ERASE FAILED on 25L6406E/MX25L6408E, EMC2512,A1398


Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.
More
7 years 9 months ago #3811 by lily
Hi! I have a mid-2012 MacBook Retina 15". 25L6406E/MX25L6408E, EMC2512, A1398 (with flashrom v0.9.9 on a Pi). Reading works fine, but writing is a problem because erasing fails.

I've seen it in the forum before; it generally seems to work (like here or here ), in spite of warnings that the chip may be single-write.

I ruled out power problems - after some initial reliability issues I settled with an external power supply to keep my voltage around 3.3V (Pi alone couldn't do it). Now reading the chip always gives the exact same result (and takes the exact same time - around 130 sec) and I'm happy to find and replace the $SVS. But trying to erase the chip, I fail. What am I doing wrong?

Thanks for your help!

First I tried erasing (because I didn't know it does that automatically) and failed:
Command line (6 args): flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6406E/MX25L6408E -E -V
Calibrating delay loop... OS timer resolution is 4 usecs, 173M loops per second, 10 myus = 10 us, 100 myus = 102 us, 1000 myus = 999 us, 10000 myus = 10126 us, 16 myus = 21 us, OK.
Initializing linux_spi programmer
Using device /dev/spidev0.0
The following protocols are supported: SPI.
Probing for Macronix MX25L6406E/MX25L6408E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Erasing and writing flash chip... 
Trying erase function 0... 0x000000-0x000fff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x00000fff: 0xd0
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 1... 0x000000-0x00ffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x0000ffff: 0x9a05
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x0000ffff: 0x9a05
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 3... 0x000000-0x7fffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x007fffff: 0x53e33c
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 4... 0x000000-0x7fffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x007fffff: 0x53e33c
ERASE FAILED!
Looking for another erase function.
No usable erase functions left.
FAILED!
Your flash chip is in an unknown state.
Please report this on IRC at chat.freenode.net (channel #flashrom) or
mail , thanks!

And then I tried writing (but failed):
Command line (7 args): flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6406E/MX25L6408E -w /home/pi/dumps/clean00.bin -V
Calibrating delay loop... OS timer resolution is 4 usecs, 173M loops per second, 10 myus = 10 us, 100 myus = 104 us, 1000 myus = 1000 us, 10000 myus = 10105 us, 16 myus = 19 us, OK.
Initializing linux_spi programmer
Using device /dev/spidev0.0
The following protocols are supported: SPI.
Probing for Macronix MX25L6406E/MX25L6408E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:S, 0x001000-0x001fff:S, 0x002000-0x002fff:S, 0x003000-0x003fff:S, 0x004000-0x004fff:S, 0x005000-0x005fff:S, 0x006000-0x006fff:S, 0x007000-0x007fff:S, 0x008000-0x008fff:S, 0x009000-0x009fff:S, 0x00a000-0x00afff:S, 0x00b000-0x00bfff:S, 0x00c000-0x00cfff:S, 0x00d000-0x00dfff:S, 0x00e000-0x00efff:S, 
// more of this ...
0x692000-0x692fff:EFAILED at 0x00692050! Expected=0xff, Found=0x24, failed byte count from 0x00692000-0x00692fff: 0x13f
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 1... 0x000000-0x00ffff:S, 0x010000-0x01ffff:S, 0x020000-0x02ffff:S, 0x030000-0x03ffff:S, 0x040000-0x04ffff:S, 0x050000-0x05ffff:S, 0x060000-0x06ffff:S, 0x070000-0x07ffff:S, 0x080000-0x08ffff:S, 0x090000-0x09ffff:S, 0x0a0000-0x0affff:S,
// more of this ...
0x630000-0x63ffff:S, 0x640000-0x64ffff:S, 0x650000-0x65ffff:S, 0x660000-0x66ffff:S, 0x670000-0x67ffff:S, 0x680000-0x68ffff:S, 0x690000-0x69ffff:EFAILED at 0x00690000! Expected=0xff, Found=0x46, failed byte count from 0x00690000-0x0069ffff: 0x214c
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:S, 0x010000-0x01ffff:S, 0x020000-0x02ffff:S, 0x030000-0x03ffff:S, 0x040000-0x04ffff:S, 0x050000-0x05ffff:S, 0x060000-0x06ffff:S, 0x070000-0x07ffff:S, 0x080000-0x08ffff:S, 0x090000-0x09ffff:S,
// more of this ...
0x660000-0x66ffff:S, 0x670000-0x67ffff:S, 0x680000-0x68ffff:S, 0x690000-0x69ffff:EFAILED at 0x00690000! Expected=0xff, Found=0x46, failed byte count from 0x00690000-0x0069ffff: 0x214c
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 3... 0x000000-0x7fffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x007fffff: 0x53e33c
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 4... 0x000000-0x7fffff:EFAILED at 0x00000010! Expected=0xff, Found=0x5a, failed byte count from 0x00000000-0x007fffff: 0x53e33c
ERASE FAILED!
Looking for another erase function.
No usable erase functions left.
FAILED!
Uh oh. Erase/write failed. Checking if anything has changed.
Reading current flash chip contents... done.
Good, writing to the flash chip apparently didn't do anything.
Please check the connections (especially those to write protection pins) between
the programmer and the flash chip. If you think the error is caused by flashrom
please report this on IRC at chat.freenode.net (channel #flashrom) or
mail , thanks!

