Hello, I'm trying to use flashrom to write a new bios to my device. It successfully writes the beginning of the bios and then fails with the error:
0x040000-0x040fff:W writing sector at 0xb7ea0000 failed! And again with the second erase function : Trying erase function 1... 0x000000-0x00ffff:EW, 0x010000-0x01ffff:S, 0x020000-0x02ffff:S, 0x030000-0x03ffff:S, 0x040000-0x04ffff:W writing sector at 0xb7ea0000 failed! leaving the bios in an unstable state.
Further experimentation shows that writing the bios fails on both erasing and writing any sector after 0x040000, which is exactly halfway through the bios (2Mb out of 4Mb). Reading from those areas works without a problem. The lock status for every block is reported as 00, full access. Full log is below.
I took a look at the source code for flashrom in order to see if I could easily fix the problem. I created a minimal flashrom-like clone that works with my chip:
#include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> #include <sys/mman.h>
#define D(bios, pos) *((volatile char*)bios + pos)
void write_byte(void* bios, int pos, char value) { char tmp1, tmp2; int i = 0; int tries = 4; retry: D(bios, 0x5555) = 0xAA; D(bios, 0x2AAA) = 0x55; D(bios, 0x5555) = 0xA0;
D(bios, pos) = value;
tmp1 = D(bios, 0) & 0x40; while (i++ < 0xFFFFFFF) { tmp2 = D(bios, 0) & 0x40; if (tmp1 == tmp2) { break; } tmp1 = tmp2; } if (D(bios, pos) != value) { if (tries > 0) { tries--; goto retry; } printf("Error writing value\n"); } }
void try_replace(void* bios, int pos) { printf("Pos = %x:\n", pos); printf("Old: %hhx\n", D(bios, pos)); write_byte(bios, pos, 0); printf("New: %hhx\n", D(bios, pos)); printf("\n"); }
int main() { int fd = open("/dev/mem", O_RDWR); void *bios = mmap(NULL, 0x80000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0xfff80000); char old;
try_replace(bios, 0); try_replace(bios, 0x20000); try_replace(bios, 0x3ff00); try_replace(bios, 0x40000); try_replace(bios, 0x50000); try_replace(bios, 0x60000); try_replace(bios, 0x70000);
munmap(bios, 0x80000); close(fd); return 0; } And it outputs:
Pos = 0: Old: 25 New: 0
Pos = 20000: Old: 81 New: 0
Pos = 3ff00: Old: ff New: 0
Pos = 40000: Old: ff Error writing value New: ff
Pos = 50000: Old: ff Error writing value New: ff
Pos = 60000: Old: ff Error writing value New: ff
Pos = 70000: Old: ff Error writing value New: ff
*Note that running this script will write garbage to your bios. Make sure to keep an original backup nearby.*
As you can see, the problem is easily reproducible. What can cause writing to fail on where the high bit of the address is set (0x40000-0x7ffff)?
Full log:
===========================================
flashrom v0.9.7-r1711 on Linux 2.6.35.12 (i586) flashrom is free software, get the source code at http://www.flashrom.org
flashrom was built with libpci 3.2.0, GCC 4.6.1, little endian Command line (5 args): ./flashrom --programmer internal -w my_bios -V Calibrating delay loop... OS timer resolution is 4 usecs, 78M loops per second, 10 myus = 12 us, 100 myus = 108 us, 1000 myus = 1030 us, 10000 myus = 10131 us, 16 myus = 21 us, OK. Initializing internal programmer No coreboot table found. sh: dmidecode: not found dmidecode execution unsuccessful - continuing without DMI info Found Winbond Super I/O, id 0x52 WARNING: No chipset found. Flash detection will most likely fail. The following protocols are supported: Non-SPI. Probing for AMD Am29F010A/B, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29F002(N)BB, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29F002(N)BT, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29F016D, 2048 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29F040B, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29F080B, 1024 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV001BB, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV001BT, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV002BB, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV002BT, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV004BB, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV004BT, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV008BB, 1024 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV008BT, 1024 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV040B, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMD Am29LV081B, 1024 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMIC A29002B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMIC A29002T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for AMIC A29040B, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for AMIC A49LF040A, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Atmel AT29C512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT29C010A, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT29C020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT29C040A, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Atmel AT49BV512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49F002(N), 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49F002(N)T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49(H)F010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49F020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Atmel AT49F040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Atmel AT49F080, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Atmel AT49F080T, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Atmel AT49LH002, 256 kB: probe_82802ab: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Catalyst CAT28F512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Bright BM29F040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for ESMT F49B002UA, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Eon EN29F010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Eon EN29F002(A)(N)B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Eon EN29F002(A)(N)T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Eon EN29LV640B, 8192 kB: probe_en29lv640b: id1 0x0000, id2 0x0000 Probing for Fujitsu MBM29F004BC, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Fujitsu MBM29F004TC, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Fujitsu MBM29F400BC, 512 kB: probe_m29f400bt: id1 0x25, id2 0x2d Probing for Fujitsu MBM29F400TC, 512 kB: probe_m29f400bt: id1 0x25, id2 0x2d Probing for Hyundai HY29F002T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Hyundai