Documentation for “Zerocat Chipflasher: ‘kick2’”
Generated on: Tue, 03 Jun 2025 18:36:04 +0200
Repository: git://zerocat.org/zerocat/projects/chipflasher
Board: board-v2.0.0-1244-4270742b1
Version: v2.0.2-0-4270742b1
Branch: flashrom-interface
kick2flashrom.
Ready to fly: Chipflasher has an Interface to ‘flashrom’!
kick2,
the second firmware approach, becomes part of the main HTML
documentation.Chipflasher board v2 design sources released!
Circuit schematics of testboard v2 have been transferred and adapted for board v2, tagged as board-v2.0.0.
Follow ../../doc/board-version-history.md to stay tuned!
The chipflasher testboard circuit schematics are now tagged with testboard-v2
Results have been transferred to mainline board schematics and the chipflasher PCB file, and will be merged as a next step. Chipflasher board v2 is approaching!
New Makefile in ../../firmware2/tests/ provides test targets to ease
testing and automated reports.
The first set of test equipment has successfully been flashed, using the
testboard with kick2 and its interface to flashrom.
The testboard comes with new features, supported by kick2/flashrom:
A difficult-to-flash target ThinkPad T60 with MX25L1605D is now supported.
Improved documentation:
README.md in firmware2/doc/ updated.Improved Makefile in firmware2/doc/:
P1 starts a batch download of all documentation, design files,
webpages and application notes around the Parallax P8X32A controller.Improved Makefile in firmware2/start/:
reset updated.Improved Makefile in firmware2/src/:
config-BOARD_V1 and config-BOARD_V2 help you to configure
the firmware for the chipflasher board (board v1) or the testboard
(board v2, default).Handmade testboard in hardware/gschem/ comes with new features:
RS232_RST.Firmware kick2:
Flashrom Interface:
Vcc_SPI net is monitored per analog-digital converter
(ADC). Software Status LEDs are used to provide visual feedback to the
operator.ADC-monitor Spin object.
Thresholds for Vcc_SPI are 3310mV (sane supply), 2700mV (alert) and
2585mV (critical). In case Vcc_SPI trips below the critical threshold,
the serprog Spin object will raise a low voltage error.Some bugfixes applied.
Flashrom Interface: Improved SPI clock line driver
Flashrom Interface: TODO ships with next steps and ideas.
Flashrom Interface: README provides updated documentation about configuration options.
Flashrom Interface: Detailed SPI high frequency oscilloscope screenshots available.
Flashrom Interface: SPI speed option spispeed is now supported.
Values like 5M, 10M and 40M are accepted.
Flashrom Interface: Makefile offers baudrate configure options.
Flashrom Interface: New Spin/PASM object speeds up SPI chip access!
Object serprog-SPI-PASM.spin comes with dedicated SPI PASM routines,
optimized for fast, byte wide read and write operations. Eight bits of a
byte are transferred over the SPI bus with a clock rate of 5MHz.
Greater bitlengths are still transferred at good clock rates, such as
4MHz (read) and 3.33MHz (write).
Flashrom Interface: Related Spin/PASM objects produce pretty documentation.
Flashrom Interface
*.spin object with optimized SPI routines.*.spin object with clean RS232 routines.flashrom utility is now supported!dash, as used on Trisquel.Improve Makefiles, sort utility checks, rename macros consistently.
Crosslink documentations.
Upgrade documentation system according to: Zerocat Project Template v0.0.12
Finalize the firmware review.
Based on tests and experiences made with kick2, firmware kick
has greatly been improved and even advanced beyond kick2’s
capabilities.
However, firmware kick2 is a fully operational alternative to
firmware kick. It is coded in Spin/PASM and offers plenty of
available RAM to ease development of new features. In contrast to
kick, access to lockbits and Macronix’ SOTP regions is not yet
implemented.
Chip readouts better match generated files by srec_cat,
such that diff -y can be used to verify data, manually.
See ../../firmware2/doc/TODO.md.
Compiler warning for connect has been fixed.
Error detection within connect has been fixed.
The documentation system has been updated according to: Zerocat Project Template v0.0.9
Manifest files carry guix channel information.
File ../../firmware2/doc/TODO.md has been updated.
Firmware kick2 allows to select the type of End-of-Write-Cycle detection
(WIP check), e.g.: polling (default) or timeout
This eases chip erase and chip write options on Lenovo T530 and W530 laptop targets.
Chip erase and write options are now implemented.
Some minor bugs have been fixed.
Firmware kick2 comes with improved status report, configuration options
and more menu options for the connect utility.
The field of read operations should now be complete, using real chip data. Results are fine, but execution speed is slow.
The field of write/erase operations is missing only one, last entry.
The documentation is build via simple Makefile, using Zerocat Project Template rather than Doxygen.
File ../../firmware2/doc/TODO.md has been updated with some next tasks.
File ../../firmware2/util/manifest.scm has been renamed to
../../firmware2/guix/manifest.scm.
Interface configuration has been put under user’s control, via
make -C ../../firmware2/src/ <config-target>. Per default, the kick2
firmware has no interface enabled, just the bare program skeleton will be
compiled and documented.
Firmware kick2 now comes with improved read operations for the connect
utility, however still using fake data. File ../../firmware2/doc/TODO.md
lists related things that should be addressed next.
kick2 now displays the correct project number.guix environment --pure is now supported by two manifest
files, ../../host/util/manifest.scm and
../../firmware2/util/manifest.scm. However, SRecord Program Collection
still needs to be compiled manually.../../firmware2/doc/Software-Bill-of-Material.md is now part of the
documentation.../../firmware2/start/Makefile now offers a reset target, which can
be used to quit the serprog object and to restart the device.Branch ‘flashrom-interface’ is dedicated to enrich the chipflasher with an interface for the widely used flashrom utility.
Flashrom carries its own protocol specification for devices attached to the
serial port of your computer. See Documentation/serprog-protocol.txt within
the flashrom source tree for detailed information.
Coding the interface goes along with the chipflasher’s firmware review. This
work is done on branch firmware2-wip, and – as a side effect – will offer
results on branches flashrom-interface and firmware1-wip as well.
The final results will merge into branch master.
The Chipflasher’s second firmware kick2 has been enriched by an interface
to the flashrom utility. The device benefits from flashrom’s huge chip
database, as well as from its automated read-erase-write-verify cycles.
However, maintaining the menu interface for the project’s own connect
utility still makes sense, as flashrom does not provide means to deal with
important chip registers. A common use case for the interface to connect is
the setup of Hardware Write Protection Mode, available on chips with
static register bits.
