On 01.05.2016 10:37, Paul Kocialkowski wrote:
Hi,
could you CC the flashrom mailing list in your future responses? This will probably interest others!
I wasn't aware of this mailing lists, thanks!
Le dimanche 24 avril 2016 à 23:15 +0200, Joerg Albert a écrit :
I'll try to program the internal SPI of a KB9012 (inside a Thinkpad S531) - as soon as I've found the correct image and soldered the necessary wires.
The KB9012 chips has an internal flash memory that is distinct from the BIOS' SPI flash, so beware not to confuse both!
I'm aware of this. The S531 manual says, that the system indicator LED shall flash three times when the power supply gets connected (without switching the notebook on). As I don't see this and the voltage at the KB9012 is correct I guess that the EC is not working properly. Flashing the BIOS SPI may be the second step ;-)
Found your patch here:
http://patchwork.coreboot.org/patch/4325/
Why couldn't I use FlashDirectAccess? Is this meant to program external SPI flash only?
Yes, that's my understanding of it too. It just makes a bridge between the BIOS' SPI flash and the KB9012 pads. This is because it's often easier to reflash it using the keyboard connector, that is often available without fully opening the device.
What you want if you need to reflash the EC is not FlashDirectAccess, but EDI. Note that some firmwares explicitly disable it, so you have to ground pin 42 to enter "test mode", where the 8051 is not running.
Note that the EDI pins are often exported on the keyboard connector, which makes soldering more doable.
The keyboard connector of the S531 has a pitch of 0.5mm, too close for my soldering experience. I couldn't find a flex cable matching the connector either, so I went for soldering wires to some vias/testpoints instead.
Connected a RaspberryPi and had some problems with the detection of the KB9012. It seemed to detect the KB9012 on every second trial only:
-------------- pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 103 us, 1000 myus = 994 us, 10000 myus = 10064 us, 20 myus = 26 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 4 usecs, 226M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 1839 us, 10000 myus = 10424 us, 16 myus = 21 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: failed to read hw version (-1) No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 994 us, 10000 myus = 10061 us, 20 myus = 22 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified. --------
I've also tried with "speed=2048" (as the KB9012 manual states a minimum clock of 1MHz) - same problem. / /I've added some error/debug printouts and it seems like the KB9012 answers with all-zeros on each second start of the probe. If the buffer content is correct everything else afterwards works fine.
So I've added a quick workaround in edi_read_byte() and edi_read() to re-do any read if the buffer contains zero at the first byte. See the patches attached.
No idea why it behaves that way, maybe the SPI detection on these pins is a bit shaky? Pin 42 was grounded and the KB9012 remained powered during the whole session.
Cheers, Joerg
Hi,
Le dimanche 01 mai 2016 à 15:47 +0200, Joerg Albert a écrit :
On 01.05.2016 10:37, Paul Kocialkowski wrote:
Hi,
could you CC the flashrom mailing list in your future responses? This will probably interest others!
I wasn't aware of this mailing lists, thanks!
Le dimanche 24 avril 2016 à 23:15 +0200, Joerg Albert a écrit :
I'll try to program the internal SPI of a KB9012 (inside a Thinkpad S531)
- as
soon as I've found the correct image and soldered the necessary wires.
The KB9012 chips has an internal flash memory that is distinct from the BIOS' SPI flash, so beware not to confuse both!
I'm aware of this. The S531 manual says, that the system indicator LED shall flash three times when the power supply gets connected (without switching the notebook on). As I don't see this and the voltage at the KB9012 is correct I guess that the EC is not working properly.
That makes sense, even though I really don't know enough about your device to say. It's a fun thing to do anyway and it would allow some more testing on my patches, so I encourage you to do it anyway :)
Flashing the BIOS SPI may be the second step ;-)
Found your patch here:
http://patchwork.coreboot.org/patch/4325/
Why couldn't I use FlashDirectAccess? Is this meant to program external SPI flash only?
Yes, that's my understanding of it too. It just makes a bridge between the BIOS' SPI flash and the KB9012 pads. This is because it's often easier to reflash it using the keyboard connector, that is often available without fully opening the device.
What you want if you need to reflash the EC is not FlashDirectAccess, but EDI. Note that some firmwares explicitly disable it, so you have to ground pin 42 to enter "test mode", where the 8051 is not running.
Note that the EDI pins are often exported on the keyboard connector, which makes soldering more doable.
The keyboard connector of the S531 has a pitch of 0.5mm, too close for my soldering experience. I couldn't find a flex cable matching the connector either, so I went for soldering wires to some vias/testpoints instead.
Good thing if you were able to get all pins that way! Soldering is generally not too hard with flux and braid. What I did is shown on my latest FOSDEM slides: ht tp://ftp-osl.osuosl.org/pub/replicant/conferences/fosdem-2016/the-road-to- liberating-software-at-the-lower-levels.pdf on the slides about the KB9012 EC.
Connected a RaspberryPi and had some problems with the detection of the KB9012. It seemed to detect the KB9012 on every second trial only:
That's quite strange, can you try with another programmer? Any cheap ch341a- based board would do for a comparison.
pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 103 us, 1000 myus = 994 us, 10000 myus = 10064 us, 20 myus = 26 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 4 usecs, 226M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 1839 us, 10000 myus = 10424 us, 16 myus = 21 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: failed to read hw version (-1) No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 994 us, 10000 myus = 10061 us, 20 myus = 22 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified.
I've also tried with "speed=2048" (as the KB9012 manual states a minimum clock of 1MHz) - same problem. / /I've added some error/debug printouts and it seems like the KB9012 answers with all-zeros on each second start of the probe.
That's typical of not getting any answer if I'm not mistaken about the SPI bus.
If the buffer content is correct everything else afterwards works fine.
So I've added a quick workaround in edi_read_byte() and edi_read() to re-do any read if the buffer contains zero at the first byte. See the patches attached.
I'll have to check that this doesn't cause further problems, but it looks like a good plan.
No idea why it behaves that way, maybe the SPI detection on these pins is a bit shaky?
I couldn't say, my setup works reliably. It doesn't look like a connector issue if it works with your patch. Maybe probe the line with a logic analyzer to see what's going on?
Pin 42 was grounded and the KB9012 remained powered during the whole session.
Thanks for the feedback!
Cheers,
-
Joerg Albert -
Paul Kocialkowski