Submitter | Vadim Girlin |
---|---|
Date | 2010-04-09 15:08:21 |
Message ID | <4BBF42E5.3030906@gmail.com> |
Download | mbox | patch |
Permalink | /patch/1210/ |
State | Not Applicable |
Headers | show |
Comments
> That could be very helpful for me. This register (LDN 7 reg EF) seems to > be very interesting. Bit 0 is chip select, but also bits 2,4,5,6 are > used in bios code. Bit 6 probably is some watchdog setting - setting it > on with resetting other bits causes reboot in ~ a second. Hm the LDN 7 EF is not documented in old 0.4 version of datasheet. > Also there is some moment in bios code about test reg 2F @ LDN F4 - it > is toggled in some place and this could be important - may be enabling > some undocumented features. Yes no docs again, > > Another interesting moment is checking for status of RI2 event (LDN 4 > reg F1 bit 1) - it's almost first op in bios startup code. AFAICS RI2 > event causes switch to chip 1 (Backup) and reboot - but there is no COM2 > port on that board. And settings at reg 29 after boot told me that RI2 > pin is switched to GPIO mode. So it is probably some debugging feature - > if we find the way to set RI2 event then it seems to be an easy way to > boot from backup bios. This bit is marked reserved. > BTW all info I have on this is from it8718 datasheet, but it seems that > the code is same for 8718 and 8720. > Hmm the LDN F4 is really some debug feature... Maybe someone should get new datasheet ;) Rudolf > Here is a dump of all regs of superio chip - may be it will help: > > entered cfg > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 F4 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x00 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 3 F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 6 2 0 0 2 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x01 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 3 F8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 4 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 50 50 50 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x02 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 50 50 50 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x03 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 3 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 3 78 0 0 0 80 0 0 0 0 0 0 0 0 0 0 > 70 7 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x04 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 4 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 2 28 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 8 8 2A 80 88 3E 1B 0 0 0 0 0 0 0 0 0 > selected LDN 0x05 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 5 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 60 0 64 0 0 0 0 0 0 0 0 0 0 0 0 > 70 1 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 48 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x06 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 6 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 C 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x07 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 7 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 2 20 2 38 0 0 0 0 0 0 0 0 0 0 > 70 0 1 0 38 0 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 80 0 0 40 1 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 3E 3E 7E > F0 0 0 0 0 0 0 26 0 0 0 0 0 8C 0 0 0 > selected LDN 0x08 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 8 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x09 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 9 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0A > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 A 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 3 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 B 2 0 0 4 4 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 6 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0B > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 B 