Yes, this is exactly what I’ve been saying since the start. The FD is corrupted (as seen even by FPT, completely wrong values) so nothing can read and write properly to the chip. Honestly I was hoping that these software tools would be able to just dump the contents of the chip without caring whether the FD is ok or not. Just raw dumping. The fact that you can boot into Linux and use flashrom there is very good. I don’t suppose that the linux fpt works any better (no error 26), right? Who knows at this point. But regarding “raw dumping/flashing” can’t it be done with flashrom? Meaning, tell it to proceed regardless of the FD state?
You are right about FD, but I was also surprise that FD is that much problematic, normally we could dump/write/erase without taking in consideration FD with
FPT for example. I tried every possible command with FPT but it was a bad shot (I mean on Windows, didn’t try on FPT Linux), I don’t know all the possible third party software out there.
I know just that, hopefully flashrom or any alternative tool would be able to flash the chip in proper way.
Flashrom apparently need FD for the hardware sequencing, so far from what I’ve read and try the learn the last hours.
I’m sure in the end I would be able to flash and back to factory bios but at this point, I’m facing this other problem that I need to resolve too.
Thinking that I could boot in a weird way to linux and use flashrom, I feel a little bit more confident.
I didn’t know that have fpt in Linux, I was thinking that fpt are only available on Win32,win64 and dos.
I will check.
It probably can be done without consulting FD, etc… but I’m still learning Flashrom, read the source code itself and check any return of similar error (didn’t find anyone in the
same position)
Honestly I never faced that type of issue and is a first, hopefully the last but if I find the solution, that probably can help other people who are in the same situation ?
Here’s the last binary revision flashrom for Windows (if you need, but on my side, It didn’t help without the internal feature, only available on Linux version, or maybe can be compiled but I’m not sure because apparently it need a strong admin access)
http://s000.tinyupload.com/index.php?fil…940374528654580
Oups, yes you are right. There is no Linux versions of the Intel tools. I got confused with some older TXE 1.x we had found. Forget about that then.
Regarding FD, it also locks itself alongside ME & GbE. So you cannot read/write to it if it’s locked. That would beat it’s purpose really.
Thank you for that newer binary but yes as you said, Linux is the only way if the dummy programmer does not work under Windows. I’ll keep it though as it’s better than others in sense that it includes the libraries inside the executable and it’s relatively new. I also have a CH341A programmer which might be helpful in the future if Linux is not an option.
Well if you manage to dump without caring about the FD please let me know and also upload a dump in such (joyful) event. I’m very curious to see what the hell happened.
Yes unfortunately only on Windows but Flashrom look like a more powerful tool.
Apparently Flashrom purposely lock write when is about ME/Description region.
I’m still working on it and try to figure out Flashrom itself.
At the same time, I use ich_descriptors_tool (interesting too)
with the original firmware available on the OEM website.
Here’s the answer about the descriptor part.
./ich_descriptors_tool -f X5BF.B07 -c MX25L6405D -d
The flash image has a size of 8388608 [0x800000] bytes.
=== Content Section ===
FLVALSIG 0x0ff0a55a
FLMAP0 0x02040003
FLMAP1 0x15100206
FLMAP2 0x00210120
— Details —
NR (Number of Regions): 3
FRBA (Flash Region Base Address): 0x040
NC (Number of Components): 1
FCBA (Flash Component Base Address): 0x030
ISL (ICH/PCH Strap Length): 21
FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100
NM (Number of Masters): 3
FMBA (Flash Master Base Address): 0x060
MSL/PSL (MCH/PROC Strap Length): 1
FMSBA (Flash MCH/PROC Strap Base Address): 0x200
=== Component Section ===
FLCOMP 0x64900044
FLILL 0xad604221
— Details —
Component 1 density: unknown
Component 2 is not used.
Read Clock Frequency: unknown
Read ID and Status Clock Freq.: unknown
Write and Erase Clock Freq.: unknown
Fast Read is supported.
