Hi Ed,
On 02.08.2016 21:34, Ed Swierk wrote:
With Nico's patches, I am able to read the BIOS portion of the flash (0x08000000-0x10000000) on a Camelback Mountain board with the stock BIOS.
thanks for the report.
I haven't been able to write the BIOS portion of the flash, though, as it fails to erase the very first block. Despite the warning, the flash is left untouched.
Your log too seems incomplete (please send a full log with -o option), I can't say if it's not just due to write protection.
[...] Warning: SPI Configuration Lockdown activated.
We are only allowed to use SPI commands specified below.
[...] 0x94: 0x5006 (PREOP)
Each byte in PREOP specfies an allowed pre command (0x06 prepares for write).
0x96: 0x4ed0 (OPTYPE) 0x98: 0x0201009f (OPMENU) 0x9C: 0xc705d803 (OPMENU+4)
Each byte in OPMENU specifies an allowed SPI command.
[...] Erasing and writing flash chip... Trying erase function 0... 0x800000-0x800fff:EInvalid OPCODE 0x06, will not execute. spi_block_erase_20 failed during command execution at address 0x800000
This is supposed to fail, as SPI command 0x20 is not allowed. (It complains about 0x06 because that's always executed before 0x20).
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 1... 0x800000-0x807fff:EInvalid OPCODE 0x06, will not execute. spi_block_erase_52 failed during command execution at address 0x800000
52 is not allowed too.
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 2... 0x800000-0x80ffff:ETransaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=1, SPOP=0, COP=5, DBC=0, SME=0, SCF=4 Running OPCODE 0xd8 failed at address 0x800000 (payload length was 0). spi_block_erase_d8 failed during command execution at address 0x800000
d8 is allowed but fails, might be due to a write protection.
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 3... 0x000000-0xffffff:RTransaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=63, SME=0, SCF=4 Running OPCODE 0x03 failed at address 0x023000 (payload length was 64).
Here it tried to fall back to erasing the whole chip, which again tries to read the ME region and fails.
Can't read! Aborting. FAILED! Uh oh. Erase/write failed. Your flash chip is in an unknown state.
The warning is correct IMHO, as flashrom really doesn't know the state.
In any case you can also try the hardware sequencing mode of flashrom (see flashrom's manpage). It let's the hardware choose the opcodes based on the flash descriptor.
Nico
I flashed coreboot using an external programmer (RPi), and booted it. Now flashrom with Nico's patches works fine for reading, erasing and writing the BIOS region. Just need to specify the layout (-l) and image (-i), and verify only the region being updated (-A).
When I switch back to the stock BIOS I'll grab more debug output to figure out the write protection issue.
--Ed
On Tue, Aug 2, 2016 at 2:10 PM, Nico Huber nico.h@gmx.de wrote:
Hi Ed,
On 02.08.2016 21:34, Ed Swierk wrote:
With Nico's patches, I am able to read the BIOS portion of the flash (0x08000000-0x10000000) on a Camelback Mountain board with the stock BIOS.
thanks for the report.
I haven't been able to write the BIOS portion of the flash, though, as it fails to erase the very first block. Despite the warning, the flash is left untouched.
Your log too seems incomplete (please send a full log with -o option), I can't say if it's not just due to write protection.
[...] Warning: SPI Configuration Lockdown activated.
We are only allowed to use SPI commands specified below.
[...] 0x94: 0x5006 (PREOP)
Each byte in PREOP specfies an allowed pre command (0x06 prepares for write).
0x96: 0x4ed0 (OPTYPE) 0x98: 0x0201009f (OPMENU) 0x9C: 0xc705d803 (OPMENU+4)
Each byte in OPMENU specifies an allowed SPI command.
[...] Erasing and writing flash chip... Trying erase function 0... 0x800000-0x800fff:EInvalid OPCODE 0x06, will not execute. spi_block_erase_20 failed during command execution at address 0x800000
This is supposed to fail, as SPI command 0x20 is not allowed. (It complains about 0x06 because that's always executed before 0x20).
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 1... 0x800000-0x807fff:EInvalid OPCODE 0x06, will not execute. spi_block_erase_52 failed during command execution at address 0x800000
52 is not allowed too.
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 2... 0x800000-0x80ffff:ETransaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=1, SPOP=0, COP=5, DBC=0, SME=0, SCF=4 Running OPCODE 0xd8 failed at address 0x800000 (payload length was 0). spi_block_erase_d8 failed during command execution at address 0x800000
d8 is allowed but fails, might be due to a write protection.
Reading current flash chip contents... done. Looking for another erase function. Trying erase function 3... 0x000000-0xffffff:RTransaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=63, SME=0, SCF=4 Running OPCODE 0x03 failed at address 0x023000 (payload length was 64).
Here it tried to fall back to erasing the whole chip, which again tries to read the ME region and fails.
Can't read! Aborting. FAILED! Uh oh. Erase/write failed. Your flash chip is in an unknown state.
The warning is correct IMHO, as flashrom really doesn't know the state.
In any case you can also try the hardware sequencing mode of flashrom (see flashrom's manpage). It let's the hardware choose the opcodes based on the flash descriptor.
Nico
-
Ed Swierk -
Nico Huber