Skip Blocks, which already contain the > + * desired data Faster, because we only write, what > + * has changed More secure, because blocks, which > + * are excluded (with the exclude or layout feature) > + * or not erased and rewritten; their data is > + * retained also in sudden power off situations > + */ > + chip_readn(tmpbuf, bios + blockoffset, blocks[i].size); > + if (!memcmp((void *)(buf + blockoffset), tmpbuf, > + blocks[i].size)) { > + printf("SKIPPED\n"); > + continue; > + } > + > + /* erase block by block and write block by block; > + this is the most secure way */ > + if (erase_82802ab_block(flash, blockoffset, > + blocks[i].size)) { > + fprintf(stderr, "ERASE FAILED!\n"); > + return -1; > + } > + write_page_82802ab(bios, buf + blockoffset, > + bios + blockoffset, blocks[i].size); > + blockoffset += blocks[i].size; > + blocknum++; > + } > + } > + printf("\n"); > + free(tmpbuf); > + > + return 0; > +} > It's great that you used block_erasers for the chip definition, but I don't understand the reason for write_28f00x. It looks exactly the same as write_82802 except for using erase blocks segments. i28f00x.c is completely unnecessary and extraneous in my opinion.

3 3

[PATCH] Support Intel 82F004BE/BV-T chip
by Michael Karcher 17 Jan '10

17 Jan '10

This chip is found in the ThinkPad T20. Implementation is from datasheet only, test welcome. Be prepared for eventual failures, and do not reboot if verify after write fails. Signed-off-by: Michael Karcher <flashrom(a)mkarcher.dialup.fu-berlin.de> --- Makefile | 2 +- chipdrivers.h | 4 ++ flashchips.c | 31 +++++++++++++++++++ flashchips.h | 2 + i28f00x.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 129 insertions(+), 1 deletions(-) create mode 100644 i28f00x.c diff --git a/Makefile b/Makefile index cdd45d1..2b882d4 100644 --- a/Makefile +++ b/Makefile @@ -44,7 +44,7 @@ endif CHIP_OBJS = jedec.o stm50flw0x0x.o w39v080fa.o sharplhf00l04.o w29ee011.o \ sst28sf040.o am29f040b.o mx29f002.o m29f400bt.o pm29f002.o w39v040c.o \ w49f002u.o 82802ab.o pm49fl00x.o sst49lf040.o en29f002a.o m29f002.o \ - sst49lfxxxc.o sst_fwhub.o flashchips.o spi.o + sst49lfxxxc.o sst_fwhub.o flashchips.o spi.o i28f00x.o LIB_OBJS = layout.o diff --git a/chipdrivers.h b/chipdrivers.h index e7261e0..be1d00b 100644 --- a/chipdrivers.h +++ b/chipdrivers.h @@ -52,11 +52,15 @@ int spi_nbyte_read(int addr, uint8_t *bytes, int len); int spi_read_chunked(struct flashchip *flash, uint8_t *buf, int start, int len, int chunksize); int spi_aai_write(struct flashchip *flash, uint8_t *buf); +/* i28f00x.c */ +int write_28f00x(struct flashchip *flash, uint8_t *buf); + /* 82802ab.c */ uint8_t wait_82802ab(chipaddr bios); int probe_82802ab(struct flashchip *flash); int erase_82802ab(struct flashchip *flash); int erase_82802ab_block(struct flashchip *flash, unsigned int page, unsigned int pagesize); +void write_page_82802ab(chipaddr bios, uint8_t *src, chipaddr dst, int page_size); int write_82802ab(struct flashchip *flash, uint8_t *buf); /* am29f040b.c */ diff --git a/flashchips.c b/flashchips.c index 8e90d2a..3698c8c 100644 --- a/flashchips.c +++ b/flashchips.c @@ -2385,6 +2385,37 @@ struct flashchip flashchips[] = { { .vendor = "Intel", + .name = "28F004BV/BE-T", + .bustype = CHIP_BUSTYPE_PARALLEL, + .manufacture_id = INTEL_ID, + .model_id = P28F004BT, + .total_size = 512, + .page_size = 128 * 1024, /* for write_i28f00x: maximal