Documentation for “Zerocat Chipflasher: ‘kick2’”
Generated on: Fri Feb 3 17:03:53 CET 2023
Repository: git://zerocat.org/zerocat/projects/chipflasher
Version: v2.0.0-0-3982cc326
Branch: flashrom-interface

Zerocat Chipflasher: kick2

– The second firmware, and its interface to flashrom.

../images/IMG_0947.JPG

Ready to fly: Chipflasher has an Interface to ‘flashrom’!

Copyright (C) 2020, 2021, 2022, 2023 Kai Mertens kmx@posteo.net

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

Section #../../firmware2/doc/NEWS.md

NEWS

2023/02/03

2022/10/28

2022/10/15

2022/10/12

2022/09/30

2022/09/22

2022/09/16

2022/08/30

2022/08/22

2022/08/18

2022/07/29

2022/07/27

2022/07/21

2022/07/14

2022/07/11

2022/06/29

2022/06/11

2022/05/18

2022/05/10

2022/04/19

2022/15/01

2021/12/26

2021/11/27

2021/10/01

2021/06/28

Interface configuration has been put under user’s control, via make -C ../../firmware2/src/ <config-target>. Per default, the kick2 firmware has no interface enabled, just the bare program skeleton will be compiled and documented.

2021/06/27

Firmware kick2 now comes with improved read operations for the connect utility, however still using fake data. File ../../firmware2/doc/TODO.md lists related things that should be addressed next.

2021/04/29

2021/04/04

2021/03/31

2020/11/14

2020/10/09

2020/10/07

January 2020 (as of)

Branch ‘flashrom-interface’ is dedicated to enrich the chipflasher with an interface for the widely used flashrom utility.

Flashrom carries its own protocol specification for devices attached to the serial port of your computer. See Documentation/serprog-protocol.txt within the flashrom source tree for detailed information.

Coding the interface goes along with the chipflasher’s firmware review. This work is done on branch firmware2-wip, and – as a side effect – will offer results on branches flashrom-interface and firmware1-wip as well.

The final results will merge into branch master.

Section #../../firmware2/doc/README.md

README

Project Goal

The Chipflasher’s second firmware kick2 has been enriched by an interface to the flashrom utility. The device benefits from flashrom’s huge chip database, as well as from its automated read-erase-write-verify cycles.

However, maintaining the menu interface for the project’s own connect utility still makes sense, as flashrom does not provide means to deal with important chip registers. A common use case for the interface to connect is the setup of Hardware Write Protection Mode, available on chips with static register bits.

Code Review

The firmware review process is done by transforming the original firmware written in C, into Spin code. Spin code is loaded into controller’s RAM, and then interpreted by one cog who is running the on-chip Spin Interpreter. As a result, the controller’s RAM is used in an efficient way, but execution speed is slow. In order to speed up important loops, parts of the Spin code will be replaced by PASM code later on, which is then executed by additional cogs fromout their faster cog-RAM. As a proof of concept, this has been done for Spin objects txline_HEXD and txline_SREC. In the end, the overall execution speed will hopefully reach that of the fast PASM code compiled from C sources.

Coding in Spin/PASM gives us some main benefits:

Hardware Requirements

Requirements are frugal:

Paths

All paths within this document are relative in respect to the original location of this source file, which is located in the project’s firmware2/doc/ folder, e.g.: ../../firmware2/doc/

Prerequisites

This is additional software and documentation.

It is assumed, that you have started with the project’s main README file ../../doc/README.md to learn how to set up requirements and how to generate the project’s root documentation ../../doc/index.html. Your current directory is ../../doc/.

Now change into this project’s second documentation folder ../../firmware2/doc/:

    [env]$ cd ../firmware2/doc/

Interfaces

Interfacing the Connect Utility

This project comes with its own PC utility called connect, which is supported via the menu Spin/PASM object:

../../firmware2/images/screenshot-20211224-140916.png

Interface to `connect`, coded in Spin/PASM

Interfacing the Flashrom Utility

The flashrom utility comes with its own protocol specification, made for external flasher devices attached to the serial port of your computer. See Documentation/serprog-protocol.txt within the flashrom source tree. This protocol is supported via serprog Spin/PASM object. It is set as the default interface of kick2.

Interfacing a Terminal

In case flashrom or connect are not available, you might still initiate the interface to a propeller terminal and use it with a terminal on the host side. However, features are heavily stripped, you cannot do something real. Again, use the menu Spin/PASM object.

Interface Configuration

The kick2 top object might be configured to run one of the following interfaces:

  1. Connect

    • Interface Setup

          [env]$ make -C ../../firmware2/src config-connect
      
    • RS232 Baudrate

      You can try RS232 baudrates, different to the default value of 115200:

          [env]$ make -C ../../firmware2/src config-baud57600
      

      or

          [env]$ make -C ../../firmware2/src config-baud38400
      
  2. Flashrom (Default)

    • Interface Setup

          [env]$ make -C ../../firmware2/src config-flashrom
      
    • Interface Configuration

      • PCB board v1, e.g. Chipflasher board-edition-1

        DIP Switch Nº     |  Function                     |  Default Value
        ------------------|---------------------------------------------------------------------------
        Not Applicable    |  SPI Clock Driver Strength    |  50%
        Not Applicable    |  SPI Mode 0 or 3              |  Mode 3
        Not Applicable    |  RS232 Baudrate               |  115200
        Not Applicable    |  SPI Power Suspend            |  allow
        Not Applicable    |  SPI Power-up Pulse Type      |  repetitive
        
