Hi! I can’t update the BIOS on our custom motherboard (Intel Atom С3538 Denverton_ns SOC) when using a bunch of coreboot + siabios. (When processing BIOS, the Intel Hurcuvar motherboard is taken as a source). The BIOS chip is located on the SPI bus. The BIOS chip size is 16 megabytes. I need to update the BIOS region (bottom 8 MB). The study of the issue led to the BIOS_CNTL registry (SPIBAR_BIOS_CONTROL 0xdc) which is responsible for protection against unauthorized overwriting. At the very beginning of the coreboot start, memory testing and training is performed and the parameters are writed to the BIOS chip (MRC). For this, the BIOS chip becomes available for writing. I found this code in the fast_spi.c file. But further, at the end of loading the FSP, the BIOS chip is locket down (As I understand by FSP). I found these lines in the booting log:
Fsp PchFspOnEndOfDxe() Start Common PchOnEndOfDxe() Start GC = 0xFDCF000C Value = 0x00000002 Protected range 0: 0x80000000 Protected range 1: 0x80000000 Protected range 2: 0x80000000 Protected range 3: 0x80000000 Protected range 4: 0x80000000 Set LPC EISS Set SPI EISS Set LPC bios lock Set SPI bios lock PM_CFG = 0xFE000018 Value = 0x29C0002C
I tried to rewrite SPIBAR_BIOS_CONTROL=0xdc after that:
fast_spi_init; bios_cntl = pci_read_config8(dev, SPIBAR_BIOS_CONTROL); bios_cntl: 0xab fast_spi_init; bios_cntl &= ~SPIBAR_BIOS_CONTROL_EISS; bios_cntl: 0x8b fast_spi_init; bios_cntl |= SPIBAR_BIOS_CONTROL_WPD bios_cntl: 0x8b fast_spi_init; bios_cntl |= SPIBAR_BIOS_CONTROL_PREFETCH_ENABLE bios_cntl: 0x8b fast_spi_init; bios_cntl &= ~SPIBAR_BIOS_CONTROL_CACHE_DISABLE bios_cntl: 0x8b fast_spi_init; READ bios_cntl: 0x8b
But in Linux I still get 0xDC register value 0xA2.
The bit[0] is equal to zero, which means write is not possible. (Write Protect Disable (WPD): When set, access to the BIOS space is enabled for both read and write cycles to BIOS. When cleared, only read cycles are permitted to the FWH or SPI flash. When this bit is written from a '0' to a '1' and the LE bit is also set, an SMI# is generated. This ensures that only SMM code can update BIOS.)
Is it possible to somehow tell the FSP not to “Set SPI bios lock”? What to do to access the possibility of updating the bios region from operating systems? Why I do not see the SPI bus in the /dev/?
Using inteltool –s utility, I got the following output:
./inteltool -s CPU: ID 0x506f1, Processor Type 0x0, Family 0x6, Model 0x5f, Stepping 0x1 Northbridge: 8086:1980 (unknown) Southbridge: 8086:19dc (Denverton)
============= SPI / BIOS CNTL =============
SB devive ID: 0x19dc BIOS_CNTL = 0x00a2 (IO)
0x0000 = BIOSWE - write enable 0x0001 = BLE - lock enable 0x0000 = SPI Read configuration 0x0000 = TopSwapStatus 0x0001 = SMM Bios Write Protect Disable 0x0002 = reserved
============= SPI Bar ==============
rcba_phys: 0x0 rcba: 0x6d16b000 0xf000ff53 = BFPR - BIOS Flash primary region 0x0000ff53 = HSFSTS - Hardware Sequencing Flash Status 0x0000f000 = HSFCTL - Hardware Sequencing Flash Control 0xf000e2c3 = FADDR - Flash Address 0xf000ff53 = Reserved 0xf000ff53 = FDATA0 0xf000e739 = FRACC - Flash Region Access Permissions 0xf000f859 = Flash Region 0 0xf000e82e = Flash Region 1 0xf000efd2 = Flash Region 2 0xf000d44f = Flash Region 3 0xf000e6f2 = Flash Region 4 0xf000ff53 = FPR0 Flash Protected Range 0 0xf000665c = FPR0 Flash Protected Range 1 0xc000503b = FPR0 Flash Protected Range 2 0xf000ff53 = FPR0 Flash Protected Range 3 0xf000ff53 = FPR0 Flash Protected Range 4 0x00000053 = SSFSTS - Software Sequencing Flash Status 0x0000ff53 = PREOP - Prefix opcode Configuration 0x0000f000 = OPTYPE - Opcode Type Configuration 0xf000ff53f000ff53 = OPMENU - Opcode Menu Configuration 0x00000053 = BBAR - BIOS Base Address Configuration 0xf000ff53 = FDOC - Flash Descriptor Observability Control 0xf000ff53 = Reserved 0xf000ff53 = AFC - Additional Flash Control 0xf000ff53 = LVSCC - Host Lower Vendor Specific Component Capabilities 0xf000ff53 = UVSCC - Host Upper Vendor Specific Component Capabilities 0xf000ff53 = FPB - Flash Partition Boundary