Hello, I am trying to dump my vendor bios through SerialICE. It seems to freeze here (full log attached):
[f000:3a5c] -- IO: outl 0cf8 <= 8000f844 [f000:3a5c] -- IO: inb 0cfc => 00 PCI 0:1f.0 R.44 [f000:3a5c] -- IO: outb 0cfc <= 10 PCI 0:1f.0 R.44 [f000:3a5c] -- IO: inw 1004 => 0000 [f000:0013] -- IO: outw 0080 <= fea0 [f000:0024] -- IO: outl 0cf8 <= 800000fc [f000:0024] -- IO: outw 0cfc <= 0109 PCI 0:00.0 R.fc [f000:0024] -- IO: outb 0080 <= 01 [f000:0078] -- IO: outb 0080 <= 02 [f000:009a] -- IO: outw 0080 <= eee3 <------FREEZE
So, through gdb debugging I think I traced it back to the source.
0xf3af0: mov $0x8000f844,%eax 0xf3af6: mov $0xcf8,%dx 0xf3af9: out %eax,(%dx) 0xf3afb: mov $0xcfc,%dx 0xf3afe: in (%dx),%al 0xf3aff: or $0x10,%al 0xf3b01: out %al,(%dx) 0xf3b02: mov %es:(%edi),%dx 0xf3b06: add $0x4,%dx 0xf3b09: in (%dx),%ax 0xf3b0a: shr $0xa,%ax 0xf3b0d: and $0x7,%ax 0xf3b10: cmp $0x5,%ax 0xf3b13: jne 0xf3b1b 0xf3b15: mov $0x80000000,%ebp 0xf3b1b: jmp 0xf0013
0xf0013: mov $0xfea0,%ax 0xf0016: out %ax,$0x80 0xf0018: mov %cr4,%eax 0xf001b: or $0x200,%eax 0xf0021: mov %eax,%cr4 0xf0024: mov $0x109,%ax 0xf0027: mov %ax,%bx 0xf0029: mov $0xfc,%al 0xf002b: and $0xff,%eax 0xf0031: or $0x80000000,%eax 0xf0037: mov %ax,%dx 0xf0039: bswap %edx 0xf003c: mov $0xcf8,%dx 0xf003f: and $0xfffffffc,%eax 0xf0043: out %eax,(%dx) 0xf0045: bswap %edx 0xf0048: mov %dx,%ax 0xf004a: bswap %edx 0xf004d: and $0x2,%ax 0xf0050: add %ax,%dx 0xf0052: add $0x4,%dx 0xf0055: mov %bx,%ax 0xf0057: out %ax,(%dx) 0xf0058: xor %ecx,%ecx 0xf005b: or $0x3,%ebp 0xf005f: mov $0x1,%al 0xf0061: out %al,$0x80 0xf0063: bswap %esp 0xf0066: mov $0x6c,%sp 0xf0069: jmp 0xf17b9 0xf006c: bswap %esp 0xf006f: jae 0xf0078 0xf0071: mov $0xeee1,%ax 0xf0074: out %ax,$0x80 0xf0076: jmp 0xf0076 0xf0078: mov $0x2,%al 0xf007a: out %al,$0x80 0xf007c: bswap %esp 0xf007f: mov $0x85,%sp 0xf0082: jmp 0xf17dc 0xf0085: bswap %esp 0xf0088: jae 0xf0091 0xf008a: mov $0xeee2,%ax 0xf008d: out %ax,$0x80 0xf008f: jmp 0xf008f 0xf0091: test $0x3,%ebp 0xf0098: jne 0xf00a1 0xf009a: mov $0xeee3,%ax 0xf009d: out %ax,$0x80 0xf009f: jmp 0xf009f 0xf00a1: mov $0x3,%al 0xf00a3: out %al,$0x80 ----bla, bla, bla
So I think it all points back to the PMBASE + 4 (0x1004) register.
0xf3b0a: shr $0xa,%ax 0xf3b0d: and $0x7,%ax 0xf3b10: cmp $0x5,%ax
I tried to set PMBASE + 4 (0x1004) to 0x0005 in my serialice mainboard config but when the bios re-enables PMBASE it seems to get wiped out (reset to 0).
#define PMBASE 0x1000
/* Set ACPI base address (I/O space). */ pci_write_config32(PCI_ADDR(0, 0x1f, 0, 0x40), (PMBASE | 1)); outw(0x0005, PMBASE + 4);
At this point I am not sure what to do or if I am looking at this correctly, I am not so good at assembly.....Help? Ideas?
* Joseph Smith joe@settoplinux.org [110106 19:28]:
[f000:3a5c] -- IO: outb 0cfc <= 10 PCI 0:1f.0 R.44 [f000:3a5c] -- IO: inw 1004 => 0000 [f000:0013] -- IO: outw 0080 <= fea0 [f000:0024] -- IO: outl 0cf8 <= 800000fc [f000:0024] -- IO: outw 0cfc <= 0109 PCI 0:00.0 R.fc [f000:0024] -- IO: outb 0080 <= 01 [f000:0078] -- IO: outb 0080 <= 02 [f000:009a] -- IO: outw 0080 <= eee3 <------FREEZE
0xf0091: test $0x3,%ebp 0xf0098: jne 0xf00a1 0xf009a: mov $0xeee3,%ax 0xf009d: out %ax,$0x80 0xf009f: jmp 0xf009f 0xf00a1: mov $0x3,%al 0xf00a3: out %al,$0x80 ----bla, bla, bla
So I think it all points back to the PMBASE + 4 (0x1004) register.
