Re: [coreboot] Dualbios on GA-MA770-UD3
On Sun, Apr 25, 2010 at 01:45:19PM +0200, Peter Stuge wrote: xdrudis wrote: They might just use a watchdog: Ok. I'm rereading the link Gigabyte gave me, Please read the US Patent. I wasn't aware. I hadn't read your mail when I wrote mine. I started to read it, but your summary was more useful. As usual claims are so broad (they claim a computer, not merely a BIOS, a whatchdog, some circuit or a motherboard), so broad you can't even buy a CPU, DIMMS and their motherboard and build a PC unless you comply with some license by them, and who would buy a motherboard and not build a PC with it ?. I guess they give you a license for the patent when you buy their motherboard, but then under what terms ? Don't take it as legal advice, IANAL, I guess any judge would narrow the claims to the inventive step or something, just laughing at the tipically silly language. But of course you meant the description, not the claims. Thank you. -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On Sat, Apr 24, 2010 at 08:26:45PM +0200, Patrick Georgi wrote: Am 24.04.2010 19:43, schrieb xdrudis: They might just use a watchdog: - BIOS 1 sets a flag - BIOS 1 configures the watchdog to trigger when it's not touched within 2 seconds (or whatever). watchdog would reboot the system then - BIOS 1 jumps in BIOS 2 - BIOS 2 does whatever it needs to do to consider itself safe - Meanwhile, BIOS 2 touches the watchdog every so often - BIOS 2 deactivates the watchdog In this scenario, coreboot would have to know how to tell the watchdog to reset its countdown, and how to disable the watchdog, to safely use the Dual BIOS feature. Ok. I'm rereading the link Gigabyte gave me, which does not explain enough or I don't understand it enough, but it might be this scenario you explain http://www.gigabyte.com.tw/FileList/NewTech/2006_motherboard_newtech/article_04_bios_explained.htm (the URL says 2006 but it was given to me in a mail in early March 2010) I've noticed they say it reboots before running the other BIOS, it's not just a jump. How would that work ? would it be some flag in CMOS ? This is better, I guess in that it gives both BIOSes the same initial state. It also says the original BIOS checks both BIOS copies, but I guess it doesn't matter since it will only run if coreboot fails, and then you have to reflash it anyway. The feature supposedly shouldn't just guard against non-Gigabyte images, but against issues with their own images, too - and those would have the right signature, and thus would pass any such test. I'd be really amazed if they'd add another chip (that actually costs money) and then only implement an incomplete protection scheme with it. Ok. It makes sense. Thank you for explaining. -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
xdrudis wrote: They might just use a watchdog: Ok. I'm rereading the link Gigabyte gave me, Please read the US Patent. //Peter -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
Thank you for your work on Dual BIOS. What I don't understand is how is this supposed to work. From what you say and what I asked sales cotact staff at gigabyte (no very useful insights) , there are two bios roms. One has the ability to check the other and run it only if it detects it's ok. If it doesn't it flashes itself to it. So if you use one of the BIOS for coreboot it will either be rewriten by the original BIOS or it will boot, depending on which ROM boots first and which ROM you put coreboot in. If you flash the ROM that boots first you can try coreboot, but in case it doesn't work how are you going to jump to the original BIOS ? If you flash the other ROM then apparently the original BIOS will boot and do what it pleases, possibly overwrite coreboot, or assuming you can trick it to believe coreboot is a correct BIOS then maybe jump to it after some initialisation, but will coreboot then have a chance to work from the same state it would in case it had booted first ? Tricking the original BIOS to believe coreboot is a correct image may be hard. In the worst case you may have to break a digital signature without the private key. This is not directly related, but gives an idea of how hard it could be http://invisiblethingslab.com/resources/bh09usa/Attacking Intel BIOS.pdf But assuming you can, will using coreboot after other firmware has set up things far enough to be able to test the ROM where coreboot is in, will that be a sufficient test ? I'm not saying it won't, I have no clue. Anyway, being able to flash both chips is good at the very least in order to have more space for payloads or so. -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
