Modify

Opened 6 years ago

Last modified 5 years ago

#120 assigned enhancement

flashrom: ICH SPI Hardware Sequencing

Reported by: toc@… Owned by: stuge
Priority: major Milestone: flashrom v1.0
Component: flashrom (please use trac on flashrom.org) Keywords: ich9 spi
Cc: Dependencies:
Patch Status: there is no patch

Description

Running flashrom -r rom.file results in an output file of all null bytes. Standard output:

Calibrating delay loop... OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)
FAILED!
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
Reading flash... done.

Verbose output indicates failure of opcode 0x03.

Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cf0008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.

Full verbose output attached

Attachments (13)

output (15.1 KB) - added by toc@… 6 years ago.
verbose flashrom output
fr.ich9lock.patch (1.5 KB) - added by stuge 6 years ago.
Print correct ICH9 lock bits and actually set ichspi_lock.
fr.ich9lock2.patch (1.9 KB) - added by fengyuning1984@… 6 years ago.
Change address of the register containing spi lock bit to SPIBAR+4h for ICH9. Add (important) debug output.
fr.ich9lock2-s.patch (2.1 KB) - added by fengyuning1984@… 6 years ago.
Signed-off.
fr.ich9prg_ops_fail.patch (1.7 KB) - added by fengyuning1984@… 6 years ago.
Check if program_opcodes fails for ICH9.
r3862+fr.ich9pro_ops_fail.patch (15.1 KB) - added by toc@… 6 years ago.
r3864 + fr.ich9prog_ops_fail.patch verbose output
r3864+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch (15.1 KB) - added by toc@… 6 years ago.
r3864 + fr.ich9prog_ops_fail.patch + fr.ich9lock2-s.patch verbose output
twopatches (15.3 KB) - added by toc@… 6 years ago.
verbose output with 2 of the aforementioned patches applied
onepatch (15.1 KB) - added by toc@… 6 years ago.
verbose output with only fr.ich9prg_ops_fail.patch applied
fr.ich9prg_ops_fail2.patch (2.0 KB) - added by fengyuning1984@… 6 years ago.
Check if program_opcodes fails for ICH9, 2nd try.
fr.trigger_failure (430 bytes) - added by fengyuning1984@… 6 years ago.
fr.ops_fail3.patch (3.6 KB) - added by fengyuning1984@… 6 years ago.
patch3 (15.6 KB) - added by toc@… 6 years ago.
verbose output with 2 patches applied to r3869

Download all attachments as: .zip

Change History (38)

Changed 6 years ago by toc@…

verbose flashrom output

Changed 6 years ago by stuge

Print correct ICH9 lock bits and actually set ichspi_lock.

comment:1 Changed 6 years ago by stuge

  • Keywords ich9 added
  • Owner changed from somebody to stuge
  • Patch Status changed from there is no patch to patch needs review
  • Status changed from new to assigned
  • version v2 deleted

Thanks for the report!

Please try the attached patch (also at http://stuge.se/fr.ich9lock.patch) and send an Acked-by line if it solves the problem.

(Please see http://www.coreboot.org/Development_Guidelines#Reviews for a full description of how Acked-by-lines work/look.)

comment:2 Changed 6 years ago by toc@…

Patch applied to svn revision 3860. Same results, i.e., disk file full of null bytes, verbose output complains about Opcode 3.

Standard output:

Calibrating delay loop... OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)
FAILED!
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
Reading flash... done.

Verbose output

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 0, FDV 0, FDOPSS 0, SCIP 1, BERASE 3, AEL 1, FCERR 1, FDONE 1
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... done
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
<<<snip>>>>
Probing for Macronix MX25L8005, 1024 KB: RDID returned c2 20 14.
probe_spi_rdid_generic: id1 0xc2, id2 0x2014
Chip status register is 00
Chip status register: Status Register Write Disable (SRWD) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 / Block Protect 3 (BP3) is not set
Chip status register: Bit 4 / Block Protect 2 (BP2) is not set
Chip status register: Bit 3 / Block Protect 1 (BP1) is not set
Chip status register: Bit 2 / Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
<<<<snip>>>>
Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cb7008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.

comment:3 follow-up: Changed 6 years ago by stuge

Ok, the patch worked, but there is some other problem. I just committed a small change that adds useful debugging in r3862. Please update and resend output from running with -V.

Changed 6 years ago by fengyuning1984@…

Change address of the register containing spi lock bit to SPIBAR+4h for ICH9. Add (important) debug output.

Changed 6 years ago by fengyuning1984@…

Signed-off.

Changed 6 years ago by fengyuning1984@…

Check if program_opcodes fails for ICH9.

comment:4 follow-up: Changed 6 years ago by fengyuning1984@…

Please also try fr.ich9prg_ops_fail.patch without fr.ich9lock2-s.patch applied, and post the verbose output.