block size */ + .tested = TEST_UNTESTED, + .probe = probe_jedec, + .probe_timing = TIMING_ZERO, /* Datasheet has no timing info specified */ + .erase = NULL, + .block_erasers = + { + { + /* Keep this the first block_erasers + entry. The write functions spies here to + get the chip layout */ + .eraseblocks = { + {128 * 1024, 3}, + {96 * 1024, 1}, + {8 * 1024, 2}, + {16 * 1024, 1}, + }, + .block_erase = erase_82802ab_block, + }, + }, + .write = write_28f00x, + .read = read_memmapped, + }, + + { + .vendor = "Intel", .name = "82802AB", .bustype = CHIP_BUSTYPE_FWH, .manufacture_id = INTEL_ID, diff --git a/flashchips.h b/flashchips.h index 2a4d93b..21d7ad5 100644 --- a/flashchips.h +++ b/flashchips.h @@ -256,6 +256,8 @@ #define I_82802AC 0xAC #define P28F001BXT 0x94 /* 28F001BX-T */ #define P28F001BXB 0x95 /* 28F001BX-B */ +#define P28F004BT 0x78 /* 28F004BV/BE-T */ +#define P28F004BB 0x79 /* 28F004BV/BE-B */ #define SHARP_LH28F008SA 0xA2 /* Sharp chip, Intel Vendor ID */ #define SHARP_LH28F008SC 0xA6 /* Sharp chip, Intel Vendor ID */ diff --git a/i28f00x.c b/i28f00x.c new file mode 100644 index 0000000..f312fb1 --- /dev/null +++ b/i28f00x.c @@ -0,0 +1,91 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2010 Michael Karcher <flashrom(a)mkarcher.dialup.fu-berlin.de> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +/* based on the Intel 82802A/B code which is + * Copyright (C) 2000 Silicon Integrated System Corporation + */ + +/* + * Datasheet: + * - Name: 4-Mbit (256K x 16, 512K x 8) SmartVoltage DataSheet + * - URL: http://www.intel.com/design/archives/flash/docs/290530.HTM + * - PDF: http://download.intel.com/design/archives/flash/docs/29053006.pdf + * - Order number: 290430-006 + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include "flash.h" +#include "chipdrivers.h" + +int write_28f00x(struct flashchip *flash, uint8_t *buf) +{ + int i, j, blocknum; + chipaddr bios = flash->virtual_memory; + int blockoffset = 0; + uint8_t *tmpbuf = malloc(flash->page_size); + struct eraseblock * blocks = flash->block_erasers[0].eraseblocks; + + if (!tmpbuf) { + printf("Could not allocate memory!\n"); + exit(1); + } + printf("Programming block: \n"); + blocknum = 0; + for (i = 0; blocks[i].size != 0; i++) { + for(j = 0; j < blocks[i].count; j++) { + printf("\b\b\b\b\b\b\b\b\b\b\b\b\b\b" + "\b\b\b\b\b\b\b\b\b\b\b\b\b"); + printf("%04d at address: 0x%08x", blocknum, + blockoffset); + + /* Auto Skip Blocks, which already contain the + * desired data Faster, because we only write, what + * has changed More secure, because blocks, which + * are excluded (with the exclude or layout feature) + * or not erased and rewritten; their data is + * retained also in sudden power off situations + */ + chip_readn(tmpbuf, bios + blockoffset, blocks[i].size); + if (!memcmp((void *)(buf + blockoffset), tmpbuf, + blocks[i].size)) { + printf("SKIPPED\n"); + continue; + } + + /* erase block by block and write block by block; + this is the most secure way */ + if (erase_82802ab_block(flash, blockoffset, + blocks[i].size)) { + fprintf(stderr, "ERASE FAILED!\n"); + return -1; + } + write_page_82802ab(bios, buf + blockoffset, + bios + blockoffset, blocks[i].size); + blockoffset += blocks[i].size; + blocknum++; + } + } + printf("\n"); + free(tmpbuf); + + return 0; +} -- 1.6.5

1 0

[PATCH] [rfc/demo] implementation of the Thinkpad T20/T21/T22 host
by Michael Karcher 16 Jan '10