Am 24.04.2010 19:43, schrieb xdrudis: What I don't understand is how is this supposed to work. From what you say and what I asked sales cotact staff at gigabyte (no very useful insights) , there are two bios roms. One has the ability to check the other and run it only if it detects it's ok. If it doesn't it flashes itself to it. So if you use one of the BIOS for coreboot it will either be rewriten by the original BIOS or it will boot, depending on which ROM boots first and which ROM you put coreboot in. If you flash the ROM that boots first you can try coreboot, but in case it doesn't work how are you going to jump to the original BIOS ? They might just use a watchdog: - BIOS 1 sets a flag - BIOS 1 configures the watchdog to trigger when it's not touched within 2 seconds (or whatever). watchdog would reboot the system then - BIOS 1 jumps in BIOS 2 - BIOS 2 does whatever it needs to do to consider itself safe - Meanwhile, BIOS 2 touches the watchdog every so often - BIOS 2 deactivates the watchdog In this scenario, coreboot would have to know how to tell the watchdog to reset its countdown, and how to disable the watchdog, to safely use the Dual BIOS feature. If you flash the other ROM then apparently the original BIOS will boot and do what it pleases, possibly overwrite coreboot, or assuming you can trick it to believe coreboot is a correct BIOS then maybe jump to it after some initialisation, but will coreboot then have a chance to work from the same state it would in case it had booted first ? Tricking the original BIOS to believe coreboot is a correct image may be hard. In the worst case you may have to break a digital signature without the private key. This is not directly related, but gives an idea of how hard it could be The feature supposedly shouldn't just guard against non-Gigabyte images, but against issues with their own images, too - and those would have the right signature, and thus would pass any such test. I'd be really amazed if they'd add another chip (that actually costs money) and then only implement an incomplete protection scheme with it. Regards, Patrick Georgi -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
Patrick Georgi wrote: I'd be really amazed if they'd add another chip (that actually costs money) and then only implement an incomplete protection scheme with it. Yes it's surprising, but Gigabyte does add another flash device. They also appear to rely on security by obscurity. I'm trying to find out if some of the SuperIO and EC registers are under some super secret NDA. Since some of the registers used are not even in the NDA versions of the docs. -Bari -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On 4/24/10 8:26 PM, Patrick Georgi wrote: They might just use a watchdog: - BIOS 1 sets a flag - BIOS 1 configures the watchdog to trigger when it's not touched within 2 seconds (or whatever). watchdog would reboot the system then - BIOS 1 jumps in BIOS 2 - BIOS 2 does whatever it needs to do to consider itself safe - Meanwhile, BIOS 2 touches the watchdog every so often - BIOS 2 deactivates the watchdog In this scenario, coreboot would have to know how to tell the watchdog to reset its countdown, and how to disable the watchdog, to safely use the Dual BIOS feature. And the way to find out would be SerialICE: http://www.serialice.com/ Best regards, Stefan -- coresystems GmbH • Brahmsstr. 16 • D-79104 Freiburg i. Br. Tel.: +49 761 7668825 • Fax: +49 761 7664613 Email: i...@coresystems.de • http://www.coresystems.de/ Registergericht: Amtsgericht Freiburg • HRB 7656 Geschäftsführer: Stefan Reinauer • Ust-IdNr.: DE245674866 -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