Thanks!

comment:5 in reply to: ↑ 3 Changed 6 years ago by toc@…

Replying to stuge:

Ok, the patch worked, but there is some other problem. I just committed a small change that adds useful debugging in r3862. Please update and resend output from running with -V.

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 0, FDV 0, FDOPSS 0, SCIP 1, BERASE 3, AEL 1, FCERR 1, FDONE 1
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... 
program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
done
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
<<<snip>>>>
probe_spi_rdid_generic: id1 0xc2, id2 0x2014
Chip status register is 00
Chip status register: Status Register Write Disable (SRWD) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 / Block Protect 3 (BP3) is not set
Chip status register: Bit 4 / Block Protect 2 (BP2) is not set
Chip status register: Bit 3 / Block Protect 1 (BP1) is not set
Chip status register: Bit 2 / Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
<<<<snip>>>>>
Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cdd008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.
}}}}

comment:6 in reply to: ↑ 4 ; follow-up: Changed 6 years ago by toc@…

Replying to fengyuning1984@…:

Please also try fr.ich9prg_ops_fail.patch without fr.ich9lock2-s.patch applied, and post the verbose output.

Thanks!

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

Changed 6 years ago by toc@…

r3864 + fr.ich9prog_ops_fail.patch verbose output

Changed 6 years ago by toc@…

r3864 + fr.ich9prog_ops_fail.patch + fr.ich9lock2-s.patch verbose output

comment:7 in reply to: ↑ 6 ; follow-up: Changed 6 years ago by anonymous

Replying to toc@…:

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

Sorry for questioning, but for r3862+fail, is the 'fail' patch applied cleanly (or is the correct output posted)?

For r3862+lock2, please also be sure the whole lock2 patch is applied (maybe try the lock2 patch alone). More register dump(0xXX: 0xXXXXXXXX (XXXX)) and a 'WARNING:' are expected in the output.

Changed 6 years ago by toc@…

verbose output with 2 of the aforementioned patches applied

Changed 6 years ago by toc@…

verbose output with only fr.ich9prg_ops_fail.patch applied

comment:8 in reply to: ↑ 7 ; follow-up: Changed 6 years ago by toc@…

Replying to anonymous:

Replying to toc@…:

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

Sorry for questioning, but for r3862+fail, is the 'fail' patch applied cleanly (or is the correct output posted)?

For r3862+lock2, please also be sure the whole lock2 patch is applied (maybe try the lock2 patch alone). More register dump(0xXX: 0xXXXXXXXX (XXXX)) and a 'WARNING:' are expected in the output.

I blew away my svn checkout, reapplied the patches, re-ran collecting the verbose output, and re-attached the results. Must have gotten confused during the last attempt.

comment:9 in reply to: ↑ 8 ; follow-up: Changed 6 years ago by fengyuning1984@…

Replying to toc@…:

I blew away my svn checkout, reapplied the patches, re-ran collecting the verbose output, and re-attached the results. Must have gotten confused during the last attempt.

With the lock2 patch, flashrom is working in an expected way. It warns for a not so good condition and does something according to that. Reading still does not work, because:

  1. the vendor BIOS has set up a flash chip instruction list(opmenu) that does not contain a read instruction(03h), and
  1. the vendor BIOS has locked down the list to prevent flashrom setting up a nicer list containing the read instruction. Once locked, it cannot be unlocked unless the machine is reset.

However, the 'fail' patch does not get a fail output. It would be very appreciated if you can help test the 'fail2' patch. The patch should also be applied to r3862 alone without other patches. Please also get the verbose output. If possible, make the execution of the new built the first flashrom execution after a reboot.

Changed 6 years ago by fengyuning1984@…

Check if program_opcodes fails for ICH9, 2nd try.

comment:10 in reply to: ↑ 9 ; follow-ups: Changed 6 years ago by toc@…

Replying to fengyuning1984@…:

However, the 'fail' patch does not get a fail output. It would be very appreciated if you can help test the 'fail2' patch. The patch should also be applied to r3862 alone without other patches. Please also get the verbose output. If possible, make the execution of the new built the first flashrom execution after a reboot.

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot. After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 1, FDV 0, FDOPSS 0, SCIP 0, BERASE 0, AEL 0, FCERR 0, FDONE 0
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... 
program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220
HSFS 0x8000, SSFS 0x04
HSFS 0x8000, SSFS 0x00
failed
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
Probing for AMD Am29F002(N)BB, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 pari
ty violation
Probing for AMD Am29F002(N)BT, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 pari
ty violation
Probing for AMD Am29F016D, 2048 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for AMD Am29F040B, 512 KB: probe_29f040b: id1 0xe3, id2 0xeb
Probing for AMD Am29LV040B, 512 KB: probe_29f040b: id1 0xe3, id2 0xeb
Probing for ASD AE49F2008, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity v
iolation
Probing for Atmel AT25DF021, 256 KB: 

comment:11 in reply to: ↑ 10 ; follow-up: Changed 6 years ago by anonymous

Replying to toc@…:

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot. After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

The 'fail' bug is one step closer to be fixed. Remaining work should be trival.

