Difference between revisions of "Board:lenovo/x201"

From coreboot
Jump to: navigation, search
(proprietary components status)
(Read the flash chip contents: Note meaning of "N/C")
 
(88 intermediate revisions by 8 users not shown)
Line 1: Line 1:
 +
Thanks for your interest in the Lenovo X201 port of Coreboot.
 +
 
== Status ==
 
== Status ==
* suspend to RAM (S3) currently fails.
 
  
== proprietary components status ==
+
=== Issues ===
* CPU Microcode (optional)
+
* Sometimes Gnome starts to think that battery is 10 time larger than real. Information from sysfs remains correct. Doesn't appear in newer gnome
* VGA option rom (optional): without it you will get no graphics during early boot, until the kernel initializes the intel graphic card
+
* Yellow USB port is not powered when computer is shut down or in S3.
* ME(Management Engine) => you do not have to touch it(just leave it where it is)
+
* Most times after suspend an EC IRQ hangs in the queue and all functions keys stopped working until cold boot.
* EC(Embedded Controller) =>  you do not have to touch it(just leave it where it is)
+
* '''Commit 456f495d broke USB and PCI-E''' (unable to boot from live ISO on USB), a hard reset to commit a3e41c08 fixed the boot issue, however the '''following issues occurred/persisted''':
 +
** The X201 immediately powers off after resuming from suspend, sometimes resulting in a completely lost session. This is due to a race condition; see [http://review.coreboot.org/#/c/10352/ http://review.coreboot.org/#/c/10352/].
 +
 
 +
=== Tested ===
 +
* RAM module combinations of 4G+4G, 4G, 2G+2G,4G+2G, 2G
 +
* Suspend to RAM (S3) '''(see issue mentioned above)'''
 +
* USB '''(see issues mentioned above)'''
 +
* Video (both internal and VGA)
 +
* ExpressCard slot (including hotplug)
 +
* Sound
 +
* LAN
 +
* mini-PCIe slots (both wlan and wwan)
 +
* Linux (through GRUB-as-payload & SeaBIOS-as-payload)
 +
* Windows (through GRUB-as-payload loading SeaBIOS image from disk; you have to use extracted VGA blob, dumped from memory isn't good enough)
 +
* SD card slot
 +
* Thermal management
 +
* Fingerprint reader
 +
* Webcam
 +
* Bluetooth
 +
* Digitizer on X201t variant.
 +
 
 +
=== Not tested ===
 +
* Modem
 +
 
 +
== Proprietary component status ==
 +
* CPU Microcode
 +
* VGA Option ROM (optional): you need it if you want graphics in SeaBIOS but most payloads (e.g. GRUB2) work just fine without it (text mode or corebootfb mode)
 +
* [[Intel_Management_Engine|Intel Management Engine (ME) firmware]] => you do not have to touch it (just leave it where it is)
 +
* Embedded Controller (EC) =>  you do not have to touch it (just leave it where it is)
  
 
== Code ==
 
== Code ==
* [http://review.coreboot.org/#/c/2663/ The code is here]
+
{{MergedIntoMaster|review_url=http://review.coreboot.org/#/c/4514/}}
 +
 
 
== Flashing ==
 
== Flashing ==
* you need an external programmer to flash it.
+
 
* The flash chip is divided between the ME and the BIOS:
+
=== Background info: flash layout ===
<phcoder> First 5M is ME firmware, last 3M is BIOS/coreboot
+
 
* To find exactly where it's divided run that command(the example below is on another laptop):
+
The flash memory in the X201 is divided into roughly 4 parts, readable and writable thus:
  [root@N71Jq ~]# flashrom -r bios.bin -pinternal:laptop=force_I_want_a_brick
+
 
  flashrom v0.9.6.1-r1564 on Linux 3.8.2-1-LIBRE (x86_64)
+
{| class="wikitable"
 +
!rowspan="2"|Part
 +
!rowspan="2"|Size
 +
!colspan="2"|With Flashrom on<br />the running system
 +
!colspan="2"|With Flashrom via<br />an external programmer
 +
|-
 +
! Readable
 +
! Writable
 +
! Readable
 +
! Writable
 +
|-
 +
| Descriptor
 +
| 12K
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: red;" | No
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
|-
 +
| [[Intel Management Engine|Intel Management Engine (ME) firmware]]
 +
| 5M minus 12K
 +
| style="background-color: red;" | No
 +
| style="background-color: red;" | No
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
|-
 +
| Rewriteable flash
 +
| 3M minus 96K
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
|-
 +
| Locked bootblock
 +
| 96K
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: red;" | No
 +
| style="background-color: lime;" | Yes
 +
| style="background-color: lime;" | Yes
 +
|}
 +
 
