Re: HP 11 G5 EE - WP disable failure

[Peter Marheine]

You don't need to cut any tracks, and that might not even do what you want
because there probably isn't a pull-up or -down on the WP signal so it
would be left floating in an indeterminate state. It looks like your Meep
uses battery presence for WP, so disconnecting the battery should be all
you need to do in order to temporarily disable hardware write protection.

On Thu, Aug 10, 2023 at 11:16 AM E239 76BF  wrote:
> I think the apparent thin link might be on the other side of the board.  I
> need to extract the board to confirm this, cut it and try again.
> I'm a hardware tech with 40 yrs experience, so no issue.  Just
> unfamiliar with ChromeOS.
> Need to remove the board.  But it's the only IT platform I have.
> Learned ChromeOS, Time to go back to linux.
>
> On Thu, 10 Aug 2023 at 13:01, Peter Marheine 
> wrote:
> > > Note: hardware status register protection is enabled. The chip's WP#
> >
> > pin must be set to an inactive voltage level to be able to change the WP
> > settings.
> >
> > You need to disable hardware write protect:
> > https://chromium.googlesource.com/chromiumos/docs/+/master/write_protection....
> >
> > On Tue, Aug 8, 2023 at 1:02 PM E239 76BF  wrote:
> > > Glenn in Wellington, New Zealand
> > > I know little about ChromeOS, but am moderately comfortable with Linux.
> > > Got this machine two months ago (because I lost all my gear in a big
> > > fire 11 weeks ago) and having learned ChromeOS, I'm now ready to return to
> > > the comfort of a linux environment.
> > >
> > > Verbose output :
> > >
> > > # flashrom --wp-disable -V
> > > flashrom 68022911 on Linux 4.14.313-20323-gc32c2d54e434 (x86_64)
> > > flashrom is free software, get the source code at https://flashrom.org
> > >
> > > Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
> > > flashrom was built with LLVM Clang 16.0.0
> > > (/var/tmp/portage/sys-devel/llvm-16.0_pre484197_p20230405-r7/work/llvm-16.0_pre484197_p20230405/clang
> > > 2916b99182752b1aece8cc4479d8d6a20b5e02da), little endian
> > > Command line (2 args): flashrom --wp-disable -V
> > > Using default programmer "internal" with arguments "".
> > > Acquiring lock (timeout=180 sec)...
> > > Opened file lock "/run/lock/firmware_utility_lock"
> > > Lock acquired.
> > > Initializing internal programmer
> > > /sys/class/mtd/mtd0 does not exist
> > > Found candidate at: 00000500-00000528
> > > Found coreboot table at 0x00000500.
> > > Found candidate at: 00000000-000005cc
> > > Found coreboot table at 0x00000000.
> > > coreboot table found at 0x79b2a000.
> > > coreboot header(24) checksum: a42a table(1460) checksum: c446 entries: 45
> > > Vendor ID: Google, part ID: Meep
> > > Using Internal DMI decoder.
> > > DMI string chassis-type: "Laptop"
> > > Laptop detected via DMI.
> > > DMI string system-manufacturer: "HP"
> > > DMI string system-product-name: "Meep"
> > > DMI string system-version: "rev7"
> > > DMI string baseboard-manufacturer: "HP"
> > > DMI string baseboard-product-name: "Meep"
> > > DMI string baseboard-version: "rev7"
> > > Found chipset "Intel Gemini Lake" with PCI ID 8086:3197.
> > > This chipset is marked as untested. If you are using an up-to-date
> > > version
> > > of flashrom *and* were (not) able to successfully update your firmware
> > > with it,
> > > then please email a report to [e-mail] including a verbose
> > > (-V) log.
> > > Thank you!
> > > Enabling flash write... BIOS_SPI_BC = 0x9: BIOS Interface Lock-Down:
> > > disabled, Boot BIOS Straps: 0x0 (SPI)
> > > Top Swap: not enabled
> > > SPI Read Configuration: prefetching enabled, caching enabled,
> > > BIOS_CNTL = 0x09: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
> > > SPIBAR = 0x00007bd11ce10000 (phys = 0xc1121000)
> > > 0x04: 0x6000 (HSFS)
> > > HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=0, SCIP=0, FDOPSS=1, FDV=1,
> > > FLOCKDN=0
> > > Programming OPCODES... done
> > > 0x06: 0x020c (HSFC)
> > > HSFC: FGO=0, FCYCLE=2, FDBC=2, SME=0