Fast Read Clock Frequency: unknown
Invalid instruction 0: 0x21
Invalid instruction 1: 0x42
Invalid instruction 2: 0x60
Invalid instruction 3: 0xad
=== Region Section ===
FLREG0 0x00000000
FLREG1 0x07ff0200
FLREG2 0x01ff0001
FLREG3 0x00007fff
FLREG4 0x00007fff
— Details —
Region 0 (Descr.) 0x00000000 - 0x00000fff
Region 1 (BIOS ) 0x00200000 - 0x007fffff
Region 2 (ME ) 0x00001000 - 0x001fffff
Region 3 (GbE ) is unused.
Region 4 (Platf.) is unused.
=== Master Section ===
FLMSTR1 0xffff0000
FLMSTR2 0xffff0000
FLMSTR3 0xffff0118
— Details —
Descr. BIOS ME GbE Platf.
BIOS rw rw rw rw rw
ME rw rw rw rw rw
GbE rw rw rw rw rw
The flash image has a size of 8388608 [0x800000] bytes.
=== Content Section ===
FLVALSIG 0x0ff0a55a
FLMAP0 0x02040003
FLMAP1 0x15100206
FLMAP2 0x00210120
— Details —
NR (Number of Regions): 3
FRBA (Flash Region Base Address): 0x040
NC (Number of Components): 1
FCBA (Flash Component Base Address): 0x030
ISL (ICH/PCH Strap Length): 21
FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100
NM (Number of Masters): 3
FMBA (Flash Master Base Address): 0x060
MSL/PSL (MCH/PROC Strap Length): 1
FMSBA (Flash MCH/PROC Strap Base Address): 0x200
=== Component Section ===
FLCOMP 0x64900044
FLILL 0xad604221
— Details —
Component 1 density: unknown
Component 2 is not used.
Read Clock Frequency: unknown
Read ID and Status Clock Freq.: unknown
Write and Erase Clock Freq.: unknown
Fast Read is supported.
Fast Read Clock Frequency: unknown
Invalid instruction 0: 0x21
Invalid instruction 1: 0x42
Invalid instruction 2: 0x60
Invalid instruction 3: 0xad
=== Region Section ===
FLREG0 0x00000000
FLREG1 0x07ff0200
FLREG2 0x01ff0001
FLREG3 0x00007fff
FLREG4 0x00007fff
— Details —
Region 0 (Descr.) 0x00000000 - 0x00000fff
Region 1 (BIOS ) 0x00200000 - 0x007fffff
Region 2 (ME ) 0x00001000 - 0x001fffff
Region 3 (GbE ) is unused.
Region 4 (Platf.) is unused.
=== Master Section ===
FLMSTR1 0xffff0000
FLMSTR2 0xffff0000
FLMSTR3 0xffff0118
— Details —
Descr. BIOS ME GbE Platf.
BIOS rw rw rw rw rw
ME rw rw rw rw rw
GbE rw rw rw rw rw
Gbe is not use nor platf.
I’m sure there is a way with all this informations to flash back to the factory bios/original bios.
Hopefully.
Thanks again for taking time for helping out with this and answer me.
I will let you know if I can proceed to a dump/write/erase etc…
I’m trying everything with Flashrom, still need figure out the hidden or secret part of this tool.
But right now I’m facing a OPCODE 0x03, one of the user on the flashrom irc recommend a flash external programmer
but I’m pretty sure that it don’t know all story behind this and that I can use the computer in a weird way.
In case anyone have more knowledge than me in Flashrom, here’s the flashrom output.
I found how to find the chip (using the swseq instead of hwseq that avoid the usage of FD)
I also find a way to load partially a layout and flash a specific region but either way, something is wrong about the OPCODE 0x03
What is weird is that flash image seems to be a legacy bios.
sudo ./flashrom -p internal:ich_spi_mode=swseq -c MX25L6406E/MX25L6408E -l layout -i BIOS -w X5BF.B07 -V
flashrom v0.9.9-r1955 on Linux 4.4.0-21-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.3.1, GCC 5.3.1 20160413, little endian
Command line (11 args): ./flashrom -p internal:ich_spi_mode=swseq -c MX25L6406E/MX25L6408E -l layout -i BIOS -w X5BF.B07 -V
romlayout 00000000 - 00000fff named Descr
romlayout 00200000 - 007fffff named BIOS
romlayout 00001000 - 001fffff named ME
Using region: “BIOS”.