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0C > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 C 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0D > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 D 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0E > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 E 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0x0F > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 F 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > selected LDN 0xF4 > 0 1 2 3 4 5 6 7 8 9 A B C D E F > 0 0 0 0 0 0 0 0 F4 0 0 0 0 0 0 0 0 > 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 20 87 20 5 40 3A 0 10 0 40 80 0 0 1 0 0 0 > 30 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 70 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 80 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > 90 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > A0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > B0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > D0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 > left cfg > > >> Regards, >> Carl-Daniel >> >> > >
> Also there is some moment in bios code about test reg 2F @ LDN F4 - it > is toggled in some place and this could be important - may be enabling > some undocumented features. The test register is only RW when written from LDN F4. Thanks, Rudolf
On 04/09/2010 07:56 PM, Rudolf Marek wrote: >> That could be very helpful for me. This register (LDN 7 reg EF) seems to >> be very interesting. Bit 0 is chip select, but also bits 2,4,5,6 are >> used in bios code. Bit 6 probably is some watchdog setting - setting it >> on with resetting other bits causes reboot in ~ a second. > > Hm the LDN 7 EF is not documented in old 0.4 version of datasheet. > >> Also there is some moment in bios code about test reg 2F @ LDN F4 - it >> is toggled in some place and this could be important - may be enabling >> some undocumented features. > > Yes no docs again, Here is code fragment I mentioned - some bit is set then reset: (Not sure now that this code runs at all) seg003:E581 mov al, 7 seg003:E583 mov dx, 2Eh ; '.' seg003:E586 out dx, al seg003:E587 mov al, 0F4h ; '¯' ; LDN F4h ? seg003:E589 inc dx seg003:E58A out dx, al seg003:E58B dec dx seg003:E58C mov al, 2Fh ; '/' seg003:E58E out dx, al seg003:E58F mov al, 4 seg003:E591 inc dx seg003:E592 out dx, al ; write 2F = 4 seg003:E593 dec dx seg003:E594 mov cx, 0Ah seg003:E597 seg003:E597 delay2: ; CODE XREF: seg003:E599j seg003:E597 out 0EBh, al seg003:E599 loop delay2 seg003:E59B mov al, 2Fh ; '/' seg003:E59D out dx, al seg003:E59E mov al, 0 seg003:E5A0 inc dx seg003:E5A1 out dx, al ; write 2F = 0 seg003:E5A2 mov dx, 2Eh ; '.' seg003:E5A5 mov al, 2 ; sio exit seg003:E5A7 out dx, al seg003:E5A8 out 0EBh, al seg003:E5AA inc dx seg003:E5AB mov al, 2 seg003:E5AD out dx, al > >> >> Another interesting moment is checking for status of RI2 event (LDN 4 >> reg F1 bit 1) - it's almost first op in bios startup code. AFAICS RI2 >> event causes switch to chip 1 (Backup) and reboot - but there is no COM2 >> port on that board. And settings at reg 29 after boot told me that RI2 >> pin is switched to GPIO mode. So it is probably some debugging feature - >> if we find the way to set RI2 event then it seems to be an easy way to >> boot from backup bios. > > This bit is marked reserved. Here is info from datasheet that I found. It is "Preliminary Specification V0.3" for IT8718F: LDN 04 APC/PME Status Register (PSR) (Index=F1h, Default=00h) ... bit desc 4 0: No PS/2 Mouse Event Detected 1: PS/2 Mouse Event Detected 3 0: No Keyboard Event Detected 1: Keyboard Event Detected 2 0: No RI2# Event Detected 1: RI2# Event Detected 1 0: No RI1# Event Detected 1: RI1# Event Detected 0 0: No CIR event Detected 1: CIR event Detected So it seems that bit 2 is RI2 Event. It's first what is tested in bios code. Here is code fragment - it runs at very early startup - before initializing CPU, HT etc: seg003:447C loc_F447C: ; DATA XREF: seg003:off_F447Ao seg003:447C mov dx, 2Eh ; '.' ; enter SIO cfg mode seg003:447F mov al, 87h ; 'Ç' seg003:4481 out dx, al seg003:4482 mov al, 1 seg003:4484 out dx, al seg003:4485 mov al, 55h ; 'U' seg003:4487 out dx, al seg003:4488 mov al, 55h ; 'U' seg003:448A out dx, al seg003:448B mov cl, 4 seg003:448D mov dx, 2Eh ; '.' seg003:4490 mov al, 7 seg003:4492 out dx, al seg003:4493 out 0EBh, al seg003:4495 inc dx seg003:4496 mov al, cl seg003:4498 out dx, al ; select LDN 4 - EC seg003:4499 out 0EBh, al seg003:449B mov cl, 0F1h ; '¸' seg003:449D mov al, cl seg003:449F mov dx, 2Eh ; '.' seg003:44A2 out dx, al seg003:44A3 out 0EBh, al seg003:44A5 inc dx seg003:44A6 in al, dx ; read F1 - APC/PME Status seg003:44A7 out 0EBh, al seg003:44A9 test al, 4 ; check bit 2 - RI2# Event seg003:44AB jz short sio_exit_0 seg003:44AD mov cl, 7 seg003:44AF mov dx, 2Eh ; '.' seg003:44B2 mov al, 7 seg003:44B4 out dx, al seg003:44B5 out 0EBh, al seg003:44B7 inc dx seg003:44B8 mov al, cl seg003:44BA out dx, al ; select LDN 7 - GPIO seg003:44BB out 0EBh, al seg003:44BD mov cl, 0EFh ; 'ÿ' ; reg EF seg003:44BF mov al, cl seg003:44C1 mov dx, 2Eh ; '.' seg003:44C4 out dx, al seg003:44C5 out 0EBh, al seg003:44C7 inc dx seg003:44C8 in al, dx ; read EF seg003:44C9 out 0EBh, al seg003:44CB test al, 1 ; test bit 0 seg003:44CD jnz short sio_exit_0 seg003:44CF mov cl, 0EFh ; 'ÿ' seg003:44D1 mov al, cl seg003:44D3 mov dx, 2Eh ; '.' seg003:44D6 out dx, al seg003:44D7 out 0EBh, al seg003:44D9 inc dx seg003:44DA in al, dx ; read EF seg003:44DB out 0EBh, al seg003:44DD or al, 1 ; set bit 0 seg003:44DF mov ah, al seg003:44E1 mov dx, 2Eh ; '.' seg003:44E4 mov al, cl seg003:44E6 out dx, al ; write EF seg003:44E7 out 0EBh, al seg003:44E9 mov al, ah seg003:44EB inc dx seg003:44EC out dx, al seg003:44ED out 0EBh, al seg003:44EF mov al, 2 seg003:44F1 mov dx, 0CF9h ; reset seg003:44F4 out dx, al seg003:44F5 mov al, 6 seg003:44F7 out dx, al > >> BTW all info I have on this is from it8718 datasheet, but it seems that >> the code is same for 8718 and 8720. >> > > Hmm the LDN F4 is really some debug feature... Maybe someone should > get new datasheet ;) > > Rudolf > >
on 09/04/2010 19:52 Vadim Girlin said the following: > Here is code fragment I mentioned - some bit is set then reset: > (Not sure now that this code runs at all) Vadim, cool work! BTW: http://www.rom.by/forum/Gigabyte_DualBIOS :-)
On 04/12/2010 05:58 PM, Andriy Gapon wrote: > on 09/04/2010 19:52 Vadim Girlin said the following: >> Here is code fragment I mentioned - some bit is set then reset: >> (Not sure now that this code runs at all) > > Vadim, > cool work! > > BTW: > http://www.rom.by/forum/Gigabyte_DualBIOS > :-) > I've seen that when I was trying to find some info. Any way, it was about IT8718, mine is 8720. That is why I wrote that my patch should work for both of them - IT8718 and IT8720
On 04/12/2010 05:58 PM, Andriy Gapon wrote: > on 09/04/2010 19:52 Vadim Girlin said the following: >> Here is code fragment I mentioned - some bit is set then reset: >> (Not sure now that this code runs at all) > > Vadim, > cool work! > > BTW: > http://www.rom.by/forum/Gigabyte_DualBIOS > :-) > I've seen that when I was trying to find some info. Any way, it was about IT8718, mine is 8720. That is why I wrote that my patch should work for both of them - IT8718 and IT8720
On 04/09/2010 08:05 PM, Rudolf Marek wrote: >> Also there is some moment in bios code about test reg 2F @ LDN F4 - it >> is toggled in some place and this could be important - may be enabling >> some undocumented features. > > The test register is only RW when written from LDN F4. > > Thanks, > Rudolf Sorry, it seems that I should not send any dumps of bios code to this list. It is mentioned on the page on flashrom.com - but not on the page about mailing list on coreboot.com. I've seen this only now. Probably you should mention it on the page about mailing list on coreboot.com. I hope it's not a big problem.
