flashrom issue w/ Avoton platform

[Pierre-O]

hi folks !

I'm trying to use flashrom with an avoton/rangeley board,
bios protections are disabled, chip is detected but simple read 
operation fails, here's my log :

*flashrom v0.9.7-r1869 on Linux 3.13.0-24-generic (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

flashrom was built with libpci 3.2.1, GCC 4.8.2, little endian
Command line (7 args): flashrom -V -p internal -c N25Q128..3E -r 
LFFF-backup.bin
Calibrating delay loop... OS timer resolution is 1 usecs, 863M loops per 
second, 10 myus = 10 us, 100 myus = 104 us, 1000 myus = 1016 us, 10000 
myus = 10017 us, 4 myus = 4 us, OK.
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
DMI string chassis-type: "Desktop"
DMI string system-manufacturer: "Insyde"
DMI string system-product-name: "MohonPeak"
DMI string system-version: "TBD by OEM"
DMI string baseboard-manufacturer: "Type2 - Board Vendor Name1"
DMI string baseboard-product-name: "Type2 - Board Product Name1"
DMI string baseboard-version: "Type2 - Board Version"
Found chipset "Intel Avoton/Rangeley" with PCI ID 8086:1f38.
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware 
with it,
then please email a report to [e-mail] including a verbose 
(-V) log.
Thank you!
Enabling flash write... Root Complex Register Block address = 0xfed1c000
GCS = 0x40000c01: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 
0x3 (SPI)
Top Swap: not enabled
0xfff80000/0xffb80000 FWH IDSEL: 0x0
0xfff00000/0xffb00000 FWH IDSEL: 0x0
0xffe80000/0xffa80000 FWH IDSEL: 0x1
0xffe00000/0xffa00000 FWH IDSEL: 0x1
0xffd80000/0xff980000 FWH IDSEL: 0x2
0xffd00000/0xff900000 FWH IDSEL: 0x2
0xffc80000/0xff880000 FWH IDSEL: 0x3
0xffc00000/0xff800000 FWH IDSEL: 0x3
0xfff80000/0xffb80000 FWH decode enabled
0xfff00000/0xffb00000 FWH decode enabled
0xffe80000/0xffa80000 FWH decode enabled
0xffe00000/0xffa00000 FWH decode enabled
0xffd80000/0xff980000 FWH decode enabled
0xffd00000/0xff900000 FWH decode enabled
0xffc80000/0xff880000 FWH decode enabled
0xffc00000/0xff800000 FWH decode enabled
0xff700000/0xff300000 FWH decode enabled
0xff600000/0xff200000 FWH decode enabled
0xff500000/0xff100000 FWH decode enabled
0xff400000/0xff000000 FWH decode enabled
Maximum FWH chip size: 0x100000 bytes
SPI_BASE_ADDRESS = 0xfed01000
SPI Read Configuration: prefetching disabled, caching enabled,
BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
0x04: 0x6018 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=3, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=0
Programming OPCODES... done
0x06: 0x0000 (HSFC)
HSFC: FGO=0, FCYCLE=0, FDBC=0, SME=0
0x50: 0x0000ffff (FRAP)
BMWAG 0x00, BMRAG 0x00, BRWA 0xff, BRRA 0xff
0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff) 
is read-write.
0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is read-write.
0x90: 0x84 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf80000 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=0
0x94: 0x5006     (PREOP)
0x96: 0x463b     (OPTYPE)
0x98: 0x05d80302 (OPMENU)
0x9C: 0xc79f0190 (OPMENU+4)
0xC4: 0x0080d807 (LVSCC)
LVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8, VCL=1
0xC8: 0x0000d807 (UVSCC)
UVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8
0xD0: 0x00000000 (FPB)
OK.
The following protocols are supported: FWH, SPI.
Probing for Micron/Numonyx/ST N25Q128..3E, 16384 kB: 
probe_spi_rdid_generic: id1 0x20, id2 0xba18
Found Micron/Numonyx/ST flash chip "N25Q128..3E" (16384 kB, SPI) mapped 
at physical address 0x00000000ff000000.
Chip status register is 0x02.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is 
not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Top/Bottom (TB) is top
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading flash... Transaction error!
SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0
SSFC: SCGO=0, ACS=0, SPOP=0, COP=1, DBC=63, SME=0, SCF=0
Running OPCODE 0x03 failed at address 0x800000 (payload length was 64).
Read operation failed!
FAILED.
Restoring MMIO space at 0x7f4c9ba1409c
Restoring MMIO space at 0x7f4c9ba14098
Restoring MMIO space at 0x7f4c9ba14096
Restoring MMIO space at 0x7f4c9ba14094
Restoring MMIO space at 0x7f4c9ba140fc

*Any idea ?

