Flashing BIOS from Linux

From ArchWiki

This article provides information on using Linux to update the BIOS of a system. Usually, the update program provided by a manufacturer must be executed under Windows. However, various utilities and methods have been published for upgrading a system BIOS under Linux.

Warning: Flashing the BIOS is a dangerous activity that may render your motherboard inoperable!
Note:
  • HP users may download Windows BIOS updater from HP website, extract *.exe file and locate ISO image for burning to a CD. Using CD, upgrade is possible from BIOS menu using 'Firmware Upgrade' without using below tools. See this thread for details. Also, see the #HP section below to upgrade using an USB if your current HP BIOS allows it.
  • For users with Dell computers, Dell recommends Linux users flash their BIOS following information located here (in short, put the .EXE on a USB stick and use the F12 boot menu to access the firmware's flash utility).

In addition to the tools described below, many laptop pages include individualized instructions for a particular model. The instructions sometimes involve bespoke utilities that may even be particular to the upgrade process on a single model. If there is no page for a particular model, it may be useful to look at pages for similar models, as it might be possible to adapt a process for the target model. The HP ENVY m4-1015dx page, for example, includes instructions that may work on a variety of HP models.

fwupd

fwupd is a simple daemon to allow session software to update device firmware on your local machine.

Large vendors including Dell and Logitech use this way to distribute firmware updates to Linux.

fwupd only supports flashing BIOS updates in UEFI mode.

See fwupd for further information about installation and usage.

BiosDisk

BiosDisk simplifies the process of flashing your system BIOS under Linux.

Note: This is only supported on systems when booted in "Legacy mode". In UEFI mode, you will need to use a different method.

Installation

Install the biosdisk-gitAUR package.

Usage

To use the biosdisk utility to create a BIOS flash image, first download the latest raw BIOS image for your system from your manufacturer's website. Make sure, however, that you always get the BIOS executable and NOT the Windows executable. You then have one of two options: create a ISO or install the image for your bootloader.

  • The mkimage action will create a ISO image on the user's hard drive. Usage is the following:
# biosdisk mkimage [-o option] [-i destination] /path/to/.exe 
  • The install action will create the biosdisk image, copy the image file to /boot, and then update the bootloader with an entry for the image. Then all the user has to do is boot the system and select the image to flash the BIOS; this will load the biosdisk image directly from the hard drive and flash the BIOS.
# biosdisk install [-o option] [--name=] /path/to/.exe

Flashrom

Flashrom is a utility for identifying, reading, writing, verifying and erasing flash chips. It is designed to flash BIOS/EFI/coreboot/firmware/optionROM images on mainboards, network/graphics/storage controller cards, and various programmer devices.

Warning: If you have a laptop/notebook/netbook, please do NOT try flashrom because interactions with the EC on these machines might crash your machine during flashing. flashrom tries to detect if a machine is a laptop, but not all laptops follow the standard, so this is not 100% reliable.[1]

Installation

Install the flashrom or flashrom-gitAUR package.

Usage

Find out if your motherboard and chipset (internal) is supported by flashrom at this website. Supported Hardware You can also find out if your hardware is supported by issuing the following command

# flashrom --programmer internal

The above command will tell you your motherboard and chipset. You can then find out if yours is supported by issuing this command:

# flashrom --programmer internal -L | grep CHIPNAMEfrompreviouscommand

On modern mainboards you probably get more than one rom chip listed. You have to select the chipname you get from the upper command. Then you use the -c option to select which rom is affected by the command

# flashrom --programmer internal -c "CHIPNAME" -r backup_CHIPNAME.bin

Write and verify the new BIOS image (proprietary or Coreboot) on the ROM chip:

# flashrom --programmer internal -c "CHIPNAME" -w newbios.bin

If you want to flash other flash chips on your mainboard, you will find all options with

# flashrom
Note: With Linux kernel versions greater than 4.4, CONFIG_IO_STRICT_DEVMEM a new kernel security measure can make flashrom stop working; in that case, you can try adding iomem=relaxed to your kernel parameters. FAQ.

FreeDOS

Some laptop manufacturers provide a DOS compatible executable to flash the system firmware. FreeDOS, a free DOS-compatible operating system, is up to the challenge, no need for proprietary DOS versions. So, all you need is a bootable floppy disk image with FreeDOS kernel on it.

Unetbootin

By far the easiest way to make a bootable FreeDOS USB Stick is using unetbootinAUR.

You should format a pendrive with FAT16 and flag it as "boot" (you may do this through a GUI with gparted or partitionmanager). Then, after mounting the flash drive, select under distribution FreeDOS and your mounted stick. The app will automatically download the image for you and copy it to the drive. Finally, you may copy everything you want to flash there (BIOS, firmwares, etc).