The firmware review process is done by transforming the original
firmware written in C, into Spin code. Spin code is loaded into
controller’s RAM, and then interpreted by one cog who is running the
on-chip Spin Interpreter. As a result, the controller’s RAM is used in
an efficient way, but execution speed is slow. In order to speed up
important loops, parts of the Spin code will be replaced by PASM code
later on, which is then executed by additional cogs fromout their
faster cog-RAM. As a proof of concept, this has been done for Spin
objects txline_HEXD and txline_SREC. In the end, the overall
execution speed will hopefully reach that of the fast PASM code
compiled from C sources.
Coding in Spin/PASM gives us some main benefits:
Requirements are frugal:
Chipflasher
PC or Laptop
/dev/ttyS0 or alike, for dataAll paths within this document are relative in respect to the original
location of this source file, which is located in the project’s
firmware2/doc/ folder, e.g.: ../../firmware2/doc/
This is additional software and documentation.
It is assumed, that you have started with the project’s main README
file ../../doc/README.md to learn how to set up requirements and
how to generate the project’s root documentation
../../doc/index.html. Your current directory is ../../doc/.
Now change into this project’s second documentation folder
../../firmware2/doc/:
[env]$ cd ../firmware2/doc/
This project comes with its own host utility called connect, which is
supported via the menu Spin/PASM object:
Interface to `connect`, coded in Spin/PASM
The flashrom utility comes with its own protocol specification, made for
external flasher devices attached to the serial port of your computer. See
Documentation/serprog-protocol.txt within the flashrom source tree. This
protocol is supported via serprog Spin/PASM object.
In case flashrom and connect are not available, you might still initiate
the interface to a propeller terminal and use it with a terminal on the
host side. However, features are heavily stripped, you cannot do something
real. Again, use the menu Spin/PASM object.
The kick2 top object might be configured to run one of the following
interfaces:
Connect (Default)
Interface Setup
[env]$ make -C ../../firmware2/src config-connect
Interface Configuration
RS232 Baudrate
You can try RS232 baudrates, different to the default value of 115200:
[env]$ make -C ../../firmware2/src config-baud57600
or
[env]$ make -C ../../firmware2/src config-baud38400
Flashrom
Interface Setup
[env]$ make -C ../../firmware2/src config-flashrom
Interface Configuration
PCB board v1, e.g. Chipflasher board-edition-1
DIP Switch Nº | Function | Default Value
------------------|---------------------------------------------------------------------------
Not Applicable | SPI Clock Driver Strength | 50%
Not Applicable | SPI Mode 0 or 3 | Mode 3
Not Applicable | RS232 Baudrate | 115200
Not Applicable | SPI Power Suspend | allow
Not Applicable | SPI Power-up Pulse Type | repetitive
PCB board v2, e.g. Chipflasher v2
DIP Switch Nº | Function | o = open, x = closed
------------------|---------------------------------------------------------------------------
DIP Switch 1..2 | SPI Clock Driver Strength | oo = 25%, xo = 50%, ox = 75%, xx = 100%
DIP Switch 3 | SPI Mode 0 or 3 | o = Mode 3, x = Mode 0
DIP Switch 4 | RS232 Baudrate | o = 115200, x = 57600
DIP Switch 5 | SPI Power Suspend | o = allow, x = inhibit
DIP Switch 6 | SPI Power-up Pulse Type | o = single, x = repetitive
Default settings or settings provided via DIP Switches can be
overridden via ../../firmware2/src/Makefile:
SPI Clock Driver
The strength of the SPI clock driver is set to 25%, 50%, 75% or 100%. A setting of 50% should work fine in conjunction with clock speeds up to 40MHz while avoiding voltage over- and undershots on the clock line.
However, you can try diminuished power in order to mitigate voltage over- and undershots even more, e.g.:
[env]$ make -C ../../firmware2/src config-SPI_CLOCK25
This setting should be combined with a slower clock speed, such like 5MHz. Otherwise communication might fail.
In case the default strength setting fails on your target board, try increased strengths as an alternate option:
[env]$ make -C ../../firmware2/src config-SPI_CLOCK75
or
[env]$ make -C ../../firmware2/src config-SPI_CLOCK100
Bare in mind that voltage over- and undershots on the clock line might violate the allowed, maximal voltage of the SPI flash chip. According to measurements on a ThinkPad X230 target board, shots stay below 4V and above -0.6V, thus should still be acceptible for flash chips that provide integrated protection.
SPI Clocking Mode
The interface to flashrom will talk to SPI devices in SPI Mode 0 or
You might set SPI modes explicitly, like so:
[env]$ make -C ../../firmware2/src config-SPI_MODE0
or
[env]$ make -C ../../firmware2/src config-SPI_MODE3
RS232 Baudrate
You can try RS232 baudrates, different to the default value of 115200:
[env]$ make -C ../../firmware2/src config-RS232_BAUD57600
or
[env]$ make -C ../../firmware2/src config-RS232_BAUD38400
SPI Power Suspend
The interface to flashrom suspends SPI power if low voltage is detected, thus giving the voltage regulator some time to recover. You can allow or inhibit this measure explicitly, like so:
[env]$ make -C ../../firmware2/src config-SUSPEND_ALLOW
or
[env]$ make -C ../../firmware2/src config-SUSPEND_INHIBIT
Suspend should be inhibited for chips with volatile register bits. Sane operation of the Vcc_SPI voltage regulator is then handed over to the PCB’s heatsink, which might fail after a while. Flashrom’s write procedure always uses a chip read procedure, twice, what makes the SPI access time sum up.
SPI Power-up Pulse Type
The interface to flashrom uses a single or repetitive pulse to power-up the SPI bus. You can set the pulse type explicitly, like so:
[env]$ make -C ../../firmware2/src config-PWRUP_ONCE
or
[env]$ make -C ../../firmware2/src config-PWRUP_REPETITIVE
Propeller Terminal
Interface Setup
[env]$ make -C ../../firmware2/src config-propterm
No Interface
Interface Setup
[env]$ make -C ../../firmware2/src config-nointerface
[env]$ make -C ../../firmware2/src kick2
You can get an overview of targets with:
[env]$ make -C ../../firmware2/src help
To see basic start options, type:
[env]$ make -C ../../firmware2/start help
To test the interface to connect, type:
[env]$ make -C ../../firmware2/start kick2-ram-connect
Testing the interface to flashrom can be done with target flashrom,
which has been added as a proof of concept: Synchronization, initialization
and probing do work fine:
[env]$ make -C ../../firmware2/start kick2-ram
[env]$ make -C ../../firmware2/start flashrom
See section #../../firmware2/doc/flashrom-invocation-examples.md if
interested in using the flashrom utility, directly.
To test the interface to propeller-terminal with a terminal, type:
[env]$ make -C ../../firmware2/start kick2-ram-terminal
We are happy to announce that the current Spin/PASM code is able to deal with
an RS232 baudrate of 115200, e.g.: commit ID ed42cddb
Inrushing page bytes, send by flashrom, are stored in an intermediate buffer, which is then safely processed while high speed action on the RS232 lines is not required.