      • PCB board v2, e.g. Chipflasher v2

        DIP Switch Nº     |  Function                     |  o = open, x = closed
        ------------------|---------------------------------------------------------------------------
        DIP Switch 1..2   |  SPI Clock Driver Strength    |  oo = 25%, xo = 50%, ox = 75%, xx = 100%
        DIP Switch 3      |  SPI Mode 0 or 3              |  o = Mode 3, x = Mode 0
        DIP Switch 4      |  RS232 Baudrate               |  o = 115200, x = 57600
        DIP Switch 5      |  SPI Power Suspend            |  o = allow, x = inhibit
        DIP Switch 6      |  SPI Power-up Pulse Type      |  o = single, x = repetitive
        

      Default settings or settings provided via DIP Switches can be overridden via ../../firmware2/src/Makefile:

      • SPI Clock Driver

        The strength of the SPI clock driver is set to 25%, 50%, 75% or 100%. A setting of 50% should work fine in conjunction with clock speeds up to 40MHz while avoiding voltage over- and undershots on the clock line.

        However, you can try diminuished power in order to mitigate voltage over- and undershots even more, e.g.:

            [env]$ make -C ../../firmware2/src config-SPI_CLOCK25
        

        This setting should be combined with a slower clock speed, such like 5MHz. Otherwise communication might fail.

        In case the default strength setting fails on your target board, try increased strengths as an alternate option:

            [env]$ make -C ../../firmware2/src config-SPI_CLOCK75
        

        or

            [env]$ make -C ../../firmware2/src config-SPI_CLOCK100
        

        Bare in mind that voltage over- and undershots on the clock line might violate the allowed, maximal voltage of the SPI flash chip. According to measurements on a ThinkPad X230 target board, shots stay below 4V and above -0.6V, thus should still be acceptible for flash chips that provide integrated protection.

      • SPI Clocking Mode

        The interface to flashrom will talk to SPI devices in SPI Mode 0 or

        1. You might set SPI modes explicitly, like so:

          [env]$ make -C ../../firmware2/src config-SPI_MODE0
          

        or

            [env]$ make -C ../../firmware2/src config-SPI_MODE3
        
      • RS232 Baudrate

        You can try RS232 baudrates, different to the default value of 115200:

            [env]$ make -C ../../firmware2/src config-RS232_BAUD57600
        

        or

            [env]$ make -C ../../firmware2/src config-RS232_BAUD38400
        
      • SPI Power Suspend

        The interface to flashrom suspends SPI power if low voltage is detected, thus giving the voltage regulator some time to recover. You can allow or inhibit this measure explicitly, like so:

            [env]$ make -C ../../firmware2/src config-SUSPEND_ALLOW
        

        or

            [env]$ make -C ../../firmware2/src config-SUSPEND_INHIBIT
        

        Suspend should be inhibited for chips with volatile register bits. Sane operation of the Vcc_SPI voltage regulator is then handed over to the PCB’s heatsink, which might fail after a while. Flashrom’s write procedure always uses a chip read procedure, twice, what makes the SPI access time sum up.

      • SPI Power-up Pulse Type

        The interface to flashrom uses a single or repetitive pulse to power-up the SPI bus. You can set the pulse type explicitly, like so:

            [env]$ make -C ../../firmware2/src config-PWRUP_ONCE
        

        or

            [env]$ make -C ../../firmware2/src config-PWRUP_REPETITIVE
        
  3. Propeller Terminal

    • Interface Setup

          [env]$ make -C ../../firmware2/src config-propterm
      
  4. No Interface

    • Interface Setup

          [env]$ make -C ../../firmware2/src config-nointerface
      
The configuration will not only affect the compiled output, but the generated documentation as well. You can get an overview of targets with:
    [env]$ make -C ../../firmware2/src help

Code

To build the firmware, type:

    [env]$ make -C ../../firmware2/src

You can get an overview of targets with:

    [env]$ make -C ../../firmware2/src help

Code Upload

To load the firmware onto the controller board, see options of ../../firmware2/start/Makefile:

    [env]$ make -C ../../firmware2/start help

It might be a good idea to upload into Free-design RAM:

    [env]$ make -C ../../firmware2/start loadram

Operate the Device

To operate the device, see options of ../../firmware2/start/Makefile:

    [env]$ make -C ../../firmware2/start help

The Makefile promotes usage of the interface to the connect utility and offers a bunch of targets.

In case you have previously configured connect to use an RS232 baudrate different to the default value, run:

    [env]$ make -C ../../firmware2/start baud57600

or, respectively,

    [env]$ make -C ../../firmware2/start baud38400

followed by:

    [env]$ make -C ../../firmware2/start start

Testing the interface to flashrom can be done with target flashrom-probe, which has been added as a proof of concept: Synchronization, initialization and probing do work fine:

    [env]$ make -C ../../firmware2/start flashrom-probe

See section #../../firmware2/doc/flashrom-invocation-examples.md if interested in using the flashrom utility, directly.

Finally, the interface to the Propeller Terminal can get uploaded and started:

    [env]$ make -C ../../firmware2/start terminal
Section #../../firmware2/doc/TODO.md

TODO

While working on the kick2 Spin/PASM code, these things should be fixed, soon:

Section #../../firmware2/doc/Software-Bill-of-Material.md

Software Bill of Material

Note this branch is developed on a GNU Guix System, which helps to list up exact package names, software versions and brief descriptions via guix show.

In addition to the project’s initial software requirements listed in ../../doc/software-tools.md, this branch will focus on Spin/PASM related tools, that ship with package propeller-development-suite@4.6.1-2.4c46ecbe7:

Furthermore, the flashrom utility is required:

The documentation is supplemented by zipped files, downloaded with the wget utility:

Section #../../firmware2/doc/RS232-speed-with-flashrom.md

RS232 Speed with Flashrom

We are happy to announce that the current Spin/PASM code is able to deal with an RS232 baudrate of 115200, e.g.: commit ID ed42cddb

Inrushing page bytes, send by flashrom, are stored in an intermediate buffer, which is then safely processed while high speed action on the RS232 lines is not required.

Filling the buffer is done at 115200baud, processing the buffer for write operations on the SPI flash chip is done at 18360Hz (Mode 0).

SPI read operations are not buffered, but processed directly, byte per byte. Sending a byte over the RS232 line is again done at 115200baud. However, processing the bytes of a sector (4096 bytes) is done at 9570Hz (Mode 0):

../../firmware2/images/IMG_1555.JPG

Read operation at 115200baud (2V/100µs per div)

The Spin/PASM code has been tuned to be as fast as possible. Three code snippets are provided here, as these give some extra boost:

Using Mode 0 and an SPI speed of up to 40MHz, flashrom takes 34 minutes and 25 seconds to fill a 4M chip with random data, erase and verify already included:

    date && \
    flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M \
      -V \
      -c "MX25L3205D/MX25L3208D" \
      -w 4M-rand.bin \
    && date

The same operation, using Mode 3 and an SPI speed of 5MHz yields to the same result – no significant difference in time! Ooops?

The same operation using Mode 0, an SPI speed of 40MHz, and just $00 bytes, again brings the same time. Hmm. How comes??

Constant SP_NREAD is set to sector size, that is 4096 bytes. If we run a test with SP_NREAD = $400000, the flash procedure with an SPI speed of up to 40MHz is about 14 seconds faster. However, if we set the SPI speed to just 5MHz, the time improvement persists. Hmm.

It looks as if the SPI speed has no impact on the overall execution time of flashrom. That is not what would have been expected.

However, a slower baudrate for the RS232 connection does have an impact. The invocation snippet as shown above, but with baudrate set to 38400, takes 1 hour, 27 minutes and 26 seconds.

Section #../../firmware2/doc/SPI-clock-speed-with-flashrom.md

SPI Clock Speed with Flashrom

Workbench

SPI clock speed development is done with the RYF-certified Chipflasher “board-edition-1”, driven by a Zerocat T60, targeting a modified ThinkPad X230 with SPI flash connector. Code execution is montitored via oscilloscope:

../../firmware2/images/IMG_1281.JPG

SPI Clock Speed Development Setup

Spin Code (e.g. commit 808341ea)

The serprog-SPI.spin object offers optimized SPI bus routines, coded in slow Spin. Byte transfer speed is 2.2kHz, clock speed is estimated to 25kHz:

../../firmware2/images/IMG<em>1215.JPG

SPI Byte Transfer Speed (read access) of Spin Code (1V/50µs per div)

../../firmware2/images/IMG</em>1208.JPG

SPI Clock Speed (8bit read access) of Spin Code (1V/5µs per div)

PASM Code (e.g. commit f8919500)

Optimized PASM routines provide much higher clock rates. Object serprog-SPI-PASM.spin achieves a clock rate of 5MHz (8bit read/write), 4MHz (24bit read) and 3.33MHz (24bit write). If using RS232 with 57600baud (default), the Spin code processes bytes with 5.2KHz.

../../firmware2/images/IMG_1237.JPG

SPI Clock Speed (8bit read access) of PASM Code (1V/50ns per div)

Code snippet, as executed above:

    :read8
                ...
                ...
                ...
                or OUTA, mask_SCLK
                andn OUTA, mask_SCLK

                'bit 6
                test mask_MISO, INA             wc
                rcl value, #1
                or OUTA, mask_SCLK
                andn OUTA, mask_SCLK

                'bit 5
                test mask_MISO, INA             wc
                rcl value, #1
                or OUTA, mask_SCLK
                andn OUTA, mask_SCLK

                'bit 4
                ...
                ...

../../firmware2/images/IMG<em>1240.JPG

SPI Byte Transfer Speed (read access) of PASM Code (1V/200ns per div)

../../firmware2/images/IMG</em>1243.JPG

Byte Process Speed (read access) at 57600baud with SPI PASM Code (1V/20µs per div)

PASM Code with Counter Modules (e.g. commit d59dad40)

Object serprog-SPI-PASM.spin achieves even higher clock rates by using free wheeling counters in the background. If the code stays in sync with counter pin outputs, it is freed from generating the pulses itself. That technique allows us to clock data bytes with 10MHz. Values like $00 and $ff do not require to toggle bit values and can be clocked with up to 80MHz. However, that frequency turned out to be too high for the device under test, that is why 40MHz is used instead.

The PASM code supports the spispeed option of the serprog protocol. Three values give you control about the SPI clock frequency according to the following table:

    spispeed  |    8bit read  |      8bit write  |     24bit read  |    24bit write  |   clock driver
    ==========|===============|==================|=================|=================|=================
          5M  |         5MHz  |            5MHz  |           4MHz  |        3.33MHz  |     full power
    ----------|---------------|------------------|-----------------|-----------------|-----------------
         10M  |         5MHz  | $00, $ff: 10MHz  |           4MHz  |        3.33MHz  |     full power
              |               | $01..$fe:  5MHz  |                 |                 |
    ----------|---------------|------------------|-----------------|-----------------|-----------------
         40M  |        10MHz  | $00, $ff: 40MHz  |           4MHz  |        3.33MHz  |     half power
              |               | $01..$fe: 10MHz  |                 |                 |

You can pass the spispeed value via command line, e.g.:

    flashrom -p serprog:dev=tty_port_pointer:57600,spispeed=40M

If you don't specify the SPI speed initially, a default value of 10M will be used. However, once specified, the speed value is not reset if not provided on the command line.

High Frequency Clock in Mode 0

../../firmware2/images/IMG<em>1321.JPG

Mode 0: 8bit read with 10MHz clock (2V/200ns per div)

../../firmware2/images/IMG</em>1336.JPG

Mode 0: 8bit write with 10MHz clock (2V/200ns per div)

../../firmware2/images/IMG<em>1349.JPG

Mode 0: Switching to 8bit write ($00, $ff) with 40MHz clock (2V/200ns per div)

../../firmware2/images/IMG</em>1384.JPG

Mode 0: in Detail: 8bit write ($00, $ff) with 40MHz clock (1V/50ns per div)

High Frequency Clock in Mode 3

../../firmware2/images/IMG<em>1389.JPG

Mode 3: 8bit read/write with 10MHz clock (2V/200ns per div)

../../firmware2/images/IMG</em>1421.JPG

Mode 3: in Detail: 8bit read/write with 10MHz clock (1V/100ns per div)

../../firmware2/images/IMG<em>1392.JPG

Mode 3: 8bit write ($00, $ff) with 40MHz clock (2V/200ns per div)

../../firmware2/images/IMG</em>1416.JPG

Mode 3: in Detail: 8bit write ($00, $ff) with 40MHz clock (1V/50ns per div)

PASM Code with Quadruple Pulse Train (e.g. commit 65ca231d)

Object serprog-SPI-PASM.spin launches up to four new cogs to run the PASM code of serprog-SPI-PASM-Pulse.spin. Each new cog uses its counter modules to drive a clock pin. The cogs are synchronized via external trigger pin, and parallel trains of eight pulses each are emitted with very little overhead.

This technique allows us to drive the SPI clock pin of the attached flash chip with full capabilities of the Chipflasher PCB, using a frequency as high as 40MHz. On the other hand, it allows driver strength configuration and mitigation of voltage over- and undershots on the clock line by using a smaller number of cogs. See example screenshots with ThinkPad X230 under test:

../../firmware2/images/IMG<em>1467.JPG

Mode 0: SPI clock pulse quality @ 5MHz, driver set to 100% (1V/100ns per div)

../../firmware2/images/IMG</em>1469.JPG

Mode 0: SPI clock pulse quality @ 5MHz, driver set to 75% (1V/100ns per div)

../../firmware2/images/IMG<em>1470.JPG

Mode 0: SPI clock pulse quality @ 5MHz, driver set to 50% (1V/100ns per div)

../../firmware2/images/IMG</em>1473.JPG

Mode 0: SPI clock pulse quality @ 5MHz, driver set to 25% (1V/100ns per div)

The PASM code supports the spispeed option of the serprog protocol according to the following, updated table:

    spispeed  |    8bit read  |      8bit write  |     24bit read  |    24bit write  |     SPI clock driver strength
    ==========|===============|==================|=================|=================|==============================
      =<  5M  |         5MHz  |            5MHz  |           4MHz  |        3.33MHz  |     100%, 75%, 50%, 25%, 0%
    ----------|---------------|------------------|-----------------|-----------------|------------------------------
      =< 10M  |        10MHz  |           10MHz  |           4MHz  |        3.33MHz  |     100%, 75%, 50%, 25%, 0%
    ----------|---------------|------------------|-----------------|-----------------|------------------------------
       > 10M  |        10MHz  | $01..$fe: 10MHz  |           4MHz  |        3.33MHz  |     100%, 75%, 50%, 25%, 0%
              |               | $00, $ff: 40MHz  |                 |                 |

You can pass the spispeed value via command line, e.g.:

    flashrom -p serprog:dev=/dev/ttyS0:57600,spispeed=40M

If you don't specify the SPI speed initially, a default value of 10M will be used. However, once specified, the speed value is not reset if not provided on the command line.

The waveforms for SPI Mode 0 and 3 have changed. In case of Mode 0, the high frequency pulse train is greatly improved. In case of Mode 3, one negative pulse is enlarged by two cycles due to synchronization requirements.

../../firmware2/images/IMG<em>1477.JPG

Mode 0: SPI clock pulse train @ 10MHz, driver set to 50% (1V/100ns per div)

../../firmware2/images/IMG</em>1535.JPG

Mode 0: SPI clock pulse train @ 40MHz, driver set to 50%, WIP polling @ 10MHz (1V/100ns per div)

../../firmware2/images/IMG<em>1487.JPG

Mode 3: SPI clock pulse train @ 10MHz, driver set to 50% (1V/100ns per div)

../../firmware2/images/IMG</em>1510.JPG

Mode 3: SPI clock pulse train @ 40MHz, driver set to 50%, WIP polling @ 10MHz (1V/100ns per div)

Support for low Frequencies

In order to provide a low frequency in case it is needed for old devices, the code has been adapted according to the following table:

    spispeed     |    8bit read  |      8bit write  |     24bit read  |    24bit write  |  SPI clock driver strength
    =============|===============|==================|=================|=================|=============================
                 |        __     |           __     |          __     |          __     |
     =< 3333333  |      3.33MHz  |         3.33MHz  |        3.33MHz  |        3.33MHz  |     100%, 75%, 50%, 25%
    -------------|---------------|------------------|-----------------|-----------------|-----------------------------
                 |               |                  |          __     |          __     |
      =<  5M     |         5MHz  |            5MHz  |        3.33MHz  |        3.33MHz  |     100%, 75%, 50%, 25%
    -------------|---------------|------------------|-----------------|-----------------|-----------------------------
                 |               |                  |          __     |          __     |
      =< 10M     |        10MHz  |           10MHz  |        3.33MHz  |        3.33MHz  |     100%, 75%, 50%, 25%
    -------------|---------------|------------------|-----------------|-----------------|-----------------------------
                 |               |                  |          __     |          __     |
       > 10M     |        10MHz  | $01..$fe: 10MHz  |        3.33MHz  |        3.33MHz  |     100%, 75%, 50%, 25%
                 |               | $00, $ff: 40MHz  |                 |                 |
Section #../../firmware2/doc/flashrom-invocation-examples.md

Flashrom Invocation Examples

Instead of using the Makefile, feel free to operate the chipflasher with the flashrom utility. Here are some invocation examples as executed in ../../firmware2/start/. These examples are using an RS232 rate of 57600baud, which used to be the default setting.

Probe

    flashrom -p serprog:dev=tty_port_pointer:57600

Probe MX25L6405D (as found on ThinkPad X230, Chip #1)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -V
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
    Command line (5 args): flashrom -p serprog:dev=tty_port_pointer:57600 -c MX25L6405D -V
    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    Initializing serprog programmer
    serprog: connected - attempting to synchronize
    .
    serprog: Synchronized
    serprog: Interface version ok.
    serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
    serprog: Maximum write-n length is 256
    serprog: Maximum read-n length is 4096
    serprog: Programmer name is "Zerocat!"
    serprog: Serial buffer size is 16
    serprog: operation buffer size is 300
    serprog: Output drivers enabled
    The following protocols are supported: SPI.
    Probing for Macronix MX25L6405D, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
    Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
    Chip status register is 0x00.
    Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
    Chip status register: Bit 6 is not set
    Chip status register: Block Protect 3 (BP3) is not set
    Chip status register: Block Protect 2 (BP2) is not set
    Chip status register: Block Protect 1 (BP1) is not set
    Chip status register: Block Protect 0 (BP0) is not set
    Chip status register: Write Enable Latch (WEL) is not set
    Chip status register: Write In Progress (WIP/BUSY) is not set
    This chip may contain one-time programmable memory. flashrom cannot read
    and may never be able to write it, hence it may not be able to completely
    clone the contents of this chip (see man page for details).
    No operations were specified.
    serprog: Output drivers disabled

Read MX25L6405D (as found on ThinkPad X230, Chip #1)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -r chip1.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
    Reading flash... done.

Verify MX25L6405D (as found on ThinkPad X230, Chip #1)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -v chip1.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
    Verifying flash... VERIFIED.

Erase MX25L6405D (as found on ThinkPad X230, Chip #1)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -E
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
    Erasing and writing flash chip... Erase/write done.

Write MX25L6405D (as found on ThinkPad X230, Chip #1)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -w chip1.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
    Reading old flash chip contents... done.
    Erasing and writing flash chip...
    Erase/write done.
    Verifying flash... VERIFIED.

Probe MX25L3205D (as found on ThinkPad X230, Chip #2)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -V
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
    Command line (5 args): flashrom -p serprog:dev=tty_port_pointer:57600 -c MX25L3205D/MX25L3208D -V
    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    Initializing serprog programmer
    serprog: connected - attempting to synchronize
    .
    serprog: Synchronized
    serprog: Interface version ok.
    serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
    serprog: Maximum write-n length is 256
    serprog: Maximum read-n length is 4096
    serprog: Programmer name is "Zerocat!"
    serprog: Serial buffer size is 16
    serprog: operation buffer size is 300
    serprog: Output drivers enabled
    The following protocols are supported: SPI.
    Probing for Macronix MX25L3205D/MX25L3208D, 4096 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2016
    Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
    Chip status register is 0x00.
    Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
    Chip status register: Bit 6 is not set
    Chip status register: Block Protect 3 (BP3) is not set
    Chip status register: Block Protect 2 (BP2) is not set
    Chip status register: Block Protect 1 (BP1) is not set
    Chip status register: Block Protect 0 (BP0) is not set
    Chip status register: Write Enable Latch (WEL) is not set
    Chip status register: Write In Progress (WIP/BUSY) is not set
    This chip may contain one-time programmable memory. flashrom cannot read
    and may never be able to write it, hence it may not be able to completely
    clone the contents of this chip (see man page for details).
    No operations were specified.
    serprog: Output drivers disabled

Read MX25L3205D (as found on ThinkPad X230, Chip #2)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -r chip2.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
    Reading flash... done.

Verify MX25L3205D (as found on ThinkPad X230, Chip #2)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -v chip2.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
    Verifying flash... VERIFIED.

Erase MX25L3205D (as found on ThinkPad X230, Chip #2)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -E
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
    Erasing and writing flash chip... Erase/write done.