16 Jan '10

This mainboard uses external pins for banking the ROM chip, which seems to be impossible to do with the "internal" programmer, yet I had to clone most of the init stuff from internal.c . Hints for a clean implementation will be appreciated. --- Makefile | 2 +- flash.h | 11 ++++++ flashrom.c | 19 ++++++++++ t20.c | 108 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 139 insertions(+), 1 deletions(-) create mode 100644 t20.c diff --git a/Makefile b/Makefile index 501f65a..cdd45d1 100644 --- a/Makefile +++ b/Makefile @@ -101,7 +101,7 @@ CONFIG_PRINT_WIKI ?= no ifeq ($(CONFIG_INTERNAL), yes) FEATURE_CFLAGS += -D'INTERNAL_SUPPORT=1' -PROGRAMMER_OBJS += chipset_enable.o board_enable.o cbtable.o it87spi.o ichspi.o sb600spi.o wbsio_spi.o +PROGRAMMER_OBJS += chipset_enable.o board_enable.o cbtable.o it87spi.o ichspi.o sb600spi.o t20.o wbsio_spi.o NEED_PCI := yes endif diff --git a/flash.h b/flash.h index 9a25c70..77b0d48 100644 --- a/flash.h +++ b/flash.h @@ -58,6 +58,9 @@ enum programmer { #if INTERNAL_SUPPORT == 1 PROGRAMMER_IT87SPI, #endif +#if INTERNAL_SUPPORT == 1 + PROGRAMMER_TPT20, +#endif #if FT2232_SPI_SUPPORT == 1 PROGRAMMER_FT2232SPI, #endif @@ -435,6 +438,14 @@ uint8_t drkaiser_chip_readb(const chipaddr addr); extern struct pcidev_status drkaiser_pcidev[]; #endif +/* t20.c */ +#if INTERNAL_SUPPORT == 1 +int t20_init(void); +int t20_shutdown(void); +void t20_chip_writeb(uint8_t val, chipaddr addr); +uint8_t t20_chip_readb(const chipaddr addr); +#endif + /* satasii.c */ #if SATASII_SUPPORT == 1 int satasii_init(void); diff --git a/flashrom.c b/flashrom.c index db44c2f..7f05eeb 100644 --- a/flashrom.c +++ b/flashrom.c @@ -226,6 +226,25 @@ const struct programmer_entry programmer_table[] = { }, #endif +#if INTERNAL_SUPPORT == 1 + { + .name = "t20", + .init = t20_init, + .shutdown = t20_shutdown, + .map_flash_region = fallback_map, + .unmap_flash_region = fallback_unmap, + .chip_readb = t20_chip_readb, + .chip_readw = fallback_chip_readw, + .chip_readl = fallback_chip_readl, + .chip_readn = fallback_chip_readn, + .chip_writeb = t20_chip_writeb, + .chip_writew = fallback_chip_writew, + .chip_writel = fallback_chip_writel, + .chip_writen = fallback_chip_writen, + .delay = internal_delay, + }, +#endif + #if FT2232_SPI_SUPPORT == 1 { .name = "ft2232spi", diff --git a/t20.c b/t20.c new file mode 100644 index 0000000..d6841cc --- /dev/null +++ b/t20.c @@ -0,0 +1,108 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2010 Michael Karcher <flashrom(a)mkarcher.dialup.fu-berlin.de> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +/* Base address of register IND1 in the Field IMGA in the DSDT */ +#define IMGA1_BASE 0x15EE + +#include "flash.h" + +static uint8_t *t20_base; + +#define MAX_COUNT 20 + +static void imga1_mask(uint8_t index, uint8_t mask, uint8_t value) +{ + uint16_t temp; + int count = 0; + /* Be careful, as ACPI might use these registers too, so check + that the index is still OK. */ + do { + OUTB(index, IMGA1_BASE); + temp = INW(IMGA1_BASE); + } + while ((temp & 0xff) != index && ++count < MAX_COUNT); + if(count == MAX_COUNT) + { + printf("error: IMGA1 index stuck at %02x\n", temp & 0xff); + return; + } + temp &= ~(mask << 8); + temp |= (value & mask) << 8; + OUTW(temp, IMGA1_BASE); +} + +int t20_init(void) +{ + pacc = pci_alloc(); + pci_init(pacc); + pci_scan_bus(pacc); /* We want to get the list of devices */ + get_io_perms(); + /* ID of the graphics chip in T20/T21/T22. The mainboards are + identical in these models */ + if (!pci_card_find(0x5333, 0x8c12, 0x1014, 0x017f)) + { + msg_perr("This is not a ThinkPad T20/T21/T22\n"); + return 1; + } + if (chipset_flash_enable() == -2) { + printf("WARNING: No chipset found. Flash detection " + "will most likely fail.\n"); + } + + imga1_mask(0, 4, 4); /* Enable flash writes */ + t20_base = physmap("IBM T20 mainboard flash", 0xFFFE0000, 0x20000); + buses_supported = CHIP_BUSTYPE_PARALLEL; + return 0; +} + +int t20_shutdown(void) +{ + physunmap(t20_base, 0x20000); + imga1_mask(0, 4, 4); /* Disable flash writes */ + release_io_perms(); + pci_cleanup(pacc); + return 0; +} + +static unsigned int currentbank = -1U; + +static void switchtobank(unsigned int banknum) +{ + if (banknum > 3) + { + msg_perr("Bad bank number %d\n", banknum); + return; + } + if(banknum != currentbank) + imga1_mask(0, 3, banknum); + currentbank = banknum; +} + +void t20_chip_writeb(uint8_t val, chipaddr addr) +{ + switchtobank(addr >> 17); + mmio_writeb(val, t20_base + (addr & 0x1FFFF)); +} + +uint8_t t20_chip_readb(chipaddr addr) +{ + switchtobank(addr >> 17); + return mmio_readb(t20_base + (addr & 0x1FFFF)); +} -- 1.6.5

