Hi,
I tried to dump the BIOS on my Lenovo X1 using flashrom and it didn't work. I'm using flashrom from svn trunk. Any ideas?
flashrom v0.9.8-r1901 on Linux 4.2.0-1-amd64 (x86_64) flashrom is free software, get the source code at http://www.flashrom.o rg
flashrom was built with libpci 3.3.1, GCC 5.2.1 20151028, little endian Command line (6 args): ./flashrom -VVp internal -c MX25L12805D --read a.rom Calibrating delay loop... OS timer resolution is 1 usecs, 2883M loops per second, 10 myus = 10 us, 100 myus = 122 us, 1000 myus = 1018 us, 10000 myus = 10335 us, 4 myus = 15 us, OK. Initializing internal programmer No coreboot table found. Using Internal DMI decoder. No DMI table found. W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect. Active config mode, unknown reg 0x20 ID: 00. Please send the output of "flashrom -V -p internal" to flashrom@flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks. Found chipset "Intel Broadwell U Premium" with PCI ID 8086:9cc3. This chipset is marked as untested. If you are using an up-to-date version of flashrom *and* were (not) able to successfully update your firmware with it, then please email a report to flashrom@flashrom.org including a verbose (-V) log. Thank you! Enabling flash write... Root Complex Register Block address = 0xfed1c000 GCS = 0x21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x0 (LPC) Top Swap: not enabled 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode enabled 0xffe00000/0xffa00000 FWH decode enabled 0xffd80000/0xff980000 FWH decode enabled 0xffd00000/0xff900000 FWH decode enabled 0xffc80000/0xff880000 FWH decode enabled 0xffc00000/0xff800000 FWH decode enabled 0xff700000/0xff300000 FWH decode enabled 0xff600000/0xff200000 FWH decode enabled 0xff500000/0xff100000 FWH decode enabled 0xff400000/0xff000000 FWH decode enabled Maximum FWH chip size: 0x100000 bytes SPI Read Configuration: prefetching enabled, caching enabled, BIOS_CNTL = 0x2a: BIOS Lock Enable: enabled, BIOS Write Enable: disabled Warning: BIOS region SMM protection is enabled! Warning: Setting Bios Control at 0xdc from 0x2a to 0x09 failed. New value is 0x2a. SPIBAR = 0x00007f030f57a000 + 0x3800 0x04: 0xe008 (HSFS) HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=1 Warning: SPI Configuration Lockdown activated. Reading OPCODES... done OP Type Pre-OP op[0]: 0x5a, read w/o addr, none op[1]: 0x9f, read w/o addr, none op[2]: 0x05, read w/o addr, none op[3]: 0x01, write w/o addr, none op[4]: 0x03, read w/ addr, none op[5]: 0x15, read w/o addr, none op[6]: 0xff, read w/o addr, none op[7]: 0xff, read w/o addr, none Pre-OP 0: 0x06, Pre-OP 1: 0x06 0x06: 0x0004 (HSFC) HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0 0x08: 0x00003000 (FADDR) 0x50: 0x00004a4b (FRAP) BMWAG 0x00, BMRAG 0x00, BRWA 0x4a, BRRA 0x4b 0x54: 0x00000000 FREG0: Warning: Flash Descriptor region (0x00000000- 0x00000fff) is read-only. 0x58: 0x0fff0500 FREG1: BIOS region (0x00500000-0x00ffffff) is read- write. 0x5C: 0x04ff0003 FREG2: Warning: Management Engine region (0x00003000- 0x004fffff) is locked. 0x60: 0x00020001 FREG3: Gigabit Ethernet region (0x00001000-0x00002fff) is read-write. 0x64: 0x00007fff FREG4: Platform Data region is unused. Not all flash regions are freely accessible by flashrom. This is most likely due to an active ME. Please see http://flashrom.org/ME for details. 0x74: 0x00000000 (PR0 is unused) 0x78: 0x8fff0eb0 PR1: Warning: 0x00eb0000-0x00ffffff is read-only. 0x7C: 0x8e2f0df1 PR2: Warning: 0x00df1000-0x00e2ffff is read-only. 0x80: 0x8df00df0 PR3: Warning: 0x00df0000-0x00df0fff is read-only. 0x84: 0x8def0a00 PR4: Warning: 0x00a00000-0x00deffff is read-only. Writes have been disabled for safety reasons. You can enforce write support with the ich_spi_force programmer option, but you will most likely harm your hardware! If you force flashrom you will get no support if something breaks. On a few mainboards it is possible to enable write access by setting a jumper (see its documentation or the board itself). 