diff options
| -rw-r--r-- | Documentation/mysteries_intel.txt | 81 | ||||
| -rw-r--r-- | chipset_enable.c | 66 | ||||
| -rw-r--r-- | flashchips.c | 8 | ||||
| -rw-r--r-- | flashrom.c | 6 | ||||
| -rw-r--r-- | ich_descriptors.c | 4 | ||||
| -rw-r--r-- | print.c | 44 | ||||
| -rw-r--r-- | programmer.h | 8 |
7 files changed, 190 insertions, 27 deletions
diff --git a/Documentation/mysteries_intel.txt b/Documentation/mysteries_intel.txt index d6d3dfb..55921cf 100644 --- a/Documentation/mysteries_intel.txt +++ b/Documentation/mysteries_intel.txt @@ -15,4 +15,83 @@ See also http://www.flashrom.org/pipermail/flashrom/2011-August/007606.html = Unlocking the ME region = -TODO + If the ME region is locked by the FRAP register in descriptor mode, the host + software is not allowed to read or write any address inside that region. There + are different ways to unlock access: + + - A pin strap: Flash Descriptor Security Override Strap (as indicated by the + Flash Descriptor Override Pin Strap Status (FDOPSS) in HSFS. That pin is + probably not accessible to end users on consumer boards (every Intel doc i + have seen stresses that this is for debugging in manufacturing only and + should not be available for end users). + The ME indicates this in bits [19:16] (Operation Mode) in the HFS register of + the HECI/MEI PCI device by setting them to 4 (SECOVR_JMPR) [MODE_CTRL]. + + - Intel Management Engine BIOS Extension (MEBx) Disable + This option may be available to end users on some boards usually accessible + by hitting ctrl+p after BIOS POST. Quote: "'Disabling' the Intel ME does not + really disable it: it causes the Intel ME code to be halted at an early stage + of the Intel ME's booting so that the system has no traffic originating from + the Intel ME on any of the buses." [MEBX] The ME indicates this in + bits [19:16] (Operation Mode) in the HFS register of the HECI/MEI PCI device + by setting them to 3 (Soft Temporary Disable) [MODE_CTRL]. + + - Previous to Ibex Peak/5 Series chipsets removing the DIMM from slot (or + channel?) #0 disables the ME completely, which may give the host access to + the ME region. + + - HMRFPO (Host ME Region Flash Protection Override) Enable MEI command + This is the most interesting one because it allows to temporarily disable + the ME region protection by software. The ME indicates this in bits [19:16] + (Operation Mode) in the HFS register of the HECI/MEI PCI device by setting + them to 5 (SECOVER_MEI_MSG) [MODE_CTRL]. + +== MEI/HECI == + Communication between the host software and the different services provided by + the ME is done via a packet-based protocol that uses MMIO transfers to one or + more virtual PCI devices. Upon this layer there exist various services that can + be used to read out hardware management values (e.g. temperatures, fan speeds + etc.). The lower levels of that protocol are well documented: + The locations/offsets of the PCI MMIO registers are noted in the chipset + datasheets. The actually communication is documented in a whitepaper [DCMI] and + an outdated as well as a current Linux kernel implementation (currently in + staging/ exist [KERNEL]. There exists a patch that re-implements this in user + space (as part of flashrom). + +== Problems == + The problem is that only very few higher level protocols are documented publicly, + especially the bunch of messages that contain the HMRFPO commands is probably + well protected and only documented in ME-specific docs and the BIOS writer's + guides. We are aware of a few leaked documents though that give us a few hints + about it, but nothing substantial regarding its implementation. + + The documents are somewhat contradicting each other in various points which + might be due to factual changes in process of time or due to the different + capabilities of the ME firmwares, example: + + Intel's Flash Programming Tool (FPT) "automatically stops ME writing to SPI + ME Region, to prevent both writing at the same time, causing data corruption." [ME8] + + "FPT is not HMRFPO-capable, so needs [the help of the FDOPS pin] HDA_SDO if + used to update the ME Region." [SPS] + + When looking at the various ME firmware editions (and different chipsets), things + get very unclear. Some docs say that HMRFPO needs to be sent before End-of-POST + (EOP), others say that the ME region can be updated in the field or that some + vendor tools use it for updates. This needs to be investigated further before + drawing any conclusion. + +[MODE_CTRL] Client Platform Enabling Tour: Platform Software + Document Number: 439167, Revision 1.2, page 52 +[MEBX] Intel Management Engine BIOS Extension (MEBX) User's Guide + Revision 1.2, Section 3.1 and 3.5 +[DCMI] DCMI Host Interface Specification + Revision 1.0 +[KERNEL] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/staging/mei;hb=HEAD +[SPI_PROG] Ibex Peak SPI Programming Guide + Document Number: 403598, Revision 1.3, page 79 +[ME8] Manufacturing with Intel Management Engine (ME) Firmware 8.X on Intel 7 Series + Revision 2.0, page 59 +[SPS] Manufacturing with Intel Management Engine (ME) on Intel C600 Series Chipset 1 + for Romley Server 2 Platforms using Server Platform Services (SPS) Firmware + Revision 2.2, page 51 diff --git a/chipset_enable.c b/chipset_enable.c index 0aba1e0..5cfcd1b 100644 --- a/chipset_enable.c +++ b/chipset_enable.c @@ -636,6 +636,18 @@ static int enable_flash_pch6(struct pci_dev *dev, const char *name) return enable_flash_ich_dc_spi(dev, name, CHIPSET_6_SERIES_COUGAR_POINT); } +/* Panther Point aka. 7 series */ +static int enable_flash_pch7(struct pci_dev *dev, const char *name) +{ + return enable_flash_ich_dc_spi(dev, name, CHIPSET_7_SERIES_PANTHER_POINT); +} + +/* Lynx Point aka. 8 series */ +static int enable_flash_pch8(struct pci_dev *dev, const char *name) +{ + return enable_flash_ich_dc_spi(dev, name, CHIPSET_8_SERIES_LYNX_POINT); +} + static int via_no_byte_merge(struct pci_dev *dev, const char *name) { uint8_t val; @@ -1186,7 +1198,7 @@ const struct penable chipset_enables[] = { {0x1039, 0x0745, OK, "SiS", "745", enable_flash_sis540}, {0x1039, 0x0746, NT, "SiS", "746", enable_flash_sis540}, {0x1039, 0x0748, NT, "SiS", "748", enable_flash_sis540}, - {0x1039, 0x0755, NT, "SiS", "755", enable_flash_sis540}, + {0x1039, 0x0755, OK, "SiS", "755", enable_flash_sis540}, {0x1039, 0x5511, NT, "SiS", "5511", enable_flash_sis5511}, {0x1039, 0x5571, NT, "SiS", "5571", enable_flash_sis530}, {0x1039, 0x5591, NT, "SiS", "5591/5592", enable_flash_sis530}, @@ -1278,9 +1290,19 @@ const struct penable chipset_enables[] = { {0x8086, 0x1c52, NT, "Intel", "C202", enable_flash_pch6}, {0x8086, 0x1c54, NT, "Intel", "C204", enable_flash_pch6}, {0x8086, 0x1c56, NT, "Intel", "C206", enable_flash_pch6}, - {0x8086, 0x1c5c, NT, "Intel", "H61", enable_flash_pch6}, + {0x8086, 0x1c5c, OK, "Intel", "H61", enable_flash_pch6}, {0x8086, 0x1d40, OK, "Intel", "X79", enable_flash_pch6}, {0x8086, 0x1d41, NT, "Intel", "X79", enable_flash_pch6}, + {0x8086, 0x1e44, NT, "Intel", "Z77", enable_flash_pch7}, + {0x8086, 0x1e46, NT, "Intel", "Z75", enable_flash_pch7}, + {0x8086, 0x1e49, NT, "Intel", "B75", enable_flash_pch7}, + {0x8086, 0x1e4a, NT, "Intel", "H77", enable_flash_pch7}, + {0x8086, 0x1e57, NT, "Intel", "HM77", enable_flash_pch7}, + {0x8086, 0x1e58, NT, "Intel", "UM77", enable_flash_pch7}, + {0x8086, 0x1e59, NT, "Intel", "HM76", enable_flash_pch7}, + {0x8086, 0x1e5d, NT, "Intel", "HM75", enable_flash_pch7}, + {0x8086, 0x1e5e, NT, "Intel", "HM70", enable_flash_pch7}, + {0x8086, 0x2310, NT, "Intel", "DH89xxCC", enable_flash_pch7}, {0x8086, 0x2410, OK, "Intel", "ICH", enable_flash_ich_4e}, {0x8086, 0x2420, OK, "Intel", "ICH0", enable_flash_ich_4e}, {0x8086, 0x2440, OK, "Intel", "ICH2", enable_flash_ich_4e}, @@ -1342,6 +1364,38 @@ const struct penable chipset_enables[] = { {0x8086, 0x7198, OK, "Intel", "440MX", enable_flash_piix4}, {0x8086, 0x8119, OK, "Intel", "SCH Poulsbo", enable_flash_poulsbo}, {0x8086, 0x8186, OK, "Intel", "Atom E6xx(T)/Tunnel Creek", enable_flash_tunnelcreek}, + {0x8086, 0x8c40, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c41, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c42, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c43, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c44, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c45, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c46, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c47, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c48, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c49, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4a, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4b, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4c, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4d, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4e, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c4f, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c50, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c51, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c52, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c53, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c54, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c55, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c56, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c57, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c58, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c59, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5a, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5b, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5c, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5d, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5e, NT, "Intel", "Lynx Point", enable_flash_pch8}, + {0x8086, 0x8c5f, NT, "Intel", "Lynx Point", enable_flash_pch8}, #endif {}, }; @@ -1380,9 +1434,11 @@ int chipset_flash_enable(void) if (chipset_enables[i].status == NT) { msg_pinfo("\nThis chipset is marked as untested. If " "you are using an up-to-date version\nof " - "flashrom please email a report to " - "flashrom@flashrom.org including a\nverbose " - "(-V) log. Thank you!\n"); + "flashrom *and* were (not) able to " + "successfully update your firmware with it,\n" + "then please email a report to " + "flashrom@flashrom.org including a verbose " + "(-V) log.\nThank you!\n"); } msg_pinfo("Enabling flash write... "); ret = chipset_enables[i].doit(dev, diff --git a/flashchips.c b/flashchips.c index 09daa0a..5904e2b 100644 --- a/flashchips.c +++ b/flashchips.c @@ -1471,7 +1471,7 @@ const struct flashchip flashchips[] = { .total_size = 2048, .page_size = 256, .feature_bits = FEATURE_WRSR_WREN, - .tested = TEST_UNTESTED, + .tested = TEST_OK_PROBE, .probe = probe_spi_rdid, .probe_timing = TIMING_ZERO, .block_erasers = @@ -3395,7 +3395,7 @@ const struct flashchip flashchips[] = { .page_size = 256, /* OTP: 512B total; enter 0x3A */ .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP, - .tested = TEST_UNTESTED, + .tested = TEST_OK_PROBE, .probe = probe_spi_rdid, .probe_timing = TIMING_ZERO, .block_erasers = @@ -5954,7 +5954,7 @@ const struct flashchip flashchips[] = { .model_id = SPANSION_S25FL032A, .total_size = 4096, .page_size = 256, - .tested = TEST_UNTESTED, + .tested = TEST_OK_PR, .probe = probe_spi_rdid, .probe_timing = TIMING_ZERO, .block_erasers = @@ -6912,7 +6912,7 @@ const struct flashchip flashchips[] = { .total_size = 2048, .page_size = 4 * 1024, .feature_bits = FEATURE_REGISTERMAP, - .tested = TEST_OK_PR, + .tested = TEST_OK_PREW, .probe = probe_82802ab, .probe_timing = TIMING_IGNORED, /* routine doesn't use probe_timing (sst49lfxxxc.c) */ .block_erasers = @@ -1412,9 +1412,9 @@ void nonfatal_help_message(void) void emergency_help_message(void) { msg_gerr("Your flash chip is in an unknown state.\n" - "Get help on IRC at irc.freenode.net (channel #flashrom) or\n" - "mail flashrom@flashrom.org with FAILED: your board name in " - "the subject line!\n" + "Get help on IRC at chat.freenode.net (channel #flashrom) or\n" + "mail flashrom@flashrom.org with the subject " + "\"FAILED: <your board name>\"!\n" "-------------------------------------------------------------" "------------------\n" "DO NOT REBOOT OR POWEROFF!\n"); diff --git a/ich_descriptors.c b/ich_descriptors.c index 726f5e0..b55625e 100644 --- a/ich_descriptors.c +++ b/ich_descriptors.c @@ -193,7 +193,7 @@ void prettyprint_ich_descriptor_region(const struct ich_descriptors *desc) uint8_t i; uint8_t nr = desc->content.NR + 1; msg_pdbg2("=== Region Section ===\n"); - if (nr >= 5) { + if (nr > 5) { msg_pdbg2("%s: number of regions too high (%d).\n", __func__, nr); return; @@ -819,7 +819,7 @@ int read_ich_descriptors_via_fdo(void *spibar, struct ich_descriptors *desc) /* region section */ nr = desc->content.NR + 1; - if (nr >= 5) { + if (nr > 5) { msg_pdbg2("%s: number of regions too high (%d) - failed\n", __func__, nr); return ICH_RET_ERR; @@ -579,6 +579,7 @@ const struct board_info boards_known[] = { B("ASRock", "ALiveNF6G-DVI", 1, "http://www.asrock.com/mb/overview.asp?Model=ALiveNF6G-DVI", NULL), B("ASRock", "AM2NF6G-VSTA", 1, "http://www.asrock.com/mb/overview.asp?Model=AM2NF6G-VSTA", NULL), B("ASRock", "ConRoeXFire-eSATA2", 1, "http://www.asrock.com/mb/overview.asp?model=conroexfire-esata2", NULL), + B("ASRock", "H67M", 0, "http://www.asrock.com/mb/overview.asp?Model=H67M", "Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("ASRock", "K7S41", 1, "http://www.asrock.com/mb/overview.asp?Model=K7S41", NULL), B("ASRock", "K7S41GX", 1, "http://www.asrock.com/mb/overview.asp?Model=K7S41GX", NULL), B("ASRock", "K7VT4A+", 0, "http://www.asrock.com/mb/overview.asp?Model=K7VT4A%2b", "No chip found, probably due to flash translation. http://www.flashrom.org/pipermail/flashrom/2009-August/000393.html"), @@ -632,6 +633,7 @@ const struct board_info boards_known[] = { B("ASUS", "M3A78-EM", 1, "http://www.asus.com/Motherboards/AMD_AM2Plus/M3A78EM/", NULL), B("ASUS", "M3N78-VM", 1, "http://www.asus.com/Motherboards/AMD_AM2Plus/M3N78VM/", NULL), B("ASUS", "M4A78-EM", 1, "http://www.asus.com/Motherboards/AMD_AM2Plus/M4A78EM/", NULL), + B("ASUS", "M4A785T-M", 1, "http://www.asus.com/Motherboards/AMD_AM3/M4A785TM/", NULL), B("ASUS", "M4A785TD-M EVO", 1, "http://www.asus.com/Motherboards/AMD_AM3/M4A785TDM_EVO/", NULL), B("ASUS", "M4A785TD-V EVO", 1, "http://www.asus.com/Motherboards/AMD_AM3/M4A785TDV_EVO/", NULL), B("ASUS", "M4A78LT-M LE", 1, "http://www.asus.com/Motherboards/AMD_AM3/M4A78LTM_LE/", NULL), @@ -640,6 +642,7 @@ const struct board_info boards_known[] = { B("ASUS", "M4A89GTD PRO", 1, "http://www.asus.com/Motherboards/AMD_AM3/M4A89GTD_PRO/", NULL), B("ASUS", "M4N78 PRO", 1, "http://www.asus.com/Motherboards/AMD_AM2Plus/M4N78_PRO/", NULL), B("ASUS", "M5A99X EVO", 1, "http://www.asus.com/Motherboards/AMD_AM3Plus/M5A99X_EVO/", NULL), + B("ASUS", "Maximus IV Extreme", 0, "http://www.asus.com/Motherboards/Intel_Socket_1155/Maximus_IV_Extreme/", "Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("ASUS", "MEW-AM", 0, "ftp://ftp.asus.com.tw/pub/ASUS/mb/sock370/810/mew-am/", "No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now."), B("ASUS", "MEW-VM", 0, "http://www.elhvb.com/mboards/OEM/HP/manual/ASUS%20MEW-VM.htm", "No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now."), B("ASUS", "OPLX-M", 0, NULL, "Untested board enable."), @@ -694,6 +697,7 @@ const struct board_info boards_known[] = { B("ASUS", "P5PE-VM", 1, "http://www.asus.com/Motherboards/Intel_Socket_775/P5PEVM/", NULL), B("ASUS", "P5QPL-AM", 1, "http://www.asus.com/Motherboards/Intel_Socket_775/P5QPLAM/", NULL), B("ASUS", "P5VD1-X", 1, "http://www.asus.com/Motherboards/Intel_Socket_775/P5VD1X/", NULL), + B("ASUS", "P5VD2-MX", 1, "http://www.asus.com/Motherboards/Intel_Socket_775/P5VD2MX/", "The MAC address of the onboard LAN NIC is stored in flash, hence overwritten by flashrom; see http://www.flashrom.org/pipermail/flashrom/2012-March/009014.html"), B("ASUS", "P6T SE", 1, "http://www.asus.com/Motherboards/Intel_Socket_1366/P6T_SE/", NULL), B("ASUS", "P6T Deluxe", 1, "http://www.asus.com/Motherboards/Intel_Socket_1366/P6T_Deluxe/", NULL), B("ASUS", "P6T Deluxe V2", 1, "http://www.asus.com/Motherboards/Intel_Socket_1366/P6T_Deluxe_V2/", NULL), @@ -705,21 +709,29 @@ const struct board_info boards_known[] = { B("ASUS", "P8H61-M LE/USB3", 0, NULL, "Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("ASUS", "P8H67-M PRO", 0, NULL, "Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("ASUS", "P8P67 (rev. 3.1)", 0, NULL, "Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), + B("ASUS", "P8P67 LE", 0, NULL, "Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("ASUS", "P8Z68-V PRO", 0, NULL, "Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), + B("ASUS", "P8Z68-V PRO/GEN3", 1, "http://www.asus.com/Motherboards/Intel_Socket_1155/P8Z68V_PROGEN3/", "Warning: MAC address of LOM is stored at 0x1000 - 0x1005 of the image."), B("ASUS", "TUSL2-C", 0, "http://support.asus.com/download.aspx?SLanguage=en&p=1&s=4&m=TUSL2-C&os=&hashedid=n/a", "Untested board enable."), B("ASUS", "Z8NA-D6C", 1, "http://www.asus.com/Server_Workstation/Server_Motherboards/Z8NAD6C/", NULL), B("ASUS", "Z8PE-D12", 1, "http://www.asus.com/Server_Workstation/Server_Motherboards/Z8PED12/", NULL), + B("Bachmann", "OT200", 1, "http://www.bachmann.info/produkte/bedien-und-beobachtungsgeraete/operator-terminals/", NULL), B("BCOM", "WinNET100", 1, "http://www.coreboot.org/BCOM_WINNET100", "Used in the IGEL-316 thin client."), B("Bifferos", "Bifferboard", 1, "http://bifferos.co.uk/", NULL), - B("Biostar", "N68S3+", 1, NULL, NULL), + B("Biostar", "H61MU3", 0, NULL, "Probing works (Eon EN25Q32(A/B), 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("Biostar", "M6TBA", 0, "ftp://ftp.biostar-usa.com/manuals/M6TBA/", "No public report found. Owned by Uwe Hermann <uwe@hermann-uwe.de>. May work now."), B("Biostar", "M7NCD Pro", 1, "http://www.biostar.com.tw/app/en/mb/content.php?S_ID=260", NULL), + B("Biostar", "M7VIQ", 0, NULL, "Missing board enable (W83697HF/F/HG/G), see http://www.flashrom.org/pipermail/flashrom/2012-February/008863.html"), + B("Biostar", "N61PB-M2S", 1, NULL, NULL), + B("Biostar", "N68S3+", 1, NULL, NULL), B("Biostar", "P4M80-M4", 1, "http://www.biostar-usa.com/mbdetails.asp?model=p4m80-m4", NULL), B("Biostar", "TA780G M2+", 1, "http://www.biostar.com.tw/app/en/t-series/content.php?S_ID=344", NULL), B("Boser", "HS-6637", 0, "http://www.boser.com.tw/manual/HS-62376637v3.4.pdf", "Reported by Mark Robinson <mark@zl2tod.net> to flashrom@coreboot.org, no public archive. Missing board enable and/or F29C51002T unlocking. May work now."), B("Congatec", "conga-X852", 1, "http://www.congatec.com/single_news+M57715f6263d.html?&L=1", NULL), + B("Dell", "Inspiron 580", 0, "http://support.dell.com/support/edocs/systems/insp580/en/index.htm", "Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked."), B("Dell", "OptiPlex GX1", 1, "http://support.dell.com/support/edocs/systems/ban_gx1/en/index.htm", NULL), B("Dell", "PowerEdge 1850", 1, "http://support.dell.com/support/edocs/systems/pe1850/en/index.htm", NULL), + B("Dell", "Vostro 460", 0, "http://support.dell.com/support/edocs/systems/vos460/en/index.htm", "Mainboard model is 0Y2MRG. Probing works (Macronix MX25L3205, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked."), B("DFI", "855GME-MGF", 0, "http://www.dfi.com.tw/portal/CM/cmproduct/XX_cmproddetail/XX_WbProdsWindow?action=e&downloadType=&windowstate=normal&mode=view&downloadFlag=false&itemId=433", "Probably needs a board enable. http://www.coreboot.org/pipermail/coreboot/2009-May/048549.html"), B("DFI", "Blood-Iron P35 T2RL", 1, "http://lp.lanparty.com.tw/portal/CM/cmproduct/XX_cmproddetail/XX_WbProdsWindow?itemId=516&downloadFlag=false&action=1", NULL), B("Elitegroup", "GeForce6100SM-M ", 1, "http://www.ecs.com.tw/ECSWebSite/Product/Product_Detail.aspx?DetailID=685&MenuID=24", NULL), @@ -734,10 +746,11 @@ const struct board_info boards_known[] = { B("Elitegroup", "P6VAP-A+", 1, "http://www.ecs.com.tw/ECSWebSite/Products/ProductsDetail.aspx?detailid=117&CategoryID=1&DetailName=Specification&MenuID=1&LanID=0", NULL), B("Elitegroup", "RS485M-M", 1, "http://www.ecs.com.tw/ECSWebSite_2007/Products/ProductsDetail.aspx?CategoryID=1&DetailID=654&DetailName=Feature&MenuID=1&LanID=0", NULL), B("Emerson", "ATCA-7360", 1, "http://www.emerson.com/sites/Network_Power/en-US/Products/Product_Detail/Product1/Pages/EmbCompATCA-7360.aspx", NULL), + B("EPoX", "EP-3PTA", 0, NULL, "Missing board enable (W83627HF/F/HG/G), see http://www.flashrom.org/pipermail/flashrom/2012-April/009043.html"), B("EPoX", "EP-8K5A2", 1, "http://www.epox.com/product.asp?ID=EP-8K5A2", NULL), B("EPoX", "EP-8NPA7I", 1, "http://www.epox.com/product.asp?ID=EP-8NPA7I", NULL), - B("EPoX", "EP-9NPA7I", 1, "http://www.epox.com/product.asp?ID=EP-9NPA7I", NULL), B("EPoX", "EP-8RDA3+", 1, "http://www.epox.com/product.asp?ID=EP-8RDA3plus", NULL), + B("EPoX", "EP-9NPA7I", 1, "http://www.epox.com/product.asp?ID=EP-9NPA7I", NULL), B("EPoX", "EP-BX3", 1, "http://www.epox.com/product.asp?ID=EP-BX3", NULL), B("EVGA", "132-CK-NF78", 1, "http://www.evga.com/articles/385.asp", NULL), B("EVGA", "270-WS-W555-A2 (Classified SR-2)", 1, "http://www.evga.com/products/moreInfo.asp?pn=270-WS-W555-A2", NULL), @@ -747,6 +760,7 @@ const struct board_info boards_known[] = { B("Foxconn", "P4M800P7MA-RS2", 1, "http://www.foxconnchannel.com/Product/Motherboards/detail_overview.aspx?id=en-us0000138", NULL), B("Freetech", "P6F91i", 1, "http://web.archive.org/web/20010417035034/http://www.freetech.com/prod/P6F91i.html", NULL), B("Fujitsu-Siemens", "ESPRIMO P5915", 1, "http://uk.ts.fujitsu.com/rl/servicesupport/techsupport/professionalpc/ESPRIMO/P/EsprimoP5915-6.htm", "Mainboard model is D2312-A2."), + B("Fujitsu-Siemens", "CELSIUS W410", 0, "ftp://ftp.ts.fujitsu.com/pub/mainboard-oem-sales/Products/Mainboards/Industrial&ExtendedLifetime/D3061&D3062/", "Mainboard model is D3062-A1. Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked."), B("GIGABYTE", "GA-2761GXDK", 1, "http://www.computerbase.de/news/hardware/mainboards/amd-systeme/2007/mai/gigabyte_dtx-mainboard/", NULL), B("GIGABYTE", "GA-6BXC", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=1445", NULL), B("GIGABYTE", "GA-6BXDU", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=1429", NULL), @@ -769,6 +783,7 @@ const struct board_info boards_known[] = { B("GIGABYTE", "GA-965P-DS4", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=2288", NULL), B("GIGABYTE", "GA-EP31-DS3L (rev. 2.1)", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=2964", NULL), B("GIGABYTE", "GA-EP35-DS3L", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=2778", NULL), + B("GIGABYTE", "GA-H61M-D2-B3", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=3773", NULL), B("GIGABYTE", "GA-EX58-UD4P", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=2986", NULL), B("GIGABYTE", "GA-K8N-SLI", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=1928", NULL), B("GIGABYTE", "GA-K8N51GMF", 1, "http://www.gigabyte.com/products/product-page.aspx?pid=1950", NULL), @@ -803,6 +818,8 @@ const struct board_info boards_known[] = { B("HP", "Vectra VL400", 1, "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00060658&lang=en&cc=us", NULL), B("HP", "Vectra VL420 SFF", 1, "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00060661&lang=en&cc=us", NULL), B("HP", "xw4400 (0A68h)", 0, "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00775230", "ICH7 with SPI lock down, BIOS lock, flash block detection (SST25VF080B); see http://paste.flashrom.org/view.php?id=686"), + B("HP", "xw6400", 0, NULL, "No chip found, see http://www.flashrom.org/pipermail/flashrom/2012-March/009006.html"), + B("HP", "xw9300", 0, "http://h20000.www2.hp.com/bizsupport/TechSupport/Home.jsp?lang=en&cc=us&prodTypeId=12454&prodSeriesId=459226", "Missing board enable, see http://www.flashrom.org/pipermail/flashrom/2012-February/008862.html"), B("HP", "xw9400", 1, "http://h20000.www2.hp.com/bizsupport/TechSupport/Home.jsp?lang=en&cc=us&prodSeriesId=3211286&prodTypeId=12454", "Boot block is write protected unless the solder points next to F2 are shorted."), B("IBASE", "MB899", 1, "http://www.ibase-i.com.tw/2009/mb899.html", NULL), B("IBM", "x3455", 1, "http://www-03.ibm.com/systems/x/hardware/rack/x3455/index.html", NULL), @@ -811,7 +828,9 @@ const struct board_info boards_known[] = { B("Intel", "D425KT", 0, "http://www.intel.com/content/www/us/en/motherboards/desktop-motherboards/desktop-board-d425kt.html", "NM10 with SPI lock down, BIOS lock, see http://www.flashrom.org/pipermail/flashrom/2012-January/008600.html"), B("Intel", "D865GLC", 0, NULL, "ICH5 with BIOS lock enable, see http://paste.flashrom.org/view.php?id=775"), B("Intel", "DG45ID", 0, "http://www.intel.com/products/desktop/motherboards/dg45id/dg45id-overview.htm", "Probing works (Winbond W25x32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked."), + B("Intel", "DG965OT", 0, NULL, "Probing enables Hardware Sequencing (behind that hides a SST SST25VF080B, 1024 kB, SPI). Parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME is locked (and the platform data region seems to be bogus)."), B("Intel", "DH67CF", 0, NULL, "H67 with BIOS lock enable and locked ME region, see http://www.flashrom.org/pipermail/flashrom/2011-September/007789.html"), + B("Intel", "DN2800MT (Marshalltown)", 0, NULL, "BIOS locked via BIOS_CNTL."), B("Intel", "EP80759", 1, NULL, NULL), B("Intel", "Foxhollow", 1, NULL, "Intel reference board."), B("Intel", "Greencity", 1, NULL, "Intel reference board."), @@ -862,6 +881,7 @@ const struct board_info boards_known[] = { B("MSI", "MS-7529 (G31TM-P21)", 1, "http://www.msi.com/product/mb/G31TM-P21.html", NULL), B("MSI", "MS-7548 (Aspen-GL8E)", 1, "http://h10025.www1.hp.com/ewfrf/wc/document?docname=c01635688&lc=en&cc=us&dlc=en", NULL), B("MSI", "MS-7596 (785GM-E51)", 1, "http://www.msi.com/product/mb/785GM-E51.html", NULL), + B("MSI", "MS-7597 (GF615M-P33)", 0, NULL, "Missing board enable/SIO support (Fintek F71889), see