Filling the buffer is done at 115200baud, processing the buffer for write operations on the SPI flash chip is done at 18360Hz (Mode 0).
SPI read operations are not buffered, but processed directly, byte per byte. Sending a byte over the RS232 line is again done at 115200baud. However, processing the bytes of a sector (4096 bytes) is done at 9570Hz (Mode 0):
Read operation at 115200baud (2V/100µs per div)
The Spin/PASM code has been tuned to be as fast as possible. Three code snippets are provided here, as these give some extra boost:
Snippet #1(3), see serprog.spin
'store 3 + inlen bytes in buffer
n := 3 + inlen
REPEAT WHILE n--
'For 115200baud on RS232, we need to be fast here!
'Function pccom.rxtime is too slow and cannot be used!
<<<<<<< fast code
BYTE[@spiopbuf][n] := pccom.rx
=======
BYTE[@spiopbuf][n] := pccom.rxtime(RX_TIMEOUT)
>>>>>>> slow code
Snippet #2(3), see serprog.spin
$03: 'JEDEC_READ
pccom.tx(S_ACK)
SPI.chip_enable
SPI.out(freq, $03, 1 << 7, FID_write)
SPI.out(freq, addr, 1 << 23, FID_write)
<<<<<<< fast code
REPEAT outlen
pccom.tx(SPI.in(freq, 8, $ff, FID_read))
=======
REPEAT outlen
v := SPI.in(freq, 8, $ff, FID_read)
pccom.tx(v)
>>>>>>> slow code
SPI.chip_disable
Snippet #3(3), see serprog-SPI-PASM.spin
<<<<<<< fast code
LONGMOVE(@stack, @freq, 4)
=======
stack[0] := freq
stack[1] := bitlength
stack[2] := bitmask
stack[3] := fid
>>>>>>> slow code
REPEAT UNTIL (stack[3] == FUNCID__READY)
Using Mode 0 and an SPI speed of up to 40MHz, flashrom takes 34 minutes
and 25 seconds to fill a 4M chip with random data, erase and verify
already included:
date && \
flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M \
-V \
-c "MX25L3205D/MX25L3208D" \
-w 4M-rand.bin \
&& date
The same operation, using Mode 3 and an SPI speed of 5MHz yields to the same result – no significant difference in time! Ooops?
The same operation using Mode 0, an SPI speed of 40MHz, and just $00 bytes,
again brings the same time. Hmm. How comes??
Constant SP_NREAD is set to sector size, that is 4096 bytes. If we run a
test with SP_NREAD = $400000, the flash procedure with an SPI speed of up
to 40MHz is about 14 seconds faster. However, if we set the SPI speed to just
5MHz, the time improvement persists. Hmm.
It looks as if the SPI speed has no impact on the overall execution time of
flashrom. That is not what would have been expected.
However, a slower baudrate for the RS232 connection does have an impact. The invocation snippet as shown above, but with baudrate set to 38400, takes 1 hour, 27 minutes and 26 seconds.
SPI clock speed development is done with the RYF-certified Chipflasher “board-edition-1”, driven by a Zerocat T60, targeting a modified ThinkPad X230 with SPI flash connector. Code execution is montitored via oscilloscope:
SPI Clock Speed Development Setup
808341ea)The serprog-SPI.spin object offers optimized SPI bus routines, coded in
slow Spin. Byte transfer speed is 2.2kHz, clock speed is estimated to 25kHz:
SPI Byte Transfer Speed (read access) of Spin Code (1V/50µs per div)
SPI Clock Speed (8bit read access) of Spin Code (1V/5µs per div)
f8919500)Optimized PASM routines provide much higher clock rates. Object
serprog-SPI-PASM.spin achieves a clock rate of 5MHz (8bit read/write),
4MHz (24bit read) and 3.33MHz (24bit write). If using RS232 with 57600baud
(default), the Spin code processes bytes with 5.2KHz.
SPI Clock Speed (8bit read access) of PASM Code (1V/50ns per div)
Code snippet, as executed above:
:read8
...
...
...
or OUTA, mask_SCLK
andn OUTA, mask_SCLK
'bit 6
test mask_MISO, INA wc
rcl value, #1
or OUTA, mask_SCLK
andn OUTA, mask_SCLK
'bit 5
test mask_MISO, INA wc
rcl value, #1
or OUTA, mask_SCLK
andn OUTA, mask_SCLK
'bit 4
...
...
SPI Byte Transfer Speed (read access) of PASM Code (1V/200ns per div)
Byte Process Speed (read access) at 57600baud with SPI PASM Code (1V/20µs per div)
d59dad40)Object serprog-SPI-PASM.spin achieves even higher clock rates by using free
wheeling counters in the background. If the code stays in sync with counter
pin outputs, it is freed from generating the pulses itself. That technique
allows us to clock data bytes with 10MHz. Values like $00 and $ff do not
require to toggle bit values and can be clocked with up to 80MHz. However,
that frequency turned out to be too high for the device under test, that is
why 40MHz is used instead.
The PASM code supports the spispeed option of the serprog protocol. Three values give you control about the SPI clock frequency according to the following table:
spispeed | 8bit read | 8bit write | 24bit read | 24bit write | clock driver
==========|===============|==================|=================|=================|=================
5M | 5MHz | 5MHz | 4MHz | 3.33MHz | full power
----------|---------------|------------------|-----------------|-----------------|-----------------
10M | 5MHz | $00, $ff: 10MHz | 4MHz | 3.33MHz | full power
| | $01..$fe: 5MHz | | |
----------|---------------|------------------|-----------------|-----------------|-----------------
40M | 10MHz | $00, $ff: 40MHz | 4MHz | 3.33MHz | half power
| | $01..$fe: 10MHz | | |
You can pass the spispeed value via command line, e.g.:
flashrom -p serprog:dev=tty_port_pointer:57600,spispeed=40M
If you don't specify the SPI speed initially, a default value of 10M will be used. However, once specified, the speed value is not reset if not provided on the command line.
Mode 0: 8bit read with 10MHz clock (2V/200ns per div)
Mode 0: 8bit write with 10MHz clock (2V/200ns per div)
Mode 0: Switching to 8bit write ($00, $ff) with 40MHz clock (2V/200ns per div)
Mode 0: in Detail: 8bit write ($00, $ff) with 40MHz clock (1V/50ns per div)
Mode 3: 8bit read/write with 10MHz clock (2V/200ns per div)
Mode 3: in Detail: 8bit read/write with 10MHz clock (1V/100ns per div)
Mode 3: 8bit write ($00, $ff) with 40MHz clock (2V/200ns per div)
Mode 3: in Detail: 8bit write ($00, $ff) with 40MHz clock (1V/50ns per div)
65ca231d)Object serprog-SPI-PASM.spin launches up to four new cogs to run the PASM
code of serprog-SPI-PASM-Pulse.spin. Each new cog uses its counter
modules to drive a clock pin. The cogs are synchronized via external trigger
pin, and parallel trains of eight pulses each are emitted with very little
overhead.
