From patchwork Sun May 1 13:47:34 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Joerg Albert X-Patchwork-Id: 617170 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from mail.coreboot.org (mail.coreboot.org [80.81.252.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3qyTL63RH8z9t4R for ; Sun, 1 May 2016 23:48:45 +1000 (AEST) Received: from [127.0.0.1] (helo=ra.coresystems.de) by mail.coreboot.org with esmtp (Exim 4.86_2) (envelope-from ) id 1awriy-0000g4-Jb; Sun, 01 May 2016 15:47:52 +0200 Received: from mout.gmx.net ([212.227.15.19]) by mail.coreboot.org with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.86_2) (envelope-from ) id 1awrik-0000fW-ER for flashrom@flashrom.org; Sun, 01 May 2016 15:47:50 +0200 Received: from [192.168.2.179] ([77.64.196.157]) by mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0LpbJm-1bYyQ43xJe-00fNy5; Sun, 01 May 2016 15:47:35 +0200 To: Paul Kocialkowski References: <571D3776.6090904@gmx.de> <1462091872.18416.36.camel@paulk.fr> From: Joerg Albert Message-ID: <572608F6.6020309@gmx.de> Date: Sun, 1 May 2016 15:47:34 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 In-Reply-To: <1462091872.18416.36.camel@paulk.fr> X-Provags-ID: V03:K0:kd6WJOcG5sJzZ5MMN52b6bEPbPHrglijJFKPhGvKnCFtfseDTys tOPLTP3+jx5p7nA3pY8ZKiRhjTvlEqQg2Mh7aZSJ8FyiytroKy4gH7Ma2vWvfK+mmTrqTJe htvJ8AWE4FOhpEQH9uiQJN/Jig7TAtpJRG+SPaW3rrk5FvU9QQZePsb1qUI0TVXn7nJfi0c 9OAk+IUXagJrNVWXF8YLQ== X-UI-Out-Filterresults: notjunk:1; V01:K0:pEyfFJOdMy8=:XD8cC/g6mROxe4m0utgO46 YD3tKhDMzPgYXQTBoeB6aUlgGick1pWueU3GkmoiabN4xABi2XYGjrYz/f9RueCVrxQqAn1kL GdOWdWwrZISBT93M61XSsj8KLWNUjxvjMLrR3An57Loatd7imBBmodhaaI+M09SNKQY8NhR+R +WIbzZHdcJwhqoVqPT0jEW3RVOnAE+VxR6JcFPJF0lZqh6L/q6NA1Ae1sY03FQohEzRdQ4IRg AA2CFmnInVYKlc48vgHOLt5Hh7KRKWKk2eboZc3Fba5Vq9KJsmIxqGDdur51BTk37D6+EzxcA NhGqkc8QgFx5ZRMluDC8ZP7icIKwBtgh5YqlTjWQQ/OD3rqB7f2chpJHu7jfUcWd+E47fSITj Eghg3viopdkl/T3iAjajSvlXepEog6UzqSHuzR6JBCHzS5rhaxHkrDMMz3wGz0E9w92X/jH/V 4jHINJAQNOo2zRC5xVRjOOGMKam7wCuCEjGm+1KXYOYVi9UUvyqXgH33Qakan9iuerVwyqfSF gbd7rbAbO1DtRRIIPwi0BwW2l8FblWwyNxB6Z/pWMmFHbtw/VDk+5UAWCK7DcrRJLkSNqM9zd ZHE7nVTARdL0b9iIV/hs6WsEbATB3wflhNGWHTAwlpE+/vdpI1iftPLu5dERsjWW9eOsUfae7 27hq4WAANpEIUW/iT0l86k0YS778sJ9CXul3gspaEDu3lbE2r1ESv0cscadbnHO2Tmcsw2kEs pzleDGNWItDsl/0FNw9N5rXmka/BBy3batxlMelpYU9RujM84E7kmLuBdSc= X-Spam-Score: -1.2 (-) Subject: Re: [flashrom] ENE KB9012 Programming with flashrom X-BeenThere: flashrom@flashrom.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: flashrom discussion and development mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: flashrom@flashrom.org Errors-To: flashrom-bounces@flashrom.org Sender: "flashrom" X-Duff: Orig. Duff, Duff Lite, Duff Dry, Duff Dark, Raspberry Duff, Lady Duff, Red Duff, Tartar Control Duff On 01.05.2016 10:37, Paul Kocialkowski wrote: > Hi, > > could you CC the flashrom mailing list in your future responses? This will > probably interest others! I wasn't aware of this mailing lists, thanks! > Le dimanche 24 avril 2016 à 23:15 +0200, Joerg Albert a écrit : >> I'll try to program the internal SPI of a KB9012 (inside a Thinkpad S531) - as >> soon as I've found the correct image and soldered the necessary wires. > The KB9012 chips has an internal flash memory that is distinct from the BIOS' > SPI flash, so beware not to confuse both! I'm aware of this. The S531 manual says, that the system indicator LED shall flash three times when the power supply gets connected (without switching the notebook on). As I don't see this and the voltage at the KB9012 is correct I guess that the EC is not working properly. Flashing the BIOS SPI may be the second step ;-) >> Found your patch here: >> >> http://patchwork.coreboot.org/patch/4325/ >> >> Why couldn't I use FlashDirectAccess? Is this meant to program external SPI >> flash only? > Yes, that's my understanding of it too. It just makes a bridge between the BIOS' > SPI flash and the KB9012 pads. This is because it's often easier to reflash it > using the keyboard connector, that is often available without fully opening the > device. > > What you want if you