 +
To install coreboot onto the X201, we need to preserve the descriptor and the ME firmware, and to overwrite the rewriteable region and the bootblock. There are two ways to achieve this:
 +
 
 +
* External flasher.
 +
* Unlock bootblock.
 +
 
 +
=== Method 1: external flasher ===
 +
 
 +
In addition to your X201, you will need an [https://www.flashrom.org/Supported_programmers external SPI flasher supported by Flashrom], connected to a PC capable of running Flashrom.
 +
 
 +
==== Read the flash chip contents ====
 +
 
 +
Turn off your X201.
 +
 
 +
Remove the following:
 +
 
 +
* battery;
 +
* keyboard;
 +
* palmrest.
 +
 
 +
Locate the SPI chip. It should be beneath a protective plastic sheet, under where the keyboard was, at roughly the location where the trackpoint was. Next to it, you should see the label "SPI1" silk-screened in white on the motherboard.
 +
 
 +
{|
 +
|[[File:Lenovo-x201-bios-location-arrow.png |200px|thumb|center|Found it!]]
 +
|[[File:X201_flash_location.png |200px|thumb|center|Under the keyboard]]
 +
|[[File:Spi-soic8-25L6445E.png|200px|thumb|center|The SPI chip]]
 +
|}
 +
 
 +
Connect your external SPI flasher to the SPI chip, ideally using a [https://www.flashrom.org/ISP SOIC-8 clip].
 +
 
 +
The pinout is as follows. (The colors in parentheses are those used by the [https://www.flashrom.org/Bus_Pirate Bus Pirate] breakout cable; your programmer may use leads with different colors. "N/C" means "not connected": these pins should not be connected to your programmer.) The top surface of the chip should have a small dimple or a dot of paint next to pin 1.
 +
 
 +
^ Towards LCD display (i.e. away from you)
 +
|
 +
 +
    (red)        (violet) (gray)
 +
    3.3V    N/C    CLK    MOSI
 +
    _|_______|_______|_______|_
 +
  |                          |
 +
  | 8      7      6      5 |
 +
  |                          |
 +
  |                          |
 +
  | 1      2      3      4 |
 +
  |___________________________|
 +
    |      |      |      |
 +
    CS      MISO    N/C    GND
 +
  (white) (black)        (brown)
 +
 +
|
 +
v Towards front edge of laptop base (i.e. towards you)
 +
 
 +
Not all external programmers supply enough current to enable reliable reads from and writes to the flash chip. If yours does not (as is the case with the Bus Pirate and the BeagleBone Black), then you may have to use a more powerful regulated power supply to feed the chip's 3.3V pin. '''Make sure not to exceed 3.3V.'''
 +
 
 +
Read the flash chip's contents at least twice, using Flashrom. Compare the files to be sure they are identical.
 +
 
 +
flashrom -p <yourprogrammer> -r flash.bin
 +
flashrom -p <yourprogrammer> -r flash2.bin
 +
diff flash.bin flash2.bin
 +
 
 +
If you have trouble reading the chip successfully, check for an eliminate these common problems:
 +
 
 +
*insufficient power supply;
 +
*bad contacts;
 +
*excessively long wires (even 10cm may be too long);
 +
*incorrect connections.
 +
 
 +
For additional troubleshooting, see: [http://flashrom.org/ISP In-System Programming].
 +
 
 +
Once you have a good copy of the flash chip's contents, save a copy of the file to external media as a backup.
 +
 