Many thanks for all the tests!

There is nothing more I can do for reading flash chip on your board using flashrom. My guess is, even the proprietory BIOS update tool from your board vendor will not read the existing content(I might be wrong, though). If you do want the flash chip content, you may have to use the "hard" way. If the flash chip is socketed, get it off and read with a flash programmer; if it is soldered, you may have to use a test clip and an in-system-programmer when the circuit of your board is allowed to do so.

comment:12 in reply to: ↑ 11 ; follow-up: Changed 6 years ago by toc@…

Replying to anonymous:

The 'fail' bug is one step closer to be fixed. Remaining work should be trival.

Send along whatever additional patches you'd like tested.

comment:13 in reply to: ↑ 12 Changed 6 years ago by fengyuning1984@…

Replying to toc@…:

Send along whatever additional patches you'd like tested.

There is another way to access the flash chip in ICH9, but may not be implemented in flashrom yet. If that is true, there is hope reading the flash and patches will come out.

comment:14 in reply to: ↑ 10 ; follow-up: Changed 6 years ago by stuge

Replying to toc@…:

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot. After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

..

program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220

Thanks! On the second call to program_opcodes the list of opcodes has been all trashed. I'll look into this a little later and try to provide a patch.

comment:15 in reply to: ↑ 14 Changed 6 years ago by fengyuning1984@…

Replying to stuge:

Replying to toc@…:

program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220

Thanks! On the second call to program_opcodes the list of opcodes has been all trashed. I'll look into this a little later and try to provide a patch.

My fault. r32_0 and r32_1 should be of uint32_t.

There is only one call to program_opcodes. The first line is values to be programmed, the second line is register content after REGWRITEs. REGWRITEs did not change the register content(see 'twopatches' for the original value) due to the lock.

comment:16 Changed 6 years ago by stuge

  • Keywords spi added
  • Patch Status changed from patch needs review to patch needs work

FYI the lock2 patch with a small change has been committed in r3869. No need for more tests yet though. Work is being done on an improved patch to check for opcode programming failure. Ultimately this bug will either be closed as invalid (because flashrom is powerless to the hardware configuration) or changed into an enhancement about making flashrom use the hardware sequencing mentioned by Yu Ning.

Changed 6 years ago by fengyuning1984@…

Changed 6 years ago by fengyuning1984@…

comment:17 follow-up: Changed 6 years ago by fengyuning1984@…

Please help test this new 'fail' patch.

Update to r3689, apply both fr.trigger_failure and fr.ops_fail3.patch. There is no need to reboot this time.

Changed 6 years ago by toc@…

verbose output with 2 patches applied to r3869

comment:18 in reply to: ↑ 17 Changed 6 years ago by anonymous

Replying to fengyuning1984@…:

Please help test this new 'fail' patch.

Update to r3689, apply both fr.trigger_failure and fr.ops_fail3.patch. There is no need to reboot this time.

Verbose output attached as "patch3"

comment:19 Changed 6 years ago by fengyuning1984@…

fr.ops_fail3.patch works as expected.

On "hardware sequencing":

ICH9 reports "FDV 1" in HSFS if hardware sequencing is possible, and "FDV 0" if not. flashrom will not be able to read the flash chip. Sorry.

comment:20 Changed 6 years ago by stuge

  • Milestone set to flashrom v1.0
  • Patch Status changed from patch needs work to there is no patch
  • Summary changed from flashrom failure to read to flashrom: ICH SPI Hardware Sequencing
  • Type changed from defect to enhancement

The original poster's BIOS has locked down the SPI commands that can be "triggered" by flashrom in the way the existing ICH SPI driver does, so in this situation flashrom has to do more work and drive the SPI commands "manually" using Hardware Sequencing.

FENG Yu Ning will work on this.

comment:21 Changed 6 years ago by stepan

ping

comment:22 Changed 6 years ago by fengyuning1984@…

In descriptor mode, ICH abstracts flash chips, providing software with "region"s to operate on. I think it will be better to implement the driver when we support partial operation.

If we are not going to support partial operation in v1.0, we may like to change the milestone. I hand out the ticket now (if I have been holding it).

BTW, ichspi.c still needs some cleanup. The code loading FDATAn registers doesn't look good, imo.

comment:23 Changed 6 years ago by hailfinger

We now have support for partial read and very limited support for partial erase.

comment:24 Changed 5 years ago by hailfinger

ICH SPI cleanup with a boatload of bugfixes: http://patchwork.coreboot.org/patch/663/

Tests are appreciated.

comment:25 Changed 5 years ago by stuge

Cleanup is great - just a note that the patch doesn't implement hardware sequencing.

Add Comment

Modify Ticket

Action
as assigned The owner will remain stuge.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.