0x90: 0xc4 (SSFS) SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0 0x91: 0xfc0000 (SSFC) SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=4 0x94: 0x0606 (PREOP) 0x96: 0x0240 (OPTYPE) 0x98: 0x01059f5a (OPMENU) 0x9C: 0xffff1503 (OPMENU+4) 0xA0: 0x00000000 (BBAR) 0xC4: 0x80802045 (LVSCC) LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1 0xC8: 0x00002045 (UVSCC) UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20 0xD0: 0x50444653 (FPB) Reading flash descriptors mapped by the chipset via FDOC/FDOD... done. === Content Section === FLVALSIG 0x0ff0a55a FLMAP0 0x03040003 FLMAP1 0x15100206 FLMAP2 0x00210120
--- Details --- NR (Number of Regions): 4 FRBA (Flash Region Base Address): 0x040 NC (Number of Components): 1 FCBA (Flash Component Base Address): 0x030 ISL (ICH/PCH Strap Length): 21 FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100 NM (Number of Masters): 3 FMBA (Flash Master Base Address): 0x060 MSL/PSL (MCH/PROC Strap Length): 1 FMSBA (Flash MCH/PROC Strap Base Address): 0x200
=== Component Section === FLCOMP 0x49900045 FLILL 0xad604221
--- Details --- Component 1 density: 16 MB Component 2 is not used. Read Clock Frequency: 20 MHz Read ID and Status Clock Freq.: 33 MHz Write and Erase Clock Freq.: 33 MHz Fast Read is supported. Fast Read Clock Frequency: 50 MHz Dual Output Fast Read Support: disabled Invalid instruction 0: 0x21 Invalid instruction 1: 0x42 Invalid instruction 2: 0x60 Invalid instruction 3: 0xad
=== Region Section === FLREG0 0x00000000 FLREG1 0x0fff0500 FLREG2 0x04ff0003 FLREG3 0x00020001 FLREG4 0x00007fff
--- Details --- Region 0 (Descr.) 0x00000000 - 0x00000fff Region 1 (BIOS ) 0x00500000 - 0x00ffffff Region 2 (ME ) 0x00003000 - 0x004fffff Region 3 (GbE ) 0x00001000 - 0x00002fff Region 4 (Platf.) is unused.
=== Master Section === FLMSTR1 0x0a0b0000 FLMSTR2 0x0c0d0000 FLMSTR3 0x08080118
--- Details --- Descr. BIOS ME GbE Platf. BIOS r rw rw ME r rw rw GbE rw
PROBLEMS, continuing anyway The following protocols are supported: FWH, SPI. Probing for Macronix MX25L12805D, 16384 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2018 Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) mapped at physical address 0x00000000ff000000. Chip status register is 0x40. Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set Chip status register: Bit 6 is set Chip status register: Block Protect 3 (BP3) is not set Chip status register: Block Protect 2 (BP2) is not set Chip status register: Block Protect 1 (BP1) is not set Chip status register: Block Protect 0 (BP0) is not set Chip status register: Write Enable Latch (WEL) is not set Chip status register: Write In Progress (WIP/BUSY) is not set This chip may contain one-time programmable memory. flashrom cannot read and may never be able to write it, hence it may not be able to completely clone the contents of this chip (see man page for details). Block protection is disabled. Reading flash... Transaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=63, SME=0, SCF=4 Running OPCODE 0x03 failed at address 0x003000 (payload length was 64). Read operation failed! FAILED. Restoring MMIO space at 0x7f030f57d8a0 Restoring PCI config space for 00:1f:0 reg 0xdc
Hello! Mainstream flashrom currently not yet merged patches, adding support of reading layout. Because ME region usually not readable not from ME itself, it should be skipped, so using layout file, in your case: # flashrom layout v2 0x00000000:0x00000fff descr 0x00500000:0x00ffffff BIOS 0x00003000:0x004fffff ME 0x00001000:0x00002fff GbE
And using flashrom with my patches should help: https://github.com/XVilka/flashrom/tree/layout_descriptor
Some of the patches are still 'dirty' but should work - I've checked them on a bunch of hardware. you need to run it like:
flashrom -V -p internal -l this_file.layout -i BIOS -r bios_dump.bin
Kind regards, Anton Kochkov.
