Skip to main content
Topic: Issue flashing MX25L1606E (Read 6016 times) previous topic - next topic

Issue flashing MX25L1606E

Hi All,

I have run into an issue with flashing using combination of bus pirate and MX25L1606E (2MB) SPI chip.

* Flashroom read the content of the chip fine (I had reference image for mfg flashed data)
* When manually issuing commands in SPI mode data flashes fine

However,

When flashing using bus pirate it seems like some bits are getting flipped.

E.g.

a) After erasing first 4K of the chip. 
b) The first 256 bytes are programmed fine. 
c) However, when the second sent of 256 bytes are programmed they end up reprogramming the  first

Verified by reading flash content after step b).  If step c) is also done  then the data in the first 256 bytes of the chip ends up as an AND of data sent in b) and c). 

I traces the byte stream up to the point where flashrom writes the bytes over to BP USB tty and the look okay. Starting with

0x04 - (binary write then read)
0x01 0x04 (write 260 bytes to chip)
0x00 0x00 (read 0x0)
0x02 (Page program)
0x00
0x00 for first 256 bytes and 0x01 for send 256 bytes
0x..... 256 bytes to flash


If I repeat above by hand using 16 bytes at a time, data is flashed in the correct locations with expected values as confirmed by dumping the rom afterwards with flashroom.


My next step is to capture USB packets going to BP to see if something gets corrupted on the way out, but I don't expect that to be the issue.

My questions are:

* Have anyone seen/heard of similar issue with binary SPI on BP?
* Is there a way for me to debug BP up to the point where it is ready to send to see if corruption happens on the way in?
* Any other debugging tips?

Thank you

Re: Issue flashing MX25L1606E

Reply #1
And BP details (also same issue on original 6.1 FW):

Bus Pirate v3.5
Firmware v6.2-beta1 r1981  Bootloader v4.4
DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
http://dangerousprototypes.com

Re: Issue flashing MX25L1606E

Reply #2
Did you select the right chip and revision? Or a chip that is 'simular enough'

Looks like flashrom selects/assumes the wrong page-size.

Re: Issue flashing MX25L1606E

Reply #3
Thanks for the reply.

According to chip markings it is the MX25L1606E. The datasheet from the manufacturer does not mention any revisions.  Also if I program 3 bytes at the same page boundaries using interactive SPI mode of BP data get programmed at the expected location  (0x100) rather than at the start (0x0).

Re: Issue flashing MX25L1606E

Reply #4
I mend did you select in flashrom the exact chip or is it properly detected by it?

Also which version of flashrom did you use?

Re: Issue flashing MX25L1606E

Reply #5
I tried both ways.  With detection and explicitly selecting the chip.  Both picked the same chip.  I do run it with explicitly selecting the chip as it is faster (it does not try other chips).

I am now running flashrom with trunk @1841 version

I enabled "-VVV" and debugged into serialport_write() function in serial.c and data stream matches what I would have expected based on the data sheet.  When I do similar command (only difference I program 16 bytes instead of all 256) the first and second pages are programmed in the correct location.

I also saw erase failing to verify in inconsistent locations but worked around by issuing chip erase by hand. As far as I can tell flashrom sends the correct binary SPI commands to BP.

Re: Issue flashing MX25L1606E

Reply #6
Perhaps the speed the commands are sent is too fast and some commands aren't recognized by the device. Is there a speed option to flashrom?

I'm sorry I'm out of options now :/

Re: Issue flashing MX25L1606E

Reply #7
Thank you for trying, much appreciated. 

Will try using SPI in BBB and see if it can program the chip without issues.

Re: Issue flashing MX25L1606E

Reply #8
Having similar issues with BBB, must be either the chip or my setup