Upgrading BIOS using spi-intel | Linux 6.18.37

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약과 해설

spi-intel.rst:1-90

`spi-intel`의 보호 조건을 확인하고 BIOS backup·erase·write·digest 검증을 완료한 뒤 reboot해야 합니다.

문서 구성

원문 줄내용

1-23보호와 위험

24-46Upgrade 준비

47-68Backup과 erase

69-90Write와 검증

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기

1 ==============================

2 Upgrading BIOS using spi-intel

3 ==============================

5 Many Intel CPUs like Baytrail and Braswell include SPI serial flash host

6 controller which is used to hold BIOS and other platform specific data.

7 Since contents of the SPI serial flash is crucial for machine to function,

8 it is typically protected by different hardware protection mechanisms to

9 avoid accidental (or on purpose) overwrite of the content.

11 Not all manufacturers protect the SPI serial flash, mainly because it

12 allows upgrading the BIOS image directly from an OS.

14 The spi-intel driver makes it possible to read and write the SPI serial

15 flash, if certain protection bits are not set and locked. If it finds

16 any of them set, the whole MTD device is made read-only to prevent

17 partial overwrites. By default the driver exposes SPI serial flash

18 contents as read-only but it can be changed from kernel command line,

19 passing "spi_intel.writeable=1".

21 Please keep in mind that overwriting the BIOS image on SPI serial flash

22 might render the machine unbootable and requires special equipment like

23 Dediprog to revive. You have been warned!

25 Below are the steps how to upgrade MinnowBoard MAX BIOS directly from

26 Linux.

28 1) Download and extract the latest Minnowboard MAX BIOS SPI image

29 [1]. At the time writing this the latest image is v92.

31 2) Install mtd-utils package [2]. We need this in order to erase the SPI

32 serial flash. Distros like Debian and Fedora have this prepackaged with

33 name "mtd-utils".

35 3) Add "spi_intel.writeable=1" to the kernel command line and reboot

36 the board (you can also reload the driver passing "writeable=1" as

37 module parameter to modprobe).

39 4) Once the board is up and running again, find the right MTD partition

40 (it is named as "BIOS")::

42 # cat /proc/mtd

43 dev: size erasesize name

44 mtd0: 00800000 00001000 "BIOS"

46 So here it will be /dev/mtd0 but it may vary.

48 5) Make backup of the existing image first::

50 # dd if=/dev/mtd0ro of=bios.bak

51 16384+0 records in

52 16384+0 records out

53 8388608 bytes (8.4 MB) copied, 10.0269 s, 837 kB/s

55 6) Verify the backup::

57 # sha1sum /dev/mtd0ro bios.bak

58 fdbb011920572ca6c991377c4b418a0502668b73 /dev/mtd0ro

59 fdbb011920572ca6c991377c4b418a0502668b73 bios.bak

61 The SHA1 sums must match. Otherwise do not continue any further!

63 7) Erase the SPI serial flash. After this step, do not reboot the

64 board! Otherwise it will not start anymore::

66 # flash_erase /dev/mtd0 0 0

67 Erasing 4 Kibyte @ 7ff000 -- 100 % complete

69 8) Once completed without errors you can write the new BIOS image::

71 # dd if=MNW2MAX1.X64.0092.R01.1605221712.bin of=/dev/mtd0

73 9) Verify that the new content of the SPI serial flash matches the new

74 BIOS image::

76 # sha1sum /dev/mtd0ro MNW2MAX1.X64.0092.R01.1605221712.bin

77 9b4df9e4be2057fceec3a5529ec3d950836c87a2 /dev/mtd0ro

78 9b4df9e4be2057fceec3a5529ec3d950836c87a2 MNW2MAX1.X64.0092.R01.1605221712.bin

80 The SHA1 sums should match.

82 10) Now you can reboot your board and observe the new BIOS starting up

83 properly.

85 References

86 ----------

88 [1] https://firmware.intel.com/sites/default/files/MinnowBoard%2EMAX_%2EX64%2E92%2ER01%2Ezip

90 [2] http://www.linux-mtd.infradead.org/

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

Intel SPI flash 보호와 write enable

1-23

Baytrail과 Braswell을 비롯한 많은 Intel CPU에는 BIOS와 platform-specific data를 저장하는 SPI serial flash host controller가 있습니다.

SPI flash 내용은 machine 동작에 필수이므로 accidental 또는 intentional overwrite를 막는 여러 hardware protection mechanism으로 보호되는 경우가 많습니다. 반대로 일부 제조사는 OS에서 BIOS image를 직접 upgrade할 수 있도록 보호하지 않습니다.

`spi-intel` driver는 protection bit가 set·lock되지 않았을 때 SPI serial flash를 읽고 쓸 수 있습니다. 보호 bit 하나라도 발견하면 partial overwrite를 막기 위해 MTD 전체를 read-only로 만듭니다.

Driver는 기본적으로 flash를 read-only로 노출합니다. Kernel command line에 `spi_intel.writeable=1`을 전달하거나 module reload 시 `writeable=1`을 주면 변경할 수 있습니다.

BIOS를 잘못 덮어쓰면 machine이 boot되지 않으며 Dediprog 같은 전용 장비로 복구해야 할 수 있습니다.

SPI Intel write 가능 조건

Protection bit set/locked전체 MTD read-only

Protection 허용`spi_intel.writeable=1`Read/write

잘못된 BIOSBoot 불가Dediprog 등으로 복구

Hardware lock과 명시적 driver option을 모두 확인합니다.

==============================
Upgrading BIOS using spi-intel
==============================

Many Intel CPUs like Baytrail and Braswell include SPI serial flash host
controller which is used to hold BIOS and other platform specific data.
Since contents of the SPI serial flash is crucial for machine to function,
it is typically protected by different hardware protection mechanisms to
avoid accidental (or on purpose) overwrite of the content.

Not all manufacturers protect the SPI serial flash, mainly because it
allows upgrading the BIOS image directly from an OS.

The spi-intel driver makes it possible to read and write the SPI serial
flash, if certain protection bits are not set and locked. If it finds
any of them set, the whole MTD device is made read-only to prevent
partial overwrites. By default the driver exposes SPI serial flash
contents as read-only but it can be changed from kernel command line,
passing "spi_intel.writeable=1".

Please keep in mind that overwriting the BIOS image on SPI serial flash
might render the machine unbootable and requires special equipment like
Dediprog to revive. You have been warned!

MinnowBoard MAX upgrade 준비

24-46

예시는 Linux에서 MinnowBoard MAX BIOS를 직접 upgrade하는 절차입니다. 최신 SPI image를 내려받아 압축을 풉니다. 문서 작성 당시 최신 image는 v92입니다.

SPI flash erase에 필요한 `mtd-utils` package를 설치합니다. Debian과 Fedora 등은 같은 이름으로 제공합니다.

Kernel command line에 `spi_intel.writeable=1`을 추가하고 reboot합니다. 또는 driver를 reload하며 `modprobe` module parameter `writeable=1`을 줄 수 있습니다.

부팅 후 `/proc/mtd`에서 이름이 `BIOS`인 partition을 찾습니다. 예시는 8 MiB, erase size 4 KiB인 `mtd0`이며 실제 device 번호는 달라질 수 있습니다.

BIOS upgrade 준비

BIOS image download`mtd-utils` 설치`spi_intel.writeable=1`Reboot/reload`/proc/mtd`의 BIOS 확인

Image와 도구를 준비한 뒤 write를 허용하고 대상 partition을 식별합니다.


Below are the steps how to upgrade MinnowBoard MAX BIOS directly from
Linux.

 1) Download and extract the latest Minnowboard MAX BIOS SPI image
    [1]. At the time writing this the latest image is v92.