This technique allows us to drive the SPI clock pin of the attached flash chip with full capabilities of the Chipflasher PCB, using a frequency as high as 40MHz. On the other hand, it allows driver strength configuration and mitigation of voltage over- and undershots on the clock line by using a smaller number of cogs. See example screenshots with ThinkPad X230 under test:
Mode 0: SPI clock pulse quality @ 5MHz, driver set to 100% (1V/100ns per div)
Mode 0: SPI clock pulse quality @ 5MHz, driver set to 75% (1V/100ns per div)
Mode 0: SPI clock pulse quality @ 5MHz, driver set to 50% (1V/100ns per div)
Mode 0: SPI clock pulse quality @ 5MHz, driver set to 25% (1V/100ns per div)
The PASM code supports the spispeed option of the serprog protocol according to the following, updated table:
spispeed | 8bit read | 8bit write | 24bit read | 24bit write | SPI clock driver strength
==========|===============|==================|=================|=================|==============================
=< 5M | 5MHz | 5MHz | 4MHz | 3.33MHz | 100%, 75%, 50%, 25%, 0%
----------|---------------|------------------|-----------------|-----------------|------------------------------
=< 10M | 10MHz | 10MHz | 4MHz | 3.33MHz | 100%, 75%, 50%, 25%, 0%
----------|---------------|------------------|-----------------|-----------------|------------------------------
> 10M | 10MHz | $01..$fe: 10MHz | 4MHz | 3.33MHz | 100%, 75%, 50%, 25%, 0%
| | $00, $ff: 40MHz | | |
You can pass the spispeed value via command line, e.g.:
flashrom -p serprog:dev=/dev/ttyS0:57600,spispeed=40M
If you don't specify the SPI speed initially, a default value of 10M will be used. However, once specified, the speed value is not reset if not provided on the command line.
The waveforms for SPI Mode 0 and 3 have changed. In case of Mode 0, the high frequency pulse train is greatly improved. In case of Mode 3, one negative pulse is enlarged by two cycles due to synchronization requirements.
Mode 0: SPI clock pulse train @ 10MHz, driver set to 50% (1V/100ns per div)
Mode 0: SPI clock pulse train @ 40MHz, driver set to 50%, WIP polling @ 10MHz (1V/100ns per div)
Mode 3: SPI clock pulse train @ 10MHz, driver set to 50% (1V/100ns per div)
Mode 3: SPI clock pulse train @ 40MHz, driver set to 50%, WIP polling @ 10MHz (1V/100ns per div)
In order to provide a low frequency in case it is needed for old devices, the code has been adapted according to the following table:
spispeed | 8bit read | 8bit write | 24bit read | 24bit write | SPI clock driver strength
=============|===============|==================|=================|=================|=============================
| __ | __ | __ | __ |
=< 3333333 | 3.33MHz | 3.33MHz | 3.33MHz | 3.33MHz | 100%, 75%, 50%, 25%
-------------|---------------|------------------|-----------------|-----------------|-----------------------------
| | | __ | __ |
=< 5M | 5MHz | 5MHz | 3.33MHz | 3.33MHz | 100%, 75%, 50%, 25%
-------------|---------------|------------------|-----------------|-----------------|-----------------------------
| | | __ | __ |
=< 10M | 10MHz | 10MHz | 3.33MHz | 3.33MHz | 100%, 75%, 50%, 25%
-------------|---------------|------------------|-----------------|-----------------|-----------------------------
| | | __ | __ |
> 10M | 10MHz | $01..$fe: 10MHz | 3.33MHz | 3.33MHz | 100%, 75%, 50%, 25%
| | $00, $ff: 40MHz | | |
While working on the kick2 Spin/PASM code, these things should be
fixed, soon:
interface to flashrom
interface to connect
The hexadecimal dump lines generated by kick2 differ from output
generated by srec_cat in respect to spaces preceeding the line feed
character. The firmware writes spaces, but srec_cat does not. Data
bytes however, do not differ.
Use sed -r -e 's/[ ]*$//;' -i chip2file.txt to adjust the firmware’s
file for direct comparison via diff -y.
Do we need a verify routine for erase options?
Very occasionally, the connect utility fails to put all characters
send by kick2 onto screen, what results in an erroneous display of menu
options and dialogues. Boot your host with radio devices disabled, that
frees up resources and should help.
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)"
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (7 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C)
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
No operations were specified.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -r test.bin
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (9 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -r test.bin
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Reading flash... done.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -E
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (8 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -E
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:E, 0x001000-0x001fff:E, 0x002000-0x002fff:E, 0x003000-0x003fff:E, 0x004000-0x004fff:E, 0x005000-0x005fff:E, 0x006000-0x006fff:E, 0x007000-0x007fff:E, 0x008000-0x008fff:E, 0x009000-0x009fff:E, 0x00a000-0x00afff:E, 0x00b000-0x00bfff:E, 0x00c000-0x00cfff:E, 0x00d000-0x00dfff:E, 0x00e000-0x00efff:E, 0x00f000-0x00ffff:E
Erase/write done.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -w test.bin
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (9 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -w test.bin
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:W, 0x001000-0x001fff:W, 0x002000-0x002fff:S, 0x003000-0x003fff:W, 0x004000-0x004fff:W, 0x005000-0x005fff:W, 0x006000-0x006fff:S, 0x007000-0x007fff:S, 0x008000-0x008fff:W, 0x009000-0x009fff:W, 0x00a000-0x00afff:W, 0x00b000-0x00bfff:W, 0x00c000-0x00cfff:W, 0x00d000-0x00dfff:W, 0x00e000-0x00efff:W, 0x00f000-0x00ffff:W
Erase/write done.
