[flashrom] FAILED: GA-B75M-D3V

Fri Dec 23 16:33:10 CET 2016

On 23.12.2016 08:19, David Hendricks wrote:
> Looks like it failed to overwrite the descriptor region (Intel ME-related
> headache): https://www.flashrom.org/ME

According to the log, the descriptor is writeable. Also the error occurs
right behind it.

When I looked through it first, I thought there might be a board speci-
fic write-protection. But now that David pointed me to the 0x1000 here:

>> 0x000000-0x00ffff:EFAILED at 0x00001000! Expected=0xff, Found=0x20,

I think you just selected the wrong chip. MX25L6405 uses a 64KiB erase-
block size by default, but only 4KiB (i.e. everything before 0x1000) got
erased. So it's likely one of the other chips flashrom proposed (it
can't know by itself, since the chip vendors reuse their IDs...).

MX25L6405D seems to be a good choice if you don't know for sure which
chip you have. It uses a subset of the functions the other chips use.

Hope that helps,
Nico

> 
> You can target regions more carefully using a layout file. It appears the
> other regions (ME, BIOS, GbE) are unlocked, so you can try creating a
> layout that includes only those regions.
> 
> On Mon, Dec 19, 2016 at 7:54 PM, Shawn <citypw at gmail.com> wrote:
> 
>> Hi flashrom maintainers,
>>
>> I failed to write a modified ROM to the flash via internal. Maybe this
>> chipset can only be writable via external programmer?
>>
>> root at sysresccd /root % flashrom -p internal
>> flashrom v0.9.8-r1888 on Linux 4.4.28-std490-amd64 (x86_64)
>> flashrom is free software, get the source code at http://www.flashrom.org
>>
>> Calibrating delay loop... OK.
>> Found chipset "Intel B75".
>> Enabling flash write... Warning: SPI Configuration Lockdown activated.
>> OK.
>> Found Macronix flash chip "MX25L6405" (8192 kB, SPI) mapped at
>> physical address 0xff800000.
>> Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) mapped at
>> physical address 0xff800000.
>> Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI)
>> mapped at physical address 0xff800000.
>> Found Macronix flash chip
>> "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) mapped at
>> physical address 0xff800000.
>> Multiple flash chip definitions match the detected chip(s):
>> "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E",
>> "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
>> Please specify which chip definition to use with the -c <chipname> option.
>>
>>
>> root at sysresccd /root % flashrom -VV -p internal -c MX25L6405  -w
>> factory_giga1.bin.new.new
>> flashrom v0.9.8-r1888 on Linux 4.4.28-std490-amd64 (x86_64)
>> flashrom is free software, get the source code at http://www.flashrom.org
>>
>> flashrom was built with libpci 3.4.1, GCC 4.8.5, little endian
>> Command line (7 args): flashrom -VV -p internal -c MX25L6405 -w
>> factory_giga1.bin.new.new
>> Calibrating delay loop... OS timer resolution is 1 usecs, 1944M loops
>> per second, 10 myus = 10 us, 100 myus = 117 us, 1000 myus = 1021 us,
>> 10000 myus = 10021 us, 4 myus = 4 us, OK.
>> Initializing internal programmer
>> No coreboot table found.
>> Using Internal DMI decoder.
>> DMI string chassis-type: "Desktop"
>> DMI string system-manufacturer: "Gigabyte Technology Co., Ltd."
>> DMI string system-product-name: "To be filled by O.E.M."
>> DMI string system-version: "To be filled by O.E.M."
>> DMI string baseboard-manufacturer: "Gigabyte Technology Co., Ltd."
>> DMI string baseboard-product-name: "B75M-D3V"
>> DMI string baseboard-version: "To be filled by O.E.M."
>> Found ITE Super I/O, ID 0x8728 on port 0x2e
>> Found chipset "Intel B75" with PCI ID 8086:1e49.
>> Enabling flash write... Root Complex Register Block address = 0xfed1c000
>> GCS = 0xc64: BIOS Interface Lock-Down: disabled, Boot BIOS Straps: 0x3
>> (SPI)
>> Top Swap: enabled (A16(+) inverted)
>> 0xfff80000/0xffb80000 FWH IDSEL: 0x0
