Really? I just modded my Asrock z390 the other day with no major issues outside finding the correct flash tool to work with the ME.

myne wrote on 2024-04-07, 02:25:

Really? I just modded my Asrock z390 the other day with no major issues outside finding the correct flash tool to work with the ME.

So... do I need to somehow deal with ME when modding BIOS? I wonder if the board shutting itself down after stucking at 94h for a few seconds has something to do with ME being tripped...

LSS10999 wrote on 2024-04-04, 08:00:

EDIT2: I just made LPCFCHK output pretty much all information I could get from the bridge... the output confirms my speculation. On both the test board with dISAppointment, and on RUBY-9719VG2AR, the bridge is in its default state. Everything is identical except GPIO states (which are read-only and perhaps change all the time).

In case these info might be helpful. The differences between RUBY-9719VG2AR and my dISAppointment test environment are registers 17h and 1Ah. Both read-only and GPIO-related. The rest of registers are identical.

RUBY-9719VG2AR: 17h -> 21h; 1Ah -> 00h (GP10, GP15 set, GP20 unset)
dISAppointment: 17h -> 00h; 1Ah -> 01h (GP20 set, GP10, GP15 unset)

On dISAppointment v0.2 all these pins are unconnected. Those pins are set to GPIO mode according to registers 04h and 05h... perhaps on RUBY those pins are connected to somewhere...

Apparently different ME versions require different FPTW64.exe
Also, when I did mine I used the -BIOS option which I believe only replaces the 8mb of the BIOS code and not the ME/Boot/whatever.
What board is it? The Ruby?

myne wrote on 2024-04-07, 03:59:

Apparently different ME versions require different FPTW64.exe
Also, when I did mine I used the -BIOS option which I believe only replaces the 8mb of the BIOS code and not the ME/Boot/whatever.
What board is it? The Ruby?

ASRock X99M Killer/3.1

So far I've only found this BIOS mod for this board. I'm not sure to how much extent the mod author had tested it, but when I flashed it the board got stuck at 94h and in some cases shut itself down after 20-30s. The board's BIOS uses Aptio V.

I wonder if ME is responsible for this automatic shutdown... but I don't want to derail the topic for now. If needed, I'll ask the question on Win-Raid instead...

The only LPC related thing I can see in the latest bios is "port 80h cycles" (LPC bus)
And possibly the GPIO lockdown - which is disabled anyway

AFAK modern boards cannot run without ME and if it was fully removed or corrupted this cause system shutdown. This is why someone created MEdisabler that remove/disable almost ME features but leave some criticals.that prevent the shutdown. But in normal case the BIOS modding tools.shouldn't touch the ME region, it's a different section of flashrom...

RayeR wrote on 2024-04-07, 13:02:

AFAK modern boards cannot run without ME and if it was fully removed or corrupted this cause system shutdown. This is why someone created MEdisabler that remove/disable almost ME features but leave some criticals.that prevent the shutdown. But in normal case the BIOS modding tools.shouldn't touch the ME region, it's a different section of flashrom...

I eventually succeeded in modding the BIOS to enable that more-Advanced menu, but that's the only thing I could achieve without breaking it. The hidden menu has some interesting options, but nothing really LPC or DMA-related. I'm considering hooking a logic analyzer through the breadboard to find out what was really going on, regarding the LDRQ1# issue...

I guess it's just Aptio BIOSes being too complex and delicate. Actually changing existing modules, including uCodes, has a very good chance to cause the BIOS not to boot (brick). Fortunately my board has two BIOS chips that I can choose with a switch should the mod turned out not working...

On the other hand... I'm not sure how to "properly" modify the BIOS PCI IRQ routing table to avoid sensitive IRQs like 5/7 without side effects. The thing is, from AMIBCP, what IRQ a PCI slot/device can use is defined by a "bitmap", which I think each bit in it corresponds to an IRQ, and the IRQs whose bits are set in the bitmap can be picked up by the specified PIRQ register.

As such, while the onboard audio claimed IRQ7 through its own separate IRQ line and PIRQ register (not shared by anything else), I probably need to make a lot of (risky) changes in the routing table to make sure nothing else would end up in IRQ7, as I'm seeling a lot of bitmap entries in the PCI IRQ routing table permitting them to use IRQ7 (bit 7 set) if available.