Vadim Girlin wrote: Please, post any info you have that can help me. This has been discussed a few times before. Gigabyte holds a patent for this technology. See http://www.mail-archive.com/linuxb...@linuxbios.org/msg05929.html for the link. The patent describes how the DualBIOS scheme works. There is a timing circuit and a special handshake. The board starts up with one chip selected, and if the handshake is performed by the BIOS before timeout then the system starts normally. In case of a timeout, the timing circuit resets the board, activates the second flash chip, and then releases reset to attempt startup with the new flash chip. Details of the handshake are not included in the patent, and I expect them to vary by board. GA-M57SLI-S4 has pads for the timing circuit, but parts are not populated. Me and Reinder investigated how the M57SLI board works, details can be inferred from http://stuge.se/m57sli/ On the M57SLI the timing circuit was drawn quite far away from the flash chips - with components totally unrelated to the superio - it was located underneath the battery holder. I think it will be difficult to learn the handshake details from looking at the board, and I do believe SerialICE can be helpful here. //Peter -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On 04/12/2010 05:58 PM, Andriy Gapon wrote: on 09/04/2010 19:52 Vadim Girlin said the following: Here is code fragment I mentioned - some bit is set then reset: (Not sure now that this code runs at all) Vadim, cool work! BTW: http://www.rom.by/forum/Gigabyte_DualBIOS :-) I've seen that when I was trying to find some info. Any way, it was about IT8718, mine is 8720. That is why I wrote that my patch should work for both of them - IT8718 and IT8720 -- Best regards, Vadim Girlin -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On 04/12/2010 05:58 PM, Andriy Gapon wrote: on 09/04/2010 19:52 Vadim Girlin said the following: Here is code fragment I mentioned - some bit is set then reset: (Not sure now that this code runs at all) Vadim, cool work! BTW: http://www.rom.by/forum/Gigabyte_DualBIOS :-) I've seen that when I was trying to find some info. Any way, it was about IT8718, mine is 8720. That is why I wrote that my patch should work for both of them - IT8718 and IT8720 -- Best regards, Vadim Girlin -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
on 09/04/2010 19:52 Vadim Girlin said the following: Here is code fragment I mentioned - some bit is set then reset: (Not sure now that this code runs at all) Vadim, cool work! BTW: http://www.rom.by/forum/Gigabyte_DualBIOS :-) -- Andriy Gapon -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
Hi Vadim, thanks for your mail. I have added the flashrom mailing list in CC: because we should develop a generic way to handle DualBIOS and similar techniques. On 09.04.2010 08:12, Vadim Girlin wrote: I'm going to try coreboot on Gigabyte GA-MA770-UD3. It's AMD 770 (RX780 / SB700). My motherboard supports hardware dual bios - with two chips on it. I'm going to try flashing backup chip and boot from it. It seems to be possible - I've tested it (flashing at least). Chips on this board could be switched by changing bit 0 at undocumented register EF on LDN 7 of IT8720. I can use slightly patched flashrom for accessing any chip I want without any problems. And this is tested many times. My idea is to use backup chip for debugging - that always keeps my chance to reboot from main bios chip. And removes the need for desoldering etc. And second problem is that original bios is checking second chip - and trying to recover it by flashing the bios from main chip on reboot? rewriting coreboot. AFAICS this could be solved by including some signatures etc. It seems to be easy to find out. May be someone is working on this? BTW I can send the patch for flashrom - but I think that with information I mentioned above somebody could make it much better than my ugly hack. I hope the regs should be the same for all latest Gigabyte MBs using IT8720/18 It would be great if you could send that patch. It will help us make a flashrom design decision that works for all boards with multiple flash chips. By the way, some of us have good contacts at ITE, so we can ask ITE for details about the undocumented registers. Regards, Carl-Daniel -- http://www.hailfinger.org/ -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On 09.04.2010 14:35, Andriy Gapon wrote: on 09/04/2010 15:18 Carl-Daniel Hailfinger said the following: By the way, some of us have good contacts at ITE, so we can ask ITE for details about the undocumented registers. BTW: http://www.flashrom.org/pipermail/flashrom/2009-September/000542.html Doesn't look like anybody showed interest that time. I'm very sorry about that. Your mail is still on my huge TODO list (final university exams are eating up my time). Two weeks from now I'll finally have time to start tackling all flashrom TODOs. Regards, Carl-Daniel -- http://www.hailfinger.org/ -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