need to reflash the EC is not FlashDirectAccess, but EDI. > Note that some firmwares explicitly disable it, so you have to ground pin 42 to > enter "test mode", where the 8051 is not running. > > Note that the EDI pins are often exported on the keyboard connector, which makes > soldering more doable. > The keyboard connector of the S531 has a pitch of 0.5mm, too close for my soldering experience. I couldn't find a flex cable matching the connector either, so I went for soldering wires to some vias/testpoints instead. Connected a RaspberryPi and had some problems with the detection of the KB9012. It seemed to detect the KB9012 on every second trial only: -------------- pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 103 us, 1000 myus = 994 us, 10000 myus = 10064 us, 20 myus = 26 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 4 usecs, 226M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 1839 us, 10000 myus = 10424 us, 16 myus = 21 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: failed to read hw version (-1) No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. pi@raspberrypi ~ $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c "KB9012 (EDI)" -V flashrom v0.9.9-r1954 on Linux 3.18.11+ (armv6l) flashrom is free software, get the source code at https://flashrom.org flashrom was built with libpci 3.1.9, GCC 4.6.3, little endian Command line (5 args): flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -c KB9012 (EDI) -V Calibrating delay loop... OS timer resolution is 5 usecs, 229M loops per second, 10 myus = 11 us, 100 myus = 102 us, 1000 myus = 994 us, 10000 myus = 10061 us, 20 myus = 22 us, OK. Initializing linux_spi programmer Using device /dev/spidev0.0 Using 1024 kHz clock The following protocols are supported: SPI. Probing for ENE KB9012 (EDI), 128 kB: probing for EDI EDI: found hw version 195 EDI id 4 Found ENE flash chip "KB9012 (EDI)" (128 kB, SPI) on linux_spi. No operations were specified. -------- I've also tried with "speed=2048" (as the KB9012 manual states a minimum clock of 1MHz) - same problem. / /I've added some error/debug printouts and it seems like the KB9012 answers with all-zeros on each second start of the probe. If the buffer content is correct everything else afterwards works fine. So I've added a quick workaround in edi_read_byte() and edi_read() to re-do any read if the buffer contains zero at the first byte. See the patches attached. No idea why it behaves that way, maybe the SPI detection on these pins is a bit shaky? Pin 42 was grounded and the KB9012 remained powered during the whole session. Cheers, Joerg From eaac203b40988272d95a754eaddf6b68aecb181c Mon Sep 17 00:00:00 2001 From: Joerg Albert Date: Sun, 1 May 2016 13:17:14 +0000 Subject: [PATCH 2/2] add workaround for the problem that the KB9012 replies all zeros on each second start --- edi.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/edi.c b/edi.c index 85e5178..05796ed 100644 --- a/edi.c +++ b/edi.c @@ -67,12 +67,28 @@ static int edi_read_byte(struct flashctx *flash, unsigned short address, unsigne edi_read_cmd(cmd, address); + // msg_pdbg("%s: buffer length 0x%x\n", __func__, sizeof(buffer)); + rc = spi_send_command(flash, sizeof(cmd), sizeof(buffer), cmd, buffer); if (rc) { msg_perr("EDI: %s: spi_send_command failed with %d\n", __func__, rc); return -1; } +#if 0 + msg_pdbg("%s: read buffer:", __func__); + for(i=0; i < sizeof(buffer); i++) { + msg_pdbg(" %02x", buffer[i]); + } + msg_pdbg("\n"); +#endif + + /* I sometimes see the chip return a buffer of all zeros. + It works correctly with the second try. + */ + if (buffer[0] == 0) + return -2; + idx = 0; for (i = 0; i < sizeof(buffer); i++) { @@ -109,6 +125,11 @@ static int edi_read(struct flashctx *flash, unsigned short address, unsigned cha do { rc = edi_read_byte(flash, address, data); + + /* dirty workaround for my problem that the chip answers all zeros on each second start ... */ + if (rc == -2) + rc = edi_read_byte(flash, address, data); + if (rc == -EDI_NOT_READY) { /* * Buffer size is increased, one step at a time, -- 1.7.10.4