Verifying flash... VERIFIED.
serprog: Output drivers disabled
nano -E layout-64K.txt
cat layout-64K.txt
-------------------------------
00000000:00000fff s00
00001000:00001fff s01
00002000:00002fff s02
00003000:00003fff s03
00004000:00004fff s04
00005000:00005fff s05
00006000:00006fff s06
00007000:00007fff s07
00008000:00008fff s08
00009000:00009fff s09
0000a000:0000afff s0a
0000b000:0000bfff s0b
0000c000:0000cfff s0c
0000d000:0000dfff s0d
0000e000:0000efff s0e
0000f000:0000ffff s0f
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -l layout-64K.txt -i s0c -E
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (12 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -l layout-64K.txt -i s0c -E
romlayout 00000000 - 00000fff named s00
romlayout 00001000 - 00001fff named s01
romlayout 00002000 - 00002fff named s02
romlayout 00003000 - 00003fff named s03
romlayout 00004000 - 00004fff named s04
romlayout 00005000 - 00005fff named s05
romlayout 00006000 - 00006fff named s06
romlayout 00007000 - 00007fff named s07
romlayout 00008000 - 00008fff named s08
romlayout 00009000 - 00009fff named s09
romlayout 0000a000 - 0000afff named s0a
romlayout 0000b000 - 0000bfff named s0b
romlayout 0000c000 - 0000cfff named s0c
romlayout 0000d000 - 0000dfff named s0d
romlayout 0000e000 - 0000efff named s0e
romlayout 0000f000 - 0000ffff named s0f
Using region: "s0c".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Erasing and writing flash chip... Trying erase function 0... 0x00c000-0x00cfff:E
Erase/write done.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -l layout-64K.txt -i s0c -w testrom-00064K.bin
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (13 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -l layout-64K.txt -i s0c -w testrom-00064K.bin
romlayout 00000000 - 00000fff named s00
romlayout 00001000 - 00001fff named s01
romlayout 00002000 - 00002fff named s02
romlayout 00003000 - 00003fff named s03
romlayout 00004000 - 00004fff named s04
romlayout 00005000 - 00005fff named s05
romlayout 00006000 - 00006fff named s06
romlayout 00007000 - 00007fff named s07
romlayout 00008000 - 00008fff named s08
romlayout 00009000 - 00009fff named s09
romlayout 0000a000 - 0000afff named s0a
romlayout 0000b000 - 0000bfff named s0b
romlayout 0000c000 - 0000cfff named s0c
romlayout 0000d000 - 0000dfff named s0d
romlayout 0000e000 - 0000efff named s0e
romlayout 0000f000 - 0000ffff named s0f
Using region: "s0c".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x00c000-0x00cfff:W
Erase/write done.
Verifying flash... VERIFIED.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c "MX25L512(E)/MX25V512(C)" -l layout-64K.txt -i s0c -v testrom-00064K.bin
-----------------------------------------------------------------------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (13 args): flashrom -p serprog:dev=tty_port_pointer:38400 -V -o flashrom.log -c MX25L512(E)/MX25V512(C) -l layout-64K.txt -i s0c -v testrom-00064K.bin
romlayout 00000000 - 00000fff named s00
romlayout 00001000 - 00001fff named s01
romlayout 00002000 - 00002fff named s02
romlayout 00003000 - 00003fff named s03
romlayout 00004000 - 00004fff named s04
romlayout 00005000 - 00005fff named s05
romlayout 00006000 - 00006fff named s06
romlayout 00007000 - 00007fff named s07
romlayout 00008000 - 00008fff named s08
romlayout 00009000 - 00009fff named s09
romlayout 0000a000 - 0000afff named s0a
romlayout 0000b000 - 0000bfff named s0b
romlayout 0000c000 - 0000cfff named s0c
romlayout 0000d000 - 0000dfff named s0d
romlayout 0000e000 - 0000efff named s0e
romlayout 0000f000 - 0000ffff named s0f
Using region: "s0c".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L512(E)/MX25V512(C), 64 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2010
Found Macronix flash chip "MX25L512(E)/MX25V512(C)" (64 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Verifying flash... VERIFIED.
serprog: Output drivers disabled
The test equipment of Set 1 and Set 2 has been flashed successfully, using the testboard testboard-v2 with a corebooted ThinkPad T60 (64bit CPU) with GNU Guix System and an Ultra Base Docking Station. Failures are listed in Set 3.
Devices are tested via Makefile:
[env]$ make -C ../../firmware2/tests test-fakeROM
Attention! If interested in using this test, create backups beforehand!! The test itself proceeds even if flashrom fails in between.
The resulting PCB board-v2.0.0 has been proved to work fine with some key equipment, listed in section Testing PCB “board-v2.0.0”.
Testing Chipflasher v2 with target T60 + MX25L1605D
Test Equipment, Set 1: two laptops, three systemboards
DIP Switch 3 has changed polarity: open = Mode 3, closed = Mode 0
Systemboard ThinkPad X60-32bit + Macronix MX25L1605D/MX25L1608D/MX25L1673E
Laptop ThinkPad X230 + Macronix MX25L6406E/MX25L6408E + Macronix MX25L3206E/MX25L3208E
Laptop ThinkPad T60 + Macronix MX25L1605D/MX25L1608D/MX25L1673E
Test Equipment, Set 2: three laptops, five systemboards, one discrete chip
DIP Switch 5 has changed to specify SPI Power-up Timing
Systemboard Gigabyte GA-G41M-ES2L + 2x Macronix MX25L8005
Systemboard ThinkPad X200 + Winbond W25X64
The test succeeded, but status register is always set to 0x80 instead
of 0x00, thus Status Register Protect Bit in effect. As no block
protection bits are set, no need to reset this bit. The bit can be
set/cleared by means of kick/connect or kick2/connect.
Systemboard ThinkPad X60-32bit + SST SST25VF016B
kick2/flashrom: Probe and Read works fine, but Erase and Write fail.
According to flashrom output, block protection bits are set at startup,
but cannot be cleared. Why that??
However, this systemboard/chip is fully supported by kick/connect or
kick2/connect.
Laptop ThinkPad T60 + SST SST25VF016B
kick2/flashrom: Probe and Read should work fine, but Erase and Write
fail. The T60 takes too much power, VCC_SPI does not reach full level,
power cycles do not take volatile nature of chip register into account.
However, this laptop/chip can still be flashed with kick/connect or
kick2/connect.
Laptop ThinkPad T60 + Atmel AT26DF161
kick2/flashrom: Probe and Read seems to work fine, but Erase and Write
fail. The T60 takes too much power, VCC_SPI does not reach full level,
power cycles do not take volatile nature of chip register into account.
However, this laptop/chip can still be flashed with kick/connect or
kick2/connect.
Laptop HP ProBook 455G4 + Winbond W25Q128.V
This laptop boots up with vendor firmware. Probe fails with both,
kick2/flashrom and kick2/connect. In order to verify that the chip is
not damaged, it is desoldered and tested as a discrete part, see Set 2.
DIP Switch 5 changes functionality. It is now designed to support SPI chips with volatile registers.
Systemboard Gigabyte GA-G41M-ES2L + 2x Macronix MX25L8005
This chip is accessed on a ThinkPad T60 motherboard.
The chip has previously been flashed, verified and erased successfully by
means of the connect interface. Thus, the following flashrom invocation
acts on an already erased sector.
