MSI K9ND Phoenix BIOS Hacking (was: Adding microcode to Phoenix BIOS)

[karbonkid]

This thread is now basically a log of my experiments trying to add Athlon64 FX support to an MSI K9ND Speedster-WA6 BIOS

The BIOS I am editing is here - http://global.msi.com.tw/index.php?func=downloadfile&dno=6814&type=bios

This entails 2 steps -

Disable all ECC options by default, so board can boot with non-ECC RAM after clear CMOS
Insert AthlonFX Microcode


Step 1
Easy peasy -
http://img155.imageshack.us/img155/1176/noecchd6.png

Step 2
Extracting microcode from ASUS L1N64 WS/B BIOS -
http://img182.imageshack.us/img182/1473/microcodedy5.png

http://img227.imageshack.us/img227/1440/microcodestd0.png


Now I'm stuck - I don't know where microcode is stored inside the K9ND BIOS, or how to edit it. It doesn't help that I'm extracting microcode from an AMI BIOS and wanting to insert it into a Phoenix one. The BIOS build log from step 1 gives some clues -


Prepare v2.07 11/02/2002
(c) Phoenix Technologies Ltd.

SCRIPT FILE: ROM.SCR
EXECUTION TIMESTAMP: Sun Sep 14 15:55:22 2008


PREPARE/CATENATE Command Parser Ver 2.3 11/02/2002
Parsing: 'ROM.SCR'

Line: 1 BANKS -N:1 -S:1024
Line: 2 COMPRESS LZINT
Line: 3 BOOTBLOCK BB.ROM -S:64
Line: 5 ACPI ACPI0.AML
Line: 6 ACPI ACPI1.BIN
Line: 7 BIOSCODE BIOSCOD0.ROM
Line: 8 BIOSCODE BIOSCOD1.ROM
Line: 9 BIOSCODE BIOSCOD2.ROM
Line: 10 BIOSCODE BIOSCOD3.ROM
Line: 11 BIOSCODE BIOSCOD4.ROM
Line: 12 BIOSCODE BIOSCOD5.ROM
Line: 13 BIOSCODE BIOSCOD6.ROM
Line: 14 DECOMPCODE DECOMPC0.ROM
Line: 15 DISPLAY DISPLAY0.ROM
Line: 16 LOGO LOGO0.BIN
Line: 17 LOGO LOGO1.BIN
Line: 18 MISER MISER0.ROM
Line: 19 MODULE MOD_4800.ROM -C:H0
Line: 20 MODULE MOD_4B00.ROM -C:K0
Line: 21 MODULE MOD_5100.ROM -C:Q0
Line: 22 OPROM OPROM0.ROM
Line: 23 OPROM OPROM1.ROM
Line: 24 OPROM OPROM2.ROM
Line: 25 ROMEXEC ROMEXEC0.ROM -Z
Line: 26 ROMEXEC ROMEXEC1.ROM -Z
Line: 27 SETUP SETUP0.ROM
Line: 28 STRINGS STRINGS0.ROM
Line: 29 TEMPLATE TEMPLAT0.ROM
Line: 30 UPDATE UPDATE0.ROM


PREPARE/CATENATE Command Parser END

Global Compression Mode = LZINT
Module: BOOTBLOCK
Module: ACPI * COMPRESSED *
Module: ACPI * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: BIOSCODE * COMPRESSED *
Module: DECOMPCODE
Module: DISPLAY * COMPRESSED *
Module: LOGO * COMPRESSED *
Module: LOGO * COMPRESSED *
Module: MISER * COMPRESSED *
Module: MODULE * COMPRESSED *
Module: MODULE * COMPRESSED *
Module: MODULE * COMPRESSED *
Module: OPROM * COMPRESSED *
Module: OPROM * COMPRESSED *
Module: OPROM * COMPRESSED *
Module: ROMEXEC
Module: ROMEXEC
Module: SETUP * COMPRESSED *
Module: STRINGS * COMPRESSED *
Module: TEMPLATE * COMPRESSED *
Module: UPDATE
27 Files Processed 22 Files Compressed.

Prepare Completed with 0 Errors.
Catenate v2.96 11/02/2002
(c) Phoenix Technologies Ltd.

Catenate Start 09/14/08 15:55:23

PREPARE/CATENATE Command Parser Ver 2.3 11/02/2002
Parsing: 'ROM.SCR'

Line: 1 BANKS -N:1 -S:1024
Line: 2 COMPRESS LZINT
Line: 3 BOOTBLOCK BB.ROM -S:64
Line: 5 ACPI ACPI0.AML
Line: 6 ACPI ACPI1.BIN
Line: 7 BIOSCODE BIOSCOD0.ROM
Line: 8 BIOSCODE BIOSCOD1.ROM
Line: 9 BIOSCODE BIOSCOD2.ROM
Line: 10 BIOSCODE BIOSCOD3.ROM
Line: 11 BIOSCODE BIOSCOD4.ROM
Line: 12 BIOSCODE BIOSCOD5.ROM
Line: 13 BIOSCODE BIOSCOD6.ROM
Line: 14 DECOMPCODE DECOMPC0.ROM
Line: 15 DISPLAY DISPLAY0.ROM
Line: 16 LOGO LOGO0.BIN
Line: 17 LOGO LOGO1.BIN
Line: 18 MISER MISER0.ROM
Line: 19 MODULE MOD_4800.ROM -C:H0
Line: 20 MODULE MOD_4B00.ROM -C:K0
Line: 21 MODULE MOD_5100.ROM -C:Q0
Line: 22 OPROM OPROM0.ROM
Line: 23 OPROM OPROM1.ROM
Line: 24 OPROM OPROM2.ROM
Line: 25 ROMEXEC ROMEXEC0.ROM -Z
Line: 26 ROMEXEC ROMEXEC1.ROM -Z
Line: 27 SETUP SETUP0.ROM
Line: 28 STRINGS STRINGS0.ROM
Line: 29 TEMPLATE TEMPLAT0.ROM
Line: 30 UPDATE UPDATE0.ROM


PREPARE/CATENATE Command Parser END


PART DESCRIPTION: 1 Banks of 1024 kBytes (1024 KBytes 8 MegaBits)


KNOWN CLASS CODES
-------------------------------------------------------------------------
* - AUTOGEN A - ACPI B - BIOSCODE
C - UPDATE D - DISPLAY E - SETUP
F - MARKS G - DECOMPCODE I - BOOTBLOCK
L - LOGO M - MISER N - ROMPILOTLOAD
O - NETWORK P - ROMPILOTINIT R - OPROM
S - STRINGS T - TEMPLATE U - USER
W - WAV X - ROMEXEC
------------------------------------------------------------------------