1 0

[PATCH] Dediprog SF100 support
by Carl-Daniel Hailfinger 14 Jan '10

14 Jan '10

Dediprog SF100 support. Very fragile, lots of stuff guessed from logs. May explode spontaneously. I think I know enough to actually use it to ID the chip, but that's it. A USB log with which includes writing an image from the original software (pretty much any image) would help clear up a few ambiguities. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-dediprog/flash.h =================================================================== --- flashrom-dediprog/flash.h (Revision 862) +++ flashrom-dediprog/flash.h (Arbeitskopie) @@ -67,6 +67,9 @@ #if BUSPIRATE_SPI_SUPPORT == 1 PROGRAMMER_BUSPIRATESPI, #endif +#if DEDIPROG_SUPPORT == 1 + PROGRAMMER_DEDIPROG, +#endif PROGRAMMER_INVALID /* This must always be the last entry. */ }; @@ -470,6 +473,10 @@ int buspirate_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr); int buspirate_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +/* dediprog.c */ +int dediprog_init(void); +int dediprog_shutdown(void); + /* flashrom.c */ extern enum chipbustype buses_supported; struct decode_sizes { Index: flashrom-dediprog/Makefile =================================================================== --- flashrom-dediprog/Makefile (Revision 862) +++ flashrom-dediprog/Makefile (Arbeitskopie) @@ -96,6 +96,9 @@ # Always enable Bus Pirate SPI for now. CONFIG_BUSPIRATESPI ?= yes +# Always enable Dediprog SF100 for now. +CONFIG_DEDIPROG ?= yes + # Disable wiki printing by default. It is only useful if you have wiki access. CONFIG_PRINT_WIKI ?= no @@ -160,6 +163,12 @@ PROGRAMMER_OBJS += buspirate_spi.o endif +ifeq ($(CONFIG_DEDIPROG), yes) +FEATURE_CFLAGS += -D'DEDIPROG_SUPPORT=1' +FEATURE_LIBS += -lusb +PROGRAMMER_OBJS += dediprog.o +endif + # Ugly, but there's no elif/elseif. ifeq ($(CONFIG_SERPROG), yes) LIB_OBJS += serial.o Index: flashrom-dediprog/flashrom.c =================================================================== --- flashrom-dediprog/flashrom.c (Revision 862) +++ flashrom-dediprog/flashrom.c (Arbeitskopie) @@ -44,7 +44,7 @@ * if more than one of them is selected. If only one is selected, it is clear * that the user wants that one to become the default. */ -#if NIC3COM_SUPPORT+GFXNVIDIA_SUPPORT+DRKAISER_SUPPORT+SATASII_SUPPORT+FT2232_SPI_SUPPORT+SERPROG_SUPPORT+BUSPIRATE_SPI_SUPPORT > 1 +#if NIC3COM_SUPPORT+GFXNVIDIA_SUPPORT+DRKAISER_SUPPORT+SATASII_SUPPORT+FT2232_SPI_SUPPORT+SERPROG_SUPPORT+BUSPIRATE_SPI_SUPPORT+DEDIPROG_SUPPORT > 1 #error Please enable either CONFIG_DUMMY or CONFIG_INTERNAL or disable support for all external programmers except one. #endif enum programmer programmer = @@ -69,6 +69,9 @@ #if BUSPIRATE_SPI_SUPPORT == 1 PROGRAMMER_BUSPIRATESPI #endif +#if DEDIPROG_SUPPORT == 1 + PROGRAMMER_DEDIPROG +#endif ; #endif @@ -283,6 +286,25 @@ }, #endif +#if DEDIPROG_SUPPORT == 1 + { + .name = "dediprog", + .init = dediprog_init, + .shutdown = dediprog_shutdown, + .map_flash_region = fallback_map, + .unmap_flash_region = fallback_unmap, + .chip_readb = noop_chip_readb, + .chip_readw = fallback_chip_readw, + .chip_readl = fallback_chip_readl, + .chip_readn = fallback_chip_readn, + .chip_writeb = noop_chip_writeb, + .chip_writew = fallback_chip_writew, + .chip_writel = fallback_chip_writel, + .chip_writen = fallback_chip_writen, + .delay = internal_delay, + }, +#endif + {}, /* This entry corresponds to PROGRAMMER_INVALID. */ }; Index: flashrom-dediprog/dediprog.c =================================================================== --- flashrom-dediprog/dediprog.c (Revision 0) +++ flashrom-dediprog/dediprog.c (Revision 0) @@ -0,0 +1,200 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2010 Carl-Daniel Hailfinger + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <string.h> +#include <stdlib.h> +#include <ctype.h> +#include <sys/types.h> +#include <usb.h> +#include "flash.h" + +#define DEFAULT_TIMEOUT 3000 +usb_dev_handle *dediprog_handle; + +void print_hex(void *buf, size_t len) +{ + size_t i; + + for (i = 0; i < len; i++) + msg_pdbg(" %02x", ((uint8_t *)buf)[i]); +} + +struct usb_device *get_device_by_vid_pid(uint16_t vid, uint16_t pid) +{ + struct usb_bus *bus; + struct usb_device *dev; + + for (bus = usb_get_busses(); bus; bus = bus->next) + for (dev = bus->devices; dev; dev = dev->next) + if ((dev->descriptor.idVendor == vid) && + (dev->descriptor.idProduct == pid)) + return dev; + + return NULL; +} + +int dediprog_init(void) +{ + struct usb_device *dev; + int ret; + char buf[0x10]; + + msg_pspew("%s\n", __func__); + + /* For now, just to make sure nothing is sent. */ + buses_supported = CHIP_BUSTYPE_NONE; + + /* Here comes the USB stuff. */ + usb_init(); + usb_find_busses(); + usb_find_devices(); + dev = get_device_by_vid_pid(0x0483, 0xdada); + if (!dev) { + msg_perr("Could not find a Dediprog SF100 on USB!\n"); + return 1; + } + msg_pdbg("Found USB device (%04x:%04x).\n", + dev->descriptor.idVendor, + dev->descriptor.idProduct); + dediprog_handle = usb_open(dev); +//int usb_control_msg(usb_dev_handle *dev, int requesttype, int request, int value, int index, char *bytes, int size, int timeout); + /* URB 6. Command A. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc3, 0xb, 0x0, 0x0, buf, 0x1, DEFAULT_TIMEOUT); + if ((ret != 0x1) || (buf[0] != 0x6f)) { + msg_perr("Unexpected response 0!\n"); + return 1; + } + /* URB 7. Command A. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc3, 0xb, 0x0, 0x0, buf, 0x1, DEFAULT_TIMEOUT); + if ((ret != 0x1) || (buf[0] != 0x6f)) { + msg_perr("Unexpected response 1!\n"); + return 1; + } + /* URB 8. Command B. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc3, 0x7, 0x0, 0xef03, buf, 0x1, DEFAULT_TIMEOUT); + /* The char casting is needed to stop gcc complaining about an always true comparison. */ + if ((ret != 0x1) || (buf[0] != (char)0xff)) { + msg_perr("Unexpected response 2!\n"); + return 1; + } + /* URB 9. Command Receive Device String. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc2, 0x8, 0xff, 0xff, buf, 0x10, DEFAULT_TIMEOUT); + if ((ret != 0x10) || !memcmp(buf, "SF100 V:2.1.1 ", 0x10)) { + msg_perr("Unexpected response 3!\n"); + return 1; + } + /* URB 10. No idea. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0x42, 0x4, 0x0, 0x0, buf, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Unexpected response 4!\n"); + return 1; + } + /* URB 11. No idea. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0x42, 0x9, 0x10, 0xff, buf, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Unexpected response 5!\n"); + return 1; + } + /* URB 12. Command Send SPI. */ + memset(buf, 0, sizeof(buf)); + /* JEDEC RDID */ + msg_pdbg("Sending RDID\n"); + buf[0] = 0x9f; + ret = usb_control_msg(dediprog_handle, 0x42, 0x1, 0xff, 0x1, buf, 0x1, DEFAULT_TIMEOUT); + if (ret != 0x1) { + msg_perr("Unexpected response 6!\n"); + return 1; + } + /* URB 13. Command Receive SPI. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc2, 0x01, 0xbb8, 0x0000, buf, 0x4, DEFAULT_TIMEOUT); + if (ret != 0x4) { + msg_perr("Unexpected response 7!\n"); + return 1; + } + msg_pdbg("Receiving response: "); + print_hex(buf, 0x10); +#if 0 + /* URB 14+15,16+17 are just RDID again. URB 18-27 are more SPI commands. */ + /* URB 28. No idea. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0x42, 0x09, 0x0, 0xff, buf, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0)) { + msg_perr("Unexpected response 8!\n"); + return 1; + } + /* URB 29-38. No idea. Wait unsuccessfully for 544 (maybe 600) ms to read one byte. + * Could also be a wait for 10 requests. + */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc2, 0x11, 0xff, 0xff, buf, 0x1, 544); + if (ret != 0x0) { + msg_perr("Unexpected response 9!\n"); + return 1; + } + /* URB 39 is just URB 11. */ + /* URB 40. No idea. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0x42, 0x61, 0x2, 0xff, buf, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Unexpected response 10!\n"); + return 1; + } + /* URB 41 is just URB 28. */ + /* URB 42,44,46,48,51,53 is just URB 8. */ + /* URB 43,45,47,49,52,54 is just URB 9. */ + /* URB 50 is just URB 6/7. */ + /* URB 55-131 is just URB 29-38. (wait unsuccessfully for 4695 (maybe 4751) ms)*/ + /* URB 132,134 is just URB 6/7. */ + /* URB 133 is just URB 29-38. */ + /* URB 135 is just URB 8. */ + /* URB 136 is just URB 9. */ + /* URB 137 is just URB 11. */ + + /* Command I is probably Start Bulk Read. Data is u16 blockcount, u16 blocksize. */ + + /* URB is just URB . */ + /* URB . No idea. */ + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, , buf, , DEFAULT_TIMEOUT); + if ((ret != 0x1) || (buf[0] != )) { + msg_perr("Unexpected response 11!\n"); + return 1; + } +#endif + + return 0; +} + +int dediprog_shutdown(void) +{ + msg_pspew("%s\n", __func__); + + if (usb_close(dediprog_handle)) { + msg_perr("Couldn't close USB device!\n"); + return 1; + } + return 0; +} -- Developer quote of the year: "We are juggling too many chainsaws and flaming arrows and tigers."