>> 0xfff00000/0xffb00000 FWH IDSEL: 0x0
>> 0xffe80000/0xffa80000 FWH IDSEL: 0x1
>> 0xffe00000/0xffa00000 FWH IDSEL: 0x1
>> 0xffd80000/0xff980000 FWH IDSEL: 0x2
>> 0xffd00000/0xff900000 FWH IDSEL: 0x2
>> 0xffc80000/0xff880000 FWH IDSEL: 0x3
>> 0xffc00000/0xff800000 FWH IDSEL: 0x3
>> 0xff700000/0xff300000 FWH IDSEL: 0x4
>> 0xff600000/0xff200000 FWH IDSEL: 0x5
>> 0xff500000/0xff100000 FWH IDSEL: 0x6
>> 0xff400000/0xff000000 FWH IDSEL: 0x7
>> 0xfff80000/0xffb80000 FWH decode enabled
>> 0xfff00000/0xffb00000 FWH decode enabled
>> 0xffe80000/0xffa80000 FWH decode enabled
>> 0xffe00000/0xffa00000 FWH decode enabled
>> 0xffd80000/0xff980000 FWH decode enabled
>> 0xffd00000/0xff900000 FWH decode enabled
>> 0xffc80000/0xff880000 FWH decode enabled
>> 0xffc00000/0xff800000 FWH decode enabled
>> 0xff700000/0xff300000 FWH decode enabled
>> 0xff600000/0xff200000 FWH decode enabled
>> 0xff500000/0xff100000 FWH decode enabled
>> 0xff400000/0xff000000 FWH decode enabled
>> Maximum FWH chip size: 0x100000 bytes
>> SPI Read Configuration: prefetching enabled, caching enabled,
>> BIOS_CNTL = 0x09: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
>> SPIBAR = 0xf7795000 + 0x3800
>> 0x04: 0xe008 (HSFS)
>> HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=1
>> Warning: SPI Configuration Lockdown activated.
>> Reading OPCODES... done
>>         OP        Type      Pre-OP
>> op[0]: 0x02, write w/  addr, none
>> op[1]: 0x03, read  w/  addr, none
>> op[2]: 0x20, write w/  addr, none
>> op[3]: 0x05, read  w/o addr, none
>> op[4]: 0x9f, read  w/o addr, none
>> op[5]: 0x01, write w/o addr, none
>> op[6]: 0x00, read  w/o addr, none
>> op[7]: 0x00, read  w/o addr, none
>> Pre-OP 0: 0x06, Pre-OP 1: 0x00
>> 0x06: 0x0000 (HSFC)
>> HSFC: FGO=0, FCYCLE=0, FDBC=0, SME=0
>> 0x08: 0x00000000 (FADDR)
>> 0x50: 0x0000ffff (FRAP)
>> BMWAG 0x00, BMRAG 0x00, BRWA 0xff, BRRA 0xff
>> 0x54: 0x00000000 FREG0: Flash Descriptor region
>> (0x00000000-0x00000fff) is read-write.
>> 0x58: 0x07ff0000 FREG1: BIOS region (0x00000000-0x007fffff) is read-write.
>> 0x5C: 0x04ff0001 FREG2: Management Engine region
>> (0x00001000-0x004fffff) is read-write.
>> 0x60: 0x00001fff FREG3: Gigabit Ethernet region is unused.
>> 0x64: 0x00001fff FREG4: Platform Data region is unused.
>> 0x74: 0x00000000 (PR0 is unused)
>> 0x78: 0x00000000 (PR1 is unused)
>> 0x7C: 0x00000000 (PR2 is unused)
>> 0x80: 0x00000000 (PR3 is unused)
>> 0x84: 0x00000000 (PR4 is unused)
>> 0x90: 0x84 (SSFS)
>> SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
>> 0x91: 0xf94240 (SSFC)
>> SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=2, SME=0, SCF=1
>> 0x94: 0x0006     (PREOP)
>> 0x96: 0x043b     (OPTYPE)
>> 0x98: 0x05200302 (OPMENU)
>> 0x9C: 0x0000019f (OPMENU+4)
>> 0xA0: 0x00000000 (BBAR)
>> 0xC4: 0x00802005 (LVSCC)
>> LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
>> 0xC8: 0x00002005 (UVSCC)
>> UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20
>> 0xD0: 0x00000000 (FPB)
>> Reading flash descriptors mapped by the chipset via FDOC/FDOD... done.
>> === Content Section ===
>> FLVALSIG 0x0ff0a55a
>> FLMAP0   0x02040003
>> FLMAP1   0x12100206
>> FLMAP2   0x00210120
>>
>> --- Details ---
>> NR          (Number of Regions):                     3
>> FRBA        (Flash Region Base Address):         0x040
>> NC          (Number of Components):                  1
>> FCBA        (Flash Component Base Address):      0x030
>> ISL         (ICH/PCH Strap Length):                 18
>> FISBA/FPSBA (Flash ICH/PCH Strap Base Address):  0x100
>> NM          (Number of Masters):                     3
>> FMBA        (Flash Master Base Address):         0x060
>> MSL/PSL     (MCH/PROC Strap Length):                 1
>> FMSBA       (Flash MCH/PROC Strap Base Address): 0x200
>>
>> === Component Section ===
>> FLCOMP   0x09300024
>> FLILL    0x00000000
>>
>> --- Details ---
>> Component 1 density:            8 MB
