dump flash firmware descriptor to a text file in layout format

[PSLLSP]

flashprog v1.3

I try to fix HP 8300 USDT with BIOS that was self destructed in a mysterious way. I use external SPI programmer with a clip for SOIC16. I can flash BIOS from HP (v2.90, file K01_0290.BIN) and after this operation I can boot PC but NIC is not working because MAC address is FF:FF:FF:FF:FF:FF. NIC is disabled, even Linux ignores such NIC and I cannot set MAC address from software. This has to be fixed in BIOS...

I have found an article related to this issue but article doesn't describe how they found what flash regions are related to NIC and how they patched BIOS with NIC code from "damaged" FLASH.

I want to use flashprog and I think I can use layout file to update just part of flash chip. "layout" file has to be defined.

I have found that flashprog understands Intel Firmware Descriptor (flag --ifd) but I cannot find a way to dump Intel Firmware Descriptor to a file in "layout format".

I have found a way to display Intel firmware Descriptor but I have to use this information and write "layout file":

$ flashprog -p ch341a_spi --ifd -V -r test.bin

flashprog v1.3 on Linux 6.8.0-48-generic (x86_64)
flashprog is free software, get the source code at https://flashprog.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
flashprog was built with GCC 13.2.0, little endian
Command line (6 args): flashprog -p ch341a_spi --ifd -V -r test.bin
Initializing ch341a_spi programmer
Device revision is 3.0.4
The following protocols are supported: SPI.
Probing for AMIC A25L010, 128 kB: probe_spi_rdid_generic: id1 0xef, id2 0x4018
...
Probing for Winbond W25Q128.V, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x4018
Added layout entry 00000000 - 00ffffff named complete flash
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
Chip status register is 0x00.
Probing for Winbond W25Q128.V..M, 16384 kB: probe_spi_rdid_generic: id1 0xef, id2 0x4018
...
Probing for Generic unknown SPI chip (REMS), 0 kB: probe_spi_rems: id1 0xef, id2 0x17
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI).
This chip may contain one-time programmable memory. flashprog cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading ich descriptor... done.
Added layout entry 00000000 - 00000fff named fd
Added layout entry 00a90000 - 00ffffff named bios
Added layout entry 00003000 - 00a8ffff named me
Added layout entry 00001000 - 00002fff named gbe
Reading flash... done.

I created layout file (layout-ifd.cfg):

0x00000000:0x00000fff fd
0x00001000:0x00002fff gbe
0x00003000:0x00a8ffff me
0x00a90000:0x00ffffff bios

Could be new option added to flashprog to dump Intel Firmware Descriptor (or any other FLASH descriptor) in the format compatible with layout file?

---

I know I should not use cheap SPI programmer based on CH341A. Programmer I received was designed in the way that voltage for SPI FLASH was 5V but I have found warning on libreboot - Do not use CH341A project and fixed my SPI programmer before it damaged any FLASH chip. I also found that test clip for SOIC-16 I received with my programmer was wired in a strange way, and I had to fix it first.... Anyway, my CH341A programmer now works reliably...

I tried to flash LibreBoot to my broken machine but it was not working, I booted it once, I started memtest but after reset machine was "dead" again. That is why I try to restore original BIOS...

[i-c-o-n]

Hi,
not sure if there is a misunderstanding. The --ifd option already provides the layout information to flashprog. There is usually no need to go through a text file. For instance, to write only the GbE region of a file: flashprog -p ch341a --ifd -i gbe -w some.rom. This has the advantage that you can be sure that the layout used matches the one that's already on the flash chip.

I guess dumping the layout to a file can be useful for other cases. There's a tool that comes with flashprog ich_descriptors_tool that could be extended. That seems more straight forward than plugging it into flashprog directly. Now I remember that coreboot's ifdtool can do it too. It might require one to specify the chipset generation, though.

[PSLLSP]

When I opened this issue, I wanted to create my own layout file, to follow advice in the article, to patch regions 0x001000:0x001095 and 0x01A000:0x01FFFF. So I was looking for an easy way to create layout file and cannot find any, so I opened this issue. When I created layout file, I noticed gbe region and I tried to patch it. It worked!

I tested two ways to recover HP 8300 USDT with damaged BIOS.

First way, fix BIOS region:

1. backup "damaged" flash to file 8300-backup.bin with command flashprog -p ch341a_spi -r 8300-backup.bin
2. flash BIOS with command flashprog -p ch341a_spi --ifd --image bios -w K01-0290.bin

Second way, replace BIOS then patch GBE region:

1. backup "damaged" flash to file 8300-backup.bin with command flashprog -p ch341a_spi -r 8300-backup.bin
2. flash BIOS with command flashprog -p ch341a_spi -w K01-0290.bin
3. patch GBE region, use data from backup: flashprog -p ch341a_spi --ifd --image gbe -w 8300-backup.bin

In both cases some ID numbers has to be entered in BIOS setup (F10 during boot), in advance setup mode (CTRL+A, then Security/System ID). MAC address cannot be changed there :-( Some missing IDs could be found in DB HP part surfer, enter desktop serial number and other numbers will be listed. MAC address in not in the list... :-(

I still have one HP 8300 USDT from the past that failed in similar way, it runs but it has MAC address FF:FF:FF:FF:FF:FF but I do not have backup of damaged FLASH. I can flash it with gbe region from other PC but I do not know how to change MAC address; I know what it should be there (I have dmidecode report from the past), I just do not know how to change MAC address... Maybe that utility nvmutil is what I have to try.

The tool ifdtool from libreboot is not supported anymore ich9utils is obsolete, it lacks documentation. ifdtool could be build from git repository when some older version is checked out. Libreboot has a lot of documentation but I have found it not really useful, at least I have not found information I needed to recover that broken BIOS. I miss information how to revert from libreboot BIOS to the original BIOS when man has no backup of the original FLASH... libreboot documentation was good starting point, it has page related to HP 8300 USDT, it has advice how to prepare SPI programmer but I miss general introduction for beginners. I even tried to build libreboot ROM for HP 8300 USDT and PC boot booted once, I was able to run embedded memetest86+ but after reboot, the PC was "dead". I cannot explain it but that was showstopper for more experiments with libreboot... Anyway, it looks like HP8300 USDT is good system to test libreboot but it is a complex topic and there is a lot of black magic in the process...

HP support web is not really useful too, there are several similar reports (PC doesn't boot, screen is black and PC beeps 8 times) but most advice are just "motherboard is broken, replace it". Emergency BIOS recovery (by Management Engine?) is not well documented, I tried it several times but I have not found any working solution.

One more note related to this issue.

flashprog in verbose mode (-V) reports regions but in human friendly format, like

Added layout entry 00000000 - 00000fff named fd

Why not to report those in format compatible with layout file?

0x00000000:0x00000fff  fd