System Details
- Device: [CAVE]
- OS: [Linux]
- Firmware Type: [UEFI Full ROM]
- Firmware Version: [MrChromebox-2509.4] (installing 20260125)
- Internal storage type: [eMMC]
Summary of the Issue
flashrom reports failure of write at block 0x00ccc000, after erasing. I’ll note this is only the second update to firmware beyond whatever Google did when they supported the device.
Steps to Reproduce
-
Have a previous mrchromebox UEFI full-ROM firmware for CAVE installed (in my case from Sep 2025, when I replaced the Chromebook firmware).
-
Running Ubuntu 25.10 desktop (seems unlikely to matter…)
-
Run the MrChromebox firmware install script.
-
Select Full UEFI
Expected Behavior
Success. Instead, flashrom reports a write failure with a DO NOT REBOOT/DO NOT POWEROFF warning.
Logs
mrchromebox_diag.txt
mrchromebox firmware-util diagnostic report
Sat Feb 28 14:59:22 MST 2026
[deviceDesc]
ASUS Chromebook Flip C302
[device.override]
[deviceCpuType.Name]
Intel Skylake
[fwDate]
11/30/2025
[hasUEFIoption]
true
[isUnsupported]
false
[device]
cave
[firmwareType]
Full ROM / UEFI
[_hwid]
CAVE
[lsb-release]
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=25.10
DISTRIB_CODENAME=questing
DISTRIB_DESCRIPTION=“Ubuntu 25.10”
[boardName]
CAVE
[dmidecode.device]
cave
[swWp]
disabled
[wpEnabled]
false
[fwVer]
MrChromebox-2509.4
[deviceCpuType.id]
SKL
flashrom.log
================================= 8< ----------------------------------------------------
Tail-end of flashrom.log:
…
HSFC: FGO=1, FCYCLE=0, WET=0, FDBC=63, SME=0
HSFC: FGO=1, FCYCLE=0, WET=0, FDBC=63, SME=0
HSFC: FGO=1, FCYCLE=0, WET=0, FDBC=63, SME=0
E(ccb000:ccbfff)Erasing 4096 bytes starting at 0xccc000.
HSFC: FGO=1, FCYCLE=3, WET=0, FDBC=0, SME=0
Transaction error between offset 0x00ccc000 and 0x00ccc000 (= 0x00ccc000 + 0)!
HSFS: FDONE=0, FCERR=1, AEL=0, SCIP=1, PRR34_LOCKDN=1, WRSDIS=1, FDOPSS=1, FDV=1, FLOCKDN=1
HSFC: FGO=0, FCYCLE=3, WET=0, FDBC=0, SME=0
Erase/write done from 200000 to ffffff
Write Failed!Uh oh. Erase/write failed.
Your flash chip is in an unknown state.
Get help on IRC (see Contact — flashrom v1.7.0-rc2 (git:v1.7.0-rc2-2-g47cb3011) documentation) or mail
[email protected] with the subject “FAILED: ”!-------------------------------------------------------------------------------
DO NOT REBOOT OR POWEROFF!
Reading Status register
Error: SCIP bit is unexpectedly set.
SPI Transaction Timeout due to previous operation in process!
Reading Status register failed
!!Restoring PCI config space for 00:1f:5 reg 0xdc
================================= 8< ----------------------------------------------------
Beginning of flashrom.log
flashrom MrChromebox-v1.5.0 (git:v1.5.0-5-g255f289445) on Linux 6.17.0-14-generic (x86_64)
flashrom was built with GCC 11.4.0, little endian
Command line (11 args): /tmp/flashrom -p internal:boardmismatch=force --use-first-chip --ifd -i bios -N -w coreboot_edk2-cave-mrchromebox_20260125.rom -o /tmp/flashrom.log
Initializing internal programmer
Found candidate at: 00000500-00000528
Found coreboot table at 0x00000500.
Found candidate at: 00000000-00001770
Found coreboot table at 0x00000000.
coreboot table found at 0x7aa0e000.
coreboot header(24) checksum: bcb6 table(5976) checksum: 9a15 entries: 46
Vendor ID: Google, part ID: Cave
Using Internal DMI decoder.
DMI chassis-type is not specific enough.
