flashrom: ICH SPI Hardware Sequencing

[toc@…]

Running flashrom -r rom.file results in an output file of all null bytes.
Standard output:

Calibrating delay loop... OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)
FAILED!
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
Reading flash... done.

Verbose output indicates failure of opcode 0x03.

Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cf0008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.

Full verbose output attached

[toc@…]

verbose flashrom output

[stuge]

Print correct ICH9 lock bits and actually set ichspi_lock.

[stuge]

Thanks for the report!

Please try the attached patch (also at ​http://stuge.se/fr.ich9lock.patch) and send an Acked-by line if it solves the problem.

(Please see http://www.coreboot.org/Development_Guidelines#Reviews for a full description of how Acked-by-lines work/look.)

[toc@…]

Patch applied to svn revision 3860. Same results, i.e., disk file full of null bytes, verbose output complains about Opcode 3.

Standard output:

Calibrating delay loop... OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)
FAILED!
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
Reading flash... done.

Verbose output

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 0, FDV 0, FDOPSS 0, SCIP 1, BERASE 3, AEL 1, FCERR 1, FDONE 1
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... done
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
<<<snip>>>>
Probing for Macronix MX25L8005, 1024 KB: RDID returned c2 20 14.
probe_spi_rdid_generic: id1 0xc2, id2 0x2014
Chip status register is 00
Chip status register: Status Register Write Disable (SRWD) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 / Block Protect 3 (BP3) is not set
Chip status register: Bit 4 / Block Protect 2 (BP2) is not set
Chip status register: Bit 3 / Block Protect 1 (BP1) is not set
Chip status register: Bit 2 / Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
<<<<snip>>>>
Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cb7008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.

[stuge]

Ok, the patch worked, but there is some other problem. I just committed a small change that adds useful debugging in r3862. Please update and resend output from running with -V.

[fengyuning1984@…]

Change address of the register containing spi lock bit to SPIBAR+4h for ICH9. Add (important) debug output.

[fengyuning1984@…]

Signed-off.

[fengyuning1984@…]

Check if program_opcodes fails for ICH9.

[fengyuning1984@…]

Please also try ​fr.ich9prg_ops_fail.patch without fr.ich9lock2-s.patch applied, and post the verbose output.

Thanks!

[toc@…]

Replying to stuge:

Ok, the patch worked, but there is some other problem. I just committed a small change that adds useful debugging in r3862. Please update and resend output from running with -V.

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 0, FDV 0, FDOPSS 0, SCIP 1, BERASE 3, AEL 1, FCERR 1, FDONE 1
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... 
program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
done
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
<<<snip>>>>
probe_spi_rdid_generic: id1 0xc2, id2 0x2014
Chip status register is 00
Chip status register: Status Register Write Disable (SRWD) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 / Block Protect 3 (BP3) is not set
Chip status register: Bit 4 / Block Protect 2 (BP2) is not set
Chip status register: Bit 3 / Block Protect 1 (BP1) is not set
Chip status register: Bit 2 / Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Found chip "Macronix MX25L8005" (1024 KB) at physical address 0xfff00000.
<<<<snip>>>>>
Reading flash... ich_spi_read_page: offset=0, number=256, buf=0xb7cdd008
Opcode 3 not found.
run OPCODE 0x03 failed
Error readingdone.
}}}}

[toc@…]

Replying to fengyuning1984@…:

Please also try ​fr.ich9prg_ops_fail.patch without fr.ich9lock2-s.patch applied, and post the verbose output.

Thanks!

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

[toc@…]

r3864 + fr.ich9prog_ops_fail.patch verbose output

[toc@…]

r3864 + fr.ich9prog_ops_fail.patch + fr.ich9lock2-s.patch verbose output

[anonymous]

Replying to toc@…:

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

Sorry for questioning, but for r3862+fail, is the 'fail' patch applied cleanly (or is the correct output posted)?

For r3862+lock2, please also be sure the whole lock2 patch is applied (maybe try the lock2 patch alone). More register dump(0xXX: 0xXXXXXXXX (XXXX)) and a 'WARNING:' are expected in the output.