Best regards,

[Stefan Tauner]

On Fri, 23 Jan 2015 18:03:10 +0100
Pierre-O  wrote:
> 0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff) 
> is read-write.
> 0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is read-write.
> […]
> Running OPCODE 0x03 failed at address 0x800000 (payload length was 64).
> Read operation failed!

That's because 0x800000 is not covered by any region... the chipset
locks everything not covered automatically.

[Pierre-O]

Le 23/01/2015 19:10, Stefan Tauner a écrit :
> On Fri, 23 Jan 2015 18:03:10 +0100
> Pierre-O  wrote:
> > 0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff)
> > is read-write.
> > 0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is read-write.
> > […]
> > Running OPCODE 0x03 failed at address 0x800000 (payload length was 64).
> > Read operation failed!
>
> That's because 0x800000 is not covered by any region... the chipset
> locks everything not covered automatically.

Thanks for your help, just missed the 0x800000 address.
Does it mean my 128Mbits flash is showed like a 64Mbits by controller 
due to BIOS given information ?
My BIOS fits 64Mbits anyway, can I tell flashrom to read found regions 
only ?

Best regards,

[Pierre-O]

Le 26/01/2015 12:52, Pierre-O a écrit :
> Le 23/01/2015 19:10, Stefan Tauner a écrit :
> > On Fri, 23 Jan 2015 18:03:10 +0100
> > Pierre-O  wrote:
> > > 0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff)
> > > is read-write.
> > > 0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is 
> > > read-write.
> > > […]
> > > Running OPCODE 0x03 failed at address 0x800000 (payload length was 64).
> > > Read operation failed!
> >
> > That's because 0x800000 is not covered by any region... the chipset
> > locks everything not covered automatically.
>
> Thanks for your help, just missed the 0x800000 address.
> Does it mean my 128Mbits flash is showed like a 64Mbits by controller 
> due to BIOS given information ?
> My BIOS fits 64Mbits anyway, can I tell flashrom to read found regions 
> only ?
>
> Best regards,

By the way, when trying to write (passing valid regions via a layout file),
rom / bios sizes difference seems to be a problem too :

*flashrom v0.9.7-r1869 on Linux 3.13.0-24-generic (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

flashrom was built with libpci 3.2.1, GCC 4.8.2, little endian
Command line (9 args): flashrom -V -p internal -c N25Q128..3E -w 
LFFF-verbose.bin -l LFFF.layout
romlayout 00000000 - 001fffff named desc
romlayout 00200000 - 007fffff named bios
Calibrating delay loop... OS timer resolution is 1 usecs, 863M loops per 
second, 10 myus = 10 us, 100 myus = 104 us, 1000 myus = 1023 us, 10000 
myus = 10017 us, 4 myus = 4 us, OK.
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
DMI string chassis-type: "Desktop"
DMI string system-manufacturer: "Insyde"
DMI string system-product-name: "MohonPeak"
DMI string system-version: "TBD by OEM"
DMI string baseboard-manufacturer: "Type2 - Board Vendor Name1"
DMI string baseboard-product-name: "Type2 - Board Product Name1"
DMI string baseboard-version: "Type2 - Board Version"
Found chipset "Intel Avoton/Rangeley" with PCI ID 8086:1f38.
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware 
with it,
then please email a report to [e-mail] including a verbose 
(-V) log.
Thank you!
Enabling flash write... Root Complex Register Block address = 0xfed1c000
GCS = 0x40000c01: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 
0x3 (SPI)
Top Swap: not enabled
0xfff80000/0xffb80000 FWH IDSEL: 0x0
0xfff00000/0xffb00000 FWH IDSEL: 0x0
0xffe80000/0xffa80000 FWH IDSEL: 0x1
0xffe00000/0xffa00000 FWH IDSEL: 0x1
0xffd80000/0xff980000 FWH IDSEL: 0x2
0xffd00000/0xff900000 FWH IDSEL: 0x2
0xffc80000/0xff880000 FWH IDSEL: 0x3
0xffc00000/0xff800000 FWH IDSEL: 0x3
0xfff80000/0xffb80000 FWH decode enabled
0xfff00000/0xffb00000 FWH decode enabled
0xffe80000/0xffa80000 FWH decode enabled
0xffe00000/0xffa00000 FWH decode enabled
0xffd80000/0xff980000 FWH decode enabled
0xffd00000/0xff900000 FWH decode enabled
0xffc80000/0xff880000 FWH decode enabled
0xffc00000/0xff800000 FWH decode enabled
0xff700000/0xff300000 FWH decode enabled
0xff600000/0xff200000 FWH decode enabled
0xff500000/0xff100000 FWH decode enabled
0xff400000/0xff000000 FWH decode enabled
Maximum FWH chip size: 0x100000 bytes
SPI_BASE_ADDRESS = 0xfed01000
SPI Read Configuration: prefetching disabled, caching enabled,
BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
0x04: 0x6018 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=3, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=0
Programming OPCODES... done
0x06: 0x0004 (HSFC)
HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0
0x50: 0x0000ffff (FRAP)
BMWAG 0x00, BMRAG 0x00, BRWA 0xff, BRRA 0xff
0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff) 
is read-write.
0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is read-write.
0x90: 0x84 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf80000 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=0
0x94: 0x5006     (PREOP)
0x96: 0x463b     (OPTYPE)
0x98: 0x05d80302 (OPMENU)
0x9C: 0xc79f0190 (OPMENU+4)
0xC4: 0x0080d807 (LVSCC)
LVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8, VCL=1
0xC8: 0x0000d807 (UVSCC)
UVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8
0xD0: 0x00000000 (FPB)
OK.
The following protocols are supported: FWH, SPI.
Probing for Micron/Numonyx/ST N25Q128..3E, 16384 kB: 
probe_spi_rdid_generic: id1 0x20, id2 0xba18
Found Micron/Numonyx/ST flash chip "N25Q128..3E" (16384 kB, SPI) mapped 
at physical address 0x00000000ff000000.
Chip status register is 0x02.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is 
not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Top/Bottom (TB) is top
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Error: Image size (8388608 B) doesn't match the flash chip's size 
(16777216 B)!
Restoring MMIO space at 0x7f53cdfb309c
Restoring MMIO space at 0x7f53cdfb3098
Restoring MMIO space at 0x7f53cdfb3096
Restoring MMIO space at 0x7f53cdfb3094
Restoring MMIO space at 0x7f53cdfb30fc*