2 1

Please help!
by Maxime Perron 14 Jan '10

14 Jan '10

Hi. I tried to flash my bios by I got these errors. What should I do? My mainboard is an MSI 865PE Neo2-P, chipset 6728v2. My previous bios was version 3.6. I tried to update to version 3.A maxime@bureau:~$ sudo flashrom -w BIOS3A.ROM flashrom v0.9.1-r706 No coreboot table found. Found chipset "Intel ICH5/ICH5R", enabling flash write... OK. This chipset supports the following protocols: Non-SPI. Calibrating delay loop... OK. Found chip "SST SST49LF004A/B" (512 KB, FWH) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... ERASE FAILED at 0x000008c2! Expected=0xff, Read=0x19, failed byte count from 0x00000000-0x0000ffff: 0xf648 ERASE FAILED! ERASE FAILED! ERASE FAILED! ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at irc.freenode.net channel #flashrom or mail flashrom(a)flashrom.org ------------------------------------------------------------ DO NOT REBOOT OR POWEROFF! -- Maxime Perron

2 1

Flashrom current trunk is to circument password protections on laptops?
by jo.lee＠gmx.net 13 Jan '10

13 Jan '10

Already reported this in IRC, but was asked to send it to the mailing list: I managed to flash a password protected BIOS on an HP TC4400 without actually knowing the password, resulting in a complete erase of the whole Eeprom, including it's password and all system related information(serial number, model, etc.). The vendor tools both for DOS(rompaq) and Windows(hpqflash) won't let me do it without having to enter the password, thus I gave flashrom a try. Here's what I did(not a very elegant approach, though it worked) 1. Get Ubuntu onto USB the usual way(see System --> Sysem management --> Create 2. Create a FreeDOS floppy disk with peritools on it. Here's one containing it: http://stashbox.org/665101/DIYVDock-conf.RAR 3. Boot into Ubuntu 4. sudo setpci -s 0:1f.0 f0 5. sudo setpci -s 0:1f.0 f1 6. sudo setpci -s 0:1f.0 f2 7. sudo setpci -s 0:1f.0 f3 8. f3+f2+f1+f0 = Offset for RBCA, e.g. 0xFED90001 9. Feature flags are at RBCA+0x3418, e.g. 0xFED93418 10. Boot from floppy 11. pt MEM read 4 RBCAOffset, e.g.: pt MEM read 4 0xFED93418 12. Sample Output: 0x003400E9 13. Bit 4 from right is for SMBus --> Change to 0x003400E1: 14. pt MEM write 4 0xFED93418 0x003400E1 15. Chainload Ubuntu from FreeDOS: 16. edit A:\grub.cfg 17. add line: title Ubuntu USB 18. add line: root (hd0,0) 19. add line: kernel /casper/vmlinuz noprompt cdrom-detect/try-usb=true persistent file=/cdrom/preseed/ubuntu.seed boot=casper quiet 20. add line: initrd /casper/initrd.lz 21. start grub: grub --config-file=grubmenu.cfg 22. Boot Ubuntu by selecting it from the menu 23. sudo apt-get install subversion 24. sudo apt-get install pcilib-dev 25. Build flashrom from svn, instructions: http://www.flashrom.org/Downloads 26. flashrom -w rom.bin -V Explanations for all steps: 1: Designated for running flashrom 2: Used with a certain software(peritool) to change some contents in memory before chainbooting Ubuntu 3-14: Enable the SMBus controller. Usually, the Embedded Controller disables it, preventing certain SPI communication. In detail: 3-9: Determine offset for the Function Disable Register 10-14: Read out the current register value and change the Bit 3 to 0 (means SMBus enabled) 15-22: Chainload Ubuntu 23-25: Build current flashrom trunk 26: Flash the BIOS For backround information and an alternative, floppyless method regards 3-14, see here: http://forum.notebookreview.com/showpost.php?p=5479271&postcount=283 The most interesting part was that flashrom v0.9.1-r706 didn't do the job. It's the version which installs via apt-get install flashrom. Only the trunk version was able to do it. It failed at first try, however it used a different function to erase the Eeprom, and then was able to write it. It looks like the Embedded Controller it's doing it's job to block the usual erase function, but not the second one. That's a pretty ugly flaw. Maybe 3-14 weren't necessary at all, however I wanted to make sure there's no missing part for SPI communication. Maybe someone could verify this with another laptop. I've attached verbose output from both flashrom versions.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom