Unlock fpt write in BIOS

Discussion in 'BIOS Mods' started by CHEF-KOCH, Feb 22, 2017.

  1. CHEF-KOCH

    CHEF-KOCH MDL Addicted

    Jan 7, 2008
    941
    871
    30
    #1 CHEF-KOCH, Feb 22, 2017
    Last edited by a moderator: Apr 20, 2017
    First this is an uefi restriction, to be specific the driver is 'locked' and applies to Phoneix and Insyde Bios'es.



    Code:
    // Bios Lock
    48 8B 0D 6D 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory
    B2 FE                mov         dl,0FEh                   ; 0xFE is (NOT 0x01), 0x01 is BIOSWE, i.e. disable BIOS write
    48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset E9 5F010000       jmp         00000000000007D8;Jump to write function
    
    
    The SMI code sets BIOSWE bit to 0 and this needs to be changed, because the flash procedure tries to change this to 1. Changing 0xFE to 0xFF will disable it.


    Code:
    // SMI Lock
    48 8B 0D 42 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory 
    48 83 64 24 48 00    and         qword ptr [rsp+48h],0     ; Some stack variable is now 0, not related
    B2 20                mov         dl,20h                    ; 0x20 is SMI_BWP, i.e enable SMI generation after BIOSWE set to 1 
    48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset
    E8 02 01 00 00       call        00000000000007AC          ; Call of write function
    
    

    Here we need changing 0x20 to 0x00 which will disable registration and handler itself within the SMI handler. After both modifications BIOSWE=1 and SMM_BWP=0 in BIOS_CNTL register, that allows flashrom to work normally.


    Why is this all important?
    E.g. in case you want to upgrade your MEI firmware and get an error like 368.


    [​IMG]
     
  2. Flipp3r

    Flipp3r MDL Expert

    Feb 11, 2009
    1,477
    627
    60
    But your only trying to flash bios region with "-bios" switch. What about trying "fptw64 -f 2202.rom"? That will flash the whole rom, both bios & me.
    Note if your mainboard has Intel Lan you also need to have the switch "-savemac"...
     
  3. cloud17

    cloud17 MDL Novice

    Oct 23, 2009
    4
    0
    0
    can you show me how to do this for other variables ? also will unlocking the bios let me use setup_var through efi shell and set variables right now I cant (hp envy 15-jxxx TS)
     
  4. JBenal

    JBenal MDL Senior Member

    Nov 2, 2009
    431
    156
    10
    #4 JBenal, Mar 9, 2017
    Last edited: Mar 9, 2017
    CHEF-KOCH, I asked this question in another post that seems to have been deleted during the "purge". I have a Dell Optiplex 790 with Phoenix BIOS that is limited to four SATA drives. There are four SATA ports on the mobo, so I see why they did this. But I would like to add another drive by way of a PCIe SATA adapter. I installed the adapter and added a drive. It was visible in the BIOS where it listed all the available drives for the boot sequence. But in the SATA section of the BIOS you could only add four devices. I was wondering if there was a way to modify the BIOS to increase the number of usable SATA drives. Thanks.

    bios info.png opt 790.png sata.jpg

    https://downloads.dell.com/FOLDER01765333M/1/O790-A18.exe
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Flipp3r

    Flipp3r MDL Expert

    Feb 11, 2009
    1,477
    627
    60
    You don't need to mod bios. The bios is listing drives on the onboard controller - not ALL controllers.
     
  6. JBenal

    JBenal MDL Senior Member

    Nov 2, 2009
    431
    156
    10
    When I added this adapter with a drive attached the SATA section of the BIOS still only showed four devices available. If I detached one of the internal drives from the mobo, the drive attached to the PCI adapter then was available and showed on the SATA page in BIOS.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. Zibri

    Zibri MDL Novice

    Sep 27, 2010
    8
    1
    0
    Important information
    I just found out that on my laptop (MSI Notebook), FPTW64 gives ERROR 368 BUT if I run fpt in EFI shell IT WORKS!
     
  8. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    783
    296
    30
    what does
    fpt -dumplock
    show about the descriptor?

    if it's unlocked you get a

    Code:
    D:\BIOS>fpt -dumplock
    
    Intel (R) Flash Programming Tool. Version:  9.1.10.1000
    Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.
    
    Platform: Intel(R) Z97 Express Chipset
    Reading HSFSTS register... Flash Descriptor: Valid
    
        --- Flash Devices Found ---
        W25Q64BV    ID:0xEF4017    Size: 8192KB (65536Kb)
    
    
    Lock Settings.
    =======================
    Host CPU master:   00 00 FF FF
    ME region master:  00 00 FF FF
    GBE region master: 18 01 FF FF
    FPT Operation Passed
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...