Warning: Unetbootin may not function properly on some Lenovo systems. It may be necessary to create the bootable stick on a different device. See here.

dosemu

The problem with the official FreeDOS images is the lack of extra space for holding firmware and BIOS update files and programs. The easiest way to create a DOS, bootable FAT drive of arbitrary size under Linux is to mount a FAT drive under dosemu and then make it bootable with the FreeDOS sys command.

For an alternative method, see Gentoo:BIOS Update#FreeDOS environment.

Pre-built images

Yet another simple solution: FreeDOS pre-built bootable USB flash drive image by Christian Taube. Instructions can be found here.

Using a FreeDOS-provided Disk Image + USB stick on Linux

As of writing (2017-07-11), unetbootinAUR does not support versions of FreeDOS more recent than 1.0 (current version is 1.2). The following procedure worked to upgrade an Inspiron 17-3737 to the A09 BIOS. (Dell offers this as a possibility on their site)

Some notes before starting:

  • You can check your current BIOS version with dmidecode. You might already be at the latest version.
  • Ensure that your hardware vendor has verified this method works (use of FreeDOS to run BIOS update .exe)
  • Laptop users should not attempt this without AC power
  • This is dangerous, and you assume all risk for following this procedure.

Procedure:

  1. Grab the latest USB installer from the FreeDOS Download Page
    • author note: used the "Full" version on suspicion that it might include more drivers, etc (pure speculation)
  2. Extract the archive, you get a .img file
  3. Determine which of /dev/sdX is your USB stick (use fdisk -l)
  4. Write the image directly to the block device:
    • dd if=FD12FULL.img of=/dev/sdX status=progress (where X is the letter representing your USB stick as a block device, do not write the image to a partition)
  5. Double-check that the image copying worked:
    • fdisk -l (you should see a single partition on a DOS disk with the bootable ("boot") flag set)
  6. Mount the partition, and copy over the .exe used to update your firmware
    • Stay on the safe side and limit the filename to 8 characters (without extension), uppercase
    • Ensure that you verified any checksums provided by your hardware vendor
  7. Unmount and reboot. Do whatever is needed to boot from the USB drive

Now you will find yourself in the FreeDOS live installation environment.

  1. Select your language
  2. You will be prompted to install FreeDOS
    • Select "No - Return to DOS"
  3. You should see a prompt (C:\>)
  4. Run dir /w and verify that your firmware upgrade tool is present
  5. Run the executable
    • author note: in the case of the Dell tool, the machine displayed a splash screen and then rebooted. Upon reboot, it started the firmware upgrade automatically, and ran for about 2 minutes with the fan at full speed)
  6. Once the process specific to your vendor completes, optionally verify through the BIOS setup screen, as well as by running dmidecode when you are back in Linux

Using a FreeDOS-provided Disk Image + USB stick with Windows

The author for this procedure encountered several issues related to mounting the FAT partition type of the USB using the previous method on Linux with dd. This procedure seeks to outline a method to flash the BIOS with FreeDOS, a USB stick and Ruckus on Windows.

Prerequisites:

  • Download and install Rufus for Windows. This can be either the full installation or the portable version.
  • Download the latest Full USB installer for FreeDOS (v1.2 as of the time of writing).
  • Download the latest BIOS update from the vendors' website
  • It is assumed that dmidecode is installed on the system

Procedure:

  1. Extract the contents of the FD12FULL.zip archive, noting the .img file
  2. Insert a flash drive and flash the FD12FULL.img file using Rufus, leaving all default options
    • Detailed use of Rufus is not covered in this guide. Refer to Rufus' manual or documentation for detailed usage
  3. Once flashed with Rufus, rename the BIOS file with 8 uppercase characters (not including the extension) and copy it over to the flash drive
  4. Eject the flash drive and plug it into the laptop.
  5. Perform whatever steps are necessary to boot from the USB with LEGACY BOOT
    • Author note: For my Dell Laptop, I press F12 for boot options and select 'USB Storage Device' under 'Legacy Options'. I have explicitly enabled legacy boot from within my BIOS, but this option may not be present if the system is only configured to boot with UEFI
  6. You will be presented with the FreeDOS Installation environment
    • Select preferred language
    • Select 'No - Return to DOS' on the next screen
    • Type dir to view the contents of the USB flash drive
    • To execute the BIOS upgrade file, simply type the filename and press enter
    • Note: My upgrade took <2 minutes with the fans at full speed. The system reboot 3 times total.
  7. Once the upgrade completes and the system boots back into the OS, issue dmidecode | grep -E 'BIOS|Version' as root and validate the BIOS version has been upgraded

