Add in place programmer's flashing "best practices" and refer to ch341a rev 1.6+ / Tigard

[tlaurion]

There is a lot of information out there on ch341a programmer giving too much voltage (5v vs 3.3v). Users reports of having bricked their laptops (SPI chip to motherboards resistors).

One of those example is a recent exchange on slack/matrix accessible at:
https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$kcFoywTcHgKLIbRP3iJ1bgJ8vRUGZsZcCGvvJsCszgw?via=matrix.org&via=nitro.chat&via=talk.puri.sm

xx20/xx30 chips and motherboard resistors are really resilient and cheap ch341a providing 5v never caused any issue, but this may vary for other SPI chips/motherboard when doing in place programming (with a PAMONA clip connected to the chip on the motherboard.)

General guidelines, depending on motherboard is:

1. Make sure that CMOS, AC Adapter and battery is deconnected.
2. Make sure to connect the clip on CHIP prior of powering up the programmer (I never followed that even with black programmer and bricked 2 laptops to date because I didn't respect point 1 above.
3. Other guides suggest to modify ch341 programmer to make sure voltage provided is 3.3v (https://www.chucknemeth.com/laptop/lenovo-x230/flash-lenovo-x230-coreboot being one of them)
4. Other guides suggest unsoldering/resoldering the SPI for extra caution (never did that)
5. More expensive programmer (LC Technologies ch341a programmers) were suggested (good general advice)

I would invite people into discussing facts here to be used to create additional flashing best practice page to the wiki.

[tlaurion]

The general guideline is to make sure that the wiring is conform to chip SPI datasheet (this is a standard generally used by a chip family. Here for xx20/xx30 and SOIC8 chips), making sure that orientation of the chip is good is mandatory. On SPI chips, there is a "dot" which inform the eye that that pin is pin 1:

1- CS / CS#
2- SO1-SIO1 / MISO
3- WP# / N/C
4- GND
5- SI-SIO0 / MOSI
6- SCLK / CLK
7- HOLD# / N/C
8- VCC

For example, those two guides inversed the picture with similar pin names:

• Datasheet : http://j5d2v7d7.stackpathcdn.com/wp-content/uploads/circuits/Macronix/25L3206E-DI1.gif
• Direct link to chucknemeth's picture

[tlaurion]

All of this should just replace ch341a by ch341a rev 1.6+ based boards which has output voltage selector (5v, 3.3v, 2.5v, 1.8v).

The ch341a v1.6/v1.7 is easily distinguishable from past versions by the voltage switch and additional components put on board, green color of board and smaller size compared to black one:

Green arrow shows easily distinguishable component not present on 1.1/1.2... 1.5 boards revisions.

One can see the differences between old (black, non versioned ch341a) and green clearly stating v1.7:

When flipping v 1.6+ board upside down, one can see on the board the voltage selection switch slots:

Example of readily available kits including proper pictures for visual identification of 1.6 board containing a voltage selector and the same components being easily distinguishable prior of buying:

https://shop.3mdeb.com/shop/modules/ch341a-flash-bios-usb-programmer-kit-soic8-sop8/

Floahazz 1 Metal Ch341A Programmer V1.7 1.8V Level Shift W25Q64Fw W25Q128Fw Gd25Lq64 Parts https://a.co/d/5hr2I5x

[tlaurion]

1- CS / CS#
2- SO1-SIO1 / MISO
3- WP# / N/C
4- GND
5- SI-SIO0 / MOSI
6- SCLK / CLK
7- HOLD# / N/C
8- VCC

Attacking the w530 today. Clip that came with kit doesn't fit constrained place, needed to rewire my pamona clip with wires that came with my raspberries across the years. They are 10 colors coded, that will help me and probably others replicating.

SPI Chip	Pomona Clip	Adapter Board	CH341A Programmer
Pin 1 (dot)	Pin 1 (red dot)	VCC (red)	25XX (red stripe)
Pin 2	Pin 2	GND (black)	GND (black)
Pin 3	Pin 3	CS (yellow)	CS (yellow)
Pin 4	Pin 4	CLK (orange)	CLK (orange)
Pin 5	Pin 5	DO (blue)	DO (blue)
Pin 6	Pin 6	DI (purple)	DI (purple)
Pin 7	Pin 7 (brown)	VCC or GND (brown)	NC
Pin 8	Pin 8 (white)	VCC or GND (white)	NC

Then.
1- Connect sopi6/8-dip8 daughter board on ziff connector, making sure the adapter is connected into the closest holes to you when looking at the adapt from the usb connector


2- Then do the wiring pattern above. Looks like that when done:

Will definitely glue all those together with Epoxy they slide way too easily, but that works!
Got my 8mb backup from w530. Now going to make external flashing image that can be flashed only on that exposed 8mb chip which is linuxboot/heads#1189 to the flash whole maximized image internally.