Write MX25L3205D (as found on ThinkPad X230, Chip #2)

    flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -w chip2.bin
    ---------------------------------------------------------------------------------------------
    flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    serprog: Programmer name is "Zerocat!"
    Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... Erase/write done.
    Verifying flash... VERIFIED.
Section #../../firmware2/doc/flashrom-failure-SST25VF016B.md

Flashrom Failure on Volatile SST25VF016B 2MB Flash Chip

This chip is accessed as a discrete component.
It is typically found on ThinkPads X60 and T60.

The chip has previously been flashed, verified and erased successfully by means of the connect interface. Thus, the following flashrom invocation acts on an already erased chip, clock driver strength set to 25%. Same results with chip in situ on ThinkPad T60, clock driver strenght set to 50%:

    flashrom v1.2 on Linux 5.18.14-gnu (x86_64)
    flashrom is free software, get the source code at https://flashrom.org

    flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
    Command line (9 args): flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M -V -c SST25VF016B -w 2M-rand.bin
    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    Initializing serprog programmer
    serprog: connected - attempting to synchronize
    .
    serprog: Synchronized
    serprog: Interface version ok.
    serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
    serprog: Maximum write-n length is 256
    serprog: Maximum read-n length is 4096
    serprog: Requested to set SPI clock frequency to 40000000 Hz. It was actually set to 40000000 Hz
    serprog: Programmer name is "Zerocat!"
    serprog: Serial buffer size is 16
    serprog: operation buffer size is 300
    serprog: Output drivers enabled
    The following protocols are supported: SPI.
    Probing for SST SST25VF016B, 2048 kB: probe_spi_rdid_generic: id1 0xbf, id2 0x2541
    Found SST flash chip "SST25VF016B" (2048 kB, SPI) on serprog.
    Chip status register is 0x1c.
    Chip status register: Block Protect Write Disable (BPL) is not set
    Chip status register: Auto Address Increment Programming (AAI) is not set
    Chip status register: Block Protect 3 (BP3) is not set
    Chip status register: Block Protect 2 (BP2) is set
    Chip status register: Block Protect 1 (BP1) is set
    Chip status register: Block Protect 0 (BP0) is set
    Chip status register: Write Enable Latch (WEL) is not set
    Chip status register: Write In Progress (WIP/BUSY) is not set
    Resulting block protection : all
    Some block protection in effect, disabling... disabled.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:Wspi_write_cmd failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Trying erase function 1... 0x000000-0x007fff:Wspi_write_cmd failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Trying erase function 2... 0x000000-0x00ffff:Wspi_write_cmd failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Trying erase function 3... 0x000000-0x1fffff:Wspi_write_cmd failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Trying erase function 4... 0x000000-0x1fffff:Wspi_write_cmd failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Trying erase function 5... not defined. Looking for another erase function.
    Trying erase function 6... not defined. Looking for another erase function.
    Trying erase function 7... not defined. No usable erase functions left.
    FAILED!
    Uh oh. Erase/write failed. Checking if anything has changed.
    Reading current flash chip contents... done.
    Good, writing to the flash chip apparently didn't do anything.
    Please check the connections (especially those to write protection pins) between
    the programmer and the flash chip. If you think the error is caused by flashrom
    please report this on IRC at chat.freenode.net (channel #flashrom) or
    mail flashrom@flashrom.org, thanks!
    serprog: Output drivers disabled
Section #../../firmware2/doc/flashrom-failure-AT26DF161.md

Flashrom Failure on Volatile AT26DF161 2MB Flash Chip

This chip is accessed on a ThinkPad T60 motherboard.

The chip has previously been flashed, verified and erased successfully by means of the connect interface. Thus, the following flashrom invocation acts on an already erased sector.

Clock driver strength has been set to 50%:

    flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
    Command line (10 args): flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M -V -c AT26DF161 -l ../firmware2/start/layout-16K.txt -is03 -w t60_atmel.s03.bin
    romlayout 00000000 - 00000fff named s00
    romlayout 00001000 - 00001fff named s01
    romlayout 00002000 - 00002fff named s02
    romlayout 00003000 - 00003fff named s03
    romlayout 00004000 - 00004fff named s04
    romlayout 00005000 - 00005fff named s05
    romlayout 00006000 - 00006fff named s06
    romlayout 00007000 - 00007fff named s07
    romlayout 00008000 - 00008fff named s08
    romlayout 00009000 - 00009fff named s09
    romlayout 0000a000 - 0000afff named s0a
    romlayout 0000b000 - 0000bfff named s0b
    romlayout 0000c000 - 0000cfff named s0c
    romlayout 0000d000 - 0000dfff named s0d
    romlayout 0000e000 - 0000efff named s0e
    romlayout 0000f000 - 0000ffff named s0f
    Using region: "s03".
    Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
    Initializing serprog programmer
    serprog: connected - attempting to synchronize
    .
    serprog: Synchronized
    serprog: Interface version ok.
    serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
    serprog: Maximum write-n length is 256
    serprog: Maximum read-n length is 4096
    serprog: Requested to set SPI clock frequency to 40000000 Hz. It was actually set to 40000000 Hz
    serprog: Programmer name is "Zerocat!"
    serprog: Serial buffer size is 16
    serprog: operation buffer size is 300
    serprog: Output drivers enabled
    The following protocols are supported: SPI.
    Probing for Atmel AT26DF161, 2048 kB: probe_spi_rdid_generic: id1 0x1f, id2 0x4600
    Found Atmel flash chip "AT26DF161" (2048 kB, SPI) on serprog.
    Chip status register is 0x1c.
    Chip status register: Sector Protection Register Lock (SRPL) is not set
    Chip status register: Bit 6 is not set
    Chip status register: Erase/Program Error (EPE) is not set
    Chip status register: WP# pin (WPP) is not asserted
    Chip status register: Software Protection Status (SWP): all sectors are protected
    Chip status register: Write Enable Latch (WEL) is not set
    Chip status register: Write In Progress (WIP/BUSY) is not set
    Some block protection in effect, disabling... disabled.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... Trying erase function 0... 0x003000-0x003fff:W
    Erase/write done.
    Verifying flash... FAILED at 0x001623a2! Expected=0xbd, Found=0x5e, failed byte count from 0x00000000-0x001fffff: 0xc50
    Your flash chip is in an unknown state.
    Please report this on IRC at chat.freenode.net (channel #flashrom) or
    mail flashrom@flashrom.org, thanks!
    serprog: Output drivers disabled
Section #../../firmware2/doc/testboard.md