Images that are too large for a floppy

If your flash image is too large for a floppy, go to the FreeDos bootdisk website, and download the 10Mb hard-disk image. This image is a full disk image, including partitions, so adding your flash utility will be a little trickier:

First find the first partition (at time of writing, the first partition starts at block 63; this means that the partitions starts at offset 512 * 63 = 32256). You can either use:

# file -sk <image-file> | sed -r 's/.*startsector ([0-9]+).*/\1/'
63

Or:

# fdisk -l <image-file>
…
Units = sectors of 1 * 512 = 512 bytes
…
      Device  Boot  Start    End  Blocks  Id  System
              *        63  19151   9544+   1  FAT12

Now you can mount the image:

# mount -oloop,offset=$((63 * 512)) <image-file> /mnt

Then you can copy your flash utility onto the filesystem as normal. Once you are done:

# umount /mnt

The image can now be copied to a USB stick for booting, or booted as a memdisk as per normal instructions.

Usage

The OEM Bootdisk version is recommended, as it only includes kernel and command.com thus leaving more space for the flash utility and new BIOS image. Download the FreeDOS image and decompress it.

Copy your BIOS flash utility and new BIOS image to the mounted floppy disk image. Load the necessary modules:

# modprobe -a vfat loop

/proc/fileystems shows if the needed file systems are supported. "loop mount" the floppy disk image to a temporary path:

$ mount --mkdir -t vfat -o loop FDOEM.144 /tmp/floppy

If the mount went without errors, copy the BIOS flash utility and new BIOS image to the mounted floppy disk image. You will probably have to unzip the archive you downloaded from your motherboard vendor site, to get to those two files. For example:

# unzip 775Dual-VSTA\(2.60\).zip
Archive: 775Dual-VSTA(2.60).zip
 inflating: 75DVSTA2.60
 inflating: ASRflash.exe
# cp 75DVSTA2.60 ASRflash.exe /tmp/floppy

Check that the two files were not too big for the floppy:

$ df /tmp/floppy
Filesystem           1K-blocks      Used Available Use% Mounted on
/tmp/FDOEM.144            1424       990       434  70% /tmp/floppy

Unmount the floppy disk image:

# umount /tmp/floppy

The next step is to burn the floppy image to a CD/DVD-RW media, but in a way that it can be booted afterwards. First create a bootable CD image, and then burn it.

# genisoimage -o bootcd.iso -b FDOEM.144 FDOEM.144
# wodim -v bootcd.iso

You may alternatively add your image to the GRUB menu. Install syslinux and copy memdisk and your image to /boot:

# cp /usr/lib/syslinux/memdisk /boot
# cp FDOEM.144 /boot/flashbios.img

Now add an entry to /boot/grub/menu.lst:

/boot/grub/menu.lst
title Flash BIOS
kernel /memdisk
initrd /flashbios.img

Or for GRUB2 in /boot/grub/grub.cfg:

/boot/grub/grub.cfg
menuentry "Flash BIOS" {
 linux16 /boot/memdisk
 initrd16 /boot/flashbios.img
}

Or for syslinux in /boot/syslinux/syslinux.cfg:

/boot/syslinux/syslinux.cfg
LABEL flashbios
	MENU LABEL Flash BIOS
	LINUX ../memdisk
	INITRD ../fdboot.img

Finally reboot your machine, making sure the CD drive is first in the boot sequence, and run the BIOS upgrade procedure when the CD boots. If using the GRUB method, choose the new entry on the list, and it should boot into FreeDOS.

Bootable optical disk emulation

The script Geteltorito.pl will extract the El Torito boot image. It has worked with Lenovo laptops like the X1 Carbon, X200, X220, X230, X260, X395, W540, T450, T450s and P50. It may work for other vendors as well.

Installation

Install the geteltoritoAUR package.

Usage

Get the bios update iso from the vendor support site. Run the geteltorito image extraction:

$ geteltorito.pl -o <image>.img <image>.iso

Copy the image to the usb thumbdrive:

# dd if=<image>.img of=<destination> bs=512K

Reboot and boot from the USB drive, follow vendor directions.

Note: If you get the message "Secure Flash Authentication failed!", it means that some security check did not allow the flash to happen. It can help to go to the BIOS options page Security > UEFI BIOS Update Option and disable Secure RollBack Prevention and enable Flash BIOS Updating by End-Users. You can set them to what you want after flashing.

Windows PE

If your manufacturer only provides an exe file and you were not successful following the prior advice, you can update your bios creating a Windows PE flash drive and from there flash the bios update as normally.