>> Component 2 is not used.
>> Read Clock Frequency:           20 MHz
>> Read ID and Status Clock Freq.: 33 MHz
>> Write and Erase Clock Freq.:    33 MHz
>> Fast Read is supported.
>> Fast Read Clock Frequency:      33 MHz
>> Dual Output Fast Read Support:  enabled
>> No forbidden opcodes.
>>
>> === Region Section ===
>> FLREG0   0x00000000
>> FLREG1   0x07ff0000
>> FLREG2   0x04ff0001
>> FLREG3   0x00001fff
>> FLREG4   0x00001fff
>>
>> --- Details ---
>> Region 0 (Descr.) 0x00000000 - 0x00000fff
>> Region 1 (BIOS  ) 0x00000000 - 0x007fffff
>> Region 2 (ME    ) 0x00001000 - 0x004fffff
>> Region 3 (GbE   ) is unused.
>> Region 4 (Platf.) is unused.
>>
>> === Master Section ===
>> FLMSTR1  0xffff0000
>> FLMSTR2  0xffff0000
>> FLMSTR3  0xffff0118
>>
>> --- Details ---
>>       Descr. BIOS ME GbE Platf.
>> BIOS    rw    rw  rw  rw   rw
>> ME      rw    rw  rw  rw   rw
>> GbE     rw    rw  rw  rw   rw
>>
>> OK.
>> No IT87* serial flash segment enabled.
>> The following protocols are supported: FWH, SPI.
>> Probing for Macronix MX25L6405, 8192 kB: probe_spi_rdid_generic: id1
>> 0xc2, id2 0x2017
>> Found Macronix flash chip "MX25L6405" (8192 kB, SPI) mapped at
>> physical address 0xff800000.
>> Chip status register is 0x00.
>> Chip status register: Status Register Write Disable (SRWD, SRP, ...) is
>> not set
>> Chip status register: Bit 6 is not set
>> Chip status register: Block Protect 3 (BP3) is not set
>> Chip status register: Block Protect 2 (BP2) is not set
>> Chip status register: Block Protect 1 (BP1) is not set
>> Chip status register: Block Protect 0 (BP0) is not set
>> Chip status register: Write Enable Latch (WEL) is not set
>> Chip status register: Write In Progress (WIP/BUSY) is not set
>> Block protection is disabled.
>> Flash image seems to be a legacy BIOS. Disabling coreboot-related checks.
>> Reading old flash chip contents... done.
>> Erasing and writing flash chip... Trying erase function 0...
>> 0x000000-0x00ffff:EFAILED at 0x00001000! Expected=0xff, Found=0x20,
>> failed byte count from 0x00000000-0x0000ffff: 0xb55d
>> ERASE FAILED!
>> Reading current flash chip contents... done. Looking for another erase
>> function.
>> Trying erase function 1... 0x000000-0x00ffff:EInvalid OPCODE 0x06,
>> will not execute.
>> spi_block_erase_d8 failed during command execution at address 0x0
>> Reading current flash chip contents... done. Looking for another erase
>> function.
>> Trying erase function 2... 0x000000-0x7fffff:EInvalid OPCODE 0x06,
>> will not execute.
>> spi_chip_erase_60 failed during command execution
>> Reading current flash chip contents... done. Looking for another erase
>> function.
>> Trying erase function 3... 0x000000-0x7fffff:EInvalid OPCODE 0x06,
>> will not execute.
>> spi_chip_erase_c7 failed during command execution
>> Looking for another erase function.
>> No usable erase functions left.
>> FAILED!
>> Uh oh. Erase/write failed. Checking if anything has changed.
>> Reading current flash chip contents... done.
>> Apparently at least some data has changed.
>> Your flash chip is in an unknown state.
>> Get help on IRC at chat.freenode.net (channel #flashrom) or
>> mail flashrom at flashrom.org with the subject "FAILED: <your board name>"!
>> ------------------------------------------------------------
>> -------------------
>> DO NOT REBOOT OR POWEROFF!
>> Restoring MMIO space at 0xf77988a0
>> Restoring PCI config space for 00:1f:0 reg 0xdc
>>
>>
>> --
>> GNU powered it...
>> GPL protect it...
>> God blessing it...
>>
>> regards
>> Shawn
>>
>> _______________________________________________
>> flashrom mailing list
>> flashrom at flashrom.org
>> https://www.flashrom.org/mailman/listinfo/flashrom
>>
> 
> 
> 
> _______________________________________________
> flashrom mailing list
> flashrom at flashrom.org
> https://www.flashrom.org/mailman/listinfo/flashrom
> 