[flashrom] Flash erasing failed mid way on Atmel AT25DF321 flash chip

Carl-Daniel Hailfinger c-d.hailfinger.devel.2006 at gmx.net
Sat Jun 19 15:43:21 CEST 2010 

Hi Ramakrishna,

On 18.06.2010 17:28, Ramakrishna.Koduri at emerson.com wrote:
> On June 18, 2010 5:27 AM, Carl-Daniel Hailfinger wrote:
>> is this a production system you have to recover now, or can you reflash
>> externally if something goes wrong?
>
> Yes. It is the production that I need to recover. This failure wiped
> out the existing BIOS on the flash.
>     I am exploring to see any other option other than JTAG interface for
> bringing back.
>   

Do you have a SPI connector on the board? If yes, you can use flashrom
to attach a Bus Pirate or a SPIPGM parallel port programmer or a FT2232H
USB-serial controller to recover.


> Flashrom worked many times for this. I don't know somehow this got
> failed in this attempt.
>
>
>> On 17.06.2010 16:26, Ramakrishna.Koduri at emerson.com wrote:
>>> I have tried upgrading BIOS image using flashrom v0.9.2-r1001.
>>> Surprisingly it failed in this attempt. 
>>>
>>> I did many times upgrade of BIOS using flashrom utility of above said 
>>> version.
>>> Earlier it was done by internal programmer with erase function-2.
>>>
>>> [root at localhost images]# flashrom -V -w atca-7360-cpu-v1.1.1.rom 
>>> flashrom v0.9.2-r1001 on Linux 2.6.18-194.el5xen (x86_64), built with

The failing flashrom run happened on a Xen kernel.


>>> libpci 2.2.3, GCC 4.1.2 20080704 (Red Hat 4.1.2-48)
>>> Initializing internal programmer
>>> No coreboot table found.
>>> DMI string system-manufacturer: "Emerson"
>>> DMI string system-product-name: "PCA,ATCA-7360/R1.0/6E "
>>> DMI string system-version: "R1.0 "
>>> DMI string baseboard-manufacturer: "Emerson"
>>> DMI string baseboard-product-name: "ATCA-7360/7365"
>>> DMI string baseboard-version: "0106865F01A    "
>>> DMI string chassis-type: ""
>>> Found chipset "Intel ICH10R", enabling flash write... 
>>> Maximum FWH chip size: 0x380000 bytes
>>> BIOS Lock Enable: disabled, BIOS Write Enable: enabled, BIOS_CNTL is 
>>> 0x9
>>> Root Complex Register Block address = 0xfed1c000 GCS = 0x460: BIOS 
>>> Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1
>>> (SPI)
>>> Top Swap : not enabled
>>> SPIBAR = 0xfed1c000 + 0x3800
>>> 0x04: 0x6008 (HSFS)
>>> FLOCKDN 0, FDV 1, FDOPSS 1, SCIP 0, BERASE 1, AEL 0, FCERR 0, FDONE 0
>>> 0x50: 0x00001b1b (FRAP)
>>> BMWAG 0, BMRAG 0, BRWA 27, BRRA 27
>>> 0x54: 0x00010000 (FREG0)
>>> 0x58: 0x03ff0080 (FREG1)
>>> 0x5C: 0x00001fff (FREG2)
>>> 0x60: 0x00030002 (FREG3)
>>> 0x64: 0x007f0004 (FREG4)
>>> 0x74: 0x00000000 (PR0)
>>> 0x78: 0x00000000 (PR1)
>>> 0x7C: 0x00000000 (PR2)
>>> 0x80: 0x00000000 (PR3)
>>> 0x84: 0x00000000 (PR4)
>>> 0x90: 0x007f100c (SSFS, SSFC)
>>> 0x94: 0x0006     (PREOP)
>>> 0x96: 0x463b     (OPTYPE)
>>> 0x98: 0x05d80302 (OPMENU)
>>> 0x9C: 0xc79f0190 (OPMENU+4)
>>> 0xA0: 0x00000000 (BBAR)
>>> 0xB0: 0x00004000 (FDOC)
>>> Programming OPCODES... 