 +
==== Neutralize the Intel Management Engine (optional) ====
 +
 
 +
As of March 2017, Coreboot builds for the X201 are [https://github.com/corna/me_cleaner/issues/3 thought to be incompatible] with neutralized MEs: MEs neutralized with <code>me_cleaner</code> seem to work fine with the stock BIOS, but not with Coreboot. Making Coreboot compatible with neutralized MEs is a [https://www.coreboot.org/pipermail/coreboot/2017-March/083798.html work in progress].
 +
 
 +
If you wish to attempt to neutralize your X201's ME anyway, see the instructions [https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html#05-neutralize-the-me here].
 +
 
 +
If you have attempted the neutralization, please report the success or failure of the attempt [https://github.com/corna/me_cleaner/issues/3 here], to help the Coreboot and <code>me_cleaner</code> developers to improve their efforts.
 +
 
 +
==== Extract descriptor and Management Engine regions ====
 +
 
 +
  dd if=flash.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/descriptor.bin \
 +
    count=12288 bs=1M iflag=count_bytes
 +
  dd if=flash.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/me.bin \
 +
    skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes
 +
 
 +
==== Compile Coreboot ====
 +
 
 +
When compiling Coreboot, remember to enable <code>HAVE_IFD</code> and <code>HAVE_ME_BIN</code>, in order to incorporate, into the resulting build, the descriptor and ME firmware that you extracted earlier. The easiest way to do this is via <code>make nconfig</code> or <code>make menuconfig</code>: the relevant options are in the "Chipset" menu.
 +
 
 +
The result will typically be a file called in the <code>build</code> directory called <code>coreboot.rom</code>.
 +
 
 +
==== Flash Coreboot to the chip ====
 +
 
 +
Flash the resulting <code>build/coreboot.rom</code> to the chip, using Flashrom.
 +
 
 +
=== Method 2: unlocking the bootblock ===
 +
 
 +
No-one has so far published any success with this method. In theory, however, it is possible.
 +
 
 +
The locking mechanism is in the bootblock itself. The original firmware has a way to update it as follows.
 +
 
 +
* Flash an update to the rewriteable region, containing a compressed copy of the new bootblock.
 +
* On next boot, the bootblock parses the rewritable region and sees that compressed copy.
 +
* That copy is uncompressed and flashed.
 +
 
 +
A way to unlock the bootblock would be to modify a firmware update to have a copy of the bootblock without protection. For this you would need to compress the modified block to fit into original space. The compression used is Lempel-Ziv- Huffman variant. [[User:Phcoder|Phcoder]] has written a compressor for it, but stated that it was not performant enough.
 +
 
 +
=== Appendix 1: how identify the regions on the chip ===
 +
 
 +
  [root@x201 ~]# flashrom -r bios.bin -pinternal:laptop=force_I_want_a_brick
 +
  flashrom v0.9.6.1-r1563 on Linux 3.10-1-grml-amd64 (x86_64)
 
  flashrom is free software, get the source code at http://www.flashrom.org
 
  flashrom is free software, get the source code at http://www.flashrom.org
 
   
 
   
 
  Calibrating delay loop... OK.
 
  Calibrating delay loop... OK.
========================================================================
+
  Found chipset "Intel QM57". Enabling flash write... WARNING: SPI Configuration Lockdown activated.
WARNING! You may be running flashrom on an unsupported laptop. We could
+
FREG0: WARNING: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
not detect this for sure because your vendor has not setup the SMBIOS
+
  FREG2: WARNING: Management Engine region (0x00003000-0x004fffff) is locked.
tables correctly. You can enforce execution by adding
+
PR0: WARNING: 0x007d0000-0x01ffffff is read-only.
'-p internal:laptop=this_is_not_a_laptop' to the command line, but
 
please read the following warning if you are not sure.
 
 
Laptops, notebooks and netbooks are difficult to support and we
 
recommend to use the vendor flashing utility. The embedded controller
 
(EC) in these machines often interacts badly with flashing.
 
See http://www.flashrom.org/Laptops for details.
 
 
If flash is shared with the EC, erase is guaranteed to brick your laptop
 
and write may brick your laptop.
 
