[flashrom] FAILED: Lenovo X1 (2015)
Антон Кочков
anton.kochkov at gmail.com
Thu Dec 17 11:08:56 CET 2015
Hello!
Mainstream flashrom currently not yet merged patches, adding support
of reading layout. Because ME region usually not readable not from ME
itself,
it should be skipped, so using layout file, in your case:
# flashrom layout v2
0x00000000:0x00000fff descr
0x00500000:0x00ffffff BIOS
0x00003000:0x004fffff ME
0x00001000:0x00002fff GbE
And using flashrom with my patches should help:
https://github.com/XVilka/flashrom/tree/layout_descriptor
Some of the patches are still 'dirty' but should work - I've checked
them on a bunch of hardware.
you need to run it like:
flashrom -V -p internal -l this_file.layout -i BIOS -r bios_dump.bin
Kind regards,
Anton Kochkov.
On Thu, Dec 17, 2015 at 10:25 AM, Rui Paulo <rpaulo at me.com> wrote:
> Hi,
>
> I tried to dump the BIOS on my Lenovo X1 using flashrom and it didn't
> work. I'm using flashrom from svn trunk. Any ideas?
>
> flashrom v0.9.8-r1901 on Linux 4.2.0-1-amd64 (x86_64)
> flashrom is free software, get the source code at http://www.flashrom.o
> rg
>
> flashrom was built with libpci 3.3.1, GCC 5.2.1 20151028, little endian
> Command line (6 args): ./flashrom -VVp internal -c MX25L12805D --read
> a.rom
> Calibrating delay loop... OS timer resolution is 1 usecs, 2883M loops
> per second, 10 myus = 10 us, 100 myus = 122 us, 1000 myus = 1018 us,
> 10000 myus = 10335 us, 4 myus = 15 us, OK.
> Initializing internal programmer
> No coreboot table found.
> Using Internal DMI decoder.
> No DMI table found.
> W836xx enter config mode worked or we were already in config mode.
> W836xx leave config mode had no effect.
> Active config mode, unknown reg 0x20 ID: 00.
> Please send the output of "flashrom -V -p internal" to
> flashrom at flashrom.org with W836xx: your board name: flashrom -V
> as the subject to help us finish support for your Super I/O. Thanks.
> Found chipset "Intel Broadwell U Premium" with PCI ID 8086:9cc3.
> This chipset is marked as untested. If you are using an up-to-date
> version
> of flashrom *and* were (not) able to successfully update your firmware
> with it,
> then please email a report to flashrom at flashrom.org including a verbose
> (-V) log.
> Thank you!
> Enabling flash write... Root Complex Register Block address =
> 0xfed1c000
> GCS = 0x21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x0
> (LPC)
> Top Swap: not enabled
> 0xfff80000/0xffb80000 FWH IDSEL: 0x0
> 0xfff00000/0xffb00000 FWH IDSEL: 0x0
> 0xffe80000/0xffa80000 FWH IDSEL: 0x1
> 0xffe00000/0xffa00000 FWH IDSEL: 0x1
> 0xffd80000/0xff980000 FWH IDSEL: 0x2
> 0xffd00000/0xff900000 FWH IDSEL: 0x2
> 0xffc80000/0xff880000 FWH IDSEL: 0x3
> 0xffc00000/0xff800000 FWH IDSEL: 0x3
> 0xff700000/0xff300000 FWH IDSEL: 0x4
> 0xff600000/0xff200000 FWH IDSEL: 0x5
> 0xff500000/0xff100000 FWH IDSEL: 0x6
> 0xff400000/0xff000000 FWH IDSEL: 0x7
> 0xfff80000/0xffb80000 FWH decode enabled
> 0xfff00000/0xffb00000 FWH decode enabled
> 0xffe80000/0xffa80000 FWH decode enabled
> 0xffe00000/0xffa00000 FWH decode enabled
> 0xffd80000/0xff980000 FWH decode enabled
> 0xffd00000/0xff900000 FWH decode enabled
> 0xffc80000/0xff880000 FWH decode enabled
> 0xffc00000/0xff800000 FWH decode enabled
> 0xff700000/0xff300000 FWH decode enabled
> 0xff600000/0xff200000 FWH decode enabled
> 0xff500000/0xff100000 FWH decode enabled
> 0xff400000/0xff000000 FWH decode enabled
> Maximum FWH chip size: 0x100000 bytes
> SPI Read Configuration: prefetching enabled, caching enabled,
> BIOS_CNTL = 0x2a: BIOS Lock Enable: enabled, BIOS Write Enable:
> disabled
> Warning: BIOS region SMM protection is enabled!