Clock driver strength has been set to 50%:
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (10 args): flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M -V -c AT26DF161 -l ../firmware2/start/layout-16K.txt -is03 -w t60_atmel.s03.bin
romlayout 00000000 - 00000fff named s00
romlayout 00001000 - 00001fff named s01
romlayout 00002000 - 00002fff named s02
romlayout 00003000 - 00003fff named s03
romlayout 00004000 - 00004fff named s04
romlayout 00005000 - 00005fff named s05
romlayout 00006000 - 00006fff named s06
romlayout 00007000 - 00007fff named s07
romlayout 00008000 - 00008fff named s08
romlayout 00009000 - 00009fff named s09
romlayout 0000a000 - 0000afff named s0a
romlayout 0000b000 - 0000bfff named s0b
romlayout 0000c000 - 0000cfff named s0c
romlayout 0000d000 - 0000dfff named s0d
romlayout 0000e000 - 0000efff named s0e
romlayout 0000f000 - 0000ffff named s0f
Using region: "s03".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Requested to set SPI clock frequency to 40000000 Hz. It was actually set to 40000000 Hz
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Atmel AT26DF161, 2048 kB: probe_spi_rdid_generic: id1 0x1f, id2 0x4600
Found Atmel flash chip "AT26DF161" (2048 kB, SPI) on serprog.
Chip status register is 0x1c.
Chip status register: Sector Protection Register Lock (SRPL) is not set
Chip status register: Bit 6 is not set
Chip status register: Erase/Program Error (EPE) is not set
Chip status register: WP# pin (WPP) is not asserted
Chip status register: Software Protection Status (SWP): all sectors are protected
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Some block protection in effect, disabling... disabled.
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x003000-0x003fff:W
Erase/write done.
Verifying flash... FAILED at 0x001623a2! Expected=0xbd, Found=0x5e, failed byte count from 0x00000000-0x001fffff: 0xc50
Your flash chip is in an unknown state.
Please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!
serprog: Output drivers disabled
This chip is accessed as a discrete component.
It is typically found on ThinkPads X60 and T60.
The chip has previously been flashed, verified and erased successfully by
means of the connect interface. Thus, the following flashrom invocation
acts on an already erased chip, clock driver strength set to 25%. Same
results with chip in situ on ThinkPad T60, clock driver strenght set to 50%:
flashrom v1.2 on Linux 5.18.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (9 args): flashrom -p serprog:dev=/dev/ttyS0:115200,spispeed=40M -V -c SST25VF016B -w 2M-rand.bin
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Requested to set SPI clock frequency to 40000000 Hz. It was actually set to 40000000 Hz
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for SST SST25VF016B, 2048 kB: probe_spi_rdid_generic: id1 0xbf, id2 0x2541
Found SST flash chip "SST25VF016B" (2048 kB, SPI) on serprog.
Chip status register is 0x1c.
Chip status register: Block Protect Write Disable (BPL) is not set
Chip status register: Auto Address Increment Programming (AAI) is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is set
Chip status register: Block Protect 1 (BP1) is set
Chip status register: Block Protect 0 (BP0) is set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Resulting block protection : all
Some block protection in effect, disabling... disabled.
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:Wspi_write_cmd failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 1... 0x000000-0x007fff:Wspi_write_cmd failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:Wspi_write_cmd failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 3... 0x000000-0x1fffff:Wspi_write_cmd failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 4... 0x000000-0x1fffff:Wspi_write_cmd failed during command execution at address 0x0
Reading current flash chip contents... done. Looking for another erase function.
Trying erase function 5... not defined. Looking for another erase function.
Trying erase function 6... not defined. Looking for another erase function.
Trying erase function 7... not defined. No usable erase functions left.
FAILED!
Uh oh. Erase/write failed. Checking if anything has changed.
Reading current flash chip contents... done.
Good, writing to the flash chip apparently didn't do anything.
Please check the connections (especially those to write protection pins) between
the programmer and the flash chip. If you think the error is caused by flashrom
please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!
serprog: Output drivers disabled
Instead of using the Makefile, feel free to operate the chipflasher with the
flashrom utility. Here are some invocation examples as executed in
../../firmware2/start/. These examples are using an RS232 rate of
57600baud, which used to be the default setting.
flashrom -p serprog:dev=tty_port_pointer:57600
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -V
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (5 args): flashrom -p serprog:dev=tty_port_pointer:57600 -c MX25L6405D -V
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L6405D, 8192 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2017
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
No operations were specified.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -r chip1.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
Reading flash... done.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -v chip1.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
Verifying flash... VERIFIED.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -E
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
Erasing and writing flash chip... Erase/write done.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L6405D" -w chip1.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on serprog.
Reading old flash chip contents... done.
Erasing and writing flash chip...
Erase/write done.
Verifying flash... VERIFIED.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -V
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
flashrom was built with libpci 3.7.0, GCC 7.5.0, little endian
Command line (5 args): flashrom -p serprog:dev=tty_port_pointer:57600 -c MX25L3205D/MX25L3208D -V
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing serprog programmer
serprog: connected - attempting to synchronize
.
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
serprog: Maximum write-n length is 256
serprog: Maximum read-n length is 4096
serprog: Programmer name is "Zerocat!"
serprog: Serial buffer size is 16
serprog: operation buffer size is 300
serprog: Output drivers enabled
The following protocols are supported: SPI.
Probing for Macronix MX25L3205D/MX25L3208D, 4096 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2016
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
No operations were specified.
serprog: Output drivers disabled
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -r chip2.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
Reading flash... done.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -v chip2.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
Verifying flash... VERIFIED.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -E
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
Erasing and writing flash chip... Erase/write done.
flashrom -p serprog:dev=tty_port_pointer:57600 -c "MX25L3205D/MX25L3208D" -w chip2.bin
---------------------------------------------------------------------------------------------
flashrom v1.2 on Linux 5.17.14-gnu (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
serprog: Programmer name is "Zerocat!"
Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on serprog.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.
Serprog control codes with prefix SCMDO_ should be split into two sections in respect to usage of the operational buffer, e.g.:
Buffered Operations:
S_CMD_O_INIT = $0B ' Initialize operation buffer
S_CMD_O_WRITEB = $0C ' Write opbuf: Write byte with address
S_CMD_O_WRITEN = $0D ' Write to opbuf: Write-N
S_CMD_O_DELAY = $0E ' Write opbuf: udelay
S_CMD_O_EXEC = $0F ' Execute operation buffer
Unbuffered Operations:
S_CMD_O_SPIOP = $13 ' Perform SPI operation.