Read and probe may irritate your EC and cause fan failure, backlight
 
failure and sudden poweroff.
 
You have been warned.
 
========================================================================
 
Proceeding anyway because user forced us to.
 
  Found chipset "Intel HM55".  
 
This chipset is marked as untested. If you are using an up-to-date version
 
of flashrom *and* were (not) able to successfully update your firmware with it,
 
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
 
Thank you!
 
Enabling flash write... FREG0: WARNING: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
 
  FREG2: WARNING: Management Engine region (0x00003000-0x001fffff) is locked.
 
 
  Please send a verbose log to flashrom@flashrom.org if this board is not listed on
 
  Please send a verbose log to flashrom@flashrom.org if this board is not listed on
 
  http://flashrom.org/Supported_hardware#Supported_mainboards yet.
 
  http://flashrom.org/Supported_hardware#Supported_mainboards yet.
Line 52: Line 209:
 
  If you force flashrom you will get no support if something breaks.
 
  If you force flashrom you will get no support if something breaks.
 
  OK.
 
  OK.
  Found SST flash chip "SST25VF032B" (4096 kB, SPI) at physical address 0xffc00000.
+
  Found Macronix flash chip "MX25L6405" (8192 kB, SPI) at physical address 0xff800000.
  Reading flash... Transaction error!
+
  Reading flash... FAILED.
Read operation failed!
+
 
FAILED.
 
 
it will print the ME regions:
 
it will print the ME regions:
  FREG2: WARNING: Management Engine region (0x00003000-0x001fffff) is locked.
+
  FREG2: WARNING: Management Engine region (0x00003000-0x004fffff) is locked.
 
it will also print the chip:
 
it will also print the chip:
  Found SST flash chip "SST25VF032B" (4096 kB, SPI) at physical address 0xffc00000.
+
  Found Macronix flash chip "MX25L6405" (8192 kB, SPI) at physical address 0xff800000.
=> verify if its voltage match with the programmer voltage...
+
'''But as in this case, flashrom might misidentify the chip''', this output is from [[Media:Spi-soic8-25L6445E.png|this MX25L6445E]]
* Then man flashrom says:
+
 
 +
visually verify your chip's part number and find an [http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/h_Index/3F21BAC2E121E17848257639003A3146/$File/MX25L6445E,%203V,%2064Mb,%20v1.8.pdf appropriate datasheet]
 +
 
 +
=>verify that its voltage matches with the programmer voltage...
 +
* Use flashrom layouts:
 
         -l, --layout <file>
 
         -l, --layout <file>
              Read ROM layout from <file>.
+
 
 +
X201 Layout
 +
000000000:00000fff fd
 +
000001000:00002fff gbe
 +
000003000:004fffff me
 +
000500000:007fffff bios
 
   
 
   
              flashrom  supports  ROM  layouts. This allows you to flash certain parts of the flash chip only. A ROM layout file contains multiple lines with the following
+
=== Appendix 2: how to flash specific regions of the chip ===
              syntax:
+
 
+
To flash only the bios partition (coreboot + payload) do:
                startaddr:endaddr imagename
+
  flashrom -l <layout> -i bios -w coreboot.rom
 
              startaddr and endaddr are hexadecimal addresses within the ROM file and do not refer to any physical address. Please note that using a 0x  prefix  for  those
 
              hexadecimal  numbers  is  not necessary, but you can't specify decimal/octal numbers.  imagename is an arbitrary name for the region/image from  startaddr to
 
              endaddr (both addresses included).
 
 
              Example:
 
 
                00000000:00008fff gfxrom
 
                00009000:0003ffff normal
 
                00040000:0007ffff fallback
 
 
              If you only want to update the image named normal in a ROM based on the layout above, run
 
 
                flashrom -p prog --layout rom.layout --image normal -w some.rom
 
 
              To update only the images named normal and fallback, run:
 
   
 
                flashrom -p prog -l rom.layout -i normal -i fallback -w some.rom
 
 
              Overlapping sections are not supported.
 

Latest revision as of 15:46, 30 March 2017

Thanks for your interest in the Lenovo X201 port of Coreboot.