Any suggestions appreciated. Thanks!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3813 by CygnusX1
Try writing the file back with the system booted. this has worked for me in the past.

If I helped you buy me a latte!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3814 by lily
Thanks for the super-fast reply!

So just to make sure I don't break anything: I switch my power supply off, connect MagSafe, and boot (until I see the firmware password screen); and then probe it (flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6406E/MX25L6408E -V), right? Should the status registers be set then?

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3816 by CygnusX1

lily wrote: Thanks for the super-fast reply!

So just to make sure I don't break anything: I switch my power supply off, connect MagSafe, and boot (until I see the firmware password screen); and then probe it (flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6406E/MX25L6408E -V), right? Should the status registers be set then?


The command line I use to detect the chip is:
flashrom -p linux_spi:dev=/dev/spidev0.0

To flash I use:
flashrom -w ~/efi/read1.bin -V -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E"

If I helped you buy me a latte!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3818 by reverendalc
what type of power supply are you using for your pi? probably not relevant to your problem at this point, but if you have an iPhone brick charger that will work and be one less variable in the equation.

what power state have you been trying to write your EFI in?
battery plugged, battery unplugged, magsafe in/out, etc?
have you had other successful writes with this configuration?

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3820 by lily
Thank you both! My Mac won't start with the EFI pomona clip connected. With the clip connected, the fans go off very briefly twice as soon as I plug in MagSafe, all without hitting start, and then hitting the start button will have no effect. Why is that? Board power state confusion?

Could having the Pi connected during boot interfere with the Mac reading the EFI (and thus prevent it from starting)? Should I connect the EFI while my computer is already running?


Before, I used a bench power supply (3.3V, pulled around 600 mA), because an iPad charger couldn't supply enough to keep voltage high throughout to read reliably. So with the regulated power it reads fine, but then fails to erase as described above.
For the configuration that I am trying now with MagSafe plugged in (I kept batteries disconnected), I powered my Pi with an iPad wall charger.

I disconnected pin 8 from my Pi (VCC pin) assuming that my Mac would supply power. Should I try disconnecting write protect (pin 3) or chip select (pin 1)?

If my Mac is running, will the chip status registers be set? Do they have to be?

Thank you!!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3821 by reverendalc
hmm. i use an iPhone/ipad power brick exclusively, and have never had an issue with power. how long are your leads and what gauge wire are they?

have you taken a multimeter and tested continuity between the GPIO header on the RBP and contacts on the SOIC clip?

i've never had to (or even tried) communicating with a booted up mac. i've never thought twice about it, but my RBP will reboot if it's powered on and i connect the SOIC clip to the chip.

i usually flash with battery connected, no magsafe. sometimes connecting magsafe if having issues, but again... i've never tried it while powered on.

you should have 3v3 connected to 3v3, wp, and hold.
The following user(s) said Thank You: lily

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3828 by lily
I have the 3v3 bus on the Pi connected to the VCC on the EFI chip and the battery plugged into the computer (hadn't tried that before). WP and Hold are pulled hi / connected to 3v3 as well. Here is what I found:

With the battery connected, the Pi (powered through iPad charger) flickers and won't start. Maybe the Pi can't supply enough that way. If I disconnect VCC from 3v3, my Pi's lights at least light up and I can ssh into it, but it won't detect the chip.

