Hi there - I'm trying to use LinuxBIOS to help me out with a problem I have with a recently acquired Panasonic R5 notebook: Panasonic decided to disable Intel Virtualization Support in the BIOS startup code (WRMSR instruction to set the lock bit in the CPU's Feature Control MSR) without giving me the option to override this in the BIOS menus or offering BIOS updates.
So my plan now is this: 'Download' my BIOS (PhoenixBIOS V1.00L13), disassemble & modify the WRMSR instruction, re-flash it onto the board (hopefully the BIOS instructions themselves are not compressed or encrypted).
First of all the latest (svn) flashrom does not detect my flash device. From prior posts on this mailing lists I deduced I may have an 'Intel firmware hub'? No idea what that is... flashrom -V output and lspci -V follow below.
My questions: 1) Is there a chance I can use flashrom to read/write my BIOS code. What is missing? Can anybody point me in any direction from the flashrom -V output below? Should I open the notebook to try to find any chip label? 2) Has anybody ever 'patched' an off-the-shelf PhoenixBIOS? Is that a realistic proposition at all, or will it be impossible because the binary is compressed/encrypted/signed/whatever?
Thanks for your help, Wolfgang Spraul
--- flashrom -V output Calibrating delay loop... Setting up microsecond timing loop 302M loops per second ok No LinuxBIOS table found. Trying Am29F040B, 512 KB probe_29f040b: id1 0x4e, id2 0x41 Trying Am29F016D, 2048 KB probe_29f040b: id1 0xaa, id2 0x55 Trying At29C040A, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying Mx29f002, 256 KB probe_29f002: id1 0xf8, id2 0x57 Trying SST29EE020A, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying SST28SF040A, 512 KB probe_28sf040: id1 0x4e, id2 0x41 Trying SST39SF020A, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying SST39VF020, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying SST49LF040B, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying SST49LF040, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying SST49LF080A, 1024 KB probe_jedec: id1 0xaa, id2 0x55 Trying SST49LF002A/B, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying SST49LF003A/B, 384 KB probe_jedec: id1 0x83, id2 0xd6 Trying SST49LF004A/B, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying SST49LF008A, 1024 KB probe_jedec: id1 0xaa, id2 0x55 Trying Pm49FL002, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying Pm49FL004, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying W29C011, 128 KB probe_jedec: id1 0x99, id2 0x8a Trying W29C020C, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying W49F002U, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying W49V002A, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying W49V002FA, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying W39V040A, 512 KB probe_jedec: id1 0x4e, id2 0x41 Trying M29F040B, 512 KB probe_29f040b: id1 0x4e, id2 0x41 Trying M29F400BT, 512 KB probe_m29f400bt: id1 0x4e, id2 0x50 Trying 82802ab, 512 KB probe_82802ab: id1 0x4e, id2 0x41 Trying 82802ac, 1024 KB probe_82802ab: id1 0xaa, id2 0x55 Trying F49B002UA, 256 KB probe_jedec: id1 0xf8, id2 0x57 Trying LHF00L04, 1024 KB probe_lhf00l04: id1 0xaa, id2 0x55 No EEPROM/flash device found.
--- lspci -v output 00:00.0 Host bridge: Intel Corporation Mobile 945GM/PM/GMS/940GML and 945GT Express Memory Controller Hub (rev 03) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, fast devsel, latency 0 Capabilities: [e0] Vendor Specific Information
00:02.0 VGA compatible controller: Intel Corporation Mobile 945GM/GMS/940GML Express Integrated Graphics Controller (rev 03) (prog-if 00 [VGA]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, fast devsel, latency 0, IRQ 5 Memory at d0200000 (32-bit, non-prefetchable) [size=512K] I/O ports at 1800 [size=8] Memory at c0000000 (32-bit, prefetchable) [size=256M] Memory at d0300000 (32-bit, non-prefetchable) [size=256K] Capabilities: [90] Message Signalled Interrupts: 64bit- Queue=0/0 Enable- Capabilities: [d0] Power Management version 2
00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/940GML Express Integrated Graphics Controller (rev 03) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, fast devsel, latency 0 Memory at d0280000 (32-bit, non-prefetchable) [size=512K] Capabilities: [d0] Power Management version 2
00:1b.0 Audio device: Intel Corporation 82801G (ICH7 Family) High Definition Audio Controller (rev 02) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, fast devsel, latency 0, IRQ 185 Memory at d0340000 (64-bit, non-prefetchable) [size=16K] Capabilities: [50] Power Management version 2 Capabilities: [60] Message Signalled Interrupts: 64bit+ Queue=0/0 Enable- Capabilities: [70] Express Unknown type IRQ 0 Capabilities: [100] Virtual Channel Capabilities: [130] Unknown (5)
00:1c.0 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 1 (rev 02) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=02, subordinate=02, sec-latency=0 Capabilities: [40] Express Root Port (Slot+) IRQ 0 Capabilities: [80] Message Signalled Interrupts: 64bit- Queue=0/0 Enable+ Capabilities: [90] #0d [0000] Capabilities: [a0] Power Management version 2 Capabilities: [100] Virtual Channel Capabilities: [180] Unknown (5)
00:1c.2 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 3 (rev 02) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=03, subordinate=03, sec-latency=0 Memory behind bridge: d0000000-d00fffff Capabilities: [40] Express Root Port (Slot+) IRQ 0 Capabilities: [80] Message Signalled Interrupts: 64bit- Queue=0/0 Enable+ Capabilities: [90] #0d [0000] Capabilities: [a0] Power Management version 2 Capabilities: [100] Virtual Channel Capabilities: [180] Unknown (5)