================================== MODULE MAP =================================
Class Code
. Instance
. .
C I B START END LENGTH B LINK1 B LINK2 MODULE NAME
---- ----------- --------- ------ ----------- ----------- ------------
I 0 0 FFFF 0000 FFFF FFFF 10000 ----- ----- BB.MOD
---- 0 FFFE FFF7 FFFE FFFF 9 ----- ----- FREE
X 0 0 FFFE 7F15 FFFE FFF6 80E2 0 FFFE 679A ----- ROMEXEC0.MOD
A 0 0 FFFE 679A FFFE 7F14 177B 0 FFFE 6730 ----- ACPI0.MOD
A 1 0 FFFE 6730 FFFE 6799 6A 0 FFFE 62D5 ----- ACPI1.MOD
G 0 0 FFFE 62D5 FFFE 672F 45B 0 FFFE 5744 ----- DECOMPC0.MOD
D 0 0 FFFE 5744 FFFE 62D4 B91 0 FFFE 4DB0 ----- DISPLAY0.MOD
L 0 0 FFFE 4DB0 FFFE 5743 994 0 FFFE 3117 ----- LOGO0.MOD
M 0 0 FFFE 3117 FFFE 4DAF 1C99 0 FFFE 30F8 ----- MISER0.MOD
2A 0h 0 FFFE 30F8 FFFE 3116 1F 0 FFFE 0B80 ----- AUTOGEN.MOD
B 0 0 FFFE 0B80 FFFE 30F7 2578 0 FFFD 8005 0 FFF9 6C5D BIOSCOD0.MOD (0)
X 1 0 FFFD 8005 FFFE 0B7F 8B7B 0 FFFD 350E ----- ROMEXEC1.MOD
L 1 0 FFFD 350E FFFD 8004 4AF7 0 FFFC DF5E ----- LOGO1.MOD
H 0 0 FFFC DF5E FFFD 350D 55B0 0 FFFC 956A ----- MOD_4800.MOD
K 0 0 FFFC 956A FFFC DF5D 49F4 0 FFFC 612D ----- MOD_4B00.MOD
Q 0 0 FFFC 612D FFFC 9569 343D 0 FFFB DFB4 ----- MOD_5100.MOD
R 0 0 FFFB DFB4 FFFC 612C 8179 0 FFFB 6859 ----- OPROM0.MOD
R 1 0 FFFB 6859 FFFB DFB3 775B 0 FFFB 1CFC ----- OPROM1.MOD
R 2 0 FFFB 1CFC FFFB 6858 4B5D 0 FFFA DD99 ----- OPROM2.MOD
E 0 0 FFFA DD99 FFFB 1CFB 3F63 0 FFFA AB70 ----- SETUP0.MOD
S 0 0 FFFA AB70 FFFA DD98 3229 0 FFFA 7543 ----- STRINGS0.MOD
T 0 0 FFFA 7543 FFFA AB6F 362D 0 FFF9 94C8 ----- TEMPLAT0.MOD
C 0 0 FFF9 94C8 FFFA 7542 E07B 0 FFF9 3503 ----- UPDATE0.MOD
---- 0 FFF9 6C5D FFF9 94C7 286B ----- ----- BIOSCOD0.MOD (1)
B 1 0 FFF9 3503 FFF9 6C5C 375A 0 FFF8 AC9A ----- BIOSCOD1.MOD (0)
B 2 0 FFF8 AC9A FFF9 3502 8869 0 FFF8 2D6A ----- BIOSCOD2.MOD (0)
B 3 0 FFF8 2D6A FFF8 AC99 7F30 0 FFF8 24C0 ----- BIOSCOD3.MOD (0)
B 4 0 FFF8 24C0 FFF8 2D69 8AA 0 FFF7 72D5 ----- BIOSCOD4.MOD (0)
B 5 0 FFF7 72D5 FFF8 24BF B1EB 0 FFF7 43D1 ----- BIOSCOD5.MOD (0)
B 6 0 FFF7 43D1 FFF7 72D4 2F04 ----- ----- BIOSCOD6.MOD (0)
---- 0 FFF0 8000 FFF7 43D0 6C3D1 ----- ----- FREE
---- 0 FFF0 6000 FFF0 7FFF 2000 ----- ----- ESCD
---- 0 FFF0 0000 FFF0 5FFF 6000 ----- ----- FREE

================================================== ============================
1st Link = Bank 0 Address: FFFE 7F15

NOTES: Link1 is the module linkage chain.
Link2 is the linkage within a fragmented module.

Total BIOS Size: 8DC26h/ 580646
Total Free Space: 723DAh/ 467930
ROM Size: 100000h/ 1048576

CHECKSUM AT: 0EFFF6(in File) VALUE: D8

0 Errors/0 Warnings.

Catenate Done 09/14/08 15:55:23

This makes me think microcode is stored in the UPDATE0.ROM file, because it is referred to as "CPU Update". Am I barking up the wrong tree here? I have, of course, extracted UPDATE0.ROM from the WPH file and can insert back in once it's modified, but does anyone know how I can extract microcode from that file and replace it with that from the ASUS BIOS?

[karbonkid]

I just thought, since AMD microcode is uncompressed/unencrypted, would it be possible to simply replace UPDATE0.ROM in the Phoenix BIOS with CPUCODE.BIN (or the equivalent) from the Award BIOS? That is of course, assuming that Update0 is the microcode file for the Phoenix BIOS.

EDIT:
We might be getting somewhere:
I've extracted the microcode module from the ASUS BIOS -

http://img385.imageshack.us/img385/7382/microcodemoduleqn4.png
(Note that I did this with both "as in the ROM file" and "in uncompressed form" and checked the files to see they were both the same (they were, ie. proving that the microcode is uncompressed)

Now to compare this module with modules from the Phoenix BIOS in a hex editor and see where it fits...

Help would be appreciated.. :)

[karbonkid]

Made some more progress...

