Looks like it failed to overwrite the descriptor region (Intel ME-related headache): https://www.flashrom.org/ME

You can target regions more carefully using a layout file. It appears the other regions (ME, BIOS, GbE) are unlocked, so you can try creating a layout that includes only those regions.

On Mon, Dec 19, 2016 at 7:54 PM, Shawn <citypw@gmail.com> wrote:
Hi flashrom maintainers,

I failed to write a modified ROM to the flash via internal. Maybe this
chipset can only be writable via external programmer?

root@sysresccd /root % flashrom -p internal
flashrom v0.9.8-r1888 on Linux 4.4.28-std490-amd64 (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
Found chipset "Intel B75".
Enabling flash write... Warning: SPI Configuration Lockdown activated.
OK.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) mapped at
physical address 0xff800000.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) mapped at
physical address 0xff800000.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI)
mapped at physical address 0xff800000.
Found Macronix flash chip
"MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) mapped at
physical address 0xff800000.
Multiple flash chip definitions match the detected chip(s):
"MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E",
"MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Please specify which chip definition to use with the -c <chipname> option.


root@sysresccd /root % flashrom -VV -p internal -c MX25L6405  -w
factory_giga1.bin.new.new
flashrom v0.9.8-r1888 on Linux 4.4.28-std490-amd64 (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

flashrom was built with libpci 3.4.1, GCC 4.8.5, little endian
Command line (7 args): flashrom -VV -p internal -c MX25L6405 -w
factory_giga1.bin.new.new
Calibrating delay loop... OS timer resolution is 1 usecs, 1944M loops
per second, 10 myus = 10 us, 100 myus = 117 us, 1000 myus = 1021 us,
10000 myus = 10021 us, 4 myus = 4 us, OK.
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
DMI string chassis-type: "Desktop"
DMI string system-manufacturer: "Gigabyte Technology Co., Ltd."
DMI string system-product-name: "To be filled by O.E.M."
DMI string system-version: "To be filled by O.E.M."
DMI string baseboard-manufacturer: "Gigabyte Technology Co., Ltd."
DMI string baseboard-product-name: "B75M-D3V"
DMI string baseboard-version: "To be filled by O.E.M."
Found ITE Super I/O, ID 0x8728 on port 0x2e
Found chipset "Intel B75" with PCI ID 8086:1e49.
Enabling flash write... Root Complex Register Block address = 0xfed1c000
GCS = 0xc64: BIOS Interface Lock-Down: disabled, Boot BIOS Straps: 0x3 (SPI)
Top Swap: enabled (A16(+) inverted)
0xfff80000/0xffb80000 FWH IDSEL: 0x0
0xfff00000/0xffb00000 FWH IDSEL: 0x0
0xffe80000/0xffa80000 FWH IDSEL: 0x1
0xffe00000/0xffa00000 FWH IDSEL: 0x1
0xffd80000/0xff980000 FWH IDSEL: 0x2
0xffd00000/0xff900000 FWH IDSEL: 0x2
0xffc80000/0xff880000 FWH IDSEL: 0x3
0xffc00000/0xff800000 FWH IDSEL: 0x3
0xff700000/0xff300000 FWH IDSEL: 0x4
0xff600000/0xff200000 FWH IDSEL: 0x5
0xff500000/0xff100000 FWH IDSEL: 0x6
0xff400000/0xff000000 FWH IDSEL: 0x7
0xfff80000/0xffb80000 FWH decode enabled
0xfff00000/0xffb00000 FWH decode enabled
0xffe80000/0xffa80000 FWH decode enabled
0xffe00000/0xffa00000 FWH decode enabled
0xffd80000/0xff980000 FWH decode enabled
0xffd00000/0xff900000 FWH decode enabled
0xffc80000/0xff880000 FWH decode enabled
0xffc00000/0xff800000 FWH decode enabled
0xff700000/0xff300000 FWH decode enabled
0xff600000/0xff200000 FWH decode enabled
0xff500000/0xff100000 FWH decode enabled
0xff400000/0xff000000 FWH decode enabled
Maximum FWH chip size: 0x100000 bytes
SPI Read Configuration: prefetching enabled, caching enabled,
BIOS_CNTL = 0x09: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
SPIBAR = 0xf7795000 + 0x3800
0x04: 0xe008 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=1
Warning: SPI Configuration Lockdown activated.
Reading OPCODES... done
        OP        Type      Pre-OP
op[0]: 0x02, write w/  addr, none
op[1]: 0x03, read  w/  addr, none
op[2]: 0x20, write w/  addr, none
op[3]: 0x05, read  w/o addr, none
op[4]: 0x9f, read  w/o addr, none
op[5]: 0x01, write w/o addr, none
op[6]: 0x00, read  w/o addr, none
op[7]: 0x00, read  w/o addr, none
Pre-OP 0: 0x06, Pre-OP 1: 0x00
0x06: 0x0000 (HSFC)
HSFC: FGO=0, FCYCLE=0, FDBC=0, SME=0
0x08: 0x00000000 (FADDR)
0x50: 0x0000ffff (FRAP)
BMWAG 0x00, BMRAG 0x00, BRWA 0xff, BRRA 0xff
0x54: 0x00000000 FREG0: Flash Descriptor region
(0x00000000-0x00000fff) is read-write.
0x58: 0x07ff0000 FREG1: BIOS region (0x00000000-0x007fffff) is read-write.
0x5C: 0x04ff0001 FREG2: Management Engine region
(0x00001000-0x004fffff) is read-write.
0x60: 0x00001fff FREG3: Gigabit Ethernet region is unused.
0x64: 0x00001fff FREG4: Platform Data region is unused.
0x74: 0x00000000 (PR0 is unused)
0x78: 0x00000000 (PR1 is unused)
0x7C: 0x00000000 (PR2 is unused)
0x80: 0x00000000 (PR3 is unused)
0x84: 0x00000000 (PR4 is unused)
0x90: 0x84 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf94240 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=2, SME=0, SCF=1
0x94: 0x0006     (PREOP)
0x96: 0x043b     (OPTYPE)
0x98: 0x05200302 (OPMENU)
0x9C: 0x0000019f (OPMENU+4)
0xA0: 0x00000000 (BBAR)
0xC4: 0x00802005 (LVSCC)
LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
0xC8: 0x00002005 (UVSCC)
UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20
0xD0: 0x00000000 (FPB)
Reading flash descriptors mapped by the chipset via FDOC/FDOD... done.
=== Content Section ===
FLVALSIG 0x0ff0a55a
FLMAP0   0x02040003
FLMAP1   0x12100206
FLMAP2   0x00210120

