MSI K9ND Phoenix BIOS Hacking (was: Adding microcode to Phoenix BIOS)

[karbonkid]

This thread is now basically a log of my experiments trying to add Athlon64 FX support to an MSI K9ND Speedster-WA6 BIOS

The BIOS I am editing is here - http://global.msi.com.tw/index.php?f...6814&type=bios

This entails 2 steps -

1. Disable all ECC options by default, so board can boot with non-ECC RAM after clear CMOS
2. Insert AthlonFX Microcode

Step 1
Easy peasy -


Step 2
Extracting microcode from ASUS L1N64 WS/B BIOS -





Now I'm stuck - I don't know where microcode is stored inside the K9ND BIOS, or how to edit it. It doesn't help that I'm extracting microcode from an AMI BIOS and wanting to insert it into a Phoenix one. The BIOS build log from step 1 gives some clues -

Prepare v2.07  11/02/2002    
(c) Phoenix Technologies Ltd.

SCRIPT FILE: ROM.SCR
EXECUTION TIMESTAMP: Sun Sep 14 15:55:22 2008


PREPARE/CATENATE Command Parser Ver 2.3  11/02/2002
Parsing: 'ROM.SCR'

     Line:  1  BANKS         -N:1 -S:1024
     Line:  2  COMPRESS      LZINT
     Line:  3  BOOTBLOCK     BB.ROM -S:64
     Line:  5  ACPI          ACPI0.AML     
     Line:  6  ACPI          ACPI1.BIN     
     Line:  7  BIOSCODE      BIOSCOD0.ROM  
     Line:  8  BIOSCODE      BIOSCOD1.ROM  
     Line:  9  BIOSCODE      BIOSCOD2.ROM  
     Line: 10  BIOSCODE      BIOSCOD3.ROM  
     Line: 11  BIOSCODE      BIOSCOD4.ROM  
     Line: 12  BIOSCODE      BIOSCOD5.ROM  
     Line: 13  BIOSCODE      BIOSCOD6.ROM  
     Line: 14  DECOMPCODE    DECOMPC0.ROM  
     Line: 15  DISPLAY       DISPLAY0.ROM  
     Line: 16  LOGO          LOGO0.BIN     
     Line: 17  LOGO          LOGO1.BIN     
     Line: 18  MISER         MISER0.ROM    
     Line: 19  MODULE        MOD_4800.ROM  -C:H0 
     Line: 20  MODULE        MOD_4B00.ROM  -C:K0 
     Line: 21  MODULE        MOD_5100.ROM  -C:Q0 
     Line: 22  OPROM         OPROM0.ROM    
     Line: 23  OPROM         OPROM1.ROM    
     Line: 24  OPROM         OPROM2.ROM    
     Line: 25  ROMEXEC       ROMEXEC0.ROM  -Z
     Line: 26  ROMEXEC       ROMEXEC1.ROM  -Z
     Line: 27  SETUP         SETUP0.ROM    
     Line: 28  STRINGS       STRINGS0.ROM  
     Line: 29  TEMPLATE      TEMPLAT0.ROM  
     Line: 30  UPDATE        UPDATE0.ROM   


PREPARE/CATENATE Command Parser END

Global Compression Mode = LZINT
Module: BOOTBLOCK     
Module: ACPI          * COMPRESSED *
Module: ACPI          * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: BIOSCODE      * COMPRESSED *
Module: DECOMPCODE    
Module: DISPLAY       * COMPRESSED *
Module: LOGO          * COMPRESSED *
Module: LOGO          * COMPRESSED *
Module: MISER         * COMPRESSED *
Module: MODULE        * COMPRESSED *
Module: MODULE        * COMPRESSED *
Module: MODULE        * COMPRESSED *
Module: OPROM         * COMPRESSED *
Module: OPROM         * COMPRESSED *
Module: OPROM         * COMPRESSED *
Module: ROMEXEC       
Module: ROMEXEC       
Module: SETUP         * COMPRESSED *
Module: STRINGS       * COMPRESSED *
Module: TEMPLATE      * COMPRESSED *
Module: UPDATE        
27 Files Processed    22 Files Compressed.

Prepare Completed with    0 Errors.
Catenate v2.96  11/02/2002    
(c) Phoenix Technologies Ltd.