On 13.04.2010 19:18, Vadim Girlin wrote: > On 04/09/2010 08:05 PM, Rudolf Marek wrote: > >>> Also there is some moment in bios code about test reg 2F @ LDN F4 - it >>> is toggled in some place and this could be important - may be enabling >>> some undocumented features. >>> >> The test register is only RW when written from LDN F4. >> >> > Sorry, it seems that I should not send any dumps of bios code to this > list. It is mentioned on the page on flashrom.com - but not on the page > about mailing list on coreboot.com. > > I've seen this only now. Probably you should mention it on the page > about mailing list on coreboot.com. > > I hope it's not a big problem. > Logs and output from flashrom/superiotool/lspci are OK. Only BIOS images ("dumps") retrieved with "flashrom -r" or downloaded from the vendor website are problematic. Regards, Carl-Daniel
Thank you for your work on Dual BIOS. What I don't understand is how is this supposed to work. From what you say and what I asked sales cotact staff at gigabyte (no very useful insights) , there are two bios roms. One has the ability to check the other and run it only if it detects it's ok. If it doesn't it flashes itself to it. So if you use one of the BIOS for coreboot it will either be rewriten by the original BIOS or it will boot, depending on which ROM boots first and which ROM you put coreboot in. If you flash the ROM that boots first you can try coreboot, but in case it doesn't work how are you going to jump to the original BIOS ? If you flash the other ROM then apparently the original BIOS will boot and do what it pleases, possibly overwrite coreboot, or assuming you can trick it to believe coreboot is a correct BIOS then maybe jump to it after some initialisation, but will coreboot then have a chance to work from the same state it would in case it had booted first ? Tricking the original BIOS to believe coreboot is a correct image may be hard. In the worst case you may have to break a digital signature without the private key. This is not directly related, but gives an idea of how hard it could be http://invisiblethingslab.com/resources/bh09usa/Attacking Intel BIOS.pdf But assuming you can, will using coreboot after other firmware has set up things far enough to be able to test the ROM where coreboot is in, will that be a sufficient test ? I'm not saying it won't, I have no clue. Anyway, being able to flash both chips is good at the very least in order to have more space for payloads or so.
Am 24.04.2010 19:43, schrieb xdrudis: > What I don't understand is how is this supposed to work. > > From what you say and what I asked sales cotact staff at gigabyte (no > very useful insights) , there are two bios roms. One has the ability > to check the other and run it only if it detects it's ok. If it > doesn't it flashes itself to it. > > So if you use one of the BIOS for coreboot it will either be rewriten > by the original BIOS or it will boot, depending on which ROM boots > first and which ROM you put coreboot in. > > If you flash the ROM that boots first you can try coreboot, but in case > it doesn't work how are you going to jump to the original BIOS ? They might just use a watchdog: - BIOS 1 sets a flag - BIOS 1 configures the watchdog to trigger when it's not touched within 2 seconds (or whatever). watchdog would reboot the system then - BIOS 1 jumps in BIOS 2 - BIOS 2 does whatever it needs to do to consider itself "safe" - Meanwhile, BIOS 2 touches the watchdog every so often - BIOS 2 deactivates the watchdog In this scenario, coreboot would have to know how to tell the watchdog to reset its countdown, and how to disable the watchdog, to safely use the Dual BIOS feature. > If you flash the other ROM then apparently the original BIOS will boot > and do what it pleases, possibly overwrite coreboot, or assuming you can trick > it to believe coreboot is a correct BIOS then maybe jump to it after > some initialisation, but will coreboot then have a chance to work from the > same state it would in case it had booted first ? > > Tricking the original BIOS to believe coreboot is a correct image may be hard. > In the worst case you may have to break a digital signature without the private key. > This is not directly related, but gives an idea of how hard it could be The feature supposedly shouldn't just guard against non-Gigabyte images, but against issues with their own images, too - and those would have the right signature, and thus would pass any such test. I'd be really amazed if they'd add another chip (that actually costs money) and then only implement an incomplete protection scheme with it. Regards, Patrick Georgi