Calibrating delay loop… OS timer resolution is 1 usecs, 3459M loops per second, 10 myus = 10 us, 100 myus = 99 us, 1000 myus = 990 us, 10000 myus = 9912 us, 4 myus = 4 us, OK.
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
No DMI table found.
W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect.
Active config mode, unknown reg 0x20 ID: 85.
Found ITE EC, ID 0x8587, Rev 0x06 on port 0x4e.
Found chipset “Intel 9 Series” with PCI ID 8086:8cc3.
This chipset is marked as untested. If you are using an up-to-date version
of flashrom and were (not) able to successfully update your firmware with it,
then please email a report to [email protected] including a verbose (-V) log.
Thank you!
Enabling flash write… Root Complex Register Block address = 0xfed1c000
GCS = 0xc61: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI)
Top Swap: enabled (A16(+) inverted)
0xfff80000/0xffb80000 FWH IDSEL: 0x0
0xfff00000/0xffb00000 FWH IDSEL: 0x0
0xffe80000/0xffa80000 FWH IDSEL: 0x1
0xffe00000/0xffa00000 FWH IDSEL: 0x1
0xffd80000/0xff980000 FWH IDSEL: 0x2
0xffd00000/0xff900000 FWH IDSEL: 0x2
0xffc80000/0xff880000 FWH IDSEL: 0x3
0xffc00000/0xff800000 FWH IDSEL: 0x3
0xff700000/0xff300000 FWH IDSEL: 0x4
0xff600000/0xff200000 FWH IDSEL: 0x5
0xff500000/0xff100000 FWH IDSEL: 0x6
0xff400000/0xff000000 FWH IDSEL: 0x7
0xfff80000/0xffb80000 FWH decode enabled
0xfff00000/0xffb00000 FWH decode enabled
0xffe80000/0xffa80000 FWH decode enabled
0xffe00000/0xffa00000 FWH decode enabled
0xffd80000/0xff980000 FWH decode enabled
0xffd00000/0xff900000 FWH decode enabled
0xffc80000/0xff880000 FWH decode enabled
0xffc00000/0xff800000 FWH decode enabled
0xff700000/0xff300000 FWH decode enabled
0xff600000/0xff200000 FWH decode enabled
0xff500000/0xff100000 FWH decode enabled
0xff400000/0xff000000 FWH decode enabled
Maximum FWH chip size: 0x100000 bytes
SPI Read Configuration: prefetching enabled, caching enabled,
BIOS_CNTL = 0x09: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
SPIBAR = 0x00007f34086ba000 + 0x3800
0x04: 0xb008 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=0, FLOCKDN=1
Warning: SPI Configuration Lockdown activated.
Reading OPCODES… done
0x90: 0x04 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf84130 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=3, DBC=1, SME=0, SCF=0
0x94: 0x0006 (PREOP)
0x96: 0x8400 (OPTYPE)
0x98: 0x05000000 (OPMENU)
0x9C: 0x5a00019f (OPMENU+4)
OK.
The following protocols are supported: FWH, SPI.
Probing for Macronix MX25L6406E/MX25L6408E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip “MX25L6406E/MX25L6408E” (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, …) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Flash image seems to be a legacy BIOS. Disabling coreboot-related checks.
Reading old flash chip contents… Invalid OPCODE 0x03, will not execute.
FAILED.
Restoring PCI config space for 00:1f:0 reg 0xdc
flashrom v0.9.9-r1955 on Linux 4.4.0-21-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.3.1, GCC 5.3.1 20160413, little endian
Command line (11 args): ./flashrom -p internal:ich_spi_mode=swseq -c MX25L6406E/MX25L6408E -l layout -i BIOS -w X5BF.B07 -V
romlayout 00000000 - 00000fff named Descr
romlayout 00200000 - 007fffff named BIOS
romlayout 00001000 - 001fffff named ME
Using region: “BIOS”.
