Bug #643
closedinternal programmer: BCR write enable failure causes flash write to fail on Intel Tiger Lake (regression since v1.5)
0%
Description
Summary¶
Since flashrom v1.5, writing to the internal flash fails on Intel Tiger Lake LP
platforms. The same operation succeeds with v1.4.0.
Symptoms¶
flashrom v1.5+ attempts to set BIOS Control Register (BCR) bit BIOSWE at 0xdc,
fails, and aborts with a transaction error:
Warning: Setting BIOS Control at 0xdc from 0x88 to 0x89 failed.
New value is 0x88.
SPI Configuration is locked down.
...
Transaction error between offset 0x00500000 and 0x00500000
Write Failed!
v1.4.0 behavior (working)¶
v1.4.0 detects the SPI lockdown, logs "OK" and proceeds using hardware
sequencing — the write succeeds:
SPI Configuration is locked down.
Enabling hardware sequencing because some important opcode is locked.
OK.
...
Verifying flash... VERIFIED.
Suspected cause¶
The regression likely originates from one or both changes introduced in v1.5:
- ichspi: Change the opcode position for reprogramming on the fly 2->4
- ichspi: Merge spi_master implementations for Intel ich
- Possibly related to the ECAM transition (libpci >= 3.13.0) changing how
PCI registers are accessed, affecting BCR read/write behavior.
Workaround¶
Using flashrom v1.4.0 compiled from source works correctly on the same system.
Steps to reproduce¶
sudo flashrom -p internal:laptop=this_is_not_a_laptop -w firmware.bin
AK Updated by Anastasia Klimchuk 17 days ago
Hello Emmanuel, thank you for reporting a bug!
I realise this was few months ago, but maybe you can provide full logs? if you can for example attach to this bug.
The working case has
Enabling hardware sequencing because some important opcode is locked.
and the other does not - but maybe you just skipped when copying pieces from logs?
It is possible to force enable hwseq with a param (internal:ich_spi_mode=hwseq). By default the mode is auto, so the decision is made during init, and one of the conditions is missing opcodes (which can be related to your first suspect commit).
Also which version of libpci you have? this is related to your third suspect
AK Updated by Anastasia Klimchuk 16 days ago
Links to suspects mentioned in the description:
https://review.coreboot.org/c/flashrom/+/84567
https://review.coreboot.org/c/flashrom/+/84593
https://review.coreboot.org/c/flashrom/+/83896
(but we don't know yet what is the root cause, might be some other commit)
PM Updated by Peter Marheine 16 days ago
I borrowed an Asus CX3400F chromebook with i7-1160G7 to test some operations.
# flashrom --version
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
# crossystem mainfw_act
B
# flashrom -p internal -r bios.bin
# flashrom -p internal --fmap -i RW_SECTION_A -E
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Erase/write done from 500000 to cfffff
# flashrom -p internal --fmap -i RW_SECTION_A -w bios.bin
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 500000 to cfffff
Verifying flash... VERIFIED.
So at least on this configuration I don't see any problems.
PM Updated by Peter Marheine 16 days ago
I borrowed an Asus Chromebook Flip CX3 with i7-1160G7 to test some operations.
# flashrom --version
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
# crossystem mainfw_act
B
# flashrom -p internal -r bios.bin
# flashrom -p internal --fmap -i RW_SECTION_A -E
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Erase/write done from 500000 to cfffff
# flashrom -p internal --fmap -i RW_SECTION_A -w bios.bin
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 500000 to cfffff
Verifying flash... VERIFIED.
So at least on this configuration I don't see any problems, but suspect whatever hardware the reported has is probably configured differently in ways that are important (and probably won't be the case on a chromebook).
PM Updated by Peter Marheine 16 days ago
Whoops, disregard the double update. I was trying to update my comment to note that this is a Chromebook Flip CX3, and I suspect chromebooks probably configure relevant bits differently from the reporter's hardware so this probably isn't very conclusive.
AK Updated by Anastasia Klimchuk 13 days ago
Fixed in https://review.coreboot.org/c/flashrom/+/94973 !
The bug was not about Tiger Lake but about ECAM: more details in the patch by the link.
AK Updated by Anastasia Klimchuk 13 days ago
- Status changed from New to Resolved