0xf3b0a: shr $0xa,%ax 0xf3b0d: and $0x7,%ax 0xf3b10: cmp $0x5,%ax
This checks if bits 12:0 have a value of 5. I.e. whether the machine is coming out of a deep sleep
I tried to set PMBASE + 4 (0x1004) to 0x0005 in my serialice mainboard config but when the bios re-enables PMBASE it seems to get wiped out (reset to 0).
Also, that would set bits that are completely unrelated to the ones checked above.
You should look for code that sets/clears the lower 2 bits in ebp
Stefan
Hi all.
I'm having the same problem on i865+ICH5.
Registers 0xf4 on device 0 and 0x48 device 6 are "Intel Reserved".
From serialice:
PCI 0:00.0 R.f4 IO: outl 0cf8 <= 800000f4 IO: outb 0cfc <= 02
PCI 0:00.0 R.f4 IO: outl 0cf8 <= 80003048 IO: inl 0cfc => 00000004
PCI 0:06.0 R.48 IO: outl 0cf8 <= 800000f4 IO: inb 0cfc => 02
PCI 0:00.0 R.f4 IO: outl 0cf8 <= 800000f4 IO: outb 0cfc <= 00
PCI 0:00.0 R.f4 IO: outb 0080 <= a3 IO: inl 0480 => 1a003180 IO: outl 0480 <= 1a2039c0 IO: inl 0484 => 0000ffff IO: outl 0484 <= 0000ffff IO: inl 048c => 1b3f0000 IO: outl 048c <= 1b1f0000 IO: inl 0498 => 00040000 IO: outl 0498 <= 00040000 IO: inl 04ac => 00000000 IO: outl 04ac <= 00002900 IO: inl 04b0 => 00000007 IO: outl 04b0 <= 00000007 IO: inl 04b4 => 00000300 IO: outl 04b4 <= 00000300 IO: inl 04b8 => 00030307 IO: outl 04b8 <= 00000307 IO: outw 082a <= ffff IO: inb 040d => 00 IO: outb 040d <= 02 IO: outb 00e1 <= 02 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d3 IO: outb 0400 <= ff IO: inb 0402 => 20 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: inb 0405 => 0f IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 0f IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: outb 0407 <= 19 IO: outb 00e1 <= 09 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d2 IO: outb 0405 <= 09 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: outb 00e1 <= 09 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d3 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: inb 0405 => 19 IO: outb 0080 <= b0 IO: outb 00e1 <= b0 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d3 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: inb 0405 => 19 IO: inb 0805 => 00 IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: inb 0407 => 0b IO: inb 0407 => 00 IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: inb 0407 => 0b IO: outb 0407 <= 00 IO: outb 0080 <= b1 IO: outb 00e1 <= 19 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d2 IO: outb 0405 <= 19 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: outb 00e1 <= 19 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d3 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: inb 0405 => 19 IO: outb 0080 <= b2 IO: outb 0070 <= 8e IO: inb 0071 => 00 IO: outb 0070 <= 00 IO: inb 0071 => 33 IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: inb 0407 => 0b IO: inb 0407 => 00 IO: inb 0407 => 8d IO: inb 0407 => 9a IO: inb 0407 => ef IO: inb 0407 => 17 IO: inb 0407 => 01 IO: inb 0407 => 95 IO: inb 0407 => 0f IO: inb 0407 => 00 IO: inb 0407 => 0c IO: inb 0407 => c0 IO: inb 0407 => ff IO: inb 0407 => bf IO: inb 0407 => fc IO: inb 0407 => 02 IO: outb 0072 <= 1e IO: inb 0073 => 41 IO: inb 0402 => 14 IO: inb 0407 => 00 IO: inb 0402 => 14 IO: outb 0407 <= 82 IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 1a IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: outb 0407 <= 3a IO: outb 0080 <= b4 IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 2f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 3a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: outb 0407 <= 02 IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 2f IO: inb 0402 => 14 IO: inb 0407 => 82 IO: outb 0407 <= 3f IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 3f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 3a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: inb 0407 => 02 IO: inb 0407 => 00 IO: inb 0402 => 14 IO: inb 0407 => 82 IO: inb 0407 => 3f IO: inb 0407 => 1f IO: inb 0407 => 7f IO: inb 0407 => 3f IO: inb 0407 => 3a IO: inb 0407 => 2a IO: inb 0407 => 31 IO: inb 0407 => 19 IO: inb 0407 => 02 IO: outb 0407 <= 40 IO: outb 0080 <= b5 IO: outb 00e1 <= 19 IO: outb 0400 <= ff IO: inb 0400 => 00 IO: outb 0403 <= 00 IO: outb 0404 <= d2 IO: outb 0405 <= 19 IO: outb 0400 <= ff IO: inb 0402 => 14 IO: outb 0402 <= 54 IO: outb 00e1 <= 54 IO: inb 0400 => 02 IO: outb 0080 <= b6
Then it just sits there/hangs -- it is supposed to get to ram init.
The post code sequence is, with 99% certainty, like this:
68, b6, d2, d5, 0c, 2a /* only visible when soft rebooted */, 38, 3b, 84 /* busy with ram init/ram testing */, 60, 78, a7 /* ? */, a9 /* ready to load stuff from cd/harddisk */, q9 /* ? */, j0/00 /* not sure about j0, sometimes certain digit seems to be underpowered */, e3 /* seen during the booting of linux */ 00
SerialICE and gdb logs are attached, ask away if you need more output.
Idwer
-
Idwer Vollering -
Joseph Smith -
Stefan Reinauer