I don't have much experiences with modding modern AMI BIOS. My Gigabyte use old-style Award BIOS so the key tool I use is CBROM to add/remove/extract various modules. There was also MODBIN tool for modding SETUP entries but it's too old for newer Award BIOSes. I remeber I also had some "hot" moments with modding that caused corruption (non-bootable MB). The problem was that BIOS contained some sensitive modules like MEMINIT.BIN and PPMINIT.ROM and when their location was changed (due to add/remove other modules) it breaks. /not sure if it was a bug in CBROM tool or bug of BIOS by design. Sometimes it necessary to use specific version (range) of modding tools for specific BIOS version otherwise it breaks. I never tried modding IRQ table so I don't know where it resides in award BIOS, there's no a separate module. I only found some IRQ releated stuff inside ACPI module in DSDT table.
There's 1 reference about PIRQ:
Device (PX40)
{
Name (_ADR, 0x001F0000) // _ADR: Address
OperationRegion (PREV, PCI_Config, 0x08, 0x01)
Scope (\)
{
Field (\_SB.PCI0.PX40.PREV, ByteAcc, NoLock, Preserve)
{
REV0, 8
}
}

OperationRegion (PIRQ, PCI_Config, 0x60, 0x04)
Scope (\)
{
Field (\_SB.PCI0.PX40.PIRQ, ByteAcc, NoLock, Preserve)
{
PIRA, 8,
PIRB, 8,
PIRC, 8,
PIRD, 8
}
}

RayeR wrote on 2024-04-10, 02:55:

I don't have much experiences with modding modern AMI BIOS. My Gigabyte use old-style Award BIOS so the key tool I use is CBROM […]
Show full quote

I don't have much experiences with modding modern AMI BIOS. My Gigabyte use old-style Award BIOS so the key tool I use is CBROM to add/remove/extract various modules. There was also MODBIN tool for modding SETUP entries but it's too old for newer Award BIOSes. I remeber I also had some "hot" moments with modding that caused corruption (non-bootable MB). The problem was that BIOS contained some sensitive modules like MEMINIT.BIN and PPMINIT.ROM and when their location was changed (due to add/remove other modules) it breaks. /not sure if it was a bug in CBROM tool or bug of BIOS by design. Sometimes it necessary to use specific version (range) of modding tools for specific BIOS version otherwise it breaks. I never tried modding IRQ table so I don't know where it resides in award BIOS, there's no a separate module. I only found some IRQ releated stuff inside ACPI module in DSDT table.
There's 1 reference about PIRQ:
Device (PX40)
{
Name (_ADR, 0x001F0000) // _ADR: Address
OperationRegion (PREV, PCI_Config, 0x08, 0x01)
Scope (\)
{
Field (\_SB.PCI0.PX40.PREV, ByteAcc, NoLock, Preserve)
{
REV0, 8
}
}

OperationRegion (PIRQ, PCI_Config, 0x60, 0x04)
Scope (\)
{
Field (\_SB.PCI0.PX40.PIRQ, ByteAcc, NoLock, Preserve)
{
PIRA, 8,
PIRB, 8,
PIRC, 8,
PIRD, 8
}
}

PIRQs are only routed to legacy IRQs before entering ACPI/APIC. Once you're in ACPI/APIC territory those PIRQs get routed to higher IRQ numbers (16+) that are not available to legacy modes, and legacy IRQs (2-15) cease to be relevant.

In my board's case, IRQ5 and IRQ7 are both used by PIRQ lines that each has only one device. IRQ5 is held by the USB3 controller while IRQ7 is held by the onboard audio. Disabling those devices will not change the legacy PIRQ routing, but will effectively free those IRQs as they are the only device in their respective PIRQ lines.

So to use an ISA sound card, I need to either give up USB3 (for IRQ5), or onboard audio (for IRQ7). The BIOS does not offer any better option. This probably applies to other motherboards of those generations as well, depending on the board design.