[toc@…]

verbose output with 2 of the aforementioned patches applied

[toc@…]

verbose output with only fr.ich9prg_ops_fail.patch applied

[toc@…]

Replying to anonymous:

Replying to toc@…:

I will be attaching verbose output from r3862+fr.ich9pro_ops_fail.patch and r3862+fr.ich9prg_ops_fail.patch+fr.ich9lock2-s.patch.

Sorry for questioning, but for r3862+fail, is the 'fail' patch applied cleanly (or is the correct output posted)?

For r3862+lock2, please also be sure the whole lock2 patch is applied (maybe try the lock2 patch alone). More register dump(0xXX: 0xXXXXXXXX (XXXX)) and a 'WARNING:' are expected in the output.

I blew away my svn checkout, reapplied the patches, re-ran collecting the verbose output, and re-attached the results. Must have gotten confused during the last attempt.

[fengyuning1984@…]

Replying to toc@…:

I blew away my svn checkout, reapplied the patches, re-ran collecting the verbose output, and re-attached the results. Must have gotten confused during the last attempt.

With the lock2 patch, flashrom is working in an expected way. It warns for a not so good condition and does something according to that. Reading still does not work, because:

1. the vendor BIOS has set up a flash chip instruction list(opmenu) that does not contain a read instruction(03h), and

2. the vendor BIOS has locked down the list to prevent flashrom setting up a nicer list containing the read instruction. Once locked, it cannot be unlocked unless the machine is reset.

However, the 'fail' patch does not get a fail output. It would be very appreciated if you can help test the 'fail2' patch. The patch should also be applied to r3862 alone without other patches. Please also get the verbose output. If possible, make the execution of the new built the first flashrom execution after a reboot.

[fengyuning1984@…]

Check if program_opcodes fails for ICH9, 2nd try.

[toc@…]

Replying to fengyuning1984@…:

However, the 'fail' patch does not get a fail output. It would be very appreciated if you can help test the 'fail2' patch. The patch should also be applied to r3862 alone without other patches. Please also get the verbose output. If possible, make the execution of the new built the first flashrom execution after a reboot.

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot.
After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

Calibrating delay loop... 663M loops per second, 100 myus = 200 us. OK.
No coreboot table found.
Found chipset "Intel ICH9R", enabling flash write... 
BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2
tried to set 0xdc to 0x3 on Intel ICH9R failed (WARNING ONLY)

Root Complex Register Block address = 0xfeda8000
GCS = 0x410460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1 (SPI)
Top Swap : not enabled
SPIBAR = 0xfeda8000 + 0x3800
0x00: 0x1fff (HSFS)
FLOCKDN 1, FDV 0, FDOPSS 0, SCIP 0, BERASE 0, AEL 0, FCERR 0, FDONE 0
0x50: 0x0000ffff (FRAP)
BMWAG 0, BMRAG 0, BRWA 255, BRRA 255
0x54: 0x00001fff (FREG0)
0x58: 0x00001fff (FREG1)
0x5C: 0x00001fff (FREG2)
0x60: 0x00001fff (FREG3)
0x64: 0x00001fff (FREG4)
0x74: 0x00000000 (PR0)
0x78: 0x00000000 (PR1)
0x7C: 0x00000000 (PR2)
0x80: 0x00000000 (PR3)
0x84: 0x00000000 (PR4)
0xB0: 0x00000000 (FDOC)
Programming OPCODES... 
program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220
HSFS 0x8000, SSFS 0x04
HSFS 0x8000, SSFS 0x00
failed
SPI Read Configuration: prefetching disabled, caching enabled, FAILED!
Probing for AMD Am29F002(N)BB, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 pari
ty violation
Probing for AMD Am29F002(N)BT, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 pari
ty violation
Probing for AMD Am29F016D, 2048 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for AMD Am29F040B, 512 KB: probe_29f040b: id1 0xe3, id2 0xeb
Probing for AMD Am29LV040B, 512 KB: probe_29f040b: id1 0xe3, id2 0xeb
Probing for ASD AE49F2008, 256 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity v
iolation
Probing for Atmel AT25DF021, 256 KB: 

[anonymous]

Replying to toc@…:

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot.
After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

The 'fail' bug is one step closer to be fixed. Remaining work should be trival.