Any option / work around for this ?

Best regards,

[Tai-Hong (Type) Wu]

Dear Pierre,

You may consider the remedy of flashrom
around encountering "unused and/or protected(e.g. ME)" offset in your
scenario.

That is, not sending spi command around these ad hoc offset.

(1) READ:                Pretend to read-success out with value := 0xFF
(2) ERASE/WRITE: Bypass the erase/write and return
erase/write-successfully-always

Regards,
Type T.H.Wu(Tai-Hong Wu)

2015-01-26 21:54 GMT+08:00 Pierre-O :
> Le 26/01/2015 12:52, Pierre-O a écrit :
>
> Le 23/01/2015 19:10, Stefan Tauner a écrit :
>
> On Fri, 23 Jan 2015 18:03:10 +0100
> Pierre-O   wrote:
>
> 0x54: 0x01ff0000 FREG0: Flash Descriptor region (0x00000000-0x001fffff)
> is read-write.
> 0x58: 0x07ff0200 FREG1: BIOS region (0x00200000-0x007fffff) is read-write.
> […]
> Running OPCODE 0x03 failed at address 0x800000 (payload length was 64).
> Read operation failed!
>
> That's because 0x800000 is not covered by any region... the chipset
> locks everything not covered automatically.
>
> Thanks for your help, just missed the 0x800000 address.
> Does it mean my 128Mbits flash is showed like a 64Mbits by controller due
> to BIOS given information ?
> My BIOS fits 64Mbits anyway, can I tell flashrom to read found regions
> only ?
>
> Best regards,
>
> By the way, when trying to write (passing valid regions via a layout file),
> rom / bios sizes difference seems to be a problem too :
>
> *flashrom v0.9.7-r1869 on Linux 3.13.0-24-generic (x86_64) flashrom is
> free software, get the source code at http://www.flashrom.org
> http://www.flashrom.org flashrom was built with libpci 3.2.1, GCC 4.8.2,
> little endian Command line (9 args): flashrom -V -p internal -c N25Q128..3E
> -w LFFF-verbose.bin -l LFFF.layout romlayout 00000000 - 001fffff named desc
> romlayout 00200000 - 007fffff named bios Calibrating delay loop... OS timer
> resolution is 1 usecs, 863M loops per second, 10 myus = 10 us, 100 myus =
> 104 us, 1000 myus = 1023 us, 10000 myus = 10017 us, 4 myus = 4 us, OK.
> Initializing internal programmer No coreboot table found. Using Internal
> DMI decoder. DMI string chassis-type: "Desktop" DMI string
> system-manufacturer: "Insyde" DMI string system-product-name: "MohonPeak"
> DMI string system-version: "TBD by OEM" DMI string baseboard-manufacturer:
> "Type2 - Board Vendor Name1" DMI string baseboard-product-name: "Type2 -
> Board Product Name1" DMI string baseboard-version: "Type2 - Board Version"
> Found chipset "Intel Avoton/Rangeley" with PCI ID 8086:1f38. This chipset
> is marked as untested. If you are using an up-to-date version of flashrom
> *and* were (not) able to successfully update your firmware with it, then
> please email a report to [e-mail] 
> including a verbose (-V) log. Thank you! Enabling flash write... Root
> Complex Register Block address = 0xfed1c000 GCS = 0x40000c01: BIOS
> Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI) Top Swap: not
> enabled 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH
> IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH
> IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH
> IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH
> IDSEL: 0x3 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000
> FWH decode enabled 0xffe80000/0xffa80000 FWH decode enabled
> 0xffe00000/0xffa00000 FWH decode enabled 0xffd80000/0xff980000 FWH decode
> enabled 0xffd00000/0xff900000 FWH decode enabled 0xffc80000/0xff880000 FWH
> decode enabled 0xffc00000/0xff800000 FWH decode enabled
> 0xff700000/0xff300000 FWH decode enabled 0xff600000/0xff200000 FWH decode
> enabled 0xff500000/0xff100000 FWH decode enabled 0xff400000/0xff000000 FWH
> decode enabled Maximum FWH chip size: 0x100000 bytes SPI_BASE_ADDRESS =
> 0xfed01000 SPI Read Configuration: prefetching disabled, caching enabled,
> BIOS_CNTL = 0x01: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
> 0x04: 0x6018 (HSFS) HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=3, SCIP=0,
> FDOPSS=1, FDV=1, FLOCKDN=0 Programming OPCODES... done 0x06: 0x0004 (HSFC)
> HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0 0x50: 0x0000ffff (FRAP) BMWAG 0x00,
> BMRAG 0x00, BRWA 0xff, BRRA 0xff 0x54: 0x01ff0000 FREG0: Flash Descriptor
> region (0x00000000-0x001fffff) is read-write. 0x58: 0x07ff0200 FREG1: BIOS
> region (0x00200000-0x007fffff) is read-write. 0x90: 0x84 (SSFS) SSFS:
> SCIP=0, FDONE=1, FCERR=0, AEL=0 0x91: 0xf80000 (SSFC) SSFC: SCGO=0, ACS=0,
> SPOP=0, COP=0, DBC=0, SME=0, SCF=0 0x94: 0x5006     (PREOP) 0x96:
> 0x463b     (OPTYPE) 0x98: 0x05d80302 (OPMENU) 0x9C: 0xc79f0190 (OPMENU+4)
> 0xC4: 0x0080d807 (LVSCC) LVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8,
> VCL=1 0xC8: 0x0000d807 (UVSCC) UVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8
> 0xD0: 0x00000000 (FPB) OK. The following protocols are supported: FWH, SPI.
> Probing for Micron/Numonyx/ST N25Q128..3E, 16384 kB:
> probe_spi_rdid_generic: id1 0x20, id2 0xba18 Found Micron/Numonyx/ST flash
> chip "N25Q128..3E" (16384 kB, SPI) mapped at physical address
> 0x00000000ff000000. Chip status register is 0x02. Chip status register:
> Status Register Write Disable (SRWD, SRP, ...) is not set Chip status
> register: Block Protect 3 (BP3) is not set Chip status register: Top/Bottom
> (TB) is top Chip status register: Block Protect 2 (BP2) is not set Chip
> status register: Block Protect 1 (BP1) is not set Chip status register:
> Block Protect 0 (BP0) is not set Chip status register: Write Enable Latch
> (WEL) is set Chip status register: Write In Progress (WIP/BUSY) is not set
> This chip may contain one-time programmable memory. flashrom cannot read
> and may never be able to write it, hence it may not be able to completely
> clone the contents of this chip (see man page for details). Error: Image
> size (8388608 B) doesn't match the flash chip's size (16777216 B)!
> Restoring MMIO space at 0x7f53cdfb309c Restoring MMIO space at
> 0x7f53cdfb3098 Restoring MMIO space at 0x7f53cdfb3096 Restoring MMIO space
> at 0x7f53cdfb3094 Restoring MMIO space at 0x7f53cdfb30fc*
>
> Any option / work around for this ?
>
> Best regards,
>
> flashrom mailing list
> [e-mail]
> http://www.flashrom.org/mailman/listinfo/flashrom