adding support for PCIe SPI flash?

[John Paul Morrison]

Hi

I'm just starting to look at fashrom to see how to read/update SPI flash on
a PCIe card

lspci -d 1106:3483
01:00.0 USB controller: VIA Technologies, Inc. VL805 USB 3.0 Host
Controller (rev 01)

There isn't much from Via but the chipset is used in the Raspberry Pi 4 and
the Pi firmware provides a flash tool vl805 (no source code of course!)

I can run it on Intel with Qemu - unfortunately for me the tool is hard
coded for a different SPI flash chip (and in later Pi hardware seems to
have been moved/removed)

Inspecting the board and related datasheets (VL800) the chipset has an SPI
interface for firmware, and it can be used for PCI BIOS apparently.  The
actual SPI chip varies from board to board - mine is FM25Q04 from the data
sheet ID=A112. Raspberry Pi seems to use W25X10BV  based on the ID EF10

Are there any simple examples of accessing SPI on PCIe cards?

sorry for the long post - I've included a bit  more info on what I could
find on the chip

thanks

John Paul

Other info on the chip:

I can  read the firmware version easily:

sudo lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version: " $5
$4 $3 $2 }'

I can use strace to see what vl805 doing - I can make out some SPI commands
- here it reads the SPI flash chip ID:
openat(AT_FDCWD, "/sys/bus/pci/devices/0000:01:00.0/config", O_RDWR) = 4
(bunch of reads/writes)
pread64(4, "\22\241\22\241", 4, 124)    = 4
write(1, "R Rx_REG0 a112a112\n", 19)    = 19

sudo ~/vl805/vl805 -d
VL805 FW version: 00013600
W CHIP_SEL 00000001
R PCI_WB_EN ffffffff
W PCI_WB_EN ffffff01
R STOP_POLLING 00000001
W STOP_POLLING 00000001
W CTRL_REG 000005a0
W CLK_DIV 0000000a
W CHIP_SEL 00000000
W Tx_REG0 90000000
W CTRL_REG 000005c0
R Rx_REG0 a112a112
W CHIP_SEL 00000001
* flash ID mismatch - found a112, expected 0000ef10

I was able to find a Windows based firmware updater which supports about 20
different SPI chips - people have reported adding new chipsets, looks like
I have to add mine as well.
The flash tool runs under wine but it can't read anything - will have to
find a fix or run in a vm.

Via SpiFlash.ini:
[MX25L512]
FlashID=C22010
ReadID=9F
WriteEnable=06
WriteStatus=01
ChipErase=60
ReadData=03
ReadStatus=05
PageProgram=02
ClockRate=32
PageSize=100

Raspberry Pi 4 ?
[W25X10BV]
FlashID=EF10
ReadID=90000000
WriteEnable=06
WriteStatus=01
ChipErase=C7
ReadData=03
ReadStatus=05
PageProgram=02
ClockRate=32
PageSize=10

adding support for PCIe SPI flash? VL805 USB

[Carl-Daniel Hailfinger]

Hi John Paul,

Am 02.02.21 um 20:12 schrieb John Paul Morrison:
> I'm just starting to look at fashrom to see how to read/update SPI
> flash on a PCIe card
>
> lspci -d 1106:3483
> 01:00.0 USB controller: VIA Technologies, Inc. VL805 USB 3.0 Host
> Controller (rev 01)
>
> There isn't much from Via but the chipset is used in the Raspberry Pi
> 4 and the Pi firmware provides a flash tool vl805 (no source code of
> course!)

I have a working flashrom driver for that host controller, but I need
testers. Back when I wrote the driver at the end of 2019 I didn't even
have a Raspberry Pi 4 and was just reverse engineering the behaviour
from traces with some help from clever on IRC.
> I can run it on Intel with Qemu - unfortunately for me the tool is
> hard coded for a different SPI flash chip (and in later Pi hardware
> seems to have been moved/removed)
>
> Inspecting the board and related datasheets (VL800) the chipset has an
> SPI interface for firmware, and it can be used for PCI BIOS
> apparently.  The actual SPI chip varies from board to board - mine is
> FM25Q04 from the data sheet ID=A112. Raspberry Pi seems to use
> W25X10BV  based on the ID EF10
>
> Are there any simple examples of accessing SPI on PCIe cards?
>
> sorry for the long post - I've included a bit  more info on what I
> could find on the chip

Thanks.

