Re: [flashrom] flashrom cannot write on ecs-A785GM-M7

[Carl-Daniel Hailfinger]

Hi Beeblebrox,

thanks for your report.

Am 24.08.2013 16:34 schrieb Beeblebrox:
> Unless I'm doing something seriously wrong,

You're doing it right, but your hardware has some quirks which can only
be handled by flashrom 0.9.7 or later.
> flashrom cannot write to my BIOS. output of command attached.
> flashrom -V -p internal -w 7857B916.ROM -o writelog.txt
>
> A non-text attachment 7857B916.ROM has been stripped. It is available at
> http://paste.flashrom.org/view.php?id=1760
>
> flashrom v0.9.6.1-r1564 on FreeBSD 9.2-PRERELEASE (amd64)
> flashrom was built with libpci 3.1.10, GCC 4.2.1 20070831 patched [FreeBSD], little endian
> Command line (7 args): flashrom -V -p internal -w 7857B916.ROM -o writelog.txt
> Calibrating delay loop... OS timer resolution is 1 usecs, 1642M loops per second, 10 myus = 11 us, 100 myus = 98 us, 1000 myus = 1021 us, 10000 myus = 9865 us, 4 myus = 5 us, OK.
> Initializing internal programmer
> No coreboot table found.
> DMI string system-manufacturer: "ECS"
> DMI string system-product-name: "A785GM-M7"
> DMI string system-version: "1.0                   "
> DMI string baseboard-manufacturer: "ECS"
> DMI string baseboard-product-name: "A785GM-M7"
> DMI string baseboard-version: "1.0                   "
> DMI string chassis-type: "Desktop"
> W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect.
> Active config mode, unknown reg 0x20 ID: 00.
> Please send the output of "flashrom -V" to 
> [e-mail] with W836xx: your board name: flashrom -V
> as the subject to help us finish support for your Super I/O. Thanks.

This is very interesting. It might be related to AMD IMC, but I'm not sure.
> Found ITE Super I/O, ID 0x8726 on port 0x2e
> Found chipset "AMD SB7x0/SB8x0/SB9x0" with PCI ID 1002:439d. Enabling flash write... SPI base address is at 0xfec10000
> AltSpiCSEnable=0, SpiRomEnable=1, AbortEnable=0
> PrefetchEnSPIFromIMC=1, PrefetchEnSPIFromHost=1, SpiOpEnInLpcMode=1
> SpiArbEnable=1, SpiAccessMacRomEn=1, SpiHostAccessRomEn=1, ArbWaitCount=4, SpiBridgeDisable=1, DropOneClkOnRd=0
> NormSpeed is 33 MHz
> GPIO11 used for SPI_DO
> GPIO12 used for SPI_DI
> GPIO31 used for SPI_HOLD
> GPIO32 used for SPI_CS
> GPIO47 used for SPI_CLK
> SB700 IMC is active.
> The SB700 IMC is active and may interfere with SPI commands. Disabling write.

Could you please retry with flashrom 0.9.7, preferably just reading the
flash chip and producing a log file? See below for instructions.
> ROM strap override is not active
> OK.
> Super I/O ID 0x8726 is not on the list of flash capable controllers.

It would be great if you could run the following command with flashrom
0.9.7.
flashrom -p internal --output readlog.txt -r backup.bin

Then please send readlog.txt to this mailing list. I hope to get further
insight from this.

Regards,
Carl-Daniel

flashrom cannot write on ecs-A785GM-M7

[Stefan Tauner]

On Tue, 27 Aug 2013 01:53:03 +0200
Carl-Daniel Hailfinger  wrote:
> Hi Beeblebrox,
>
> thanks for your report.
>
> Am 24.08.2013 16:34 schrieb Beeblebrox:
> > Unless I'm doing something seriously wrong,
>
> You're doing it right, but your hardware has some quirks which can only
> be handled by flashrom 0.9.7 or later.