on 09/04/2010 15:42 Carl-Daniel Hailfinger said the following: On 09.04.2010 14:35, Andriy Gapon wrote: on 09/04/2010 15:18 Carl-Daniel Hailfinger said the following: By the way, some of us have good contacts at ITE, so we can ask ITE for details about the undocumented registers. BTW: http://www.flashrom.org/pipermail/flashrom/2009-September/000542.html Doesn't look like anybody showed interest that time. I'm very sorry about that. Your mail is still on my huge TODO list (final university exams are eating up my time). Two weeks from now I'll finally have time to start tackling all flashrom TODOs. No problem, I frequently find myself in the same situation. -- Andriy Gapon -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
on 09/04/2010 15:18 Carl-Daniel Hailfinger said the following: By the way, some of us have good contacts at ITE, so we can ask ITE for details about the undocumented registers. BTW: http://www.flashrom.org/pipermail/flashrom/2009-September/000542.html Doesn't look like anybody showed interest that time. -- Andriy Gapon -- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
Re: [coreboot] Dualbios on GA-MA770-UD3
On 04/09/2010 04:18 PM, Carl-Daniel Hailfinger wrote:
Hi Vadim,
thanks for your mail. I have added the flashrom mailing list in CC:
because we should develop a generic way to handle DualBIOS and similar
techniques.
On 09.04.2010 08:12, Vadim Girlin wrote:
I'm going to try coreboot on Gigabyte GA-MA770-UD3.
It's AMD 770 (RX780 / SB700).
My motherboard supports hardware dual bios - with two chips on it.
I'm going to try flashing backup chip and boot from it. It seems to be
possible - I've tested it (flashing at least). Chips on this board could
be switched by changing bit 0 at undocumented register EF on LDN 7 of
IT8720. I can use slightly patched flashrom for accessing any chip I
want without any problems. And this is tested many times.
My idea is to use backup chip for debugging - that always keeps my
chance to reboot from main bios chip. And removes the need for
desoldering etc.
And second problem is that original bios is checking second chip - and
trying to recover it by flashing the bios from main chip on reboot?
rewriting coreboot. AFAICS this could be solved by including some
signatures etc. It seems to be easy to find out. May be someone is
working on this?
BTW I can send the patch for flashrom - but I think that with
information I mentioned above somebody could make it much better than my
ugly hack. I hope the regs should be the same for all latest Gigabyte
MBs using IT8720/18
It would be great if you could send that patch. It will help us make a
flashrom design decision that works for all boards with multiple flash
chips.
OK, I'm sending the patch for flashrom - but it is based on RE and needs
careful testing.
It works fine on GA-MA770-UD3 (rev 1.0) but should be tested with other MBs.
Anyway I hope it should work for all latest Gigabyte MBs with dual bios
chips connected through IT8720/18.
I think it's not ready for inclusion in flashrom - it probably should be
done in more safe and generic way.
Probably it should check for default values in regs etc.
It may be used as following:
flashrom -p it87spi:gbdualindex=0 ...
flashrom -p it87spi:gbdualindex=1 ...
This value needs to be set only once and further ops on selected chip
can be performed without parameters.
Index: it87spi.c
===
--- it87spi.c (revision 992)
+++ it87spi.c (working copy)
@@ -155,6 +155,28 @@
sio_write(port, 0x65, (flashport 0xff));
free(portpos);
}
+
+ portpos = extract_param(programmer_param,
+ gbdualindex=, ,:);
+ if (portpos) {
+ int chip_index = strtol(portpos, (char **)NULL,
0);
+ if ((chip_index!=0) (chip_index!=1)) {
+ msg_perr(Dual bios: Invalid chip index
requested: %d\n,chip_index);
+ flashport=0;
+ } else {
+ tmp=sio_read(port,0xEF);
+ msg_pinfo(Dual bios: Current chip :
%d\n,tmp1);
+ if (chip_index!=(tmp1)) {
+
sio_write(port,0xEF,(tmp0xFE)|chip_index);
+ tmp=sio_read(port,0xEF)1;
+ if (tmp!=chip_index) {
+ msg_perr(Dual bios:
Chip selection failed.\n);
+ flashport=0;
+ } else msg_pinfo(Dual bios:
Selected chip: %d\n,tmp1);
+ }
+ }
+ free(portpos);
+ }
}
exit_conf_mode_ite(port);
break;
By the way, some of us have good contacts at ITE, so we can ask ITE for
details about the undocumented registers.