Many thanks for all the tests!

There is nothing more I can do for reading flash chip on your board using flashrom. My guess is, even the proprietory BIOS update tool from your board vendor will not read the existing content(I might be wrong, though). If you do want the flash chip content, you may have to use the "hard" way. If the flash chip is socketed, get it off and read with a flash programmer; if it is soldered, you may have to use a test clip and an in-system-programmer when the circuit of your board is allowed to do so.

[toc@…]

Replying to anonymous:

The 'fail' bug is one step closer to be fixed. Remaining work should be trival.

Send along whatever additional patches you'd like tested.

[fengyuning1984@…]

Replying to toc@…:

Send along whatever additional patches you'd like tested.

There is another way to access the flash chip in ICH9, but may not be implemented in flashrom yet. If that is true, there is hope reading the flash and patches will come out.

[stuge]

Replying to toc@…:

Reverted checkout to r3862, cleared out old patches, applied fail2 patch, make clean, make, reboot.
After reboot, ran flashrom with verbose output. Segmentation fault. Verbose output up to segfault below:

..

program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220

Thanks! On the second call to program_opcodes the list of opcodes has been all trashed. I'll look into this a little later and try to provide a patch.

[fengyuning1984@…]

Replying to stuge:

Replying to toc@…:

program_opcodes: preop=0006 optype=463b opmenu=05d80302c79f01ab
program_opcodes: preop=0606 optype=4fc8 opmenu=0000abab00000220

Thanks! On the second call to program_opcodes the list of opcodes has been all trashed. I'll look into this a little later and try to provide a patch.

My fault. r32_0 and r32_1 should be of uint32_t.

There is only one call to program_opcodes. The first line is values to be programmed, the second line is register content after REGWRITEs. REGWRITEs did not change the register content(see 'twopatches' for the original value) due to the lock.

[stuge]

FYI the lock2 patch with a small change has been committed in r3869. No need for more tests yet though. Work is being done on an improved patch to check for opcode programming failure. Ultimately this bug will either be closed as invalid (because flashrom is powerless to the hardware configuration) or changed into an enhancement about making flashrom use the hardware sequencing mentioned by Yu Ning.

[fengyuning1984@…]

Please help test this new 'fail' patch.

Update to r3689, apply both fr.trigger_failure and fr.ops_fail3.patch. There is no need to reboot this time.

[toc@…]

verbose output with 2 patches applied to r3869

[anonymous]

Replying to fengyuning1984@…:

Please help test this new 'fail' patch.

Update to r3689, apply both fr.trigger_failure and fr.ops_fail3.patch. There is no need to reboot this time.

Verbose output attached as "patch3"

[fengyuning1984@…]

fr.ops_fail3.patch works as expected.

On "hardware sequencing":

ICH9 reports "FDV 1" in HSFS if hardware sequencing is possible, and "FDV 0" if not. flashrom will not be able to read the flash chip. Sorry.

[stuge]

The original poster's BIOS has locked down the SPI commands that can be "triggered" by flashrom in the way the existing ICH SPI driver does, so in this situation flashrom has to do more work and drive the SPI commands "manually" using Hardware Sequencing.

FENG Yu Ning will work on this.

[stepan]

ping

[fengyuning1984@…]

In descriptor mode, ICH abstracts flash chips, providing software with
"region"s to operate on. I think it will be better to implement the
driver when we support partial operation.

If we are not going to support partial operation in v1.0, we may like
to change the milestone. I hand out the ticket now (if I have been
holding it).

BTW, ichspi.c still needs some cleanup. The code loading FDATAn
registers doesn't look good, imo.

[hailfinger]

We now have support for partial read and very limited support for partial erase.

[hailfinger]

ICH SPI cleanup with a boatload of bugfixes:
​http://patchwork.coreboot.org/patch/663/

Tests are appreciated.

[stuge]

Cleanup is great - just a note that the patch doesn't implement hardware sequencing.