cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

spi-intel.rst (3227B)


      1==============================
      2Upgrading BIOS using spi-intel
      3==============================
      4
      5Many Intel CPUs like Baytrail and Braswell include SPI serial flash host
      6controller which is used to hold BIOS and other platform specific data.
      7Since contents of the SPI serial flash is crucial for machine to function,
      8it is typically protected by different hardware protection mechanisms to
      9avoid accidental (or on purpose) overwrite of the content.
     10
     11Not all manufacturers protect the SPI serial flash, mainly because it
     12allows upgrading the BIOS image directly from an OS.
     13
     14The spi-intel driver makes it possible to read and write the SPI serial
     15flash, if certain protection bits are not set and locked. If it finds
     16any of them set, the whole MTD device is made read-only to prevent
     17partial overwrites. By default the driver exposes SPI serial flash
     18contents as read-only but it can be changed from kernel command line,
     19passing "spi_intel.writeable=1".
     20
     21Please keep in mind that overwriting the BIOS image on SPI serial flash
     22might render the machine unbootable and requires special equipment like
     23Dediprog to revive. You have been warned!
     24
     25Below are the steps how to upgrade MinnowBoard MAX BIOS directly from
     26Linux.
     27
     28 1) Download and extract the latest Minnowboard MAX BIOS SPI image
     29    [1]. At the time writing this the latest image is v92.
     30
     31 2) Install mtd-utils package [2]. We need this in order to erase the SPI
     32    serial flash. Distros like Debian and Fedora have this prepackaged with
     33    name "mtd-utils".
     34
     35 3) Add "spi_intel.writeable=1" to the kernel command line and reboot
     36    the board (you can also reload the driver passing "writeable=1" as
     37    module parameter to modprobe).
     38
     39 4) Once the board is up and running again, find the right MTD partition
     40    (it is named as "BIOS")::
     41
     42	# cat /proc/mtd
     43	dev:    size   erasesize  name
     44	mtd0: 00800000 00001000 "BIOS"
     45
     46    So here it will be /dev/mtd0 but it may vary.
     47
     48 5) Make backup of the existing image first::
     49
     50	# dd if=/dev/mtd0ro of=bios.bak
     51	16384+0 records in
     52	16384+0 records out
     53	8388608 bytes (8.4 MB) copied, 10.0269 s, 837 kB/s
     54
     55 6) Verify the backup::
     56
     57	# sha1sum /dev/mtd0ro bios.bak
     58	fdbb011920572ca6c991377c4b418a0502668b73  /dev/mtd0ro
     59	fdbb011920572ca6c991377c4b418a0502668b73  bios.bak
     60
     61    The SHA1 sums must match. Otherwise do not continue any further!
     62
     63 7) Erase the SPI serial flash. After this step, do not reboot the
     64    board! Otherwise it will not start anymore::
     65
     66	# flash_erase /dev/mtd0 0 0
     67	Erasing 4 Kibyte @ 7ff000 -- 100 % complete
     68
     69 8) Once completed without errors you can write the new BIOS image::
     70
     71    # dd if=MNW2MAX1.X64.0092.R01.1605221712.bin of=/dev/mtd0
     72
     73 9) Verify that the new content of the SPI serial flash matches the new
     74    BIOS image::
     75
     76	# sha1sum /dev/mtd0ro MNW2MAX1.X64.0092.R01.1605221712.bin
     77	9b4df9e4be2057fceec3a5529ec3d950836c87a2  /dev/mtd0ro
     78	9b4df9e4be2057fceec3a5529ec3d950836c87a2 MNW2MAX1.X64.0092.R01.1605221712.bin
     79
     80    The SHA1 sums should match.
     81
     82 10) Now you can reboot your board and observe the new BIOS starting up
     83     properly.
     84
     85References
     86----------
     87
     88[1] https://firmware.intel.com/sites/default/files/MinnowBoard%2EMAX_%2EX64%2E92%2ER01%2Ezip
     89
     90[2] http://www.linux-mtd.infradead.org/