Usage

Download a ISO Windows PE to create a bootable drive.

Boot the USB and go to your manufacturer website and download the respective update, and execute normally.

Note: This method was tested on an Acer Laptop, your mileage may vary

Vendor specific

HP

Warning: Not all HP BIOSes are the same. A method that may work in one of their models may or may not work in another model.For eg. neither of the below methods work with the HP T730 Thin Client.

Some HP BIOS, especially the ones available in their business lines -- ProDesk 600, EliteDesk 800, Thin Clients (T620, T730 etc) -- have an option to update the BIOS from within the BIOS. This option is usually available under the File Menu and is called "Flash System ROM". There are 2 different directory structures that seem to work. Your BIOS may or may not work with either directory structure.

  1. Placing the BIOS *.bin file in the root of the FAT32 formatted USB drive without any other directories. You do not need any other files.
  2. Using the directory structure as described here

If neither of the above directory structures seem to work, then either use the FreeDOS method if HP provides the relevant DOS executables for your BIOS version or get a Windows machine to first create a HP BIOS Flash Recovery USB and then use that USB to flash the BIOS using the same Flash System ROM option.

Procedure:

  1. Download the BIOS executable from HP's support website using your serial number and indicating Windows as the OS .
  2. The exe file is an archive and can then be extracted using e.g 7z
  3. Create the appropriate directory structure in the USB as described above. If one does not work, try the other
  4. Unmount the USB
  5. Attach it to the computer whose BIOS needs to be upgraded (if using a different computer to create the USB drive)
  6. Reboot the computer and get into the BIOS using the assigned key (e.g. F10) for your BIOS.
  7. Once in the BIOS, find and select the Flash System ROM option. It may provide you with 3 options to flash from
    • USB
    • Hard disk
    • Network
  8. Select the appropriate option (in this case USB) and it will pop up another text box which will have the file name of the BIN file that you put in the root of the USB drive.
  9. Hit Enter and it should indicate that current version of the BIOS and new one being upgraded to.
  10. Follow the screen prompts to upgrade the BIOS and finally reboot.
Note: If you put the *.BIN file under a folder as suggested here, the "Flash System ROM" option is still able to find it. However when you proceed to upgrade the BIOS, it fails after a couple of minutes indicating "ROM is incompatible with the system". If you get this message, make sure that the BIN file is in the root of the USB drive and then try again.

For some models, particularly around the years 2010-2014, unpacking the executable produces a file ending in .fd that contains both the BIOS file and an RSA signature for the file. Instructions have been published on how to extract from the .fd file, and some tools have been published as well. Once these files are extracted and placed on a USB drive, they can be used to perform the update. Sometimes the firmware update user interface makes it possible to navigate to the files, but it may sometimes also be necessary to place them in a particular directory with a particular name. The bios file usually has the suffix .bin and the signature file has the suffix .sig or .s12. The HP ENVY m4-1015dx page provides specific details for one such model.

ASUS

Modern Asus motherboards do not require Windows for firmware update. You can update bios from within bios with in-built utility Ez-Flash. However, they ask you to update ME before updating bios. The problem is that they do not include Linux update tool in the arhive (example).

Even if your bios is at latest version, you need update ME anyway. It is important to avoid hardware problems, such as unable to wake from sleep.

Download the System Tools from here. For this particular motherboard the latest (v15) version did not work (Unknown PCH platform). As recommended here, using v11 version worked. Extract the linux executable from the archive ("CSME System Tools v11 r46/FWUpdate/LINUX64/FWUpdLcl") and place it to the folder with the firmware in archive downloaded from Asus site (MEUpdateTool_11.8.80.3746v5_S/FW/). Make the "FWUpdLcl" executable.

Show usage

$ ./FWUpdLcl

Intel (R) Firmware Update Utility Version: 11.8.92.4222
Copyright (C) 2007 - 2022, Intel Corporation.  All rights reserved.

FWUpdLcl.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-F] [-Y] [-SAVE] 
             [-FWVER] [-PARTID] [-ALLOWSV] [-FORCERESET] [-OEMID] [-PASS] 
             [-PARTVER] 

-H|?                    Displays help screen. 
-VER                    Displays version information. 
-EXP                    Displays example usage of this tool. 
-VERBOSE<file>          Display the debug information of the tool. 
-F <file>               File used for updating the FW. 
-Y                      Automatically answer Yes to prompts. 
-SAVE <file>            Save the current FW to an update image. 
-FWVER<file>            Display the FW Version of current FW or update image. 
-PARTID<Partition ID>   Provide specific Partition ID to perform partial update. 
-ALLOWSV                Allows same version firmware updates. 
-FORCERESET             Automatically Reboots system after update (if needed). 
-OEMID <UUID>           OEM ID needed to perform firmware update. 
-PASS <pass>            MeBX password. Optional with the '-f' option.  
-PARTVER <Partition ID> Display the Version of specific partition.