[tlaurion]

That question popped again under Matrix channel https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$Y5a44cDMjH-CO96sfpn7ZCHeHkBDrsBjPEatp3mbcLE?via=matrix.org&via=nitro.chat&via=envs.net

[tlaurion]

Concerns raised again at https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$n56mqz2A0ZCWP1HrqVBkRL1IGKOfqJmsGqTvI8kNP-g?via=matrix.org&via=nitro.chat&via=envs.net

[tlaurion]

To be honest, I think this thread and concerns from end users are mixing two different use cases:

Unbricking / initial flashing/non-development related dev cycles / initial external flashing was made from well testers and platform I well tested

There I actually no need here to anything better/faster /safer then a ch341a even at 5v for most older platforms (thinkpads) if all external power sources are disconnected.

dev cycles / debugging /porting of new platforms / multiple flashing a day is needed / newcomers to coreboot and external flashing / insecure end users

There are way better options then ch341a, different prices ranges, different features across reprogrammers, including some development helper kits (Tigard best of line here) that also provide logic analyser), permits to turn programmer into a coreboot usb debugging helper (through serial over usb) which is possible through beaglebone black and Tigard. So the reason this is not yet in docs is because, depending of goals and needs, there are multiple tools out there.

perplexity.ai discussion (made public) : https://www.perplexity.ai/search/Of-all-in-nfyU4c8tQp2.2GONIONnyA

Extract of markdown table:

Programmer	Cost	Theoretical Speed (16MB)	Voltage Selection	Flashrom Support	Additional Use for Debugging
DediProg SF600Plus-G2	$500-$600	16 seconds	Multiple	Not mentioned	No
DediProg SF100	$200-$300	22 seconds	Multiple	Not mentioned	No
CH341A	$5-$15	480 seconds (8 minutes)	3.3V (mod needed)	Yes	No
Raspberry Pi	$35-$80	16 seconds	3.3V (additional hardware needed for other voltages)	Yes	No
BeagleBone Black	$60-$90	16 seconds	3.3V, some pins 1.8V	Yes	Yes
REVELPROG-IS	$150-$200	16 seconds	Not specified	Not mentioned	No
Tigard	$69-$89	16 seconds	1.8V, 3.3V, 5.0V, external target voltage	Yes	Yes

[tlaurion]

Will buy a Tigard and test across platforms I own. For some reason,s people don't want to commust ordered one ent on github and stay stubborn having sporadic and non permanent/searchable notes given on Heads matrix channel. Point against Tigard at https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$WDHLHatL2aVLFCxTK3EX9PUAo8t18yx-eufPSCHdQPk?via=matrix.org&via=nitro.chat&via=envs.net

EDIT: if Tigard testing is good:

• faster flash speed (1mb/s) promises met
• logic analysis promises met (maybe order later, will see)
• USB debugging dongle promise met
  • maybe even switch usb debugging on all heads coreboot config so that when a brick occurs, logs would give insights to devels here. Would be awesome capability here, to some costs of privacy which might require some scripts provided to anonimize logs prior of submitting, will see.

---

Then revise promotion of ch341a v1.6+ to tigard/beaglebone black.

Just ordered a Tigard from https://www.crowdsupply.com/securinghw/tigard for 67$USD (to ship to Canada, prices will vary), which is not bad and a nice project giving money to someone that devotes himself changing things for the better here

[tlaurion]

Ideally, we would be able to propose a refreshed version for the beaglebone black screwdriver so that bricking could give input from testers through EHCI debugging logs, based and improved upon
https://www.coreboot.org/BeagleBone_Black_-_screwdriver

Or a cheaper alternative, providing both flashrom and usb EHCI debug support, ideally permitting to grab the logs, take micro ssd card/launch command on host and be able to upload those logs in a bug report.

[tlaurion]

Just experienced a n41 bad rom flash from linuxboot/heads@b05fbf6

Points:

• Tigard : 0
• ch341a : 1

Tigard, while faster with default settings, was constantly failing on flashrom verify step, and didn't seem to even check if what was attempted to be written was actually written while verify failed at different addresses.

Flashing with ch341a, while slower, successfully unbricked my nv41 with master rom.

Some pictures.... Scary setup. No I'm not zen enough to stay immobile for more then 8 minutes at a time with frustrating failing attempts.

• vice grip, battery pack for weight, sitting on top of nv41 fan for safety, ch341a + wson probe
  
• time took to read+erase+write+verify (varies depending of what needs to be written on chip from what was read: diffs applied by flashrom) :
  

Edit: flashrom loop command added from history: retry until successful. No power source connected (no ac, no battery, no cmos).