Sadly it does not even work with my AMD patches on top of a recent HEAD:
> flashrom v0.9.7-r on FreeBSD 9.2-PRERELEASE (amd64)
> flashrom was built with libpci 3.2.0, LLVM Clang 3.3 (tags/RELEASE_33/final 183502), little endian
> Command line (5 args): ./flashrom -V -p internal -o amd-probe.log
> Calibrating delay loop... OS timer resolution is 1 usecs, 1109M loops per second, 10 myus = 11 us, 100 myus = 103 us, 1000 myus = 1000 us, 10000 myus = 10095 us, 4 myus = 5 us, OK.
> Initializing internal programmer
> No coreboot table found.
> DMI string system-manufacturer: "ECS"
> DMI string system-product-name: "A785GM-M7"
> DMI string system-version: "1.0                   "
> DMI string baseboard-manufacturer: "ECS"
> DMI string baseboard-product-name: "A785GM-M7"
> DMI string baseboard-version: "1.0                   "
> DMI string chassis-type: "Desktop"
> W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect.
> Active config mode, unknown reg 0x20 ID: 00.
> Please send the output of "flashrom -V" to 
> [e-mail] with W836xx: your board name: flashrom -V
> as the subject to help us finish support for your Super I/O. Thanks.
> Found ITE Super I/O, ID 0x8726 on port 0x2e
> Found chipset "AMD SB7x0/SB8x0/SB9x0" with PCI ID 1002:439d. Enabling flash write... SPI base address is at 0xfec10000
> Trying to determine the generation of the SPI interface... SB7xx/SP5100 detected.
> SpiRomEnable=1, AltSpiCSEnable=0, AbortEnable=0, PrefetchEnSPIFromIMC=1, SpiOpEnInLpcMode=1, PrefetchEnSPIFromHost=1
> (0x0cc82390) SpiArbEnable=1, SpiAccessMacRomEn=1, SpiHostAccessRomEn=1, ArbWaitCount=4, SpiBridgeDisable=1, DropOneClkOnRd/SpiClkGate=0, SpiBusy=0
> GPIO11 used for SPI_DO
> GPIO12 used for SPI_DI
> GPIO31 used for SPI_HOLD
> GPIO32 used for SPI_CS
> GPIO47 used for SPI_CLK
> NormSpeed is 33 MHz
> Setting SPI clock to 16.5 MHz (0x3).
> Writes have been disabled for safety reasons because the presence of the IMC
> was detected and it could interfere with accessing flash memory. Flashrom will
> try to disable it temporarily but even then this might not be safe:
> when it is reenabled and after a reboot it expects to find working code
> in the flash and it is unpredictable what happens if there is none.
>
> To be safe make sure that there is a working IMC firmware at the right
> location in the image you intend to write and do not attempt to erase.
>
> You can enforce write support with the amd_imc_force programmer option.
> IMC SIO is at 0x4e.
> IMC MBOX is at 0x3e.
> IMC MBOX: Timeout!
> Shutting down IMC failed.
> ROM strap override is not active
> FAILED!
> FATAL ERROR!
> Error: Programmer initialization failed.
> Restoring MMIO space at 0x8007a200d

Beeblebrox: Please keep the mailing list always at least in Cc: so that
everyone gets your messages and please do not post binary blobs of
proprietary firmware (copyright).

The problem is not clang as you suggested, but the configuration of the
AMD integrated microcontroller (IMC). That's a small CPU inside the
chipset that is independent of the main x86 CPU and shares the flash
space with it. There is a mechanism to tell the IMC to leave the flash
alone so that we can update it safely but that is not documented (very
well). In some cases, yours included, we see the interface to the IMC
set up but it does not reply to our requests. It is unknown to us if we
are just using the wrong messages or if it is disabled or whatever.

AFAICS there is a valid IMC blob in the vendor images so I guess the IMC
is really active in your configuration too, but maybe it crashed. Maybe
Rudolf has any ideas (and time to reply :) He did figure out the whole
IMC interface...

flashrom cannot write on ecs-A785GM-M7

[Beeblebrox]

As you have requested, from recently built flashrom in git repo:
/sourcefiles/flashrom> # ./flashrom -p internal --output readlog.txt -r
backup.bin
IMC MBOX: Timeout!
Shutting down IMC failed.
FAILED!
FATAL ERROR!
Error: Programmer initialization failed.

I assume 0.97 <= HEAD (?). Logfile attached. I am going to go ahead and
flash the BIOS using some other method. Will try and continue to support
your info/test requests in the mean time.
Regards.