The leads are about 35cm at 28AWG (I bought a clip set on the internet and it came like that). I measure about 1 ohm between any of the pins on the clip and the GPIO header on the Pi. Noting that the circuit was drawing 600mA, the voltage drop may put me near the threshold of the EFI chip (2.7V).

Before cutting my wires or using my other power supply again, I've followed your advice of just connecting MagSafe while the battery is also still connected. It threw my fans on, but my Pi works now. I can have VCC connected (and WP and Hold) and it still finds the chip. Reading now. I'll report back.

I guess what I'd be curious about is how the read can work so well if there was a problem with the circuit or just not enough power. In my mind the serial communication should be the same. Anyway, we'll see. Even with MagSafe and battery both connected (and fans running), I get the un-set registers:
Command line (7 args): flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6406E/MX25L6408E -r /home/pi/dumps/read42.bin -V
Calibrating delay loop... OS timer resolution is 4 usecs, 173M loops per second, 10 myus = 10 us, 100 myus = 103 us, 1000 myus = 1323 us, 10000 myus = 10255 us, 16 myus = 19 us, OK.
Initializing linux_spi programmer
Using device /dev/spidev0.0
The following protocols are supported: SPI.
Probing for Macronix MX25L6406E/MX25L6408E, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading flash... 

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3829 by lily
Boom! It worked! Erase function 0 did the job. Yes!
Erase/write done.
Verifying flash... VERIFIED.

Thank you so much!

Now reinstalling OSX / resetting firmware password. What an adventure :)

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3830 by CygnusX1
I am glad it worked for you!!!

If I helped you buy me a latte!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3831 by reverendalc
Kudos on the success.

Don't forgot to zap the nvram!

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago - 7 years 9 months ago #3836 by lily
Thanks for the reminder about PRAM / NVRAM.

Here is what I did after and what worked for me (in case this helps anyone):
  1. Start in SU Mode (cmd+S), shut down
  2. Clear PRAM / NVRAM (cmd+opt+P+R), shut down
  3. (Started in SU Mode again and checked disks; likely unnecessary)
  4. Start in Recovery Mode (cmd+R), set new Firmware Password, feel achieved :)
  5. (Reinstalling OS X from SD card failed, so I just tried starting my old system)
  6. Set hard drive as boot device, restart

So I did not have to reinstall OS X, but just go in Recovery Mode and set a new Firmware Password.

Also, one thing I noticed in reading out my EFI so many times is that even though I got repeatable / identical reads every session, the reads differed from session to session (session meaning I reconnected things and powered my Pi back up etc.). Not sure why that is, but depending on how people reflash their EFI this may be good to know.

Moderator: Feel free to move this thread into the MBP / MBA category if you feel it's more helpful there.

Thanks everyone for helping!
Last edit: 7 years 9 months ago by lily.

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3837 by reverendalc
if this was an iCloud locked macbook, i will strongly recommend against using the existing install of OSX.

disc maker X is a free, easy to use utility for creating bootable usb install media.

i would also recommend against using the internet recovery option.

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3839 by lily
Thank you for the info!

I should mention that I was lucky not to have my MBP iCloud-locked, but just EFI-locked; so resetting my Firmware password did the job. My MBP was connected only with my own iCloud account and I had never activated Find My Mac. Is there a chance that iCloud references could hide on the system from a previous owner?

I had created a bootable medium using a terminal command and the installer. Disk Maker X would have been my next option and I had heard good things about it. Thanks for pointing it out.

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3840 by reverendalc
iCloud locks are stored partly in the OS and partly in the NVRAM. if you were the last iCloud account linked to the macbook, you've got nothing to worry about, because any pre-existing OS X install would've been linked to you.

'sall good!

Please Log in or Create an account to join the conversation.

Moderators: token.paul

Who's Online

We have 378 guests and no members online

N00BZ

  • ljamal
  • ljamal74
  • mikeg2atest
  • ducchinhbui
  • anjarezt

Cookies