> Warning: Setting Bios Control at 0xdc from 0x2a to 0x09 failed.
> New value is 0x2a.
> SPIBAR = 0x00007f030f57a000 + 0x3800
> 0x04: 0xe008 (HSFS)
> HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1,
> FLOCKDN=1
> Warning: SPI Configuration Lockdown activated.
> Reading OPCODES... done
> OP Type Pre-OP
> op[0]: 0x5a, read w/o addr, none
> op[1]: 0x9f, read w/o addr, none
> op[2]: 0x05, read w/o addr, none
> op[3]: 0x01, write w/o addr, none
> op[4]: 0x03, read w/ addr, none
> op[5]: 0x15, read w/o addr, none
> op[6]: 0xff, read w/o addr, none
> op[7]: 0xff, read w/o addr, none
> Pre-OP 0: 0x06, Pre-OP 1: 0x06
> 0x06: 0x0004 (HSFC)
> HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0
> 0x08: 0x00003000 (FADDR)
> 0x50: 0x00004a4b (FRAP)
> BMWAG 0x00, BMRAG 0x00, BRWA 0x4a, BRRA 0x4b
> 0x54: 0x00000000 FREG0: Warning: Flash Descriptor region (0x00000000-
> 0x00000fff) is read-only.
> 0x58: 0x0fff0500 FREG1: BIOS region (0x00500000-0x00ffffff) is read-
> write.
> 0x5C: 0x04ff0003 FREG2: Warning: Management Engine region (0x00003000-
> 0x004fffff) is locked.
> 0x60: 0x00020001 FREG3: Gigabit Ethernet region (0x00001000-0x00002fff)
> is read-write.
> 0x64: 0x00007fff FREG4: Platform Data region is unused.
> Not all flash regions are freely accessible by flashrom. This is most
> likely
> due to an active ME. Please see http://flashrom.org/ME for details.
> 0x74: 0x00000000 (PR0 is unused)
> 0x78: 0x8fff0eb0 PR1: Warning: 0x00eb0000-0x00ffffff is read-only.
> 0x7C: 0x8e2f0df1 PR2: Warning: 0x00df1000-0x00e2ffff is read-only.
> 0x80: 0x8df00df0 PR3: Warning: 0x00df0000-0x00df0fff is read-only.
> 0x84: 0x8def0a00 PR4: Warning: 0x00a00000-0x00deffff is read-only.
> Writes have been disabled for safety reasons. You can enforce write
> support with the ich_spi_force programmer option, but you will most
> likely
> harm your hardware! If you force flashrom you will get no support if
> something breaks. On a few mainboards it is possible to enable write
> access by setting a jumper (see its documentation or the board itself).
> 0x90: 0xc4 (SSFS)
> SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
> 0x91: 0xfc0000 (SSFC)
> SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=4
> 0x94: 0x0606 (PREOP)
> 0x96: 0x0240 (OPTYPE)
> 0x98: 0x01059f5a (OPMENU)
> 0x9C: 0xffff1503 (OPMENU+4)
> 0xA0: 0x00000000 (BBAR)
> 0xC4: 0x80802045 (LVSCC)
> LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
> 0xC8: 0x00002045 (UVSCC)
> UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20
> 0xD0: 0x50444653 (FPB)
> Reading flash descriptors mapped by the chipset via FDOC/FDOD... done.