I really should update the VL805 patch against current flashrom and
submit it.
> thanks
>
> John Paul

Regards,
Carl-Daniel
> Other info on the chip:
>
> I can  read the firmware version easily:
>
> sudo lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version:
> " $5 $4 $3 $2 }'
>
> I can use strace to see what vl805 doing - I can make out some SPI
> commands - here it reads the SPI flash chip ID:
> openat(AT_FDCWD, "/sys/bus/pci/devices/0000:01:00.0/config", O_RDWR) = 4
> (bunch of reads/writes)
> pread64(4, "\22\241\22\241", 4, 124)    = 4                          
> write(1, "R Rx_REG0 a112a112\n", 19)    = 19
>
> sudo ~/vl805/vl805 -d
> VL805 FW version: 00013600
> W CHIP_SEL 00000001
> R PCI_WB_EN ffffffff
> W PCI_WB_EN ffffff01
> R STOP_POLLING 00000001
> W STOP_POLLING 00000001
> W CTRL_REG 000005a0
> W CLK_DIV 0000000a
> W CHIP_SEL 00000000
> W Tx_REG0 90000000
> W CTRL_REG 000005c0
> R Rx_REG0 a112a112
> W CHIP_SEL 00000001
> flash ID mismatch - found a112, expected 0000ef10
>
> I was able to find a Windows based firmware updater which supports
> about 20 different SPI chips - people have reported adding new
> chipsets, looks like I have to add mine as well. 
> The flash tool runs under wine but it can't read anything - will have
> to find a fix or run in a vm.
>
> Via SpiFlash.ini:
> [MX25L512]
> FlashID=C22010
> ReadID=9F
> WriteEnable=06
> WriteStatus=01
> ChipErase=60
> ReadData=03
> ReadStatus=05
> PageProgram=02
> ClockRate=32
> PageSize=100
>
> Raspberry Pi 4 ?
> [W25X10BV]
> FlashID=EF10
> ReadID=90000000
> WriteEnable=06
> WriteStatus=01
> ChipErase=C7
> ReadData=03
> ReadStatus=05
> PageProgram=02
> ClockRate=32
> PageSize=10

adding support for PCIe SPI flash? VL805 USB

[John Paul Morrison]

Thanks Carl-Daniel

I have a couple of these VL805 cards to test with - I don't have a Pi but
your code should work if I can add the FM25Q04
Not too worried about bricking - cheap on Amazon. From Ubuntuforms it
sounds like you can recover pretty easily from erased firmware using the
windows based VIA programmer.

do you have a tarball/zip/git of your build?

thanks, again,

John Paul

Link to the datasheet:

FM25Q04_ds_eng.pdf (fmsh.com) http://eng.fmsh.com/nvm/FM25Q04_ds_eng.pdf

For the Windows tool my guess is to add this to the firmware updaters
spiflash.ini  but won't be able to test for a couple of days.
The commands seem to be pretty standard and match the datasheet.
I'm not sure about the ClockRate - most flash ships are set to 32 but not
all.
Page size 0x100 (256) is used by almost all but exceptions are MX25L5121E
(0x20)  AT25F512A(0x80), and W25X10BV(0x10)
I haven't looked up all the chips but some of them had a page size of 0x100
but the firmware tool sets a smaller value.
e.g. W25X10BV datasheet says its page size is 0x100 but the tool sets it to
0x10 - maybe there's reasons to program with smaller pages?