Control codes that are executed as part of SCMDO_SPIOP should be named differently:
S_CMD_R_BYTE = $09 ' Read a single byte
S_CMD_R_NBYTES = $0A ' Read n bytes
Simple toplevel codes are easier to implement, they do not use the operational buffer and they are not executed as part of SCMDO_SPIOP:
S_CMD_SYNCNOP = $10 ' Special no-operation that returns NAK+ACK
S_CMD_Q_IFACE = $01 ' Query interface version
S_CMD_Q_CMDMAP = $02 ' Query supported commands bitmap
S_CMD_Q_PGMNAME = $03 ' Query programmer name
S_CMD_Q_SERBUF = $04 ' Query Serial Buffer Size
S_CMD_Q_BUSTYPE = $05 ' Query supported bustypes
S_CMD_Q_CHIPSIZE = $06 ' Query supported chipsize (2^n format)
S_CMD_Q_OPBUF = $07 ' Query operation buffer size
S_CMD_Q_WRNMAXLEN = $08 ' Query Write to opbuf: Write-N maximum length
S_CMD_Q_RDNMAXLEN = $11 ' Query read-n maximum length
S_CMD_S_BUSTYPE = $12 ' Set used bustype(s).
S_CMD_S_SPI_FREQ = $14 ' Set SPI clock frequency
S_CMD_S_PIN_STATE = $15 ' Enable/disable output drivers
Where to put this control code? Is it executed as part of SCMDO_SPIOP?? Shall the chip be selected or not??
S_CMD_NOP = $00 ' No operation
Which JEDEC SPI Commands are going to be used by SCMDO_SPIOP?
Successfully tried so far:
JEDEC_RDSR
JEDEC_READN
JEDEC_BE4K ($20)
JEDEC_BE64K ($d8)
Which code flags are honoured??
Flags of ...
S_CMD_O_WRITEB = $0C ' Write opbuf: Write byte with address
S_CMD_O_WRITEN = $0D ' Write to opbuf: Write-
do not seem to be checked.
The more difficult part to code is chip write. Unfortunately, flashrom-serprog reads the entire chip to get prepared for write processes, which takes a lot of time. There should be an option to disable that. It would speed up testing iterations.
Buffered Write N is not used, probably. Instead write is processed as SCMDOSPIOP. Addresses are incremented in page steps. Our SIZENWRITE is not big enough for that. We are not fast enough to process that many incoming data with Spin code, at least not with 115200baud.
Messages:
“Initializing serprog programmer” should be “Initializing serprog programmer.”
“serprog: connected - attempting to synchronize” should be “serprog: Connected - attempting to synchronize...”
“serprog: Synchronized” should be “serprog: Synchronized.”
“serprog: operation buffer size is 300” should be “serprog: Operational buffer size is: 300 bytes”
“serprog: Maximum write-n length is 256” should be “serprog: Maximal write-n length is: 256”
“serprog: Maximum read-n length is 4096” should be “serprog: Maximal read-n length is: 4096”
“serprog: Programmer name is "Zerocat Flasher"” should be “serprog: Name of programmmer is: "Zerocat Flasher"”
“serprog: Serial buffer size is 16” should be “serprog: Serial buffer size is: 16 bytes”
“serprog: Output drivers enabled” should be “serprog: Output drivers enabled.”
“Reading old flash chip contents...” should be “Reading flash chip’s old content...”
“Reading current flash chip contents...” should be “Reading flash chip’s current content...”
“spiwritecmd failed during command execution at address 0x0” should be “Function spiwritecmd failed during command execution at address 0x0.”
The message should start in a new line of its own.
“FAILED at 0x00001000!” should start in a new line of its own, same like “Erase/write done.” does.
“serprog: Output drivers disabled” should be “serprog: Output drivers disabled.”
“Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set” should end with a period.
“Chip status register: Bit x is not set” should end with a period.
“Chip status register: Block Protect x (BPx) is not set” should end with a period.
“Chip status register: Write Enable Latch (WEL) is not set” should end with a period.
“Chip status register: Write In Progress (WIP/BUSY) is not set” should end with a period.
“Using region: "b00".” should not end with a period.
Adress bytes are sent to the device in big endian format. This contradicts the Serial Flasher Protocol Specification - version 1:
“All multibyte values are little-endian. Addresses and lengths are 24-bit.”
Our code has been adopted in serprog.spin, accordingly.
However, as a result, our claim to support protocol version 1 is
false, isn’t it??
Hardware Design Sources are licensed under CERN Open Hardware Licence Version 2 – Strongly Reciprocal, or any later version.
See CERN-OHL-S v2 User Guide to get guidelines on how to use these hardware designs for your own projects.
The Zerocat Chipflasher aims to be free-design as much as possible, that’s why it relies on the Parallax Propeller 1 microcontroller. In 2014, the chip design files of this controller have been released under the GPLv3, by Parallax.
Testboard, handmade
These switches are intended to simulate the otherwise hardwired board version configuration.
DIP Switch A, B¹ | Board Version
------------------|-----------------
on, on | V1
open, on | V2²
on, open | V3
open, open | V4
¹ On PCB board-edition-1, this switch input is tristate, but will
hopefully be read as low level.
² Default for this testboard and its new features.
Upon startup of kick2, the board version is displayed by the number of a
grouped light-up on software status LEDS D1 through D3.
The DIP Switch Block is intended for runtime configuration of the device and its firmware.
Testboard, DIP Switch for runtime configuration
kick2 Configuration Table DIP Switch Nº | Function | o = open, x = closed
------------------|---------------------------------------------------------------------------
DIP Switch 1..2 | SPI Clock Driver Strength | oo = 25%, xo = 50%, ox = 75%, xx = 100%
DIP Switch 3 | SPI Mode 0 or 3 | o = Mode 3, x = Mode 0
DIP Switch 4 | RS232 Baudrate | o = 115200, x = 57600
DIP Switch 5 | SPI Power Suspend | o = allow, x = inhibit
DIP Switch 6 | SPI Power-up Pulse Type | o = single, x = repetitive
DIP Switch Nº | Clock Driver | Remarks
1 | 2 | Strength |
-----------------------------------|-----------------------
open | open | 25% | discrete chips
on | open | 50% | many systemboards
open | on | 75% | ThinkPad X200, X200t
on | on | 100% | ThinkPad T500
On board version v1, the strength defaults to 50%.
Use Makefile in firmware2/src to configure explicitly.
DIP Switch 3 | SPI Mode
--------------------------------------------
open | 3
on | 0
On board version v1, the SPI mode defaults to Mode 3.
Use Makefile in firmware2/src to configure explicitly.
SPI Clocking Mode 0 is not as robust as Mode 3 regarding noise pick-up. It requires a shielded clock wire, grounded at one side:
Shielded clock wire, grounded at one side. Mandatory for Mode 0.
DIP Switch 4 | RS232 Baudrate
--------------------------------------------
open | 115200
on | 57600
On board version v1, the baudrate defaults to 115200.
Use Makefile in firmware2/src to configure explicitly.