> === Content Section ===
> FLVALSIG 0x0ff0a55a
> FLMAP0 0x03040003
> FLMAP1 0x15100206
> FLMAP2 0x00210120
>
> --- Details ---
> NR (Number of Regions): 4
> FRBA (Flash Region Base Address): 0x040
> NC (Number of Components): 1
> FCBA (Flash Component Base Address): 0x030
> ISL (ICH/PCH Strap Length): 21
> FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100
> NM (Number of Masters): 3
> FMBA (Flash Master Base Address): 0x060
> MSL/PSL (MCH/PROC Strap Length): 1
> FMSBA (Flash MCH/PROC Strap Base Address): 0x200
>
> === Component Section ===
> FLCOMP 0x49900045
> FLILL 0xad604221
>
> --- Details ---
> Component 1 density: 16 MB
> Component 2 is not used.
> Read Clock Frequency: 20 MHz
> Read ID and Status Clock Freq.: 33 MHz
> Write and Erase Clock Freq.: 33 MHz
> Fast Read is supported.
> Fast Read Clock Frequency: 50 MHz
> Dual Output Fast Read Support: disabled
> Invalid instruction 0: 0x21
> Invalid instruction 1: 0x42
> Invalid instruction 2: 0x60
> Invalid instruction 3: 0xad
>
> === Region Section ===
> FLREG0 0x00000000
> FLREG1 0x0fff0500
> FLREG2 0x04ff0003
> FLREG3 0x00020001
> FLREG4 0x00007fff
>
> --- Details ---
> Region 0 (Descr.) 0x00000000 - 0x00000fff
> Region 1 (BIOS ) 0x00500000 - 0x00ffffff
> Region 2 (ME ) 0x00003000 - 0x004fffff
> Region 3 (GbE ) 0x00001000 - 0x00002fff
> Region 4 (Platf.) is unused.
>
> === Master Section ===
> FLMSTR1 0x0a0b0000
> FLMSTR2 0x0c0d0000
> FLMSTR3 0x08080118
>
> --- Details ---
> Descr. BIOS ME GbE Platf.
> BIOS r rw rw
> ME r rw rw
> GbE rw
>
> PROBLEMS, continuing anyway
> The following protocols are supported: FWH, SPI.
> Probing for Macronix MX25L12805D, 16384 kB: probe_spi_rdid_generic: id1
> 0xc2, id2 0x2018
> Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) mapped at
> physical address 0x00000000ff000000.
> Chip status register is 0x40.
> Chip status register: Status Register Write Disable (SRWD, SRP, ...) is
> not set
> Chip status register: Bit 6 is set
> Chip status register: Block Protect 3 (BP3) is not set
> Chip status register: Block Protect 2 (BP2) is not set
> Chip status register: Block Protect 1 (BP1) is not set
> Chip status register: Block Protect 0 (BP0) is not set
> Chip status register: Write Enable Latch (WEL) is not set
> Chip status register: Write In Progress (WIP/BUSY) is not set
> This chip may contain one-time programmable memory. flashrom cannot
> read
> and may never be able to write it, hence it may not be able to
> completely
> clone the contents of this chip (see man page for details).
> Block protection is disabled.
> Reading flash... Transaction error!
> SSFS: SCIP=0, FDONE=1, FCERR=1, AEL=0
> SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=63, SME=0, SCF=4
> Running OPCODE 0x03 failed at address 0x003000 (payload length was 64).
> Read operation failed!
> FAILED.
> Restoring MMIO space at 0x7f030f57d8a0
> Restoring PCI config space for 00:1f:0 reg 0xdc
> --
> Rui Paulo
>
>
> _______________________________________________
> flashrom mailing list
> flashrom at flashrom.org
> http://www.flashrom.org/mailman/listinfo/flashrom
More information about the flashrom
mailing list