That could be very helpful for me. This register (LDN 7 reg EF) seems to
be very interesting. Bit 0 is chip select, but also bits 2,4,5,6 are
used in bios code. Bit 6 probably is some watchdog setting - setting it
on with resetting other bits causes reboot in ~ a second.
Also there is some moment in bios code about test reg 2F @ LDN F4 - it
is toggled in some place and this could be important - may be enabling
some undocumented features.
Another interesting moment is checking for status of RI2 event (LDN 4
reg F1 bit 1) - it's almost first op in bios startup code. AFAICS RI2
event causes switch to chip 1 (Backup) and reboot - but there is no COM2
port on that board. And settings at reg 29 after boot told me that RI2
pin is switched to GPIO mode. So it is probably some debugging
Re: [coreboot] Dualbios on GA-MA770-UD3
That could be very helpful for me. This register (LDN 7 reg EF) seems to be very interesting. Bit 0 is chip select, but also bits 2,4,5,6 are used in bios code. Bit 6 probably is some watchdog setting - setting it on with resetting other bits causes reboot in ~ a second. Hm the LDN 7 EF is not documented in old 0.4 version of datasheet. Also there is some moment in bios code about test reg 2F @ LDN F4 - it is toggled in some place and this could be important - may be enabling some undocumented features. Yes no docs again, Another interesting moment is checking for status of RI2 event (LDN 4 reg F1 bit 1) - it's almost first op in bios startup code. AFAICS RI2 event causes switch to chip 1 (Backup) and reboot - but there is no COM2 port on that board. And settings at reg 29 after boot told me that RI2 pin is switched to GPIO mode. So it is probably some debugging feature - if we find the way to set RI2 event then it seems to be an easy way to boot from backup bios. This bit is marked reserved. BTW all info I have on this is from it8718 datasheet, but it seems that the code is same for 8718 and 8720. Hmm the LDN F4 is really some debug feature... Maybe someone should get new datasheet ;) Rudolf Here is a dump of all regs of superio chip - may be it will help: entered cfg 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 0 0 0 0 0 0 0 F4 0 0 0 0 0 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 selected LDN 0x00 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 60 3 F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 70 6 2 0 0 2 4 0 0 0 0 0 0 0 0 0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 selected LDN 0x01 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 60 3 F8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 70 4 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 50 50 50 0 0 0 0 0 0 0 0 0 0 0 0 selected LDN 0x02 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 70 0 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 50 50 50 0 0 0 0 0 0 0 0 0 0 0 0 selected LDN 0x03 0
Re: [coreboot] Dualbios on GA-MA770-UD3