Status

Issues

  • Sometimes Gnome starts to think that battery is 10 time larger than real. Information from sysfs remains correct. Doesn't appear in newer gnome
  • Yellow USB port is not powered when computer is shut down or in S3.
  • Most times after suspend an EC IRQ hangs in the queue and all functions keys stopped working until cold boot.
  • Commit 456f495d broke USB and PCI-E (unable to boot from live ISO on USB), a hard reset to commit a3e41c08 fixed the boot issue, however the following issues occurred/persisted:
    • The X201 immediately powers off after resuming from suspend, sometimes resulting in a completely lost session. This is due to a race condition; see http://review.coreboot.org/#/c/10352/.

Tested

  • RAM module combinations of 4G+4G, 4G, 2G+2G,4G+2G, 2G
  • Suspend to RAM (S3) (see issue mentioned above)
  • USB (see issues mentioned above)
  • Video (both internal and VGA)
  • ExpressCard slot (including hotplug)
  • Sound
  • LAN
  • mini-PCIe slots (both wlan and wwan)
  • Linux (through GRUB-as-payload & SeaBIOS-as-payload)
  • Windows (through GRUB-as-payload loading SeaBIOS image from disk; you have to use extracted VGA blob, dumped from memory isn't good enough)
  • SD card slot
  • Thermal management
  • Fingerprint reader
  • Webcam
  • Bluetooth
  • Digitizer on X201t variant.

Not tested

  • Modem

Proprietary component status

  • CPU Microcode
  • VGA Option ROM (optional): you need it if you want graphics in SeaBIOS but most payloads (e.g. GRUB2) work just fine without it (text mode or corebootfb mode)
  • Intel Management Engine (ME) firmware => you do not have to touch it (just leave it where it is)
  • Embedded Controller (EC) => you do not have to touch it (just leave it where it is)

Code

 $ git clone http://review.coreboot.org/p/coreboot


Flashing

Background info: flash layout

The flash memory in the X201 is divided into roughly 4 parts, readable and writable thus:

Part Size With Flashrom on
the running system
With Flashrom via
an external programmer
Readable Writable Readable Writable
Descriptor 12K Yes No Yes Yes
Intel Management Engine (ME) firmware 5M minus 12K No No Yes Yes
Rewriteable flash 3M minus 96K Yes Yes Yes Yes
Locked bootblock 96K Yes No Yes Yes

To install coreboot onto the X201, we need to preserve the descriptor and the ME firmware, and to overwrite the rewriteable region and the bootblock. There are two ways to achieve this:

  • External flasher.
  • Unlock bootblock.

Method 1: external flasher

In addition to your X201, you will need an external SPI flasher supported by Flashrom, connected to a PC capable of running Flashrom.

Read the flash chip contents

Turn off your X201.

Remove the following:

  • battery;
  • keyboard;
  • palmrest.

Locate the SPI chip. It should be beneath a protective plastic sheet, under where the keyboard was, at roughly the location where the trackpoint was. Next to it, you should see the label "SPI1" silk-screened in white on the motherboard.

Found it!
Under the keyboard
The SPI chip

Connect your external SPI flasher to the SPI chip, ideally using a SOIC-8 clip.

The pinout is as follows. (The colors in parentheses are those used by the Bus Pirate breakout cable; your programmer may use leads with different colors. "N/C" means "not connected": these pins should not be connected to your programmer.) The top surface of the chip should have a small dimple or a dot of paint next to pin 1.

^ Towards LCD display (i.e. away from you)
|

   (red)        (violet) (gray)
   3.3V    N/C     CLK    MOSI
   _|_______|_______|_______|_
  |                           |
  | 8       7       6       5 |
  |                           |
  |                           |
  | 1       2       3       4 |
  |___________________________|
    |       |       |       |
   CS      MISO    N/C     GND
  (white) (black)        (brown)

|
v Towards front edge of laptop base (i.e. towards you)

Not all external programmers supply enough current to enable reliable reads from and writes to the flash chip. If yours does not (as is the case with the Bus Pirate and the BeagleBone Black), then you may have to use a more powerful regulated power supply to feed the chip's 3.3V pin. Make sure not to exceed 3.3V.