Show your current ME version:

$ sudo ./FWUpdLcl -FWVER
Intel (R) Firmware Update Utility Version: 11.8.92.4222
Copyright (C) 2007 - 2022, Intel Corporation.  All rights reserved.

FW Version: 11.8.65.3590

Show the ME version of the file in downloaded archive:

$ ./FWUpdLcl -FWVER ME.bin
Intel (R) Firmware Update Utility Version: 11.8.92.4222
Copyright (C) 2007 - 2022, Intel Corporation.  All rights reserved.

FW Version: 11.8.80.3746

Start flashing:

sudo ./FWUpdLcl -F ME.bin
Intel (R) Firmware Update Utility Version: 11.8.92.4222
Copyright (C) 2007 - 2022, Intel Corporation.  All rights reserved.

Communication Mode: MEI
Checking firmware parameters...

Warning: Do not exit the process or power off the machine before the firmware update process ends.
Sending the update image to FW for verification:  [ COMPLETE ] 



FW Update:  [ 100% (/)]Do not Interrupt
FW Update is completed successfully.

To be able to see new version you need reboot. Now you can see the version applied:

sudo ./FWUpdLcl -FWVER
Intel (R) Firmware Update Utility Version: 11.8.92.4222
Copyright (C) 2007 - 2022, Intel Corporation.  All rights reserved.

FW Version: 11.8.80.3746
Note: Alternatively, you can update via uefi shell using FWUpdLcl.efi from the archive.

Lenovo

Some firmware updates are only provided in Windows executable format. This section uses as an example the Lenovo IdeaPad L340-15API firmware. If you try to apply these steps to another system, your mileage may vary. The Lenovo IdeaPad L340-15API only offers a .exe on the Lenovo support site. This renders not just many, but all of the methods in the article futile:

  • Wine: while dangerous, the mentioned IdeaPad firmware failed due to a "TDK library" error. More on this below.
  • fwupd alone does not work because the firmware is not on the LVFS, even if other entries might be, such as the Secure Boot Forbidden Signatures Database (dbx).
  • BiosDisk only works on "BIOS executables" and not our executable. It is also made by Dell, so your mileage could vary with other vendors.
  • Flashrom comes with the specific warning not to use it with laptops. Many systems, and the IdeaPad included, are not supported in their hardware list either.
  • For FreeDOS to work, the firmware would need to be a DOS executable. If your firmware executable is like that of the IdeaPad discussed, it will not run in FreeDOS at all even with modern Windows executables starting with a DOS header.
  • geteltorito.pl only works if you have an ISO.
  • Windows PE, might also yield incompatibility issues. In particular, the installer might not run because it is checking the operating system for compatibility.
  1. The installer. The IdeaPad's firmware download comes in an installer format, specifically set up by Inno Setup. Instead of extracting by running the installer with something like Wine, use the innoextract tool:
    $ innoextract installer.exe
  2. We find inside another executable. This inner IdeaPad executable also does not work in FreeDOS or Windows PE. However, note the earlier mentioned TDK library error. TDK refers to the firmware dev kit made by Phoenix Technologies. It was mentioned on the badcaps forum that the executable itself will extract the contents using the /ext argument. So using Wine, run
    $ wine firmware.exe /ext
    Alternatively, using 7z has been reported as working too:
    $ 7z x firmware.exe
  3. We find ourselves with more .exe files in this .exe file too. None of them work in FreeDOS or Windows PE. However, note that the firmware itself is in a UEFI capsule update format, suggested in bladecoder's blog.
    • In the extracted files, look for the .cap file. You have located the extracted firmware.
    • Alternatively, some models use an .fd file.
  4. With the UEFI capsule in hand, the next step is to try to install it manually. Mentioned in that blog, fwupd can help with this. fwupdate is not provided in the fwupd package, but fwupdtool accomplishes the same task. First, identify the device ID of the firmware:
    # fwupdtool get-devices
  5. Finding the ID in the devices output, use it with a manual install:
    # fwupdtool install-blob BIOS.ext DEVICE-ID
  6. Reboot when prompted. The screen may go completely black: wait for it to finish installing.
  7. The EFI boot list is cleared after the update. First, update your UEFI settings to your previous ones.
  8. Finally, use an external boot media to reinstall your bootloader.