On 04/09/2010 07:56 PM, Rudolf Marek wrote: That could be very helpful for me. This register (LDN 7 reg EF) seems to be very interesting. Bit 0 is chip select, but also bits 2,4,5,6 are used in bios code. Bit 6 probably is some watchdog setting - setting it on with resetting other bits causes reboot in ~ a second. Hm the LDN 7 EF is not documented in old 0.4 version of datasheet. Also there is some moment in bios code about test reg 2F @ LDN F4 - it is toggled in some place and this could be important - may be enabling some undocumented features. Yes no docs again, Here is code fragment I mentioned - some bit is set then reset: (Not sure now that this code runs at all) seg003:E581 mov al, 7 seg003:E583 mov dx, 2Eh ; '.' seg003:E586 out dx, al seg003:E587 mov al, 0F4h ; '¯' ; LDN F4h ? seg003:E589 inc dx seg003:E58A out dx, al seg003:E58B dec dx seg003:E58C mov al, 2Fh ; '/' seg003:E58E out dx, al seg003:E58F mov al, 4 seg003:E591 inc dx seg003:E592 out dx, al ; write 2F = 4 seg003:E593 dec dx seg003:E594 mov cx, 0Ah seg003:E597 seg003:E597 delay2: ; CODE XREF: seg003:E599j seg003:E597 out 0EBh, al seg003:E599 loopdelay2 seg003:E59B mov al, 2Fh ; '/' seg003:E59D out dx, al seg003:E59E mov al, 0 seg003:E5A0 inc dx seg003:E5A1 out dx, al ; write 2F = 0 seg003:E5A2 mov dx, 2Eh ; '.' seg003:E5A5 mov al, 2 ; sio exit seg003:E5A7 out dx, al seg003:E5A8 out 0EBh, al seg003:E5AA inc dx seg003:E5AB mov al, 2 seg003:E5AD out dx, al Another interesting moment is checking for status of RI2 event (LDN 4 reg F1 bit 1) - it's almost first op in bios startup code. AFAICS RI2 event causes switch to chip 1 (Backup) and reboot - but there is no COM2 port on that board. And settings at reg 29 after boot told me that RI2 pin is switched to GPIO mode. So it is probably some debugging feature - if we find the way to set RI2 event then it seems to be an easy way to boot from backup bios. This bit is marked reserved. Here is info from datasheet that I found. It is Preliminary Specification V0.3 for IT8718F: LDN 04 APC/PME Status Register (PSR) (Index=F1h, Default=00h) ... bitdesc 40: No PS/2 Mouse Event Detected 1: PS/2 Mouse Event Detected 30: No Keyboard Event Detected 1: Keyboard Event Detected 20: No RI2# Event Detected 1: RI2# Event Detected 10: No RI1# Event Detected 1: RI1# Event Detected 00: No CIR event Detected 1: CIR event Detected So it seems that bit 2 is RI2 Event. It's first what is tested in bios code. Here is code fragment - it runs at very early startup - before initializing CPU, HT etc: seg003:447C loc_F447C: ; DATA XREF: seg003:off_F447Ao seg003:447C mov dx, 2Eh ; '.' ; enter SIO cfg mode seg003:447F mov al, 87h ; 'Ç' seg003:4481 out dx, al seg003:4482 mov al, 1 seg003:4484 out dx, al seg003:4485 mov al, 55h ; 'U' seg003:4487 out dx, al seg003:4488 mov al, 55h ; 'U' seg003:448A out dx, al seg003:448B mov cl, 4 seg003:448D mov dx, 2Eh ; '.' seg003:4490 mov al, 7 seg003:4492 out dx, al seg003:4493 out 0EBh, al seg003:4495 inc dx seg003:4496 mov al, cl seg003:4498 out dx, al ; select LDN 4 - EC seg003:4499 out 0EBh, al seg003:449B mov cl, 0F1h ; '¸' seg003:449D mov al, cl seg003:449F mov dx, 2Eh ; '.' seg003:44A2 out dx, al seg003:44A3 out 0EBh, al seg003:44A5 inc dx seg003:44A6 in al, dx ; read F1 - APC/PME Status seg003:44A7 out 0EBh, al seg003:44A9 testal, 4 ; check bit 2 - RI2# Event seg003:44AB jz short sio_exit_0 seg003:44AD mov cl, 7 seg003:44AF mov dx, 2Eh ; '.' seg003:44B2 mov al, 7 seg003:44B4 out dx, al seg003:44B5 out 0EBh, al seg003:44B7 inc dx seg003:44B8 mov al, cl