http://www.flashrom.org/pipermail/flashrom/2012-March/008956.html"), B("MSI", "MS-7599 (870-C45)", 1, "http://www.msi.com/product/mb/870-C45.html", NULL), B("MSI", "MS-7613 (Iona-GL8E)", 0, "http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02014355&lc=en&cc=dk&dlc=en&product=4348478", "Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), B("MSI", "MS-7635 (H55M-ED55)", 0, "http://www.msi.com/product/mb/H55M-ED55.html", "Probing works (Winbond W25Q64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), @@ -870,6 +890,7 @@ const struct board_info boards_known[] = { B("MSI", "MS-7676 (H67MA-ED55(B3))", 1, "http://www.msi.com/product/mb/H67MA-ED55--B3-.html", "Seems to work fine basically, but user reported (hopefully unrelated) buggy behavior of the board after a firmware upgrade. See http://www.flashrom.org/pipermail/flashrom/2012-January/008547.html"), B("MSI", "MS-7696 (A75MA-G55)", 1, "http://www.msi.com/product/mb/A75MA-G55.html", NULL), B("MSI", "MS-7698 (E350IA-E45)", 1, "http://www.msi.com/product/mb/E350IA-E45.html", NULL), + B("MSI", "MS-7740 (H61MA-E35(B3))", 1, "http://www.msi.com/product/mb/H61MA-E35--B3-.html", NULL), B("NEC", "PowerMate 2000", 1, "http://support.necam.com/mobilesolutions/hardware/Desktops/pm2000/celeron/", NULL), B("Nokia", "IP530", 1, NULL, NULL), B("PCCHIPS ", "M598LMR (V9.0)", 1, NULL, NULL), @@ -923,29 +944,30 @@ const struct board_info boards_known[] = { B("Thomson", "IP1000", 1, "http://www.settoplinux.org/index.php?title=Thomson_IP1000", NULL), B("TriGem", "Anaheim-3", 1, "http://www.e4allupgraders.info/dir1/motherboards/socket370/anaheim3.shtml", NULL), B("TriGem", "Lomita", 1, "http://www.e4allupgraders.info/dir1/motherboards/socket370/lomita.shtml", NULL), - B("Tyan", "S5375-1U (Tempest i5100X)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=610", NULL), B("Tyan", "S1846 (Tsunami ATX)", 1, "http://www.tyan.com/archive/products/html/tsunamiatx.html", NULL), B("Tyan", "S2466 (Tiger MPX)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=461", NULL), B("Tyan", "S2498 (Tomcat K7M)", 1, "http://www.tyan.com/archive/products/html/tomcatk7m.html", NULL), B("Tyan", "S2723 (Tiger i7501)", 1, "http://www.tyan.com/archive/products/html/tigeri7501.html", NULL), + B("Tyan", "S2875 (Tiger K8W)", 1, "http://www.tyan.com/archive/products/html/tigerk8w.html", NULL), B("Tyan", "S2881 (Thunder K8SR)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=115", NULL), - B("Tyan", "S2882 (Thunder K8S Pro)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=121", NULL), B("Tyan", "S2882-D (Thunder K8SD Pro)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=127", NULL), + B("Tyan", "S2882 (Thunder K8S Pro)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=121", NULL), B("Tyan", "S2891 (Thunder K8SRE)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=144", NULL), B("Tyan", "S2892 (Thunder K8SE)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=145", NULL), B("Tyan", "S2895 (Thunder K8WE)", 1, "http://www.tyan.com/archive/products/html/thunderk8we.html", NULL), B("Tyan", "S2912 (Thunder n3600R)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=157", NULL), - B("Tyan", "S2915 (Thunder n6650W)", 1, "http://tyan.com/product_board_detail.aspx?pid=163", NULL), B("Tyan", "S2915-E (Thunder n6650W)", 1, "http://tyan.com/product_SKU_spec.aspx?ProductType=MB&pid=541&SKU=600000041", NULL), + B("Tyan", "S2915 (Thunder n6650W)", 1, "http://tyan.com/product_board_detail.aspx?pid=163", NULL), B("Tyan", "S2933 (Thunder n3600S)", 1, "http://tyan.com/product_SKU_spec.aspx?ProductType=MB&pid=478&SKU=600000063", NULL), B("Tyan", "S3095 (Tomcat i945GM)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=181", NULL), B("Tyan", "S3992 (Thunder h2000M)", 1, "http://tyan.com/product_board_detail.aspx?pid=235", NULL), B("Tyan", "S5180 (Toledo i965R)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=456", NULL), B("Tyan", "S5191 (Toledo i3000R)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=343", NULL), B("Tyan", "S5197 (Toledo i3010W)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=349", NULL), - B("Tyan", "S5211 (Toledo i3210W)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=591", NULL), B("Tyan", "S5211-1U (Toledo i3200R)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=593", NULL), + B("Tyan", "S5211 (Toledo i3210W)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=591", NULL), B("Tyan", "S5220 (Toledo q35T)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=597", NULL), + B("Tyan", "S5375-1U (Tempest i5100X)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=610", NULL), B("Tyan", "S5375 (Tempest i5100X)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=566", NULL), B("Tyan", "S5376 (Tempest i5100W)", 1, "http://www.tyan.com/product_board_detail.aspx?pid=605", "Both S5376G2NR and S5376WAG2NR should work."), B("Tyan", "S5377 (Tempest i5100T)", 1, "http://www.tyan.com/product_SKU_spec.aspx?ProductType=MB&pid=642&SKU=600000017", NULL), @@ -965,9 +987,11 @@ const struct board_info boards_known[] = { B("VIA", "PC3500G", 1, "http://www.via.com.tw/en/initiatives/empowered/pc3500_mainboard/index.jsp", NULL), B("VIA", "VB700X", 1, "http://www.via.com.tw/en/products/mainboards/motherboards.jsp?motherboard_id=490", NULL), B("ZOTAC", "Fusion-ITX WiFi (FUSION350-A-E)", 1, NULL, NULL), - B("ZOTAC", "GeForce 8200", 1, "http://pden.zotac.com/index.php?page=shop.product_details&product_id=129&category_id=92", NULL), + B("ZOTAC", "GeForce 8200", 1, NULL, NULL), B("ZOTAC", "H67-ITX WiFi (H67ITX-C-E)", 0, NULL, "Probing works (Winbond W25Q32, 4096 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME region is locked."), - B("ZOTAC", "ZBOX HD-ID11", 1, "http://pdde.zotac.com/index.php?page=shop.product_details&product_id=240&category_id=75", NULL), + B("ZOTAC", "nForce 630i Supreme (N73U-Supreme)", 1, NULL, NULL), + B("ZOTAC", "ZBOX AD02 (PLUS)", 1, NULL, NULL), + B("ZOTAC", "ZBOX HD-ID11", 1, NULL, NULL), #endif {}, @@ -986,7 +1010,9 @@ const struct board_info laptops_known[] = { B("HP/Compaq", "nx9005", 0, "http://h18000.www1.hp.com/products/quickspecs/11602_na/11602_na.HTML", "Shuts down when probing for a chip. http://www.flashrom.org/pipermail/flashrom/2010-May/003321.html"), B("HP/Compaq", "nx9010", 0, "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00348514", "Hangs upon '''flashrom -V''' (needs hard power-cycle then)."), B("IBM/Lenovo", "Thinkpad T40p", 0, "http://www.thinkwiki.org/wiki/Category:T40p", NULL), - B("IBM/Lenovo", "Thinkpad T410s", 0, "http://www.thinkwiki.org/wiki/Category:T410s", "Probing works (Winbond W25X64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs), ME and platform are locked."), + B("IBM/Lenovo", "Thinkpad T420", 0, "http://www.thinkwiki.org/wiki/Category:T420", "Probing works (Macronix MX25L6405, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block)."), + B("IBM/Lenovo", "Thinkpad T410s", 0, "http://www.thinkwiki.org/wiki/Category:T410s", "Probing works (Winbond W25X64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block)."), + B("IBM/Lenovo", "Thinkpad X1", 0, "http://www.thinkwiki.org/wiki/Category:X1", "Probing works (ST M25PX64, 8192 kB, SPI), but parts of the flash are problematic: descriptor is r/o (conforming to ICH reqs) and ME is locked. Also, a Protected Range is locking the top range of the BIOS region (presumably the boot block)."), B("IBM/Lenovo", "240", 0, "http://www.stanford.edu/~bresnan//tp240.html", "Seems to (partially) work at first, but one block/sector cannot be written which then leaves you with a bricked laptop. Maybe this can be investigated and fixed in software later."), B("Lenovo", "3000 V100 TF05Cxx", 1, "http://www5.pc.ibm.com/europe/products.nsf/products?openagent&brand=Lenovo3000Notebook&series=Lenovo+3000+V+Series#viewallmodelstop", NULL), #endif diff --git a/programmer.h b/programmer.h index c99e37f..50be159 100644 --- a/programmer.h +++ b/programmer.h @@ -527,8 +527,7 @@ int default_spi_read(struct flashctx *flash, uint8_t *buf, unsigned int start, u int default_spi_write_256(struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len); int register_spi_programmer(const struct spi_programmer *programmer); -/* ichspi.c */ -#if CONFIG_INTERNAL == 1 +/* The following enum is needed by ich_descriptor_tool and ich* code. */ enum ich_chipset { CHIPSET_ICH_UNKNOWN, CHIPSET_ICH7 = 7, @@ -537,9 +536,12 @@ enum ich_chipset { CHIPSET_ICH10, CHIPSET_5_SERIES_IBEX_PEAK, CHIPSET_6_SERIES_COUGAR_POINT, - CHIPSET_7_SERIES_PANTHER_POINT + CHIPSET_7_SERIES_PANTHER_POINT, + CHIPSET_8_SERIES_LYNX_POINT }; +/* ichspi.c */ +#if CONFIG_INTERNAL == 1 extern uint32_t ichspi_bbar; int ich_init_spi(struct pci_dev *dev, uint32_t base, void *rcrb, enum ich_chipset ich_generation); |
