Fwd: Intel QS77 chipet on MBA 2012

[Nico Huber]

Sorry, it seems this one got lost in moderation, forwarding...

-------- Forwarded Message --------
Subject: Intel QS77 chipet on MBA 2012
Date: Wed, 24 Oct 2018 23:18:40 +0200
From: Laura Martín 
To: [e-mail]

Hi all,

I'm trying to fix a corrupted EFI on a Macbook Air 13'' of 2012. I messed
up with efibootmgr and that's the result... It's not a locked EFI, in the
laptop Gentoo is installed, so I can access to the OS, although I can't
boot from USB.

So, I modified an EFI-dump for my laptop (I checked out it's not locked as
well), I made a dump of the current EFI and replaced the serial number and
other parameters. The size is OK, I checked out with hexdump.

The stanza to made the write is:

*# flashrom -p internal:pci=8086:1e56.0 -c "MX25L6406E/MX25L6408E" -V -w
/home/m00n/nueva.rom*

The output:

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
No DMI table found.
*Found chipset "Intel QS77" with PCI ID 8086:1e56.*
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with
it,
then please email a report to [e-mail] including a verbose
(-V) log.
Thank you!
Enabling flash write... Root Complex Register Block address = 0xfed1c000
GCS = 0xc21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI)

...

BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled

....

BMWAG 0x00, BMRAG 0x00, BRWA 0xff, BRRA 0xff
0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff) is
read-write.
0x58: 0x07ff0190 FREG1: BIOS region (0x00190000-0x007fffff) is read-write.
0x5C: 0x018f0001 FREG2: Management Engine region (0x00001000-0x0018ffff) is
read-write.
0x74: 0x866f0190 PR0: Warning: 0x00190000-0x0066ffff is read-only.
0x78: 0x9fff0692 PR1: Warning: 0x00692000-0x01ffffff is read-only.
Writes have been disabled for safety reasons. You can enforce write
support with the ich_spi_force programmer option, but you will most likely
harm your hardware! If you force flashrom you will get no support if
something breaks. On a few mainboards it is possible to enable write
access by setting a jumper (see its documentation or the board itself).
0x90: 0xc4 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf94140 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=1, SME=0, SCF=1
0x94: 0x0606     (PREOP)
0x96: 0x3c6c     (OPTYPE)
0x98: 0x0103029f (OPMENU)
0x9c: 0xffd82005 (OPMENU+4)
0xA0: 0x00000000 (BBAR)
0xC4: 0x00800000 (LVSCC)
LVSCC: BES=0x0, WG=0, WSR=0, WEWS=0, EO=0x0, VCL=1
0xC8: 0x00002005 (UVSCC)
UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20
0xD0: 0x00000000 (FPB)
OK.
Unhandled programmer parameters: pci=8086:1e56.0
Aborting.
Error: Programmer initialization failed.
Restoring MMIO space at 0x7f50ae5978a0
Restoring PCI config space for 00:1f:0 reg 0xdc

So, what I'm doing wrong? It's an old laptop and with external devices I've
read that it's possible to flash, From the same device it should be
possible to do it .... I suppose that I'm missing some parameter.... But I
can't find which.

Any help would be appreciated... KR

[Antonio Ospite]

On Thu, 25 Oct 2018 17:22:48 +0200
Nico Huber  wrote:
> Sorry, it seems this one got lost in moderation, forwarding...

JFYI I got both this one and what appears to be the original message.
> -------- Forwarded Message --------
> Subject: Intel QS77 chipet on MBA 2012
> Date: Wed, 24 Oct 2018 23:18:40 +0200
> From: Laura Martín 
> To: [e-mail]
>
> Hi all,
>
> I'm trying to fix a corrupted EFI on a Macbook Air 13'' of 2012. I messed
> up with efibootmgr and that's the result... It's not a locked EFI, in the
> laptop Gentoo is installed, so I can access to the OS, although I can't
> boot from USB.
>
> So, I modified an EFI-dump for my laptop (I checked out it's not locked as
> well), I made a dump of the current EFI and replaced the serial number and
> other parameters. The size is OK, I checked out with hexdump.
>
> The stanza to made the write is:
>
> *# flashrom -p internal:pci=8086:1e56.0 -c "MX25L6406E/MX25L6408E" -V -w
> /home/m00n/nueva.rom*

[...]
> Writes have been disabled for safety reasons. You can enforce write
> support with the ich_spi_force programmer option, but you will most likely
> harm your hardware! If you force flashrom you will get no support if
> something breaks. On a few mainboards it is possible to enable write
> access by setting a jumper (see its documentation or the board itself).

This message from flashrom suggest to use the ich_spi_force option, and
the man page states that it can be used by adding this to the command
line:

-p internal:ich_spi_force=yes

Flashrom also says:
> Unhandled programmer parameters: pci=8086:1e56.0

I guess the "internal" programmer auto-discovers the PCI device, so
maybe that part can be removed from the -p option.

Your command line becomes:

# flashrom -p internal:ich_spi_force=yes -c "MX25L6406E/MX25L6408E" -V -w /home/m00n/nueva.rom

Note that flashrom also says that it takes no responsibility for any
damage; so, before proceeding, I'd check if flashing externally is
possible/easy, just in case something goes wrong with "-p internal".

Ciao,
   Antonio

[Angel Pons]

Hello,
> 0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-write.
> 0x58: 0x07ff0190 FREG1: BIOS region (0x00190000-0x007fffff) is read-write.
> 0x5C: 0x018f0001 FREG2: Management Engine region (0x00001000-0x0018ffff) is read-write.

I see you made all the flash regions read-write. This means region
protections should not be a problem to use flashrom.
> 0x74: 0x866f0190 PR0: Warning: 0x00190000-0x0066ffff is read-only.
> 0x78: 0x9fff0692 PR1: Warning: 0x00692000-0x01ffffff is read-only.

AFAIK, this means flashing internally a complete image may not work.
However, if you only want to restore the EFI variables region, you
should tell flashrom to only write to the EFI variables region (which
I imagine is not write-protected) using a layout file. Since you know
the rest of the firmware is working properly, it is safer to only
change what is not working.

Best regards,

Angel Pons Pons