 2) Install mtd-utils package [2]. We need this in order to erase the SPI
    serial flash. Distros like Debian and Fedora have this prepackaged with
    name "mtd-utils".

 3) Add "spi_intel.writeable=1" to the kernel command line and reboot
    the board (you can also reload the driver passing "writeable=1" as
    module parameter to modprobe).

 4) Once the board is up and running again, find the right MTD partition
    (it is named as "BIOS")::

        # cat /proc/mtd
        dev:    size   erasesize  name
        mtd0: 00800000 00001000 "BIOS"

    So here it will be /dev/mtd0 but it may vary.

기존 BIOS backup과 erase

47-68

먼저 read-only device `/dev/mtd0ro`를 `dd`로 `bios.bak`에 복사합니다. 예시는 8,388,608 byte image입니다.

`sha1sum /dev/mtd0ro bios.bak`의 두 digest가 반드시 같아야 합니다. 다르면 더 진행하지 않습니다.

`flash_erase /dev/mtd0 0 0`으로 SPI serial flash 전체를 지웁니다. 이 단계 이후 새 image를 쓰기 전에 reboot하면 board가 더 이상 시작되지 않으므로 절대 reboot하지 않습니다.

Backup과 위험 지점

단계명령확인

Backup`dd if=/dev/mtd0ro of=bios.bak`전체 image 보관

검증`sha1sum /dev/mtd0ro bios.bak`Digest 일치 필수

Erase`flash_erase /dev/mtd0 0 0`완료 후 reboot 금지


5) Make backup of the existing image first::

       # dd if=/dev/mtd0ro of=bios.bak
       16384+0 records in
       16384+0 records out
       8388608 bytes (8.4 MB) copied, 10.0269 s, 837 kB/s

6) Verify the backup::

       # sha1sum /dev/mtd0ro bios.bak
       fdbb011920572ca6c991377c4b418a0502668b73  /dev/mtd0ro
       fdbb011920572ca6c991377c4b418a0502668b73  bios.bak

   The SHA1 sums must match. Otherwise do not continue any further!

7) Erase the SPI serial flash. After this step, do not reboot the
   board! Otherwise it will not start anymore::

       # flash_erase /dev/mtd0 0 0
       Erasing 4 Kibyte @ 7ff000 -- 100 % complete

새 BIOS write와 최종 검증

69-90

Erase가 오류 없이 끝나면 `dd`로 새 BIOS image를 `/dev/mtd0`에 씁니다.

`sha1sum /dev/mtd0ro <새 image>`로 flash 내용과 image의 SHA1을 비교합니다. 두 값이 일치해야 합니다.

검증이 끝난 뒤 board를 reboot하고 새 BIOS가 정상 시작되는지 관찰합니다. 문서 끝에는 MinnowBoard MAX image와 Linux MTD 자료 reference가 있습니다.

BIOS write 완료

새 image `dd` write`/dev/mtd0ro` SHA1Image SHA1과 일치Reboot새 BIOS 확인

Erase 이후에는 write와 read-back digest 검증을 완료한 뒤에만 reboot합니다.

 8) Once completed without errors you can write the new BIOS image::

    # dd if=MNW2MAX1.X64.0092.R01.1605221712.bin of=/dev/mtd0

 9) Verify that the new content of the SPI serial flash matches the new
    BIOS image::

        # sha1sum /dev/mtd0ro MNW2MAX1.X64.0092.R01.1605221712.bin
        9b4df9e4be2057fceec3a5529ec3d950836c87a2  /dev/mtd0ro
        9b4df9e4be2057fceec3a5529ec3d950836c87a2 MNW2MAX1.X64.0092.R01.1605221712.bin

    The SHA1 sums should match.

 10) Now you can reboot your board and observe the new BIOS starting up
     properly.

References
----------

[1] https://firmware.intel.com/sites/default/files/MinnowBoard%2EMAX_%2EX64%2E92%2ER01%2Ezip

[2] http://www.linux-mtd.infradead.org/