Testboard

Hardware of a free Design

Hardware Design Sources are licensed under CERN Open Hardware Licence Version 2 – Strongly Reciprocal, or any later version.

See CERN-OHL-S v2 User Guide to get guidelines on how to use these hardware designs for your own projects.

The Zerocat Chipflasher aims to be free-design as much as possible, that’s why it relies on the Parallax Propeller 1 microcontroller. In 2014, the chip design files of this controller have been released under the GPLv3, by Parallax.

../../firmware2/images/IMG_1605.JPG

Testboard, handmade

Diplexer A and B

These switches are intended to simulate the otherwise hardwired board version configuration.

    DIP Switch A, B¹  |  Board Version
    ------------------|-----------------
    on, on            |  V1
    open, on          |  V2²
    on, open          |  V3
    open, open        |  V4

    ¹ On PCB board-edition-1, this switch input is tristate, but will
      hopefully be read as low level.

    ² Default for this testboard and its new features.

Upon startup of kick2, the board version is displayed by the number of a grouped light-up on software status LEDS D1 through D3.

DIP Switches 1 to 6

The DIP Switch Block is intended for runtime configuration of the device and its firmware.

../../firmware2/images/IMG_1677.JPG

Testboard, DIP Switch for runtime configuration

Firmware kick2 Configuration Table

    DIP Switch Nº     |  Function                     |  o = open, x = closed
    ------------------|---------------------------------------------------------------------------
    DIP Switch 1..2   |  SPI Clock Driver Strength    |  oo = 25%, xo = 50%, ox = 75%, xx = 100%
    DIP Switch 3      |  SPI Mode 0 or 3              |  o = Mode 3, x = Mode 0
    DIP Switch 4      |  RS232 Baudrate               |  o = 115200, x = 57600
    DIP Switch 5      |  SPI Power Suspend            |  o = allow, x = inhibit
    DIP Switch 6      |  SPI Power-up Pulse Type      |  o = single, x = repetitive

DIP Switches 1 and 2: SPI Clock Driver Strength

       DIP Switch Nº  |  Clock Driver  |  Remarks
        1  |       2  |    Strength    |
    -----------------------------------|-----------------------
     open  |    open  |           25%  |  discrete chips
       on  |    open  |           50%  |  many systemboards
     open  |      on  |           75%  |  ThinkPad X200, X200t
       on  |      on  |          100%  |  ThinkPad T500

On board version v1, the strength defaults to 50%.
Use Makefile in firmware2/src to configure explicitly.

DIP Switch 3: SPI Mode 0 or 3

      DIP Switch 3  |  SPI Mode
    --------------------------------------------
              open  |  3
                on  |  0

On board version v1, the SPI mode defaults to Mode 3. Use Makefile in firmware2/src to configure explicitly.

SPI Clocking Mode 0 is not as robust as Mode 3 regarding noise pick-up. It requires a shielded clock wire, grounded at one side:

../../firmware2/images/IMG_1732.JPG

Shielded clock wire, grounded at one side. Mandatory for Mode 0.

DIP Switch 4: RS232 Baudrate

      DIP Switch 4  |  RS232 Baudrate
    --------------------------------------------
              open  |  115200
                on  |  57600

On board version v1, the baudrate defaults to 115200. Use Makefile in firmware2/src to configure explicitly.

DIP Switch 5: SPI Power Suspend

This DIP switch instructs the firmware to suspend SPI power if considered useful, or to keep it powered. On board version v1, suspend is allowed.

      DIP Switch 5  |  SPI Power Suspend
    --------------------------------------------
              open  |  allow
                on  |  inhibit

DIP Switch 6: SPI Power-up Pulse Type

      DIP Switch 6  |  SPI Power-up Pulse Type
    --------------------------------------------
              open  |  one-shot
                on  |  repetitive

On board version v1, the pulse type defaults to repetitive.
Use Makefile in firmware2/src to configure explicitly.

../../firmware2/images/IMG<em>1683.JPG

C22=100nF | Vcc_SPI after Single Power-up Pulse on ThinkPad T60/Macronix (500mV/1ms per div)

../../firmware2/images/IMG</em>1685.JPG

C22=100nF | Vcc_SPI after Repetitive Power-up Pulse on ThinkPad T60/SST (500mV/1ms per div)

To make the power-up ramp a smooth curve, capacitor C22 has been increased from 100nF to 1000µF. Capacitor C1 being a 10µF Tantalum placed across pins 2 and 3 of U5 avoids flickering of SPI LED D7 during shutdown. However, the requirement to trigger Q1 repetitively to elevate the voltage on T60/SST persists.

