Hello everybody,
I would like to request your help and advise regarding a writting/erasing issue I have on the SPI flash MX25L12835F.
I recently saw that thanks to riptidewave93 work, OpenWRT can be used on Aruba AP-105. Since I had one laying around, I decided to give it a try using the instruction page and the MX25L12835F datasheet.
I only had a Raspberry Pi 3 for communicating with SPI and according to some posts over the internet powering the SPI flash on the AP-105 board from your Rpi 3V3 pin would draw a lot of current (because of others ICs connected to the SPI flash) and is likely to destroy the RPI. So I used an old computer power-supply to power the 3V3 VCC input of the SPI flash with this wiring :
- Note : the pull-up resistor for the CS line is advised in the MX25L datasheet.
After some fixing :
- connecting to VCC some floating pins
- Specifying the SPI clock speed in flashrom (around 15 Mhz). Chip was not detected using default speed.
- connecting my oscilloscope ground cable to the circuit ground (I still don't know why the power LED of the AP-105 would not turn on without this...)
I was able to read the whole 16 Mb of the SPI flash thanks to the flashrom linux application. I did that two other times and compare the md5sum of the three images to be sure that there were no reading issue.
However, and this is the whole reason of this post (sorry for the long introduction by the way...), I am still not able to write back anything into the SPI flash. flashrom would always give me the same output :
tranxen@nas:/tmp $ flashrom -V -w To_modify.rom -p linux_spi:dev=/dev/spidev0.0,spispeed=16500 -V -c MX25L12835F/MX25L12845E/MX25L12865E
flashrom on Linux 4.19.97-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.5.2, GCC 8.2.0, little endian
Command line (8 args): flashrom -V -w To_modify.rom -p linux_spi:dev=/dev/spidev0.0,spispeed=16500 -V -c MX25L12835F/MX25L12845E/MX25L12865E
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing linux_spi programmer
Using device /dev/spidev0.0
Using 16500 kHz clock
The following protocols are supported: SPI.
Probing for Macronix MX25L12835F/MX25L12845E/MX25L12865E, 16384 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2018
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Block protection is disabled.
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:EFAILED at 0x00000000! Expected=0xff, Found=0x10, failed byte count from 0x00000000-0x00000fff: 0xfab
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 1... 0x000000-0x007fff:EFAILED at 0x00000000! Expected=0xff, Found=0x10, failed byte count from 0x00000000-0x00007fff: 0x7e01
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:EFAILED at 0x00000000! Expected=0xff, Found=0x10, failed byte count from 0x00000000-0x0000ffff: 0xfbb3
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 3... 0x000000-0xffffff:EFAILED at 0x00000000! Expected=0xff, Found=0x10, failed byte count from 0x00000000-0x00ffffff: 0x7e95f4
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 4... 0x000000-0xffffff:EFAILED at 0x00000000! Expected=0xff, Found=0x10, failed byte count from 0x00000000-0x00ffffff: 0x7e95f4
ERASE FAILED!
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 5... not defined. No usable erase functions left.
FAILED!
Uh oh. Erase/write failed. Checking if anything has changed.
Reading current flash chip contents... done.
Good, writing to the flash chip apparently didn't do anything.
Please check the connections (especially those to write protection pins) between
the programmer and the flash chip. If you think the error is caused by flashrom
please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!
Please find below the list of things that I tried to fix that without succeeding :
- Decreasing the SPI speed clock on flashrom down to 100 KHz
- Forcing the WEL bit to 1 using the SPI command WREN before writting.
- Trying to only Erase instead of Erase+Write
- Putting the WP pin to low (which gave the very same output from flashrom...).
- Forcing reset pin low and back high before attempting a new writing
- Disconnecting the external power-supply and connecting the AP-105 with its own PSU, waiting for the AR7161 CPU to stop using SPI, connect the SPI wiring from my RPI. That didn't work probably because even if the CPU was not using SPI it was still pulling SC and MOSI to Vcc so my RPI didn't manage to drive these pins at the expected voltage.
I am running out of clues and it is starting to get frustrating... I know there are a few people here (@riptidewave93 and @markbirss) that succeed in writing the u-boot into the SPI flash but I am not sure if the MX25L12835F was still on the main board while they did it.
The only hint I have is about the external power-supply that may lead to writing errors. But if it is the case why the reading did work ? I am not excluding this idea however because this person on another forum that has the exact same problem I had (but not with the very same flash) has resolved it using the board power-supply...
Additional information about my AP-105
I have the early version of the AP-105 which is lacking the reset button that you usually find on the back. Because of that I cannot stall the CPU (AR7161) to prevent it to drive the SPI pins on the SPI flash. I will check on the AR7161 datasheet, maybe there is a reset pin that I can force to low to achieve the same effect.
While using the original boot mode of the AP-105 and writing to the flash (using the saveenv Aruba bootmode command) I got the following output :
apboot> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
.done
Erased 1 sectors
Writing
apboot>
The "Un-Protected" word let me think that there could be some chunk of the memory that could be "protected" from writing. Possibily a one-time programmable memory like flashrom suggested ?
Thank you for reading and if you have any idea or feedback from past experience with that SPI Flash I would love to hear about it
Here is a picture of the whole setup if that could help.
Best regards,
Fabien