Project

General

Profile

Actions

Bug #643

closed
EB

internal programmer: BCR write enable failure causes flash write to fail on Intel Tiger Lake (regression since v1.5)

Bug #643: internal programmer: BCR write enable failure causes flash write to fail on Intel Tiger Lake (regression since v1.5)

Added by Emmanuel BRUNACHE 4 months ago. Updated 13 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Programmer
Target version:
Start date:
05/04/2026
Due date:
% Done:

0%

Estimated time:
Affected versions:
Needs backport to:
Affected hardware:
Intel Tiger Lake LP / Tiger Lake U Premium, GigaDevice GD25B128B/GD25Q128B (16384 kB)
Affected OS:
Linux 7.0.0-15-generic (x86_64), Ubuntu 26.04

Description

Summary

Since flashrom v1.5, writing to the internal flash fails on Intel Tiger Lake LP
platforms. The same operation succeeds with v1.4.0.

Symptoms

flashrom v1.5+ attempts to set BIOS Control Register (BCR) bit BIOSWE at 0xdc,
fails, and aborts with a transaction error:

Warning: Setting BIOS Control at 0xdc from 0x88 to 0x89 failed.
New value is 0x88.
SPI Configuration is locked down.
...
Transaction error between offset 0x00500000 and 0x00500000
Write Failed!

v1.4.0 behavior (working)

v1.4.0 detects the SPI lockdown, logs "OK" and proceeds using hardware
sequencing — the write succeeds:

SPI Configuration is locked down.
Enabling hardware sequencing because some important opcode is locked.
OK.
...
Verifying flash... VERIFIED.

Suspected cause

The regression likely originates from one or both changes introduced in v1.5:

  • ichspi: Change the opcode position for reprogramming on the fly 2->4
  • ichspi: Merge spi_master implementations for Intel ich
  • Possibly related to the ECAM transition (libpci >= 3.13.0) changing how
    PCI registers are accessed, affecting BCR read/write behavior.

Workaround

Using flashrom v1.4.0 compiled from source works correctly on the same system.

Steps to reproduce

sudo flashrom -p internal:laptop=this_is_not_a_laptop -w firmware.bin

AK Updated by Anastasia Klimchuk 17 days ago Actions #1

Hello Emmanuel, thank you for reporting a bug!

I realise this was few months ago, but maybe you can provide full logs? if you can for example attach to this bug.

The working case has
Enabling hardware sequencing because some important opcode is locked.
and the other does not - but maybe you just skipped when copying pieces from logs?

It is possible to force enable hwseq with a param (internal:ich_spi_mode=hwseq). By default the mode is auto, so the decision is made during init, and one of the conditions is missing opcodes (which can be related to your first suspect commit).

Also which version of libpci you have? this is related to your third suspect

AK Updated by Anastasia Klimchuk 16 days ago Actions #2

Links to suspects mentioned in the description:

https://review.coreboot.org/c/flashrom/+/84567
https://review.coreboot.org/c/flashrom/+/84593
https://review.coreboot.org/c/flashrom/+/83896

(but we don't know yet what is the root cause, might be some other commit)

PM Updated by Peter Marheine 16 days ago Actions #3

I borrowed an Asus CX3400F chromebook with i7-1160G7 to test some operations.

# flashrom --version
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
# crossystem mainfw_act
B
# flashrom -p internal -r bios.bin
# flashrom -p internal --fmap -i RW_SECTION_A -E
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Erase/write done from 500000 to cfffff
# flashrom -p internal --fmap -i RW_SECTION_A -w bios.bin
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 500000 to cfffff
Verifying flash... VERIFIED.

So at least on this configuration I don't see any problems.

PM Updated by Peter Marheine 16 days ago Actions #4

I borrowed an Asus Chromebook Flip CX3 with i7-1160G7 to test some operations.

# flashrom --version
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
# crossystem mainfw_act
B
# flashrom -p internal -r bios.bin
# flashrom -p internal --fmap -i RW_SECTION_A -E
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Erase/write done from 500000 to cfffff
# flashrom -p internal --fmap -i RW_SECTION_A -w bios.bin
flashrom v1.5.0 (git:v1.5.0) on Linux 6.12.94-01425-g32498b4fcee8 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

coreboot table found at 0x76b22000.
Found chipset "Intel Tiger Lake LP".
Enabling flash write... Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00500000-0x01ffffff) is read-write.
FREG2: Management Engine region (0x00001000-0x004fffff) is read-only.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
GPR0: Warning: 0x00001000-0x0014bfff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Winbond flash chip "W25Q256JV_M" (32768 kB, Programmer-specific) on internal.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
Using region: "RW_SECTION_A".
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 500000 to cfffff
Verifying flash... VERIFIED.

So at least on this configuration I don't see any problems, but suspect whatever hardware the reported has is probably configured differently in ways that are important (and probably won't be the case on a chromebook).

PM Updated by Peter Marheine 16 days ago Actions #5

Whoops, disregard the double update. I was trying to update my comment to note that this is a Chromebook Flip CX3, and I suspect chromebooks probably configure relevant bits differently from the reporter's hardware so this probably isn't very conclusive.

AK Updated by Anastasia Klimchuk 13 days ago Actions #6

Fixed in https://review.coreboot.org/c/flashrom/+/94973 !

The bug was not about Tiger Lake but about ECAM: more details in the patch by the link.

AK Updated by Anastasia Klimchuk 13 days ago Actions #7

  • Status changed from New to Resolved
Actions

Also available in: PDF Atom