00:1d.0 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI #1 (rev 02) (prog-if 00 [UHCI]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 217 I/O ports at 1820 [size=32]
00:1d.1 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI #2 (rev 02) (prog-if 00 [UHCI]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 225 I/O ports at 1840 [size=32]
00:1d.2 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI #3 (rev 02) (prog-if 00 [UHCI]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 177 I/O ports at 1860 [size=32]
00:1d.3 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI #4 (rev 02) (prog-if 00 [UHCI]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 233 I/O ports at 1880 [size=32]
00:1d.7 USB Controller: Intel Corporation 82801G (ICH7 Family) USB2 EHCI Controller (rev 02) (prog-if 20 [EHCI]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 217 Memory at d0544000 (32-bit, non-prefetchable) [size=1K] Capabilities: [50] Power Management version 2 Capabilities: [58] Debug port
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev e2) (prog-if 01 [Subtractive decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=04, subordinate=05, sec-latency=32 I/O behind bridge: 00002000-00002fff Memory behind bridge: d0100000-d01fffff Prefetchable memory behind bridge: 0000000030000000-0000000031f00000 Capabilities: [50] #0d [0000]
00:1f.0 ISA bridge: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge (rev 02) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0 Capabilities: [e0] Vendor Specific Information
00:1f.1 IDE interface: Intel Corporation 82801G (ICH7 Family) IDE Controller (rev 02) (prog-if 8a [Master SecP PriP]) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 0, IRQ 177 I/O ports at <unassigned> I/O ports at <unassigned> I/O ports at <unassigned> I/O ports at <unassigned> I/O ports at 1810 [size=16]
00:1f.3 SMBus: Intel Corporation 82801G (ICH7 Family) SMBus Controller (rev 02) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: medium devsel, IRQ 11 I/O ports at 18a0 [size=32]
03:00.0 Network controller: Intel Corporation PRO/Wireless 3945ABG Network Connection (rev 02) Subsystem: Intel Corporation Unknown device 1003 Flags: bus master, fast devsel, latency 0, IRQ 7 Memory at d0000000 (32-bit, non-prefetchable) [size=4K] Capabilities: [c8] Power Management version 2 Capabilities: [d0] Message Signalled Interrupts: 64bit+ Queue=0/0 Enable- Capabilities: [e0] Express Legacy Endpoint IRQ 0 Capabilities: [100] Advanced Error Reporting Capabilities: [140] Device Serial Number c1-29-2b-ff-ff-02-13-00
04:01.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 32, IRQ 225 I/O ports at 2000 [size=256] Memory at d0100000 (32-bit, non-prefetchable) [size=256] Capabilities: [50] Power Management version 2
04:05.0 CardBus bridge: Ricoh Co Ltd RL5c476 II (rev 8d) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 168, IRQ 185 Memory at d0101000 (32-bit, non-prefetchable) [size=4K] Bus: primary=04, secondary=05, subordinate=08, sec-latency=176 Memory window 0: 30000000-31fff000 (prefetchable) Memory window 1: 32000000-33fff000 I/O window 0: 00002400-000024ff I/O window 1: 00002800-000028ff 16-bit legacy interface ports at 0001
04:05.1 Class 0805: Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter (rev 13) Subsystem: Matsushita Electric Industrial Co., Ltd. Unknown device 8338 Flags: bus master, medium devsel, latency 32, IRQ 11 Memory at d0100400 (32-bit, non-prefetchable) [size=256] Capabilities: [80] Power Management version 2
Wolfgang Spraul wrote:
Hi there - I'm trying to use LinuxBIOS to help me out with a problem I have with a recently acquired Panasonic R5 notebook: Panasonic decided to disable Intel Virtualization Support in the BIOS startup code (WRMSR instruction to set the lock bit in the CPU's Feature Control MSR) without giving me the option to override this in the BIOS menus or offering BIOS updates.
So my plan now is this: 'Download' my BIOS (PhoenixBIOS V1.00L13), disassemble & modify the WRMSR instruction, re-flash it onto the board (hopefully the BIOS instructions themselves are not compressed or encrypted).
First of all the latest (svn) flashrom does not detect my flash device. From prior posts on this mailing lists I deduced I may have an 'Intel firmware hub'? No idea what that is... flashrom -V output and lspci -V follow below.
My questions:
- Is there a chance I can use flashrom to read/write my BIOS code. What
is missing? Can anybody point me in any direction from the flashrom -V output below? Should I open the notebook to try to find any chip label? 2) Has anybody ever 'patched' an off-the-shelf PhoenixBIOS? Is that a realistic proposition at all, or will it be impossible because the binary is compressed/encrypted/signed/whatever?
Guide to Award BIOS Reverse Engineering http://www.geocities.com/mamanzip/Articles/Award_Bios_RE/Award_Bios_RE_guide...
* Wolfgang Spraul wspraul@q-ag.de [060724 00:37]:
- Is there a chance I can use flashrom to read/write my BIOS code. What
is missing? Can anybody point me in any direction from the flashrom -V output below? Should I open the notebook to try to find any chip label?
:-( It looks like the bios of your machine also locks accesses to the flash chip with some GPIO line.
You might need to use the vendor supplied flash tool (or "invesitigate" the bios image to see how the protection works)
Stefan
-
Bari Ari -
Stefan Reinauer -
Wolfgang Spraul