HY29F002B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Hyundai HY29F040A, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F001BN/BX-B, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F001BN/BX-T, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F002BC/BL/BV/BX-T, 256 kB: probe_82802ab: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F008S3/S5/SC, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F004B5/BE/BV/BX-B, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F004B5/BE/BV/BX-T, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F400BV/BX/CE/CV-B, 512 kB: probe_82802ab: id1 0x25, id2 0x2d, id1 is normal flash content, id2 is normal flash content Probing for Intel 28F400BV/BX/CE/CV-T, 512 kB: probe_82802ab: id1 0x25, id2 0x2d, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AB, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AC, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29F001B, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29F001T, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29F002(N)B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29F002(N)T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29F040, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX29LV040, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for MoselVitelic V29C51000B, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for MoselVitelic V29C51000T, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for MoselVitelic V29C51400B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for MoselVitelic V29C51400T, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for MoselVitelic V29LC51000, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for MoselVitelic V29LC51001, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for MoselVitelic V29LC51002, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm29F002T, 256 kB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm29F002B, 256 kB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm39LV010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm39LV020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm39LV040, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm39LV512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL002, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL004, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Sharp LH28F008BJT-BTLZ1, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for Sharp LHF00L04, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SST SST28SF040A, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SST SST29EE010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST29LE010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST29EE020A, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST29LE020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39SF512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39SF010A, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39SF020A, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39SF040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST39VF512, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39VF010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39VF020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST39VF040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST39VF080, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF002A/B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF003A/B, 384 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF004A/B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Found SST flash chip "SST49LF004A/B" (512 kB, FWH) at physical address 0xfff80000. Lock status for 0x000000 (size 0x010000) is 00, full access Lock status for 0x010000 (size 0x010000) is 00, full access Lock status for 0x020000 (size 0x010000) is 00, full access Lock status for 0x030000 (size 0x010000) is 00, full access Lock status for 0x040000 (size 0x010000) is 00, full access Lock status for 0x050000 (size 0x010000) is 00, full access Lock status for 0x060000 (size 0x010000) is 00, full access Lock status for 0x070000 (size 0x010000) is 00, full access Probing for SST SST49LF004C, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008A, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF008C, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF016C, 2048 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF020A, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF040B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF080A, 1024 kB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xbf, id2 0x60 Probing for SST SST49LF160C, 2048 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M29F002B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M29F002T/NT, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M29F040B, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M29F400BB, 512 kB: probe_m29f400bt: id1 0x25, id2 0x2d Probing for ST M29F400BT, 512 kB: probe_m29f400bt: id1 0x25, id2 0x2d Probing for ST M29W010B, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M29W040B, 512 kB: probe_jedec_common: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M29W512B, 64 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040A, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 kB: probe_82802ab: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW016, 2048 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW040, 512 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW080, 1024 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for ST M50LPW116, 2048 kB: probe_82802ab: id1 0x25, id2 0x7b, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS/MoselVitelic {F,S,V}29C51001B, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS/MoselVitelic {F,S,V}29C51001T, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS/MoselVitelic {F,S,V}29C51002B, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS/MoselVitelic {F,S,V}29C51002T, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS/MoselVitelic {F,S,V}29C51004B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SyncMOS/MoselVitelic {F,S,V}29C51004T, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SyncMOS/MoselVitelic {S,V}29C31004B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for SyncMOS/MoselVitelic {S,V}29C31004T, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for TI