On Thu, Dec 17, 2015 at 10:25 AM, Rui Paulo rpaulo@me.com wrote:
Hi,
I tried to dump the BIOS on my Lenovo X1 using flashrom and it didn't work. I'm using flashrom from svn trunk. Any ideas?
flashrom v0.9.8-r1901 on Linux 4.2.0-1-amd64 (x86_64) flashrom is free software, get the source code at http://www.flashrom.o rg
flashrom was built with libpci 3.3.1, GCC 5.2.1 20151028, little endian Command line (6 args): ./flashrom -VVp internal -c MX25L12805D --read a.rom Calibrating delay loop... OS timer resolution is 1 usecs, 2883M loops per second, 10 myus = 10 us, 100 myus = 122 us, 1000 myus = 1018 us, 10000 myus = 10335 us, 4 myus = 15 us, OK. Initializing internal programmer No coreboot table found. Using Internal DMI decoder. No DMI table found. W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect. Active config mode, unknown reg 0x20 ID: 00. Please send the output of "flashrom -V -p internal" to flashrom@flashrom.org with W836xx: your board name: flashrom -V as the subject to help us finish support for your Super I/O. Thanks. Found chipset "Intel Broadwell U Premium" with PCI ID 8086:9cc3. This chipset is marked as untested. If you are using an up-to-date version of flashrom *and* were (not) able to successfully update your firmware with it, then please email a report to flashrom@flashrom.org including a verbose (-V) log. Thank you! Enabling flash write... Root Complex Register Block address = 0xfed1c000 GCS = 0x21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x0 (LPC) Top Swap: not enabled 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode enabled 0xffe00000/0xffa00000 FWH decode enabled 0xffd80000/0xff980000 FWH decode enabled 0xffd00000/0xff900000 FWH decode enabled 0xffc80000/0xff880000 FWH decode enabled 0xffc00000/0xff800000 FWH decode enabled 0xff700000/0xff300000 FWH decode enabled 0xff600000/0xff200000 FWH decode enabled 0xff500000/0xff100000 FWH decode enabled 0xff400000/0xff000000 FWH decode enabled Maximum FWH chip size: 0x100000 bytes SPI Read Configuration: prefetching enabled, caching enabled, BIOS_CNTL = 0x2a: BIOS Lock Enable: enabled, BIOS Write Enable: disabled Warning: BIOS region SMM protection is enabled! Warning: Setting Bios Control at 0xdc from 0x2a to 0x09 failed. New value is 0x2a. SPIBAR = 0x00007f030f57a000 + 0x3800 0x04: 0xe008 (HSFS) HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=1 Warning: SPI Configuration Lockdown activated. Reading OPCODES... done OP Type Pre-OP op[0]: 0x5a, read w/o addr, none op[1]: 0x9f, read w/o addr, none op[2]: 0x05, read w/o addr, none op[3]: 0x01, write w/o addr, none op[4]: 0x03, read w/ addr, none op[5]: 0x15, read w/o addr, none op[6]: 0xff, read w/o addr, none op[7]: 0xff, read w/o addr, none Pre-OP 0: 0x06, Pre-OP 1: 0x06 0x06: 0x0004 (HSFC) HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0 0x08: 0x00003000 (FADDR) 0x50: 0x00004a4b (FRAP) BMWAG 0x00, BMRAG 0x00, BRWA 0x4a, BRRA 0x4b 0x54: 0x00000000 FREG0: Warning: Flash Descriptor region (0x00000000- 0x00000fff) is read-only. 0x58: 0x0fff0500 FREG1: BIOS region (0x00500000-0x00ffffff) is read- write. 0x5C: 0x04ff0003 FREG2: Warning: Management Engine region (0x00003000- 0x004fffff) is locked. 0x60: 0x00020001 FREG3: Gigabit Ethernet region (0x00001000-0x00002fff) is read-write. 0x64: 0x00007fff FREG4: Platform Data region is unused. Not all flash regions are freely accessible by flashrom. This is most likely due to an active ME. Please see http://flashrom.org/ME for details. 