[flashrom] ENE KB9012 Programming with flashrom

Paul Kocialkowski contact at paulk.fr
Mon May 16 11:14:21 CEST 2016


Hi,

Le dimanche 01 mai 2016 à 15:47 +0200, Joerg Albert a écrit :
> On 01.05.2016 10:37, Paul Kocialkowski wrote:
> > Hi,
> > 
> > could you CC the flashrom mailing list in your future responses? This will
> > probably interest others!
> I wasn't aware of this mailing lists, thanks!
> > Le dimanche 24 avril 2016 à 23:15 +0200, Joerg Albert a écrit :
> > > I'll try to program the internal SPI of a KB9012 (inside a Thinkpad S531)
> > > - as
> > > soon as I've found the correct image and soldered the necessary wires.
> > The KB9012 chips has an internal flash memory that is distinct from the
> > BIOS'
> > SPI flash, so beware not to confuse both!
>
> I'm aware of this. The S531 manual says, that the system indicator LED shall
> flash three times when the power supply gets connected (without switching the
> notebook on). As I don't see this and the voltage at the KB9012 is correct I
> guess that the EC is not working properly.

That makes sense, even though I really don't know enough about your device to
say. It's a fun thing to do anyway and it would allow some more testing on my
patches, so I encourage you to do it anyway :)

> Flashing the BIOS SPI may be the second step ;-)
> 
> > > Found your patch here:
> > > 
> > > http://patchwork.coreboot.org/patch/4325/
> > > 
> > > Why couldn't I use FlashDirectAccess? Is this meant to program external
> > > SPI
> > > flash only?
> > Yes, that's my understanding of it too. It just makes a bridge between the
> > BIOS'
> > SPI flash and the KB9012 pads. This is because it's often easier to reflash
> > it
> > using the keyboard connector, that is often available without fully opening
> > the
> > device.
> > 
> > What you want if you need to reflash the EC is not FlashDirectAccess, but
> > EDI.
> > Note that some firmwares explicitly disable it, so you have to ground pin 42
> > to
> > enter "test mode", where the 8051 is not running.
> > 
> > Note that the EDI pins are often exported on the keyboard connector, which
> > makes
> > soldering more doable.
> > 
> The keyboard connector of the S531 has a pitch of 0.5mm, too close for my
> soldering experience.
> I couldn't find a flex cable matching the connector either, so I went for
> soldering wires to some vias/testpoints instead.

Good thing if you were able to get all pins that way! Soldering is generally not
too hard with flux and braid. What I did is shown on my latest FOSDEM slides: ht
tp://ftp-osl.osuosl.org/pub/replicant/conferences/fosdem-2016/the-road-to-
liberating-software-at-the-lower-levels.pdf on the slides about the KB9012 EC.

> Connected a RaspberryPi and had some problems with the detection of the
> KB9012. It seemed to detect the KB9012
> on every second trial only:

That's quite strange, can you try with another programmer? Any cheap ch341a-
based board would do for a comparison.

> --------------
> pi at raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c
> "KB9012 (EDI)" -V
> flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l)
> flashrom is free software, get the source code at https://flashrom.org
> 
> flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian
> Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024
> -c KB9012 (EDI) -V
> Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per
> second, 10 myus = 11 us, 100 myus = 103 us, 1000 myus = 994 us, 10000 myus =
> 10064 us, 20 myus = 26 us, OK.
> Initializing linux_spi programmer
> Using device /dev/spidev0.0
> Using 1024 kHz clock
> The following protocols are supported: SPI.
> Probing for ENE KB9012 (EDI), 128 kB: probing for EDI
> EDI: found hw version 195 EDI id 4
> Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi.
> No operations were specified.
> pi at raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c
> "KB9012 (EDI)" -V
> flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l)
> flashrom is free software, get the source code at https://flashrom.org
> 
> flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian
> Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024
> -c KB9012 (EDI) -V
> Calibrating delay loop... OS timer resolution is 4 usecs, 226M loops per
> second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 1839 us, 10000 myus =
> 10424 us, 16 myus = 21 us, OK.
> Initializing linux_spi programmer
> Using device /dev/spidev0.0
> Using 1024 kHz clock
> The following protocols are supported: SPI.
> Probing for ENE KB9012 (EDI), 128 kB: probing for EDI
> EDI: failed to read hw version (-1)
> No EEPROM/flash device found.
> Note: flashrom can never write if the flash chip isn't found automatically.
> pi at raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c
> "KB9012 (EDI)" -V
> flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l)
> flashrom is free software, get the source code at https://flashrom.org
> 
> flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian
> Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024
> -c KB9012 (EDI) -V
> Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per
> second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 994 us, 10000 myus =
> 10061 us, 20 myus = 22 us, OK.
> Initializing linux_spi programmer
> Using device /dev/spidev0.0
> Using 1024 kHz clock
> The following protocols are supported: SPI.
> Probing for ENE KB9012 (EDI), 128 kB: probing for EDI
> EDI: found hw version 195 EDI id 4
> Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi.
> No operations were specified.
> --------
> 
> I've also tried with "speed=2048" (as the KB9012 manual states a minimum clock
> of 1MHz) - same problem.
> /
> /I've added some error/debug printouts and it seems like the KB9012 answers
> with all-zeros on each second start of the probe.

That's typical of not getting any answer if I'm not mistaken about the SPI bus.

> If the buffer content is correct everything else afterwards works fine.
> 
> So I've added a quick workaround in edi_read_byte() and edi_read() to re-do
> any read if the buffer contains zero at the first byte.
> See the patches attached.

I'll have to check that this doesn't cause further problems, but it looks like a
good plan.

> No idea why it behaves that way, maybe the SPI detection on these pins is a
> bit shaky?

I couldn't say, my setup works reliably. It doesn't look like a connector issue
if it works with your patch. Maybe probe the line with a logic analyzer to see
what's going on?

> Pin 42 was grounded and the KB9012 remained powered during the whole session.

Thanks for the feedback!

Cheers,
-- 
Paul Kocialkowski, developer of low-level free software for embedded devices

Website: https://www.paulk.fr/
Coding blog: https://code.paulk.fr/
Git repositories: https://git.paulk.fr/ https://git.code.paulk.fr/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://www.flashrom.org/pipermail/flashrom/attachments/20160516/f6a506f7/attachment.asc>


More information about the flashrom mailing list