>>> program_opcodes: preop=5006 optype=463b opmenu=05d80302c79f0190 done 
>>> SPI Read Configuration: prefetching enabled, caching enabled, OK.
>>> This chipset supports the following protocols: FWH,SPI.
>>> Calibrating delay loop... 1062M loops per second, 10 myus = 12 us, 100
>>> myus = 101 us, 1000 myus = 999 us, 10000 myus = 10005 us, OK.
>>> Probing for Atmel AT25DF321, 4096 KB: probe_spi_rdid_generic: id1 
>>> 0x1f,
>>> id2 0x4700
>>> Chip status register is 10
>>> Found chip "Atmel AT25DF321" (4096 KB, SPI) at physical address 
>>> 0xffc00000.
>>> Flash image seems to be a legacy BIOS. Disabling checks.
>>> Writing flash chip... Some block protection in effect, disabling 
>>> Erasing flash before programming... Erasing flash chip... Looking at 
>>> blockwise erase function 0... trying... 0x000000-0x000fff,
>>> ich_spi_send_multicommand: FIXME: Add on-the-fly reprogramming of the 
>>> chipset opcode list.
>>> Invalid OPCODE 0x20
>>> spi_block_erase_20 failed during command execution at address 0x0
>>>
>>> Looking at blockwise erase function 1... trying... 0x000000-0x007fff,
>>> ich_spi_send_multicommand: FIXME: Add on-the-fly reprogramming of the 
>>> chipset opcode list.
>>> Invalid OPCODE 0x52
>>> spi_block_erase_52 failed during command execution at address 0x0
>>>
>>> Looking at blockwise erase function 2... trying... 0x000000-0x00ffff, 
>>> 0x010000-0x01ffff, 0x020000-0x02ffff, 0x030000-0x03ffff, 
>>> 0x040000-0x04ffff, 0x050000-0x05ffff, 0x060000-0x06ffff, 
>>> 0x070000-0x07ffff, 0x080000-0x08ffff, 0x090000-0x09ffff, 
>>> 0x0a0000-0x0affff, ERASE FAILED at 0x000a0800! Expected=0xff, 
>>> Read=0x1f,Transaction error!
>>> run OPCODE 0x03 failed
>>> Transaction error!
>>> [...]
>>> run OPCODE 0x03 failed
>>> Transaction error!
>> Ah yes. This means your current BIOS version somehow blocks reading of
>> some regions. You could try flashrom r1016 or later which has improved
>> region protection handling.
>
> I am surprised to see why it should block some regions. 
>     May be once the board is UP, I shall give a try using flashrom r1016
> version.    
>
>
>>>  failed byte count from 0x000a0000-0x000affff: 0x1a ERASE FAILED!
>>>
>>> Looking at blockwise erase function 3... trying... 0x000000-0x3fffff, 
>>> Some block protection in effect, disabling
>>> ich_spi_send_multicommand: FIXME: Add on-the-fly reprogramming of the 
>>> chipset opcode list.
>>> Invalid OPCODE 0x60
>>> spi_chip_erase_60 failed during command execution
>>>
>>> Looking at blockwise erase function 4... trying... 0x000000-0x3fffff, 
>>> Some block protection in effect, disabling
>> It would be interesting to check if reading the complete chip works.
>> I think it probably won't work. Please report back with the verbose
>> results of a pure read test. 
>
> The current state of the system is not usable any more due to
> boardreset immediately after the flashrom failed. 
>     It didn't give me any chance to repair system back.
>   