[FM25Q04]
FlashID=A112
ReadID=9F
WriteEnable=06
WriteStatus=01
ChipErase=C7
ReadData=03
ReadStatus=05
PageProgram=02
ClockRate=32
PageSize=100

On Tue, Feb 2, 2021 at 2:53 PM Carl-Daniel Hailfinger <
[e-mail]> wrote:
> Hi John Paul,
>
> Am 02.02.21 um 20:12 schrieb John Paul Morrison:
> > I'm just starting to look at fashrom to see how to read/update SPI
> > flash on a PCIe card
> >
> > lspci -d 1106:3483
> > 01:00.0 USB controller: VIA Technologies, Inc. VL805 USB 3.0 Host
> > Controller (rev 01)
> >
> > There isn't much from Via but the chipset is used in the Raspberry Pi
> > 4 and the Pi firmware provides a flash tool vl805 (no source code of
> > course!)
>
> I have a working flashrom driver for that host controller, but I need
> testers. Back when I wrote the driver at the end of 2019 I didn't even
> have a Raspberry Pi 4 and was just reverse engineering the behaviour
> from traces with some help from clever on IRC.
> > I can run it on Intel with Qemu - unfortunately for me the tool is
> > hard coded for a different SPI flash chip (and in later Pi hardware
> > seems to have been moved/removed)
> >
> > Inspecting the board and related datasheets (VL800) the chipset has an
> > SPI interface for firmware, and it can be used for PCI BIOS
> > apparently.  The actual SPI chip varies from board to board - mine is
> > FM25Q04 from the data sheet ID=A112. Raspberry Pi seems to use
> > W25X10BV  based on the ID EF10
> >
> > Are there any simple examples of accessing SPI on PCIe cards?
> >
> > sorry for the long post - I've included a bit  more info on what I
> > could find on the chip
>
> Thanks.
>
> I really should update the VL805 patch against current flashrom and
> submit it.
> > thanks
> >
> > John Paul
>
> Regards,
> Carl-Daniel
> > Other info on the chip:
> >
> > I can  read the firmware version easily:
> >
> > sudo lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version:
> > " $5 $4 $3 $2 }'
> >
> > I can use strace to see what vl805 doing - I can make out some SPI
> > commands - here it reads the SPI flash chip ID:
> > openat(AT_FDCWD, "/sys/bus/pci/devices/0000:01:00.0/config", O_RDWR) = 4
> > (bunch of reads/writes)
> > pread64(4, "\22\241\22\241", 4, 124)    = 4
> > write(1, "R Rx_REG0 a112a112\n", 19)    = 19
> >
> > sudo ~/vl805/vl805 -d
> > VL805 FW version: 00013600
> > W CHIP_SEL 00000001
> > R PCI_WB_EN ffffffff
> > W PCI_WB_EN ffffff01
> > R STOP_POLLING 00000001
> > W STOP_POLLING 00000001
> > W CTRL_REG 000005a0
> > W CLK_DIV 0000000a
> > W CHIP_SEL 00000000
> > W Tx_REG0 90000000
> > W CTRL_REG 000005c0
> > R Rx_REG0 a112a112
> > W CHIP_SEL 00000001
> > flash ID mismatch - found a112, expected 0000ef10
> >
> > I was able to find a Windows based firmware updater which supports
> > about 20 different SPI chips - people have reported adding new
> > chipsets, looks like I have to add mine as well.
> > The flash tool runs under wine but it can't read anything - will have
> > to find a fix or run in a vm.
> >
> > Via SpiFlash.ini:
> > [MX25L512]
> > FlashID=C22010
> > ReadID=9F
> > WriteEnable=06
> > WriteStatus=01
> > ChipErase=60
> > ReadData=03
> > ReadStatus=05
> > PageProgram=02
> > ClockRate=32
> > PageSize=100
> >
> > Raspberry Pi 4 ?
> > [W25X10BV]
> > FlashID=EF10
> > ReadID=90000000
> > WriteEnable=06
> > WriteStatus=01
> > ChipErase=C7
> > ReadData=03
> > ReadStatus=05
> > PageProgram=02
> > ClockRate=32
> > PageSize=10