What is SPI flash in BIOS firmware?
Explains SPI flash in BIOS firmware: flash chip, descriptor, regions, BIOS region, NVRAM, FV layout, update flow, and wrong-image debugging.
SPI flash is the non-volatile chip that stores platform firmware. It may contain BIOS/UEFI code, NVRAM or variable store data, flash layout information, and sometimes other regions such as ME or GbE depending on the platform.
When people say “flash the BIOS”, they often mean an update file. In real firmware debugging, you need to separate the SPI flash chip, full SPI image, Flash Descriptor, BIOS Region, Firmware Volume, and UEFI variable store.
What can SPI flash contain?
On many PC and embedded x86 platforms, SPI flash is split into regions.
| Region | Role | What can fail |
|---|---|---|
| Flash Descriptor | Describes region layout and access permissions | Tools cannot write or use the wrong offset |
| BIOS Region | Contains the main UEFI firmware | Firmware does not change if the wrong region is flashed |
| ME/TXE Region | Management engine firmware | Copying from another board can break platform behavior |
| GbE Region | MAC and NIC related data | MAC address or network behavior is lost |
| NVRAM/Variable Store | Stores UEFI variables | BootOrder, Setup, or Secure Boot keys disappear or corrupt |
| OEM/Platform Data | Vendor-specific board data | Factory data is lost when flashing the wrong full image |
Not every platform has all of these regions. ARM and embedded platforms may use different layouts, but the debugging principle is the same: identify whether the file is a full image, a region image, or a capsule.
From SPI flash to firmware module
SPI flash chip
Non-volatile storage on the board.
Flash Descriptor
Defines region map and access permissions.
BIOS Region
Holds the main UEFI firmware.
Firmware Volume
Container for FFS files.
FFS File
Firmware module or data file.
FFS Section
PE32, TE, DEPEX, RAW, UI, or another section type.
Full SPI image, BIOS region image, and capsule
| Type | Usually contains | Risk |
|---|---|---|
| Full SPI image | Descriptor plus multiple regions | Can overwrite board-specific data |
| BIOS Region image | Only the BIOS Region | Wrong if the tool expects a full image |
| Capsule/update package | Signed or wrapped update payload | Cannot be flashed raw as a region image |
| FV image | One Firmware Volume | Only a part inside BIOS Region |
| FFS File | One module or data file | Not a directly flashable image |
When you receive a .bin or .cap file, the first question should be: which layer does this file represent?
Common wrong-flash failures
Practical failures include:
- The flash tool reports success, but the board still runs the old firmware.
- A BIOS Region image is treated as a full SPI image.
- A full image from another board overwrites MAC, serial number, board ID, or calibration data.
- BIOS update preserves NVRAM, so old BootOrder or Setup problems remain.
- A capsule is flashed raw and the platform no longer recognizes it correctly.
- Descriptor or protected ranges block writes, but the tool log is not clear enough.
Real debug case: flashing succeeds but the version does not change
You flash a file with a vendor tool or programmer. The tool reports success, but BIOS Setup still shows the old version.
Check in this order:
- Identify whether the file is a capsule, BIOS region, or full SPI image.
- Read back SPI flash after programming and compare bytes.
- Check whether the write offset matches BIOS Region.
- Check descriptor access, BIOS lock, and protected ranges.
- Check whether the platform has dual BIOS, backup bank, or recovery bank.
- Check which FV or variable BIOS Setup reads for the version string.
- If update preserves NVRAM, check whether the version string is code data or variable data.
What to look for in source or tool logs
SPI flash debugging checklist
Security angle
SPI flash stores code and policy that run before the OS. If region protection is too open, a buggy tool or attacker may write BIOS Region or NVRAM. If the lock policy is too early or too strict, legitimate updates may fail. Review update flow, SMM write path, descriptor permissions, and protected ranges together.
Takeaway
SPI flash is the physical storage layer for firmware, but it contains several logical layers. When debugging BIOS update or firmware image issues, first identify the scope: full SPI, BIOS Region, FV, FFS, or capsule. Many “flash did not work” bugs are actually wrong-layer or wrong-region bugs.
Found this article useful?
Share it with someone learning firmware, BIOS/UEFI, or embedded systems, or support the author.
Biến note thành bài viết hoàn chỉnh
Notes là nơi ghi nhanh khái niệm.