DMI string system-manufacturer: “Google”
DMI string system-product-name: “Cave”
DMI string system-version: “1.0”
DMI string baseboard-manufacturer: “Google”
DMI string baseboard-product-name: “Cave”
DMI string baseboard-version: “1.0”
Found chipset “Intel Skylake Y Premium” with PCI ID 8086:9d46.
This chipset is marked as untested. If you are using an up-to-date version
of flashrom and were (not) able to successfully update your firmware with it,
then please email a report to [email protected] including a verbose (-V) log.
Thank you!
Enabling flash write… Using libpci PCI_ACCESS_I386_TYPE1
BIOS_SPI_BC = 0x8b: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x0 (SPI)
Top Swap: not enabled
SPI Read Configuration: prefetching enabled, caching enabled,
BIOS_CNTL = 0x8b: BIOS Lock Enable: enabled, BIOS Write Enable: enabled
Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
SPIBAR = 0x00007d7880433000 (phys = 0xfe010000)
0x04: 0xf800 (HSFS)
HSFS: FDONE=0, FCERR=0, AEL=0, SCIP=0, PRR34_LOCKDN=1, WRSDIS=1, FDOPSS=1, FDV=1, FLOCKDN=1
SPI Configuration is locked down.
Reading OPCODES… done
OP Type Pre-OP
op[0]: 0x01, write w/o addr, none
op[1]: 0x02, write w/ addr, none
op[2]: 0x03, read w/ addr, none
op[3]: 0x05, read w/o addr, none
op[4]: 0x20, write w/ addr, none
op[5]: 0x9f, read w/o addr, none
op[6]: 0xd8, write w/ addr, none
op[7]: 0x0b, read w/ addr, none
Pre-OP 0: 0x06, Pre-OP 1: 0x50
0x06: 0x020c (HSFC)
HSFC: FGO=0, FCYCLE=6, WET=0, FDBC=2, SME=0
0x08: 0x00000001 (FADDR)
0x0c: 0x00001f00 (DLOCK)
DLOCK: BMWAG_LOCKDN=0, BMRAG_LOCKDN=0, SBMWAG_LOCKDN=0, SBMRAG_LOCKDN=0,
PR0_LOCKDN=1, PR1_LOCKDN=1, PR2_LOCKDN=1, PR3_LOCKDN=1, PR4_LOCKDN=1,
SSEQ_LOCKDN=0
0x50: 0x00004acb (FRAP)
BMWAG 0x00, BMRAG 0x00, BRWA 0x4a, BRRA 0xcb
0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
0x58: 0x0fff0200 FREG1: BIOS region (0x00200000-0x00ffffff) is read-write.
0x5C: 0x01ff0001 FREG2: Management Engine region (0x00001000-0x001fffff) is locked.
0x60: 0x00007fff FREG3: Gigabit Ethernet region is unused.
0x64: 0x00007fff FREG4: Platform Data region is unused.
0x68: 0x00007fff FREG5: Device Expansion region is unused.
0x6C: 0x00007fff FREG6: BIOS2 region is unused.
0x70: 0x00007fff FREG7: unknown region is unused.
0x74: 0x00007fff FREG8: EC/BMC region is unused.
0x78: 0x00007fff FREG9: Device Expansion 2 region is unused.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see ME (Management Engine) — flashrom v1.7.0-rc2 (git:v1.7.0-rc2-2-g47cb3011) documentation for details.
0x84: 0x00000000 (PR0 is unused)
0x88: 0x00000000 (PR1 is unused)
0x8C: 0x00000000 (PR2 is unused)
0x90: 0x00000000 (PR3 is unused)
0x94: 0x00000000 (PR4 is unused)
0x98: 0x00000000 (GPR0 is unused)
At least some flash regions are read protected. You have to use a flash
layout and include only accessible regions. For write operations, you’ll
additionally need the --noverify-all switch. See manpage for more details.
0xa0: 0x80 (SSFS)
SSFS: SCIP=0, FDONE=0, FCERR=0, AEL=0
0xa1: 0xfe0000 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=6
0xa4: 0x5006 (PREOP)
0xa6: 0xb32d (OPTYPE)
0xa8: 0x05030201 (OPMENU)
0xac: 0x0bd89f20 (OPMENU+4)
0xc4: 0xf3d82004 (LVSCC)
LVSCC: BES=0x0, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
0xc8: 0x00002000 (UVSCC)
UVSCC: BES=0x0, WG=0, WSR=0, WEWS=0, EO=0x20
Reading flash descriptors mapped by the chipset via FDOC/FDOD… done.