Calibrating delay loop… OS timer resolution is 1 usecs, 3459M loops per second, 10 myus = 10 us, 100 myus = 99 us, 1000 myus = 990 us, 10000 myus = 9912 us, 4 myus = 4 us, OK.
Initializing internal programmer
No coreboot table found.
Using Internal DMI decoder.
No DMI table found.
W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect.
Active config mode, unknown reg 0x20 ID: 85.
Found ITE EC, ID 0x8587, Rev 0x06 on port 0x4e.
Found chipset “Intel 9 Series” with PCI ID 8086:8cc3.
This chipset is marked as untested. If you are using an up-to-date version
of flashrom and were (not) able to successfully update your firmware with it,
then please email a report to [email protected] including a verbose (-V) log.
Thank you!
Enabling flash write… Root Complex Register Block address = 0xfed1c000
GCS = 0xc61: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI)
Top Swap: enabled (A16(+) inverted)
0xfff80000/0xffb80000 FWH IDSEL: 0x0
0xfff00000/0xffb00000 FWH IDSEL: 0x0
0xffe80000/0xffa80000 FWH IDSEL: 0x1
0xffe00000/0xffa00000 FWH IDSEL: 0x1
0xffd80000/0xff980000 FWH IDSEL: 0x2
0xffd00000/0xff900000 FWH IDSEL: 0x2
0xffc80000/0xff880000 FWH IDSEL: 0x3
0xffc00000/0xff800000 FWH IDSEL: 0x3
0xff700000/0xff300000 FWH IDSEL: 0x4
0xff600000/0xff200000 FWH IDSEL: 0x5
0xff500000/0xff100000 FWH IDSEL: 0x6
0xff400000/0xff000000 FWH IDSEL: 0x7
0xfff80000/0xffb80000 FWH decode enabled
0xfff00000/0xffb00000 FWH decode enabled
0xffe80000/0xffa80000 FWH decode enabled
0xffe00000/0xffa00000 FWH decode enabled
0xffd80000/0xff980000 FWH decode enabled
0xffd00000/0xff900000 FWH decode enabled
0xffc80000/0xff880000 FWH decode enabled
0xffc00000/0xff800000 FWH decode enabled
0xff700000/0xff300000 FWH decode enabled
0xff600000/0xff200000 FWH decode enabled
0xff500000/0xff100000 FWH decode enabled
0xff400000/0xff000000 FWH decode enabled
Maximum FWH chip size: 0x100000 bytes
SPI Read Configuration: prefetching enabled, caching enabled,
BIOS_CNTL = 0x09: BIOS Lock Enable: disabled, BIOS Write Enable: enabled
SPIBAR = 0x00007f34086ba000 + 0x3800
0x04: 0xb008 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=0, FLOCKDN=1
Warning: SPI Configuration Lockdown activated.
Reading OPCODES… done
0x90: 0x04 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf84130 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=3, DBC=1, SME=0, SCF=0
0x94: 0x0006 (PREOP)
0x96: 0x8400 (OPTYPE)
0x98: 0x05000000 (OPMENU)
0x9C: 0x5a00019f (OPMENU+4)
OK.
The following protocols are supported: FWH, SPI.
Probing for Macronix MX25L6406E/MX25L6408E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip “MX25L6406E/MX25L6408E” (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, …) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Flash image seems to be a legacy BIOS. Disabling coreboot-related checks.
Reading old flash chip contents… Invalid OPCODE 0x03, will not execute.
FAILED.
Restoring PCI config space for 00:1f:0 reg 0xdc
It can’t be legacy BIOS, the image is EFI based with an Aptio V bios. Maybe that’s the cause of the error, wrong detection? I’ve no idea. But you are definitely making progress since you managed to ignore the broken FD. Regarding flashrom knowledge, I think @Pacman knows more about it. Maybe he can suggest something.
No, sorry, i don’t know what is the cause of the error, newer used flashrom for internal flashing,
but i would also recommend getting an external programmer, it would almost certainly be a lot easier.