This DIP switch instructs the firmware to suspend SPI power if considered useful, or to keep it powered. On board version v1, suspend is allowed.
DIP Switch 5 | SPI Power Suspend
--------------------------------------------
open | allow
on | inhibit
DIP Switch 6 | SPI Power-up Pulse Type
--------------------------------------------
open | one-shot
on | repetitive
On board version v1, the pulse type defaults to repetitive.
Use Makefile in firmware2/src to configure explicitly.
C22=100nF | Vcc_SPI after Single Power-up Pulse on ThinkPad T60/Macronix (500mV/1ms per div)
C22=100nF | Vcc_SPI after Repetitive Power-up Pulse on ThinkPad T60/SST (500mV/1ms per div)
To make the power-up ramp a smooth curve, capacitor C22 has been increased from 100nF to 1000µF. Capacitor C1 being a 10µF Tantalum placed across pins 2 and 3 of U5 avoids flickering of SPI LED D7 during shutdown. However, the requirement to trigger Q1 repetitively to elevate the voltage on T60/SST persists.
PNP MOSFET Q1, powering the SPI bus.
The voltage monitor on net Vcc_SPI uses a semaphoric flag system:
Normal job execution is indicated with LED D1 switched on.
Once the voltage drops below 2700mV, the alert flag is rised and indicated on LED D2. Power is withdrawn in order to give the overcharged voltage regulator some time to recover. This state is indicated on LED3 with SPI Bus LED switched off.
Once the voltage recovers back to 3250mV, the good flag is rised, power is applied back again, LED D3 is switched off, SPI Bus Led is switched on, and the normal job execution in resumed.
However, once the voltage drops below the critical level of 2350mV, the critical flag is rised and the device stops, indicating the Low Voltage Error on LED D2.
Testboard, ADC Section monitoring the Vcc_SPI net, Top View
Testboard, ADC Section monitoring the Vcc_SPI net, Bottom View
This new feature has successfully been tested on several targeted ThinkPad T60 models:
ThinkPad T60 with MX25L1605D
successful probe, read, erase, write
ThinkPad T60 with AT26DF161
successful probe, read, erase
Chip write on AT26DF161 might not be supported by flashrom?
ThinkPad T60 with SST25VF016B and repetitive power-on pulse
successful probe, read, erase
Chip write on SST25VF016B might not be supported by flashrom?
On other ThinkPad targets, this feature might not come into action due to persistent, good voltage levels.
Discrete test chips help to understand effects that are introduced by systemboards.
Several test chips, discrete
The front label comes with an extra, blank field, intended for your notices.
Testboard Front Label
Front Label
Acrylic Glass Front Plate (4mm, 100×170mm)
Hexagon Distances, Discs and Screws
Experimental Through-Hole Board 100×160mm with Components
../../hardware/gschem/testboard-page01.bom.html
../../hardware/gschem/testboard-page02.bom.html
../../hardware/gschem/testboard-page03.bom.html
../../hardware/gschem/testboard-page04.bom.html
../../hardware/gschem/testboard-page05.bom.html
../../hardware/gschem/testboard-page06.bom.html
../../hardware/gschem/testboard-page07.bom.html
../../hardware/gschem/testboard-page08.bom.html
../../hardware/gschem/testboard-page09.bom.html
../../hardware/gschem/testboard-page10.bom.html
Cables and Test Chips
../../hardware/gschem/testboard-page11.bom.html
../../hardware/gschem/testboard-page12.bom.html
../../hardware/gschem/testboard-page13.bom.html
../../hardware/gschem/testboard-page14.bom.html
../../hardware/gschem/testboard-page15.bom.html
Test Clip SOIC8
Test Clip SOIC16
Test Socket DIL8
Front Label, Scalable Vector Graphic, created with Inkscape
Circuit Schematics, created with gEDA/gschem
../../hardware/gschem/testboard-page01.sch
../../hardware/gschem/testboard-page02.sch
../../hardware/gschem/testboard-page03.sch
../../hardware/gschem/testboard-page04.sch
../../hardware/gschem/testboard-page05.sch
../../hardware/gschem/testboard-page06.sch
../../hardware/gschem/testboard-page07.sch
../../hardware/gschem/testboard-page08.sch
../../hardware/gschem/testboard-page09.sch
../../hardware/gschem/testboard-page10.sch
../../hardware/gschem/testboard-page11.sch
../../hardware/gschem/testboard-page12.sch
../../hardware/gschem/testboard-page13.sch
../../hardware/gschem/testboard-page14.sch
../../hardware/gschem/testboard-page15.sch
PDFs, generated from source files via ../../hardware/Makefile:
../../hardware/artwork/testboard-label.svg.pdf
../../hardware/gschem/testboard-page01.sch.pdf
../../hardware/gschem/testboard-page02.sch.pdf
../../hardware/gschem/testboard-page03.sch.pdf
../../hardware/gschem/testboard-page04.sch.pdf
../../hardware/gschem/testboard-page05.sch.pdf
../../hardware/gschem/testboard-page06.sch.pdf
../../hardware/gschem/testboard-page07.sch.pdf
../../hardware/gschem/testboard-page08.sch.pdf
../../hardware/gschem/testboard-page09.sch.pdf
../../hardware/gschem/testboard-page10.sch.pdf
../../hardware/gschem/testboard-page11.sch.pdf
../../hardware/gschem/testboard-page12.sch.pdf
../../hardware/gschem/testboard-page13.sch.pdf
../../hardware/gschem/testboard-page14.sch.pdf
../../hardware/gschem/testboard-page15.sch.pdf
Testboard Circuit Schematic, Page 1(15): Controller with Reset Circuit
Testboard Circuit Schematic, Page 2(15): Power Input with Sense
Testboard Circuit Schematic, Page 3(15): Power Switch and Voltage Regulators
Testboard Circuit Schematic, Page 4(15): SPI Bus
Testboard Circuit Schematic, Page 5(15): Software Status LEDs
Testboard Circuit Schematic, Page 6(15): RS232 Circuit #0
Testboard Circuit Schematic, Page 7(15): RS232 Circuit #1
Testboard Circuit Schematic, Page 8(15): RS232 Circuit Selector
Testboard Circuit Schematic, Page 9(15): Serial EEPROM of a non-free Design, optional.
Testboard Circuit Schematic, Page 10(15): Sigma-delta ADC Circuit
Testboard Circuit Schematic, Page 11(15): RS232 Cable
Testboard Circuit Schematic, Page 12(15): USB Power-only Y-Cable
Testboard Circuit Schematic, Page 13(15): Test Clip Connectors
Testboard Circuit Schematic, Page 14(15): SOIC8 Test Chip of a non-free Design
Testboard Circuit Schematic, Page 15(15): SOIC16 Test Chip of a non-free Design
