SST 49LF0008A - Erase problem (and solution)

[Panino ColSalame]

Hello,

I'm playing with flashrom on an ASEM Industrial PC based on an Atom Z530 and the US15W (Poulsbo) System Controller Hub.
The BIOS flash is the SST 49LF0008A (Firmware Hub).

After downloading the latest development code using git, flashrom was able to detect and read the flash, but the erase command failed.

At first I've tried to increase the delay that is used by the toggle functions in jedec.c, passing from the default 8 to 80 (just for testing).
At this point, the Erase command started to work properly.

SST manual reads:
The End-of-Write detection mode is incorporated into the FWH Read cycle.
The actual completion of the nonvolatile write is asynchronous with the system; therefore, either a Data# Polling or Toggle Bit read
may be simultaneous with the completion of the Write cycle.
If this occurs, the system may possibly get an erroneous result, i.e., valid data may appear to conflict with either DQ7 or DQ6.
In order to prevent spurious rejection, if an erroneous result occurs, the software routine should include a loop to read the accessed location an additional two (2) times.
If both reads are valid, then the device has completed the Write cycle, otherwise the rejection is valid.

So, I've set the delay for reading the toggle bit again to the default value of 8 and I've added an additional toggle bit check, in case the first one seems to be ok.

It works!

So, I'm able to Read, Write and Erase the chip.

Best Regards

Panino

diff -Nur flashromold/jedec.c flashromnew/jedec.c
--- flashromold/jedec.c    2010-03-08 14:07:23.000000000 +0100
+++ flashromnew/jedec.c    2010-03-08 13:29:30.000000000 +0100
@@ -50,7 +50,11 @@
             programmer_delay(delay);
         tmp2 = chip_readb(dst) & 0x40;
         if (tmp1 == tmp2) {
-            break;
+            tmp1 = chip_readb(dst) & 0x40;
+            programmer_delay(delay);
+            tmp2 = chip_readb(dst) & 0x40;
+            if (tmp1 == tmp2)
+                break;
         }
         tmp1 = tmp2;
     }

_________________________________________________________________
Personalizza il tuo Messenger con nuove e divertenti Emoticon
http://www.pimpit.it/emoticon.html

[Sean Nelson]

On 3/8/10 5:41 AM, Panino ColSalame wrote:
> Hello,
>
> I'm playing with flashrom on an ASEM Industrial PC based on an Atom Z530 and the US15W (Poulsbo) System Controller Hub.
> The BIOS flash is the SST 49LF0008A (Firmware Hub).
>
> After downloading the latest development code using git, flashrom was able to detect and read the flash, but the erase command failed.
>
> At first I've tried to increase the delay that is used by the toggle functions in jedec.c, passing from the default 8 to 80 (just for testing).
> At this point, the Erase command started to work properly.

The proper solution would to use the longer delay; in your case. It is 
possible there's a problem/bug with your system.
> SST manual reads:
> The End-of-Write detection mode is incorporated into the FWH Read cycle.
> The actual completion of the nonvolatile write is asynchronous with the system; therefore, either a Data# Polling or Toggle Bit read
> may be simultaneous with the completion of the Write cycle.
> If this occurs, the system may possibly get an erroneous result, i.e., valid data may appear to conflict with either DQ7 or DQ6.
> In order to prevent spurious rejection, if an erroneous result occurs, the software routine should include a loop to read the accessed location an additional two (2) times.
> If both reads are valid, then the device has completed the Write cycle, otherwise the rejection is valid.
>
> So, I've set the delay for reading the toggle bit again to the default value of 8 and I've added an additional toggle bit check, in case the first one seems to be ok.

The toggle check does a continuous read until it gets the correct data, 
you just changed the loop so it would work for you but is not a fix. It 
adds extraneous reads in a while loop.
> It works!
>
> So, I'm able to Read, Write and Erase the chip.
>
> Best Regards
>
> Panino

Nacked because of the previously mentioned points.

[Carl-Daniel Hailfinger]

Hi,

thanks for your report.

On 08.03.2010 14:41, Panino ColSalame wrote:
> I'm playing with flashrom on an ASEM Industrial PC based on an Atom Z530 and the US15W (Poulsbo) System Controller Hub.
> The BIOS flash is the SST 49LF0008A (Firmware Hub).
>
> After downloading the latest development code using git, flashrom was able to detect and read the flash, but the erase command failed.

Interesting. Such failures shouldn't happen, though.
> At first I've tried to increase the delay that is used by the toggle functions in jedec.c, passing from the default 8 to 80 (just for testing).
> At this point, the Erase command started to work properly.

Interesting. While the longer delay has the side effect of fixing this,
having 80 ms delays per sector is pretty much unacceptable for devices
with 1024 sectors or more.
> SST manual reads:
> The End-of-Write detection mode is incorporated into the FWH Read cycle.
> The actual completion of the nonvolatile write is asynchronous with the system; therefore, either a Data# Polling or Toggle Bit read
> may be simultaneous with the completion of the Write cycle.
> If this occurs, the system may possibly get an erroneous result, i.e., valid data may appear to conflict with either DQ7 or DQ6.
> In order to prevent spurious rejection, if an erroneous result occurs, the software routine should include a loop to read the accessed location an additional two (2) times.
> If both reads are valid, then the device has completed the Write cycle, otherwise the rejection is valid.

Please note that the SST manual talks about false rejects (which are not
a problem here) and doesn't talk about false accepts (which are a
problem here). Since the toggle loop continues running as long as there
is a reject, the additional two reads happen automatically with the
current code.
> So, I've set the delay for reading the toggle bit again to the default value of 8 and I've added an additional toggle bit check, in case the first one seems to be ok.

There are two possible reasons for a false accept (which the datasheet
doesn't mention):
1. Foreign reads from the chip by other apps/hardware. Can happen due to
ACPI, network card etc. If the number of  foreign reads between
subsequent toggle loop iterations is an odd number, the toggle loop will
get a false accept.
2. The chip toggles too slowly. Happens on some Winbond chips, but
usually only for erase. toggle_ready_jedec_slow() takes care of that.

Your patch has the side effect of partially fixing case 1, but it
violates the Winbond delay expectation while checking for the validity
of an accept.

Could you please try the patch below in verbose mode? It should issue
one read less in the success case, still conform to all timing
requirements, and fix false accept reason 1 with a high probability.

"flashrom -EV" or "flashrom -wV" output would be highly appreciated.

Signed-off-by: Carl-Daniel Hailfinger

Index: flashrom-recheck_jedec_toggle/jedec.c
===================================================================
--- flashrom-recheck_jedec_toggle/jedec.c	(Revision 988)
+++ flashrom-recheck_jedec_toggle/jedec.c	(Arbeitskopie)
@@ -50,7 +50,14 @@
    		programmer_delay(delay);
    	tmp2 = chip_readb(dst) & 0x40;
    	if (tmp1 == tmp2) {
-			break;
+			/* Recheck to avoid spurious results. */
+			programmer_delay(delay);
+			tmp1 = chip_readb(dst) & 0x40;
+			if (tmp1 == tmp2)
+				break;
+			msg_cdbg("Spurious toggle ready!\n");
+			/* Avoid a false positive during next loop. */
+			tmp2 = tmp1;
    	}
    	tmp1 = tmp2;
    }

Regards,
Carl-Daniel