Re: [flashrom] DOS binary doesn't work?

[max]

--- On Mon, 10/11/10, max  wrote:
> Thank you, lspci yielded some interesting information. On
> the linux that works, there are two kernel modules
> associated with device 8086/24C0 (where the write enable
> register is located): iTCO_wdt and intel-rng. Those modules
> are not present on the linux that doesn't work.

Ok, I have the answer. It was iTCO_wdt, not intel_rng as I first guessed. iTCO_wdt clears bit 13 (TCO_EN) of SMI_EN. This is what allows flashrom to enable writing (tested by clearing the bit with a debugger and running DOS flashrom).

from iTCO_wdt.c iTCO_wdt_init:
    /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
    val32 = inl(SMI_EN);
    val32 &= 0xffffdfff;	/* Turn off SMI clearing watchdog */
    outl(val32, SMI_EN);

Thanks,
Dan

DOS binary doesn't work?

[Stefan Reinauer]

* max  [101012 07:33]:
> --- On Mon, 10/11/10, max  wrote:
> > Thank you, lspci yielded some interesting information. On
> > the linux that works, there are two kernel modules
> > associated with device 8086/24C0 (where the write enable
> > register is located): iTCO_wdt and intel-rng. Those modules
> > are not present on the linux that doesn't work.
>
> Ok, I have the answer. It was iTCO_wdt, not intel_rng as I first guessed. iTCO_wdt clears bit 13 (TCO_EN) of SMI_EN. This is what allows flashrom to enable writing (tested by clearing the bit with a debugger and running DOS flashrom).
>
> from iTCO_wdt.c iTCO_wdt_init:
>    /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
>    val32 = inl(SMI_EN);
>    val32 &= 0xffffdfff;	/* Turn off SMI clearing watchdog */
>    outl(val32, SMI_EN);

Nice finding! Don't you love the effectiveness of SPI flash protection?
:)

Stefan

DOS binary doesn't work?

[max]

--- On Tue, 10/19/10, Stefan Reinauer  wrote:
> From: Stefan Reinauer 
> Subject: Re: [flashrom] DOS binary doesn't work?
> To: "max" 
> Cc: [e-mail]
> Date: Tuesday, October 19, 2010, 1:22 PM
> max
>
> [101012 07:33]:
> > --- On Mon, 10/11/10, max
>
> wrote:
> > > Thank you, lspci yielded some interesting
>
> information. On
> > > the linux that works, there are two kernel
>
> modules
> > > associated with device 8086/24C0 (where the write
>
> enable
> > > register is located): iTCO_wdt and intel-rng.
>
> Those modules
> > > are not present on the linux that doesn't work.
> >
> > Ok, I have the answer. It was iTCO_wdt, not intel_rng
>
> as I first guessed. iTCO_wdt clears bit 13 (TCO_EN) of
> SMI_EN. This is what allows flashrom to enable writing
> (tested by clearing the bit with a debugger and running DOS
> flashrom).
> > from iTCO_wdt.c iTCO_wdt_init:
> >     /* Bit 13: TCO_EN -> 0 =
>
> Disables TCO logic generating an SMI# */
> > val32 = inl(SMI_EN);
> >     val32 &=
>
> 0xffffdfff;    /* Turn off SMI clearing
> watchdog */
> > outl(val32, SMI_EN);
>
> Nice finding! Don't you love the effectiveness of SPI flash
> protection?
> :)

I noticed that in ICH5, Intel added yet another "lock" which prevents TCO_EN from being cleared, perhaps to close this hole. However, I have an Intel ICH5 motherboard and it doesn't use the TCO_EN lock.

It might be dangerous to rely on TCO_EN since the BIOS is still getting SMI interrupts from other sources. The safest thing is to exit with a meaningful error message if the BIOS write lock bit is set.

Dan