[tlaurion]

Undusted my beaglebone black, but discovered screwdriver is an unmaintained project :(

https://www.coreboot.org/BeagleBone_Black_-_screwdriver

unmaintainted project : https://github.com/lynxis/bbb_screwdriver_builder

---

Discussions:

• Discussion with the developer (@lynxis) at https://matrix.to/#/!EhaGFZyYcbyhdSgStq:matrix.org/$qNQ-6PHpv_j4h3mZ6i6WRbvzorACuALvgfJ3h-gi9H0?via=matrix.org&via=sibnsk.net&via=nope.chat

• @mkc has some ideas https://matrix.to/#/!rsKWMJGPMsyPTTjXuh:matrix.org/$XEHtBtSn__StlD1h__1Io83HsVqli7TNO7-FDaw7IhU?via=matrix.org&via=nitro.chat&via=hackliberty.org

[tlaurion]

Tigard: 1
ch341a: 1

Externally flashed x230t to test linuxboot/heads#1541 and linuxboot/heads#1744 in one rock two stones test. Tigard is way faster then ch341a:

user@localhost:~/heads$ time sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -w /home/user/heads/build/x86/x230-maximized/heads-x230-maximized-v0.2.0-2283-g7147a60
heads-x230-maximized-v0.2.0-2283-g7147a60-bottom.rom  heads-x230-maximized-v0.2.0-2283-g7147a60-top.rom     
heads-x230-maximized-v0.2.0-2283-g7147a60.rom         heads-x230-maximized-v0.2.0-2283-g7147a60.zip         
user@localhost:~/heads$ time sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -w /home/user/heads/build/x86/x230-maximized/heads-x230-maximized-v0.2.0-2283-g7147a60-top.rom 
flashrom unknown on Linux 6.6.42-1.qubes.fc37.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L3205(A)" (4096 kB, SPI) on ft2232_spi.
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on ft2232_spi.
Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on ft2232_spi.
Found Macronix flash chip "MX25L3233F/MX25L3273E" (4096 kB, SPI) on ft2232_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L3205(A)", "MX25L3205D/MX25L3208D", "MX25L3206E/MX25L3208E", "MX25L3233F/MX25L3273E"
Please specify which chip definition to use with the -c <chipname> option.

real	0m0.156s
user	0m0.005s
sys	0m0.009s
user@localhost:~/heads$ time sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -w /home/user/heads/build/x86/x230-maximized/heads-x230-maximized-v0.2.0-2283-g7147a60-top.rom -c "MX25L3205D/MX25L3208D"
flashrom unknown on Linux 6.6.42-1.qubes.fc37.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on ft2232_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

real	0m6.858s
user	0m0.003s
sys	0m0.006s

[tlaurion]

• Tigard : 2
• Ch341a: 1

time sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -w  heads-nitropad-nv41-v0.2.0-2285-geb88b18.rom

flashrom unknown on Linux 6.6.21-1.qubes.fc37.x86_64 (x86_64)

flashrom is free software, get the source code at https://flashrom.org


Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).

Found Macronix flash chip "MX25L25635F/MX25L25645G" (32768 kB, SPI) on ft2232_spi.

===

This flash part has status UNTESTED for operations: WP

The test status of this chip may have been updated in the latest development

version of flashrom. If you are running the latest development version,

please email a report to [email protected] if any of the above operations

work correctly for you with this flash chip. Please include the flashrom log

file for all operations you tested (see the man page for details), and mention

which mainboard or programmer you tested in the subject line.

Thanks for your help!

Reading old flash chip contents... done.

Erasing and writing flash chip... Erase/write done.

Verifying flash... VERIFIED.


real    2m37.587s

user    0m0.007s

sys    0m0.006s

[tlaurion]

Tigard: 3
ch341a: 1

1. Recovering brick on the v560TU showed ch341a 1.6 struggle with erase functions in 1.8v, looping and looping forever without success, each attempt taking more than 8m each (32M SPI chip there)

• false; while [ $? != 0 ]; do time sudo flashrom/build/flashrom -V -p ch341a_spi -w /home/user/v560TU_14th_gen_backup.rom; done

1. Recovering brick with tigard failed in 1.8v, had to switch voltage regulator to 3.3v, flashing succeeded

• false; while [ $? != 0 ]; do time sudo flashrom/build/flashrom -V -p ch341a_spi -w /home/user/v560TU_14th_gen_backup.rom; done

Note that I bought myself a nice improvement for otherwise problematic WSON8, a nice probe providing a guider that gently secure the pins to be aligned to the spi chip prior of pushing it down and applying weight to keep it in place.

Note that as opposed to the ch341a wich would require you to stay still for 16 minutes (read, write with lots of change + verify that written content fits what is on spi), tigard is really quick and would require you to stay still for around 2 minutes.

As of today, I would recommend Tigard to anyone, and guide should probably keep away of too much technical details.

• AC adapter+ Disconnect CMOS + Disconnect battery

• Put programmer on chip, secure it in place connecting probe/clip

• Put voltage selector to 1.8v

• run flashprog/flashrom -r in a loop, assign programmer to qube if needed

• If the chip size dectected is of size 0, increase voltage to 3.3v, it it succeed detection let it be, otherwise put back voltage to 1.8v and redo this until this step succeeds.

• check with hexdump that backup image contains data

• run flashrom in a loop to verify backup against spi chip.

• run flashrom in a loop to write image to spi chip.

• Image of the WSO8 probe with guider:
  

• Bough from: https://www.amazon.ca/dp/B0DJ8XTCKD