Catenate Start 09/14/08 15:55:23

PREPARE/CATENATE Command Parser Ver 2.3  11/02/2002
Parsing: 'ROM.SCR'

     Line:  1  BANKS         -N:1 -S:1024
     Line:  2  COMPRESS      LZINT
     Line:  3  BOOTBLOCK     BB.ROM -S:64
     Line:  5  ACPI          ACPI0.AML     
     Line:  6  ACPI          ACPI1.BIN     
     Line:  7  BIOSCODE      BIOSCOD0.ROM  
     Line:  8  BIOSCODE      BIOSCOD1.ROM  
     Line:  9  BIOSCODE      BIOSCOD2.ROM  
     Line: 10  BIOSCODE      BIOSCOD3.ROM  
     Line: 11  BIOSCODE      BIOSCOD4.ROM  
     Line: 12  BIOSCODE      BIOSCOD5.ROM  
     Line: 13  BIOSCODE      BIOSCOD6.ROM  
     Line: 14  DECOMPCODE    DECOMPC0.ROM  
     Line: 15  DISPLAY       DISPLAY0.ROM  
     Line: 16  LOGO          LOGO0.BIN     
     Line: 17  LOGO          LOGO1.BIN     
     Line: 18  MISER         MISER0.ROM    
     Line: 19  MODULE        MOD_4800.ROM  -C:H0 
     Line: 20  MODULE        MOD_4B00.ROM  -C:K0 
     Line: 21  MODULE        MOD_5100.ROM  -C:Q0 
     Line: 22  OPROM         OPROM0.ROM    
     Line: 23  OPROM         OPROM1.ROM    
     Line: 24  OPROM         OPROM2.ROM    
     Line: 25  ROMEXEC       ROMEXEC0.ROM  -Z
     Line: 26  ROMEXEC       ROMEXEC1.ROM  -Z
     Line: 27  SETUP         SETUP0.ROM    
     Line: 28  STRINGS       STRINGS0.ROM  
     Line: 29  TEMPLATE      TEMPLAT0.ROM  
     Line: 30  UPDATE        UPDATE0.ROM   


PREPARE/CATENATE Command Parser END


PART DESCRIPTION: 1 Banks of 1024 kBytes     (1024 KBytes     8 MegaBits)


                            KNOWN CLASS CODES
-------------------------------------------------------------------------
   * - AUTOGEN              A - ACPI                 B - BIOSCODE          
   C - UPDATE               D - DISPLAY              E - SETUP             
   F - MARKS                G - DECOMPCODE           I - BOOTBLOCK         
   L - LOGO                 M - MISER                N - ROMPILOTLOAD      
   O - NETWORK              P - ROMPILOTINIT         R - OPROM             
   S - STRINGS              T - TEMPLATE             U - USER              
   W - WAV                  X - ROMEXEC           
------------------------------------------------------------------------