Oh, that is very unfortunate. The board should not have resetted.


>     I have the traces of previously successful write operation. Please
> find the same here.
>
> [root at localhost flashrom-0.9.2]# ./flashrom -V  -l layout -w
> atca7360-bios.img -i part_2000_4000.log
>   

What does "-i part_2000_4000.log" do?


> flashrom v0.9.2-r1001 on Linux 2.6.18-194.el5PAE (i686), built with
> libpci 2.2.3, GCC 4.1.2 20080704 (Red Hat 4.1.2-48)
>   

The working flashrom run happened on a PAE kernel.


> flashrom is free software, get the source code at
> http://www.flashrom.org
> romlayout 00002000 - 00003fff named
> /mnt/root/ramki/flashrom-0.9.2/part_2000_4000.log
> Looking for "part_2000_4000.log"... not found.
>   

It seems you told flashrom that part_2000_4000.log is the image name in
the layout file. Is that intentional?


> Initializing internal programmer
> No coreboot table found.
> DMI string system-manufacturer: "Emerson"
> DMI string system-product-name: "PCA,ATCA-7360/R1.0/6E
> "
> DMI string system-version: "R1.0 "
> DMI string baseboard-manufacturer: "Emerson"
> DMI string baseboard-product-name: "ATCA-7360/7365"
> DMI string baseboard-version: "0106865F01A    "
> DMI string chassis-type: ""
> Found chipset "Intel ICH10R", enabling flash write... 
> Maximum FWH chip size: 0x380000 bytes
> BIOS Lock Enable: disabled, BIOS Write Enable: enabled, BIOS_CNTL is 0x9
> Root Complex Register Block address = 0xfed1c000
> GCS = 0x460: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x1
> (SPI)
> Top Swap : not enabled
> SPIBAR = 0xfed1c000 + 0x3800
> 0x04: 0x6008 (HSFS)
> FLOCKDN 0, FDV 1, FDOPSS 1, SCIP 0, BERASE 1, AEL 0, FCERR 0, FDONE 0
> 0x50: 0x00001b1b (FRAP)
> BMWAG 0, BMRAG 0, BRWA 27, BRRA 27
> 0x54: 0x00010000 (FREG0)
> 0x58: 0x03ff0080 (FREG1)
> 0x5C: 0x00001fff (FREG2)
> 0x60: 0x00030002 (FREG3)
> 0x64: 0x007f0004 (FREG4)
> 0x74: 0x00000000 (PR0)
> 0x78: 0x00000000 (PR1)
> 0x7C: 0x00000000 (PR2)
> 0x80: 0x00000000 (PR3)
> 0x84: 0x00000000 (PR4)
> 0x90: 0x007f100c (SSFS, SSFC)
> 0x94: 0x0006     (PREOP)
> 0x96: 0x463b     (OPTYPE)
> 0x98: 0x05d80302 (OPMENU)
> 0x9C: 0xc79f0190 (OPMENU+4)
> 0xA0: 0x00000000 (BBAR)
> 0xB0: 0x00004000 (FDOC)
> Programming OPCODES... 
> program_opcodes: preop=5006 optype=463b opmenu=05d80302c79f0190
> done
> SPI Read Configuration: prefetching enabled, caching enabled, OK.
> This chipset supports the following protocols: FWH,SPI.
> Calibrating delay loop... 1091M loops per second, 10 myus = 10 us, 100
> myus = 103 us, 1000 myus = 1029 us, 10000 myus = 10073 us, OK.
> Probing for Atmel AT25DF321, 4096 KB: probe_spi_rdid_generic: id1 0x1f,
> id2 0x4700
> Chip status register is 10
> Found chip "Atmel AT25DF321" (4096 KB, SPI) at physical address
> 0xffc00000.
> Flash image seems to be a legacy BIOS. Disabling checks.
> Writing flash chip... Some block protection in effect, disabling
> Erasing flash before programming... Erasing flash chip... Looking at
> blockwise erase function 0... trying... 0x000000-0x000fff,
> ich_spi_send_multicommand: FIXME: Add on-the-fly reprogramming of the
> chipset opcode list.
> Invalid OPCODE 0x20
> spi_block_erase_20 failed during command execution at address 0x0
>
> Looking at blockwise erase function 1... trying... 0x000000-0x007fff,
> ich_spi_send_multicommand: FIXME: Add on-the-fly reprogramming of the
> chipset opcode list.
> Invalid OPCODE 0x52
> spi_block_erase_52 failed during command execution at address 0x0
>
> Looking at blockwise erase function 2... trying... 0x000000-0x00ffff,
> 0x010000-0x01ffff, 0x020000-0x02ffff, 0x030000-0x03ffff,
> 0x040000-0x04ffff, 0x050000-0x05ffff, 0x060000-0x06ffff,
> 0x070000-0x07ffff, 0x080000-0x08ffff, 0x090000-0x09ffff,
> 0x0a0000-0x0affff, 0x0b0000-0x0bffff, 0x0c0000-0x0cffff,
> 0x0d0000-0x0dffff, 0x0e0000-0x0effff, 0x0f0000-0x0fffff,
> 0x100000-0x10ffff, 0x110000-0x11ffff, 0x120000-0x12ffff,
> 0x130000-0x13ffff, 0x140000-0x14ffff, 0x150000-0x15ffff,
> 0x160000-0x16ffff, 0x170000-0x17ffff, 0x180000-0x18ffff,
> 0x190000-0x19ffff, 0x1a0000-0x1affff, 0x1b0000-0x1bffff,
> 0x1c0000-0x1cffff, 0x1d0000-0x1dffff, 0x1e0000-0x1effff,
> 0x1f0000-0x1fffff, 0x200000-0x20ffff, 0x210000-0x21ffff,
> 0x220000-0x22ffff, 0x230000-0x23ffff, 0x240000-0x24ffff,
> 0x250000-0x25ffff, 0x260000-0x26ffff, 0x270000-0x27ffff,
> 0x280000-0x28ffff, 0x290000-0x29ffff, 0x2a0000-0x2affff,
> 0x2b0000-0x2bffff, 0x2c0000-0x2cffff, 0x2d0000-0x2dffff,
> 0x2e0000-0x2effff, 0x2f0000-0x2fffff, 0x300000-0x30ffff,
> 0x310000-0x31ffff, 0x320000-0x32ffff, 0x330000-0x33ffff,
> 0x340000-0x34ffff, 0x350000-0x35ffff, 0x360000-0x36ffff,
> 0x370000-0x37ffff, 0x380000-0x38ffff, 0x390000-0x39ffff,
> 0x3a0000-0x3affff, 0x3b0000-0x3bffff, 0x3c0000-0x3cffff,
> 0x3d0000-0x3dffff, 0x3e0000-0x3effff, 0x3f0000-0x3fffff, 
> SUCCESS.
> done.
> Programming page: 
>
> COMPLETE.
> Verifying flash... VERIFIED.
>   

I think that the crash was related to the Xen kernel.


Regards,
Carl-Daniel

-- 
http://www.hailfinger.org/

More information about the flashrom mailing list