> > > 0x0c: 0x00000000 (DLOCK)
> > > DLOCK: BMWAG_LOCKDN=0, BMRAG_LOCKDN=0, SBMWAG_LOCKDN=0, SBMRAG_LOCKDN=0,
> > >        PR0_LOCKDN=0, PR1_LOCKDN=0, PR2_LOCKDN=0, PR3_LOCKDN=0,
> > > PR4_LOCKDN=0,
> > >        SSEQ_LOCKDN=0
> > > 0x50: 0x000042c3 (FRAP)
> > > BMWAG 0x00, BMRAG 0x00, BRWA 0x42, BRRA 0xc3
> > > 0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff)
> > > is read-only.
> > > 0x58: 0x0f7e0001 FREG1: BIOS region (0x00001000-0x00f7efff) is
> > > read-write.
> > > 0x68: 0x0fff0f7f FREG5: Device Expansion region (0x00f7f000-0x00ffffff)
> > > is locked.
> > > 0x7C: 0x7fff7fff FREG10: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > 0x80: 0x7fff7fff FREG11: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > 0xE0: 0x7fff7fff FREG12: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > 0xE4: 0x7fff7fff FREG13: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > 0xE8: 0x7fff7fff FREG14: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > 0xEC: 0x7fff7fff FREG15: unknown region (0x07fff000-0x07ffffff) has
> > > unknown permissions.
> > > Not all flash regions are freely accessible by flashrom. This is most
> > > likely
> > > due to an active ME. Please see https://flashrom.org/ME for details.
> > > At least some flash regions are read protected. You have to use a flash
> > > layout and include only accessible regions. For write operations, you'll
> > > additionally need the --noverify-all switch. See manpage for more
> > > details.
> > > 0xa0: 0xc0 (SSFS)
> > > SSFS: SCIP=0, FDONE=0, FCERR=0, AEL=0
> > > 0xa1: 0xfe0000 (SSFC)
> > > SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=6
> > > 0xa4: 0x5006     (PREOP)
> > > 0xa6: 0x463b     (OPTYPE)
> > > 0xa8: 0x05200302 (OPMENU)
> > > 0xac: 0xc79f0190 (OPMENU+4)
> > > 0xc4: 0xb1d82024 (LVSCC)
> > > LVSCC: BES=0x0, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
> > > 0xc8: 0x00002000 (UVSCC)
> > > UVSCC: BES=0x0, WG=0, WSR=0, WEWS=0, EO=0x20
> > > Enabling hardware sequencing by default for
> > > Apollo/Gemini/Jasper/Elkhart/Meteor Lake.
> > > OK.
> > > The following protocols are supported: Programmer-specific.
> > > Probing for Programmer Opaque flash chip, 0 kB: Hardware sequencing
> > > reports 1 attached SPI flash chip with a density of 16384 kB.
> > > HSFC: FGO=1, FCYCLE=2, FDBC=2, SME=0
> > > Chip identified: GD25LQ128C/GD25LQ128D/GD25LQ128E
> > > Added layout entry 00000000 - 00ffffff named complete flash
> > > Found GigaDevice flash chip "GD25LQ128C/GD25LQ128D/GD25LQ128E" (16384
> > > kB, Programmer-specific) on internal.
> > > Found GigaDevice flash chip "GD25LQ128C/GD25LQ128D/GD25LQ128E" (16384
> > > kB, Programmer-specific).
> > > This chip may contain one-time programmable memory. flashrom cannot read
> > > and may never be able to write it, hence it may not be able to completely
> > > clone the contents of this chip (see man page for details).
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > Writing status register
> > > HSFC: FGO=1, FCYCLE=3, FDBC=0, SME=0
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Reading Status register
> > > HSFC: FGO=1, FCYCLE=0, FDBC=0, SME=0
> > > write_wp_bits: wp_verify failed: reg:1 actual:0xb4 expected:0x34
> > > ich_hwseq_read_status: only supports STATUS1
> > > wp_read_register: read from register 2 not is supported by programmer,
> > > writeprotect operations will assume it contains 0x00.
> > > Failed to apply new WP settings: unexpected WP configuration read back
> > > from chip
> > > Note: hardware status register protection is enabled. The chip's WP# pin
> > > must be set to an inactive voltage level to be able to change the WP
> > > settings.
> > > Restoring MMIO space at 0x7bd11ce10084
> > > Restoring MMIO space at 0x7bd11ce100ac
> > > Restoring MMIO space at 0x7bd11ce100a8
> > > Restoring MMIO space at 0x7bd11ce100a6
> > > Restoring MMIO space at 0x7bd11ce100a4
> > > _______________________________________________
> > > flashrom mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]