Read the flash chip's contents at least twice, using Flashrom. Compare the files to be sure they are identical.

flashrom -p <yourprogrammer> -r flash.bin
flashrom -p <yourprogrammer> -r flash2.bin
diff flash.bin flash2.bin

If you have trouble reading the chip successfully, check for an eliminate these common problems:

  • insufficient power supply;
  • bad contacts;
  • excessively long wires (even 10cm may be too long);
  • incorrect connections.

For additional troubleshooting, see: In-System Programming.

Once you have a good copy of the flash chip's contents, save a copy of the file to external media as a backup.

Neutralize the Intel Management Engine (optional)

As of March 2017, Coreboot builds for the X201 are thought to be incompatible with neutralized MEs: MEs neutralized with me_cleaner seem to work fine with the stock BIOS, but not with Coreboot. Making Coreboot compatible with neutralized MEs is a work in progress.

If you wish to attempt to neutralize your X201's ME anyway, see the instructions here.

If you have attempted the neutralization, please report the success or failure of the attempt here, to help the Coreboot and me_cleaner developers to improve their efforts.

Extract descriptor and Management Engine regions

 dd if=flash.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/descriptor.bin \
   count=12288 bs=1M iflag=count_bytes
 dd if=flash.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/me.bin \
   skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes

Compile Coreboot

When compiling Coreboot, remember to enable HAVE_IFD and HAVE_ME_BIN, in order to incorporate, into the resulting build, the descriptor and ME firmware that you extracted earlier. The easiest way to do this is via make nconfig or make menuconfig: the relevant options are in the "Chipset" menu.

The result will typically be a file called in the build directory called coreboot.rom.

Flash Coreboot to the chip

Flash the resulting build/coreboot.rom to the chip, using Flashrom.

Method 2: unlocking the bootblock

No-one has so far published any success with this method. In theory, however, it is possible.

The locking mechanism is in the bootblock itself. The original firmware has a way to update it as follows.

  • Flash an update to the rewriteable region, containing a compressed copy of the new bootblock.
  • On next boot, the bootblock parses the rewritable region and sees that compressed copy.
  • That copy is uncompressed and flashed.

A way to unlock the bootblock would be to modify a firmware update to have a copy of the bootblock without protection. For this you would need to compress the modified block to fit into original space. The compression used is Lempel-Ziv- Huffman variant. Phcoder has written a compressor for it, but stated that it was not performant enough.

Appendix 1: how identify the regions on the chip

[root@x201 ~]# flashrom -r bios.bin -pinternal:laptop=force_I_want_a_brick
flashrom v0.9.6.1-r1563 on Linux 3.10-1-grml-amd64 (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
Found chipset "Intel QM57". Enabling flash write... WARNING: SPI Configuration Lockdown activated.
FREG0: WARNING: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG2: WARNING: Management Engine region (0x00003000-0x004fffff) is locked.
PR0: WARNING: 0x007d0000-0x01ffffff is read-only.
Please send a verbose log to flashrom@flashrom.org if this board is not listed on
http://flashrom.org/Supported_hardware#Supported_mainboards yet.
Writes have been disabled. You can enforce write support with the
ich_spi_force programmer option, but it will most likely harm your hardware!
If you force flashrom you will get no support if something breaks.
OK.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) at physical address 0xff800000.
Reading flash... FAILED.

it will print the ME regions:

FREG2: WARNING: Management Engine region (0x00003000-0x004fffff) is locked.

it will also print the chip:

Found Macronix flash chip "MX25L6405" (8192 kB, SPI) at physical address 0xff800000.

But as in this case, flashrom might misidentify the chip, this output is from this MX25L6445E

visually verify your chip's part number and find an appropriate datasheet

=>verify that its voltage matches with the programmer voltage...

  • Use flashrom layouts:
       -l, --layout <file>

X201 Layout

000000000:00000fff fd
000001000:00002fff gbe
000003000:004fffff me
000500000:007fffff bios

Appendix 2: how to flash specific regions of the chip

To flash only the bios partition (coreboot + payload) do:

flashrom -l <layout> -i bios -w coreboot.rom