../../firmware2/images/IMG_1694.JPG

PNP MOSFET Q1, powering the SPI bus.

SPI Voltage Monitor

The voltage monitor on net Vcc_SPI uses a semaphoric flag system:

../../firmware2/images/IMG<em>1653.JPG

Testboard, ADC Section monitoring the Vcc_SPI net, Top View

../../firmware2/images/IMG</em>1657.JPG

Testboard, ADC Section monitoring the Vcc_SPI net, Bottom View

This new feature has successfully been tested on several targeted ThinkPad T60 models:

On other ThinkPad targets, this feature might not come into action due to persistent, good voltage levels.

Discrete Test Chips

Discrete test chips help to understand effects that are introduced by systemboards.

../../firmware2/images/IMG_1613.JPG

Several test chips, discrete

Front Label

The front label comes with an extra, blank field, intended for your notices.

../../hardware/artwork/testboard-label.svg.png

Testboard Front Label

Bill of Material

Source Files

Generated PDFs

PDFs, generated from source files via ../../hardware/Makefile:

../../hardware/artwork/testboard-label.svg.pdf
../../hardware/gschem/testboard-page01.sch.pdf
../../hardware/gschem/testboard-page02.sch.pdf
../../hardware/gschem/testboard-page03.sch.pdf
../../hardware/gschem/testboard-page04.sch.pdf
../../hardware/gschem/testboard-page05.sch.pdf
../../hardware/gschem/testboard-page06.sch.pdf
../../hardware/gschem/testboard-page07.sch.pdf
../../hardware/gschem/testboard-page08.sch.pdf
../../hardware/gschem/testboard-page09.sch.pdf
../../hardware/gschem/testboard-page10.sch.pdf
../../hardware/gschem/testboard-page11.sch.pdf
../../hardware/gschem/testboard-page12.sch.pdf
../../hardware/gschem/testboard-page13.sch.pdf
../../hardware/gschem/testboard-page14.sch.pdf
../../hardware/gschem/testboard-page15.sch.pdf

Circuit Schematics

../../hardware/gschem/testboard-page01.sch.png

Testboard Circuit Schematic, Page 1(15): Controller with Reset Circuit

../../hardware/gschem/testboard-page02.sch.png

Testboard Circuit Schematic, Page 2(15): Power Input with Sense

../../hardware/gschem/testboard-page03.sch.png

Testboard Circuit Schematic, Page 3(15): Power Switch and Voltage Regulators

../../hardware/gschem/testboard-page04.sch.png

Testboard Circuit Schematic, Page 4(15): SPI Bus

../../hardware/gschem/testboard-page05.sch.png

Testboard Circuit Schematic, Page 5(15): Software Status LEDs

../../hardware/gschem/testboard-page06.sch.png

Testboard Circuit Schematic, Page 6(15): RS232 Circuit #0

../../hardware/gschem/testboard-page07.sch.png

Testboard Circuit Schematic, Page 7(15): RS232 Circuit #1

../../hardware/gschem/testboard-page08.sch.png

Testboard Circuit Schematic, Page 8(15): RS232 Circuit Selector

../../hardware/gschem/testboard-page09.sch.png

Testboard Circuit Schematic, Page 9(15): Serial EEPROM of a non-free Design, optional.

../../hardware/gschem/testboard-page10.sch.png

Testboard Circuit Schematic, Page 10(15): Sigma-delta ADC Circuit

../../hardware/gschem/testboard-page11.sch.png

Testboard Circuit Schematic, Page 11(15): RS232 Cable

../../hardware/gschem/testboard-page12.sch.png

Testboard Circuit Schematic, Page 12(15): USB Power-only Y-Cable

../../hardware/gschem/testboard-page13.sch.png

Testboard Circuit Schematic, Page 13(15): Test Clip Connectors

../../hardware/gschem/testboard-page14.sch.png

Testboard Circuit Schematic, Page 14(15): SOIC8 Test Chip of a non-free Design

../../hardware/gschem/testboard-page15.sch.png

Testboard Circuit Schematic, Page 15(15): SOIC16 Test Chip of a non-free Design

Section #../../firmware2/doc/equipment-tests.md

Successful Read-Erase-Write on Test Equipment

The test equipment of Set 1 and Set 2 has been flashed successfully, using the testboard testboard-v2 with a corebooted ThinkPad T60 (64bit CPU) with GNU Guix System and an Ultra Base Docking Station. Failures are listed in Set 3.

Devices are tested via Makefile:

    [env]$ make -C ../../firmware2/tests test-fakeROM

Attention! If interested in using this test, create backups beforehand!! The test itself proceeds even if flashrom fails in between.

The resulting PCB board-v2.0.0 has been proved to work fine with some key equipment, listed in section Testing PCB “board-v2.0.0”.

../../firmware2/images/IMG_1887.JPG

Testing Chipflasher v2 with target T60 + MX25L1605D

Set 1, Test Reports

../../firmware2/images/IMG_1733.JPG

Test Equipment, Set 1: two laptops, three systemboards

DIP Switch 3 has changed polarity: open = Mode 3, closed = Mode 0

Set 2, Test Reports

../../firmware2/images/IMG_1752.JPG

Test Equipment, Set 2: three laptops, five systemboards, one discrete chip

DIP Switch 5 has changed to specify SPI Power-up Timing

Set 3, Unsupported/Fail

Testing PCB “board-v2.0.0”

DIP Switch 5 changes functionality. It is now designed to support SPI chips with volatile registers.