TMS29F002RB, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for TI TMS29F002RT, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W29C010(M)/W29C011A/W29EE011/W29EE012-old, 128 kB: Old Winbond W29* probe method disabled because the probing sequence puts the AMIC A49LF040A in a funky state. Use 'flashrom -c W29C010(M)/W29C011A/W29EE011/W29EE012-old' if you have a board with such a chip. Probing for Winbond W29C010(M)/W29C011A/W29EE011/W29EE012, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W29C020(C)/W29C022, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W29C040/P, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39F010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39L010, 128 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39L020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39L040, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040A, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040B, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040C, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040FA, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040FB, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V040FC, 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V080A, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W49F002U/N, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W49F020, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W49V002A, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W49V002FA, 256 kB: probe_jedec_common: id1 0xd2, id2 0xce, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V080FA, 1024 kB: probe_jedec_common: id1 0xbf, id2 0x60 Probing for Winbond W39V080FA (dual mode), 512 kB: probe_jedec_common: id1 0xbf, id2 0x60 Found SST flash chip "SST49LF004A/B" (512 kB, FWH). Lock status for 0x000000 (size 0x010000) is 00, full access Lock status for 0x010000 (size 0x010000) is 00, full access Lock status for 0x020000 (size 0x010000) is 00, full access Lock status for 0x030000 (size 0x010000) is 00, full access Lock status for 0x040000 (size 0x010000) is 00, full access Lock status for 0x050000 (size 0x010000) is 00, full access Lock status for 0x060000 (size 0x010000) is 00, full access Lock status for 0x070000 (size 0x010000) is 00, full access Flash image seems to be a legacy BIOS. Disabling coreboot-related checks. Reading old flash chip contents... done. Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:S, 0x001000-0x001fff:S, 0x002000-0x002fff:S, 0x003000-0x003fff:S, 0x004000-0x004fff:S, 0x005000-0x005fff:S, 0x006000-0x006fff:S, 0x007000-0x007fff:S, 0x008000-0x008fff:S, 0x009000-0x009fff:S, 0x00a000-0x00afff:S, 0x00b000-0x00bfff:S, 0x00c000-0x00cfff:S, 0x00d000-0x00dfff:S, 0x00e000-0x00efff:S, 0x00f000-0x00ffff:S, 0x010000-0x010fff:S, 0x011000-0x011fff:S, 0x012000-0x012fff:S, 0x013000-0x013fff:S, 0x014000-0x014fff:S, 0x015000-0x015fff:S, 0x016000-0x016fff:S, 0x017000-0x017fff:S, 0x018000-0x018fff:S, 0x019000-0x019fff:S, 0x01a000-0x01afff:S, 0x01b000-0x01bfff:S, 0x01c000-0x01cfff:S, 0x01d000-0x01dfff:S, 0x01e000-0x01efff:S, 0x01f000-0x01ffff:S, 0x020000-0x020fff:S, 0x021000-0x021fff:S, 0x022000-0x022fff:S, 0x023000-0x023fff:S, 0x024000-0x024fff:S, 0x025000-0x025fff:S, 0x026000-0x026fff:S, 0x027000-0x027fff:S, 0x028000-0x028fff:S, 0x029000-0x029fff:S, 0x02a000-0x02afff:S, 0x02b000-0x02bfff:S, 0x02c000-0x02cfff:S, 0x02d000-0x02dfff:S, 0x02e000-0x02efff:S, 0x02f000-0x02ffff:S, 0x030000-0x030fff:S, 0x031000-0x031fff:S, 0x032000-0x032fff:S, 0x033000-0x033fff:S, 0x034000-0x034fff:S, 0x035000-0x035fff:S, 0x036000-0x036fff:S, 0x037000-0x037fff:S, 0x038000-0x038fff:S, 0x039000-0x039fff:EW, 0x03a000-0x03afff:W, 0x03b000-0x03bfff:W, 0x03c000-0x03cfff:W, 0x03d000-0x03dfff:W, 0x03e000-0x03efff:W, 0x03f000-0x03ffff:W, 0x040000-0x040fff:W writing sector at 0xb7ea0000 failed! Reading current flash chip contents... done. Looking for another erase function. Trying erase function 1... 0x000000-0x00ffff:EW, 0x010000-0x01ffff:S, 0x020000-0x02ffff:S, 0x030000-0x03ffff:S, 0x040000-0x04ffff:W writing sector at 0xb7ea0000 failed! Looking for another erase function. No usable erase functions left. FAILED! Uh oh. Erase/write failed. Checking if anything changed. Your flash chip is in an unknown state. Get help on IRC at chat.freenode.net (channel #flashrom) or mail flashrom@flashrom.org with the subject "FAILED: <your board name>"! ------------------------------------------------------------------------------- DO NOT REBOOT OR POWEROFF!
On Mon, 24 Feb 2014 10:51:20 -0500 "Tim Sebastian" timtok239@linuxmail.org wrote:
Hello, I'm trying to use flashrom to write a new bios to my device. It successfully writes the beginning of the bios and then fails with the error:
0x040000-0x040fff:W writing sector at 0xb7ea0000 failed! And again with the second erase function : Trying erase function 1... 0x000000-0x00ffff:EW, 0x010000-0x01ffff:S, 0x020000-0x02ffff:S, 0x030000-0x03ffff:S, 0x040000-0x04ffff:W writing sector at 0xb7ea0000 failed! leaving the bios in an unstable state.
Further experimentation shows that writing the bios fails on both erasing and writing any sector after 0x040000, which is exactly halfway through the bios (2Mb out of 4Mb). Reading from those areas works without a problem. The lock status for every block is reported as 00, full access. Full log is below.
Our code contains the following comment: /* Contrary to the data sheet, TBL# on the SST49LF004B affects the top 128kB (instead of 64kB) * and is only honored for 64k block erase, but not 4k sector erase. */
While this does not explain the problem you are seeing, I would not be too surprised, if there are chips out there, where the affected area is even 256kB... the lock statuses are not related to this kind of protection (TBL pin) but are a software lock IIRC. If you have a multimeter then you should measure the voltage level of TBL# against ground. If it is 0 then my theory is probably correct. In that case your boards need a so-called board enable.
What board is this?
2014-02-25 23:39 GMT+01:00 Stefan Tauner <stefan.tstefan.tauner@student.tuwien.ac.at
In that case your boards need a so-called board enable.
See http://flashrom.org/Board_Enable#Reverse_Engineering_your_BIOS
Additional information and details can be found here: http://www.flashrom.org/Laptop_enable http://flashrom.org/Board_Testing_HOWTO
HTH,
Idwer
-
Idwer Vollering -
Stefan Tauner -
Tim Sebastian