Patrick Georgi wrote: > I'd be really amazed if they'd add another chip (that actually costs > money) and then only implement an incomplete protection scheme with it. > Yes it's surprising, but Gigabyte does add another flash device. They also appear to rely on security by obscurity. I'm trying to find out if some of the SuperIO and EC registers are under some super secret NDA. Since some of the registers used are not even in the NDA versions of the docs. -Bari
On 4/24/10 8:26 PM, Patrick Georgi wrote: > They might just use a watchdog: > - BIOS 1 sets a flag > - BIOS 1 configures the watchdog to trigger when it's not touched within > 2 seconds (or whatever). watchdog would reboot the system then > - BIOS 1 jumps in BIOS 2 > - BIOS 2 does whatever it needs to do to consider itself "safe" > - Meanwhile, BIOS 2 touches the watchdog every so often > - BIOS 2 deactivates the watchdog > > In this scenario, coreboot would have to know how to tell the watchdog > to reset its countdown, and how to disable the watchdog, to safely use > the Dual BIOS feature. > > And the way to find out would be SerialICE: http://www.serialice.com/ Best regards, Stefan
On Sat, Apr 24, 2010 at 08:26:45PM +0200, Patrick Georgi wrote: > Am 24.04.2010 19:43, schrieb xdrudis: > They might just use a watchdog: > - BIOS 1 sets a flag > - BIOS 1 configures the watchdog to trigger when it's not touched within > 2 seconds (or whatever). watchdog would reboot the system then > - BIOS 1 jumps in BIOS 2 > - BIOS 2 does whatever it needs to do to consider itself "safe" > - Meanwhile, BIOS 2 touches the watchdog every so often > - BIOS 2 deactivates the watchdog > > In this scenario, coreboot would have to know how to tell the watchdog > to reset its countdown, and how to disable the watchdog, to safely use > the Dual BIOS feature. > Ok. I'm rereading the link Gigabyte gave me, which does not explain enough or I don't understand it enough, but it might be this scenario you explain http://www.gigabyte.com.tw/FileList/NewTech/2006_motherboard_newtech/article_04_bios_explained.htm (the URL says 2006 but it was given to me in a mail in early March 2010) I've noticed they say it reboots before running the other BIOS, it's not just a jump. How would that work ? would it be some flag in CMOS ? This is better, I guess in that it gives both BIOSes the same initial state. It also says the original BIOS checks both BIOS copies, but I guess it doesn't matter since it will only run if coreboot fails, and then you have to reflash it anyway. > The feature supposedly shouldn't just guard against non-Gigabyte images, > but against issues with their own images, too - and those would have the > right signature, and thus would pass any such test. > > I'd be really amazed if they'd add another chip (that actually costs > money) and then only implement an incomplete protection scheme with it. > Ok. It makes sense. Thank you for explaining.
xdrudis wrote: > > They might just use a watchdog: > > Ok. I'm rereading the link Gigabyte gave me, Please read the US Patent. //Peter
On Sun, Apr 25, 2010 at 01:45:19PM +0200, Peter Stuge wrote: > xdrudis wrote: > > > They might just use a watchdog: > > > > Ok. I'm rereading the link Gigabyte gave me, > > Please read the US Patent. > I wasn't aware. I hadn't read your mail when I wrote mine. I started to read it, but your summary was more useful. As usual claims are so broad (they claim a computer, not merely a BIOS, a whatchdog, some circuit or a motherboard), so broad you can't even buy a CPU, DIMMS and their motherboard and build a PC unless you comply with some license by them, and who would buy a motherboard and not build a PC with it ?. I guess they give you a license for the patent when you buy their motherboard, but then under what terms ? Don't take it as legal advice, IANAL, I guess any judge would narrow the claims to the inventive step or something, just laughing at the tipically silly language. But of course you meant the description, not the claims. Thank you.
On Tue, Apr 27, 2010 at 12:51:40AM +0200, xdrudis wrote:
> broad (they claim a computer, not merely a BIOS, a whatchdog, some
No, sorry, they claim "a selectable BIOS". I misread.
Patch
Index: it87spi.c =================================================================== --- it87spi.c (revision 992) +++ it87spi.c (working copy) @@ -155,6 +155,28 @@ sio_write(port, 0x65, (flashport & 0xff)); free(portpos); } + + portpos = extract_param(&programmer_param, + "gbdualindex=", ",:"); + if (portpos) { + int chip_index = strtol(portpos, (char **)NULL, 0); + if ((chip_index!=0) && (chip_index!=1)) { + msg_perr("Dual bios: Invalid chip index requested: %d\n",chip_index); + flashport=0; + } else { + tmp=sio_read(port,0xEF); + msg_pinfo("Dual bios: Current chip : %d\n",tmp&1); + if (chip_index!=(tmp&1)) { + sio_write(port,0xEF,(tmp&0xFE)|chip_index); + tmp=sio_read(port,0xEF)&1; + if (tmp!=chip_index) { + msg_perr("Dual bios: Chip selection failed.\n"); + flashport=0; + } else msg_pinfo("Dual bios: Selected chip: %d\n",tmp&1); + } + } + free(portpos); + } } exit_conf_mode_ite(port); break;