=== Content Section ===
FLVALSIG 0x0ff0a55a
FLMAP0 0x00040003
FLMAP1 0x42100208
FLMAP2 0x00310330
— Details —
NR (Number of Regions): 10
FRBA (Flash Region Base Address): 0x040
NC (Number of Components): 1
FCBA (Flash Component Base Address): 0x030
ISL (ICH/PCH/SoC Strap Length): 66
FISBA/FPSBA (Flash ICH/PCH/SoC Strap Base Addr): 0x100
NM (Number of Masters): 3
FMBA (Flash Master Base Address): 0x080
MSL/PSL (MCH/PROC Strap Length): 3
FMSBA (Flash MCH/PROC Strap Base Address): 0x300
=== Component Section ===
FLCOMP 0x125c00f5
FLILL 0xad604221
FLILL1 0xc7c4b9b7
— Details —
Component 1 density: 16 MB
Component 2 is not used.
Read Clock Frequency: 17 MHz
Read ID and Status Clock Freq.: 48 MHz
Write and Erase Clock Freq.: 48 MHz
Fast Read is supported.
Fast Read Clock Frequency: 48 MHz
Dual Output Fast Read Support: disabled
Invalid instruction 0: 0x21
Invalid instruction 1: 0x42
Invalid instruction 2: 0x60
Invalid instruction 3: 0xad
Invalid instruction 4: 0xb7
Invalid instruction 5: 0xb9
Invalid instruction 6: 0xc4
Invalid instruction 7: 0xc7
=== Region Section ===
FLREG0 0x00000000
FLREG1 0x0fff0200
FLREG2 0x01ff0001
FLREG3 0x00007fff
FLREG4 0x00007fff
FLREG5 0x00007fff
FLREG6 0x00007fff
FLREG7 0x00007fff
FLREG8 0x00007fff
FLREG9 0x00007fff
— Details —
Region 0 (Descr. ) 0x00000000 - 0x00000fff
Region 1 (BIOS ) 0x00200000 - 0x00ffffff
Region 2 (ME ) 0x00001000 - 0x001fffff
Region 3 (GbE ) is unused.
Region 4 (Platf. ) is unused.
Region 5 (DevExp ) is unused.
Region 6 (BIOS2 ) is unused.
Region 7 (unknown) is unused.
Region 8 (EC/BMC ) is unused.
Region 9 (unknown) is unused.
=== Master Section ===
FLMSTR1 0x00a00b00
FLMSTR2 0x00c00d00
FLMSTR3 0x00800800
— Details —
FD BIOS ME GbE Pltf DE BIOS2 Reg7 EC DE2
BIOS r rw rw
ME r rw rw
GbE rw
Enabling hardware sequencing by default for 100+ series PCH.
OK.
No board enable found matching coreboot IDs vendor=“Google”, model=“Cave”.
The following protocols are supported: Programmer-specific.
Probing for Programmer Opaque flash chip, 0 kB: Hardware sequencing reports 1 attached SPI flash chip with a density of 16384 kB.
There is only one partition containing the whole address space (0x000000 - 0xffffff).
There are 4096 erase blocks with 4096 B each.
HSFC: FGO=1, FCYCLE=6, WET=0, FDBC=2, SME=0
Chip identified: W25Q128.V
Added layout entry 00000000 - 00ffffff named complete flash
Found Winbond flash chip “W25Q128.V” (16384 kB, Programmer-specific) on internal.
Found Winbond flash chip “W25Q128.V” (16384 kB, Programmer-specific).
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Skipping writeprotect-based unlocking for read/verify operations.
Reading ich descriptor… read_flash: Flash Descriptor region (00000000..0x000fff) is readable, reading range (00000000..0x000fff).
Reading 4096 bytes starting at 0x000000.
HSFC: FGO=1, FCYCLE=0, WET=0, FDBC=63, SME=0
HSFC: FGO=1, FCYCLE=0, WET=0, FDBC=63, SME=0
…
Status
Device is powered up, has not rebooted and will remain on charger until resolved or it is time to send it to the electronics recycler.
I have reported this to flashrom via email and libera.