Using Hex Workshop's resynchronising compare tool (8192 window, 24 match bytes, still need to play around with this to correctly match the lengths of microcode strings), I've found 2 entries in the ASUS microcode that don't appear in UPDATE0 from the MSI BIOS. However, UPDATE0 seems to contain a lot more information than just microcode, and I need to figure out how, and where to attach these entries. A quick scan through the separate microcode files I extracted shows that the missing entries correspond to the ASUS entries 01 and 05, which are CPUID 0413 and 041B, hopefully Athlon64 FX ;)

EDIT: A little illustration :)
http://img182.imageshack.us/img182/4494/firstmatchescy1.png

[karbonkid]

Well, this morning I started a compare using the length of individual microcode patches - 2048 bytes - and a window of 524288. This is going to take a long time; if only I had some kind of 2CPU system to speed it up... :rolleyes: :ROTF:

http://img146.imageshack.us/img146/6505/comparingxp7.png

[karbonkid]

OK, so I've been doing some more digging around.

As we have seen, the ASUS microcode module is just the individual microcode modules (numbered 01 to 08), one after the other.

The data that the MSI UPDATE0 file starts with exactly matches with what ASUS refers to as microcode number 03 (CPURevID 0414):
http://img150.imageshack.us/img150/1279/03comparexq4.png


After this, the MSI file has what ASUS refers to as 04 (CPURevID 040A). However, as you can see from the below screenshot, MSI begins this microcode with an extra "00" register (and of course deletes one off the end to make sure the offsets line up).

http://img244.imageshack.us/img244/5263/04comparese0.png

Now, my question is - Are all subsequent microcodes in the MSI file to be also preceded in this way (ie. extra 00 at beginning of microcode and microcode shifted accordingly)? Is it a mistake on MSI's part (Or indeed ASUS's)? Or does it not actually matter (Likely the 00 instruction doesn't do anything, but still, could incorrectly lined-up offsets mess up timings?..) MSI must have added/ASUS must have removed that extra "00" for a reason, unless it's a mistake, and I need to know if it's a system to be followed for all but the first microcode...

These two appear to be the only microcodes that appear on both BIOSs. The MSI file continues after microcode "04" with what looks like a few more microcodes, and then some other code.

EDIT: I may have found the solution. I've found another matching microcode and, again, the offsets don't line up. Will report back once I've found out...

EDIT EDIT:

http://img398.imageshack.us/img398/889/06comparezw8.png


The next microcode in UPDATE0 is "06" (CPURevID 1000) and it begins with two "00" registers, showing that microcodes END with an extra 00, which makes more sense...

[karbonkid]

All done :D I cross-referenced the microcodes with those from the ASUS L1N64 board (Like WS/B but no quad-core support) to find that AthlonFX is CPURevID 0413. I then compared the UPDATE0 ROMs from 2 versions of the MSI BIOS to find how to pad out the file in order to line up offsets - turns out I just had to fill the last line with "00"s. It turns out that UPDATE0 also contains the AGESA code, which should make updating that a fairly trivial process, too ;)

:)

Screenshots coming soon, hopefully.

[Ket]

If you need more info and tools for BIOS modding search rebels haven forums ;) I would of said a much faster way to add FX support to the MSI board would of been to go to the "CPU Patch" tab in MMTOOL, extract the small chunk of code instead of the whole P6 table, then just slot that small bit of code in. You kinda took the long route :p:

[karbonkid]

If you need more info and tools for BIOS modding search rebels haven forums ;) I would of said a much faster way to add FX support to the MSI board would of been to go to the "CPU Patch" tab in MMTOOL, extract the small chunk of code instead of the whole P6 table, then just slot that small bit of code in. You kinda took the long route :p:

That's what I did :p:
I used the whole P6 table only for comparison with the UPDATE0 ROM, in which case it was very useful.

And yeah, Rebels Haven is an invaluable resource. Don't know why I haven't signed up yet!

[karbonkid]

Sorry for the bumpage... just to let you know there is a mini-howto up on Rebels Haven if you want to achieve something similar:

http://www.rebelshavenforum.com/sis-bin/ultimatebb.cgi?ubb=get_topic;f=52;t=000135

[Vienna]

Is this motherboard support quad core opterons?

[karbonkid]

Is this motherboard support quad core opterons?

Yes, it supports Quad-core Barcelona. It might also be possible to mod the BIOS to support Shanghai, but it might prove too difficult...