--- Details ---
NR          (Number of Regions):                     3
FRBA        (Flash Region Base Address):         0x040
NC          (Number of Components):                  1
FCBA        (Flash Component Base Address):      0x030
ISL         (ICH/PCH Strap Length):                 18
FISBA/FPSBA (Flash ICH/PCH Strap Base Address):  0x100
NM          (Number of Masters):                     3
FMBA        (Flash Master Base Address):         0x060
MSL/PSL     (MCH/PROC Strap Length):                 1
FMSBA       (Flash MCH/PROC Strap Base Address): 0x200

=== Component Section ===
FLCOMP   0x09300024
FLILL    0x00000000

--- Details ---
Component 1 density:            8 MB
Component 2 is not used.
Read Clock Frequency:           20 MHz
Read ID and Status Clock Freq.: 33 MHz
Write and Erase Clock Freq.:    33 MHz
Fast Read is supported.
Fast Read Clock Frequency:      33 MHz
Dual Output Fast Read Support:  enabled
No forbidden opcodes.

=== Region Section ===
FLREG0   0x00000000
FLREG1   0x07ff0000
FLREG2   0x04ff0001
FLREG3   0x00001fff
FLREG4   0x00001fff

--- Details ---
Region 0 (Descr.) 0x00000000 - 0x00000fff
Region 1 (BIOS  ) 0x00000000 - 0x007fffff
Region 2 (ME    ) 0x00001000 - 0x004fffff
Region 3 (GbE   ) is unused.
Region 4 (Platf.) is unused.

=== Master Section ===
FLMSTR1  0xffff0000
FLMSTR2  0xffff0000
FLMSTR3  0xffff0118

--- Details ---
      Descr. BIOS ME GbE Platf.
BIOS    rw    rw  rw  rw   rw
ME      rw    rw  rw  rw   rw
GbE     rw    rw  rw  rw   rw

OK.
No IT87* serial flash segment enabled.
The following protocols are supported: FWH, SPI.
Probing for Macronix MX25L6405, 8192 kB: probe_spi_rdid_generic: id1
0xc2, id2 0x2017
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) mapped at
physical address 0xff800000.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Block protection is disabled.
Flash image seems to be a legacy BIOS. Disabling coreboot-related checks.
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0...
0x000000-0x00ffff:EFAILED at 0x00001000! Expected=0xff, Found=0x20,
failed byte count from 0x00000000-0x0000ffff: 0xb55d
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 1... 0x000000-0x00ffff:EInvalid OPCODE 0x06,
will not execute.
spi_block_erase_d8 failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 2... 0x000000-0x7fffff:EInvalid OPCODE 0x06,
will not execute.
spi_chip_erase_60 failed during command execution
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 3... 0x000000-0x7fffff:EInvalid OPCODE 0x06,
will not execute.
spi_chip_erase_c7 failed during command execution
Looking for another erase function.
No usable erase functions left.
FAILED!
Uh oh. Erase/write failed. Checking if anything has changed.
Reading current flash chip contents... done.
Apparently at least some data has changed.
Your flash chip is in an unknown state.
Get help on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org with the subject "FAILED: <your board name>"!
-------------------------------------------------------------------------------
DO NOT REBOOT OR POWEROFF!
Restoring MMIO space at 0xf77988a0
Restoring PCI config space for 00:1f:0 reg 0xdc


--
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn

_______________________________________________
flashrom mailing list
flashrom@flashrom.org
https://www.flashrom.org/mailman/listinfo/flashrom