So I have a cheap X99 motherboard from aliexpress ($37 including CPU!). There is no boardview so I'm going to have to find LDRQ0/1 another way. Hopefully at least one of them is brought out to a resistor and not just left floating...

The SuperIO doesn't even have an LDRQ pin so I can't steal it from there.

Maybe I can write a program to toggle GPIO23 at a known frequency and probe some random resistors?

Can perhaps find LDRQ0 by just spamming DMA requests. EDIT : no that won't work, LDRQ0 is an input. (Although maybe I could spam DMA requests and touch the LDRQ signal to various random resistors until audio starts working...)

Who is the MB manufacturer? If there's even DMA-less SuperIO chip I doubt that some chinese designers would generously route LDRQ from PCH to nowhere for you...
Do you have any chance to meet someone working with X-ray machine? It could give a fast answer whats under the ball 😀

RayeR wrote on 2024-04-10, 20:40:

Who is the MB manufacturer? If there's even DMA-less SuperIO chip I doubt that some chinese designers would generously route LDRQ from PCH to nowhere for you...

"Machinist" is the manufacturer. The size is somewhere between Mini-ITX and Micro-ATX (I dunno if this size has a name).

Most of the other X99 motherboards I've seen route LDRQ1 to a nearby pullup resistor even if it doesn't go anywhere else (leaving signals floating is bad I guess). The Machinist board has a lot of resistors in the area you'd expect an LDRQ1 pullup to be, so I'm optimistic that I'll be able to find it.

EDIT : actually these boards are so cheap I could just get a second one and pull the PCH chip off to trace everything, 🤣.

Lol
Try emailing them. Offer $50 for the boardview. Or less for the location.
I'm moderately sure they're based on reverse engineered older boards and they're so cheap that being copied isn't a big issue.

They don't need to reverse anything there are floating a lot of leaked MB schematics, e.g. hundreds from Gigabyte 😀 Yes, you can try to ask them first but in case of this low price it makes sense to desolder the PCH rather paying them more, as a bonus you'll have spare parts for repair 😀

Well, they kinda do. I suspect that the high speed portion of the boards are identical to some old board. No need to do all the R&D to deal with signalling reflections, cross talk, impedence, etc.

The lower speed portions are more idiot proof.

Yeah when I had to do DDR3 routing I just copied the tracks from an open source project and worked the rest of my PCB around it 🤣

Proper PCB design tools like Altium has all necessary functions to make good DDR3, etc. routing (impedance calculator for defined PCB stackup, diff pair routing, signal length matching...) it's not too rocket science, just need to follow some high-speed signal routing guidelines that are freely available 😀

We're talking about random no-name chinaboards maxing out at around $150 here.
What do YOU think is more likely?

1) They spend weeks to months designing, prototyping, testing, and revising.
2) They copy something that works, mod a few things here and there and call it a day.

rasteri wrote on 2024-04-10, 21:14:

"Machinist" is the manufacturer. The size is somewhere between Mini-ITX and Micro-ATX (I dunno if this size has a name). […]
Show full quote

RayeR wrote on 2024-04-10, 20:40:

Who is the MB manufacturer? If there's even DMA-less SuperIO chip I doubt that some chinese designers would generously route LDRQ from PCH to nowhere for you...

"Machinist" is the manufacturer. The size is somewhere between Mini-ITX and Micro-ATX (I dunno if this size has a name).

Most of the other X99 motherboards I've seen route LDRQ1 to a nearby pullup resistor even if it doesn't go anywhere else (leaving signals floating is bad I guess). The Machinist board has a lot of resistors in the area you'd expect an LDRQ1 pullup to be, so I'm optimistic that I'll be able to find it.

EDIT : actually these boards are so cheap I could just get a second one and pull the PCH chip off to trace everything, 🤣.

Is it this one ? https://www.youtube.com/watch?v=j58Fpm0uetI Machinist X99 PR9

Seems like the board in the video actually has a z97 chipset 😉

weedeewee wrote on 2024-04-11, 07:16:

Is it this one ? https://www.youtube.com/watch?v=j58Fpm0uetI Machinist X99 PR9

Seems like the board in the video actually has a z97 chipset 😉

Yeah that's it. Maybe the z97 will be easier to get to work than the X99?