0x74: 0x00000000 (PR0 is unused) 0x78: 0x8fff0eb0 PR1: Warning: 0x00eb0000-0x00ffffff is read-only. 0x7C: 0x8e2f0df1 PR2: Warning: 0x00df1000-0x00e2ffff is read-only. 0x80: 0x8df00df0 PR3: Warning: 0x00df0000-0x00df0fff is read-only. 0x84: 0x8def0a00 PR4: Warning: 0x00a00000-0x00deffff is read-only. Writes have been disabled for safety reasons. You can enforce write support with the ich_spi_force programmer option, but you will most likely harm your hardware! If you force flashrom you will get no support if something breaks. On a few mainboards it is possible to enable write access by setting a jumper (see its documentation or the board itself). 0x90: 0xc4 (SSFS) SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0 0x91: 0xfc0000 (SSFC) SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=4 0x94: 0x0606 (PREOP) 0x96: 0x0240 (OPTYPE) 0x98: 0x01059f5a (OPMENU) 0x9C: 0xffff1503 (OPMENU+4) 0xA0: 0x00000000 (BBAR) 0xC4: 0x80802045 (LVSCC) LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1 0xC8: 0x00002045 (UVSCC) UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20 0xD0: 0x50444653 (FPB) Reading flash descriptors mapped by the chipset via FDOC/FDOD... done. === Content Section === FLVALSIG 0x0ff0a55a FLMAP0 0x03040003 FLMAP1 0x15100206 FLMAP2 0x00210120
--- Details --- NR (Number of Regions): 4 FRBA (Flash Region Base Address): 0x040 NC (Number of Components): 1 FCBA (Flash Component Base Address): 0x030 ISL (ICH/PCH Strap Length): 21 FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100 NM (Number of Masters): 3 FMBA (Flash Master Base Address): 0x060 MSL/PSL (MCH/PROC Strap Length): 1 FMSBA (Flash MCH/PROC Strap Base Address): 0x200
=== Component Section === FLCOMP 0x49900045 FLILL 0xad604221
--- Details --- Component 1 density: 16 MB Component 2 is not used. Read Clock Frequency: 20 MHz Read ID and Status Clock Freq.: 33 MHz Write and Erase Clock Freq.: 33 MHz Fast Read is supported. Fast Read Clock Frequency: 50 MHz Dual Output Fast Read Support: disabled Invalid instruction 0: 0x21 Invalid instruction 1: 0x42 Invalid instruction 2: 0x60 Invalid instruction 3: 0xad
=== Region Section === FLREG0 0x00000000 FLREG1 0x0fff0500 FLREG2 0x04ff0003 FLREG3 0x00020001 FLREG4 0x00007fff
--- Details --- Region 0 (Descr.) 0x00000000 - 0x00000fff Region 1 (BIOS ) 0x00500000 - 0x00ffffff Region 2 (ME ) 0x00003000 - 0x004fffff Region 3 (GbE ) 0x00001000 - 0x00002fff Region 4 (Platf.) is unused.
=== Master Section === FLMSTR1 0x0a0b0000 FLMSTR2 0x0c0d0000 FLMSTR3 0x08080118
--- Details --- Descr. BIOS ME GbE Platf. BIOS r rw rw ME r rw rw GbE rw
PROBLEMS, continuing anyway The following protocols are supported: FWH, SPI. Probing for Macronix MX25L12805D, 16384 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2018 Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) mapped at physical address 0x00000000ff000000. Chip status register is 0x40. Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set Chip status register: Bit 6 is set Chip status register: Block Protect 3 (BP3) is not set Chip status register: Block Protect 2 (BP2) is not set Chip status register: Block Protect 1 (BP1) is not set Chip status register: Block Protect 0 (BP0) is not set Chip status register: Write Enable Latch (WEL) is not set Chip status register: Write In Progress (WIP/BUSY) is not set This chip may contain one-time programmable memory. flashrom cannot read and may never be able to write it, hence it may not be able to completely clone the contents of this chip (see man page for details). Block protection is disabled. Reading flash... Transaction error! SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0 SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=63, SME=0, SCF=4 Running OPCODE 0x03 failed at address 0x003000 (payload length was 64). Read operation failed! FAILED. Restoring MMIO space at 0x7f030f57d8a0 Restoring PCI config space for 00:1f:0 reg 0xdc -- Rui Paulo
flashrom mailing list flashrom@flashrom.org http://www.flashrom.org/mailman/listinfo/flashrom
-
Rui Paulo -
Антон Кочков