================================== MODULE MAP =================================
Class Code
. Instance
. .
C I    B   START       END     LENGTH  B  LINK1     B  LINK2    MODULE NAME
----   -----------  ---------  ------  -----------  ----------- ------------
I  0   0 FFFF 0000  FFFF FFFF   10000     -----         -----   BB.MOD
----   0 FFFE FFF7  FFFE FFFF       9     -----         -----   FREE
X  0   0 FFFE 7F15  FFFE FFF6    80E2  0 FFFE 679A      -----   ROMEXEC0.MOD
A  0   0 FFFE 679A  FFFE 7F14    177B  0 FFFE 6730      -----   ACPI0.MOD
A  1   0 FFFE 6730  FFFE 6799      6A  0 FFFE 62D5      -----   ACPI1.MOD
G  0   0 FFFE 62D5  FFFE 672F     45B  0 FFFE 5744      -----   DECOMPC0.MOD
D  0   0 FFFE 5744  FFFE 62D4     B91  0 FFFE 4DB0      -----   DISPLAY0.MOD
L  0   0 FFFE 4DB0  FFFE 5743     994  0 FFFE 3117      -----   LOGO0.MOD
M  0   0 FFFE 3117  FFFE 4DAF    1C99  0 FFFE 30F8      -----   MISER0.MOD
2A 0h  0 FFFE 30F8  FFFE 3116      1F  0 FFFE 0B80      -----   AUTOGEN.MOD
B  0   0 FFFE 0B80  FFFE 30F7    2578  0 FFFD 8005  0 FFF9 6C5D BIOSCOD0.MOD (0)
X  1   0 FFFD 8005  FFFE 0B7F    8B7B  0 FFFD 350E      -----   ROMEXEC1.MOD
L  1   0 FFFD 350E  FFFD 8004    4AF7  0 FFFC DF5E      -----   LOGO1.MOD
H  0   0 FFFC DF5E  FFFD 350D    55B0  0 FFFC 956A      -----   MOD_4800.MOD
K  0   0 FFFC 956A  FFFC DF5D    49F4  0 FFFC 612D      -----   MOD_4B00.MOD
Q  0   0 FFFC 612D  FFFC 9569    343D  0 FFFB DFB4      -----   MOD_5100.MOD
R  0   0 FFFB DFB4  FFFC 612C    8179  0 FFFB 6859      -----   OPROM0.MOD
R  1   0 FFFB 6859  FFFB DFB3    775B  0 FFFB 1CFC      -----   OPROM1.MOD
R  2   0 FFFB 1CFC  FFFB 6858    4B5D  0 FFFA DD99      -----   OPROM2.MOD
E  0   0 FFFA DD99  FFFB 1CFB    3F63  0 FFFA AB70      -----   SETUP0.MOD
S  0   0 FFFA AB70  FFFA DD98    3229  0 FFFA 7543      -----   STRINGS0.MOD
T  0   0 FFFA 7543  FFFA AB6F    362D  0 FFF9 94C8      -----   TEMPLAT0.MOD
C  0   0 FFF9 94C8  FFFA 7542    E07B  0 FFF9 3503      -----   UPDATE0.MOD
----   0 FFF9 6C5D  FFF9 94C7    286B     -----         -----   BIOSCOD0.MOD (1)
B  1   0 FFF9 3503  FFF9 6C5C    375A  0 FFF8 AC9A      -----   BIOSCOD1.MOD (0)
B  2   0 FFF8 AC9A  FFF9 3502    8869  0 FFF8 2D6A      -----   BIOSCOD2.MOD (0)
B  3   0 FFF8 2D6A  FFF8 AC99    7F30  0 FFF8 24C0      -----   BIOSCOD3.MOD (0)
B  4   0 FFF8 24C0  FFF8 2D69     8AA  0 FFF7 72D5      -----   BIOSCOD4.MOD (0)
B  5   0 FFF7 72D5  FFF8 24BF    B1EB  0 FFF7 43D1      -----   BIOSCOD5.MOD (0)
B  6   0 FFF7 43D1  FFF7 72D4    2F04     -----         -----   BIOSCOD6.MOD (0)
----   0 FFF0 8000  FFF7 43D0   6C3D1     -----         -----   FREE
----   0 FFF0 6000  FFF0 7FFF    2000     -----         -----   ESCD
----   0 FFF0 0000  FFF0 5FFF    6000     -----         -----   FREE

==============================================================================
1st Link = Bank 0  Address: FFFE 7F15

NOTES: Link1 is the module linkage chain.
       Link2 is the linkage within a fragmented module.

Total BIOS Size:     8DC26h/  580646
Total Free Space:    723DAh/  467930
ROM Size:           100000h/ 1048576

CHECKSUM AT: 0EFFF6(in File)   VALUE: D8

0 Errors/0 Warnings.

Catenate Done 09/14/08 15:55:23

This makes me think microcode is stored in the UPDATE0.ROM file, because it is referred to as "CPU Update". Am I barking up the wrong tree here? I have, of course, extracted UPDATE0.ROM from the WPH file and can insert back in once it's modified, but does anyone know how I can extract microcode from that file and replace it with that from the ASUS BIOS?

[karbonkid]

I just thought, since AMD microcode is uncompressed/unencrypted, would it be possible to simply replace UPDATE0.ROM in the Phoenix BIOS with CPUCODE.BIN (or the equivalent) from the Award BIOS? That is of course, assuming that Update0 is the microcode file for the Phoenix BIOS.

EDIT:
We might be getting somewhere:
I've extracted the microcode module from the ASUS BIOS -


(Note that I did this with both "as in the ROM file" and "in uncompressed form" and checked the files to see they were both the same (they were, ie. proving that the microcode is uncompressed)

Now to compare this module with modules from the Phoenix BIOS in a hex editor and see where it fits...

Help would be appreciated..

[karbonkid]

Made some more progress...

Using Hex Workshop's resynchronising compare tool (8192 window, 24 match bytes, still need to play around with this to correctly match the lengths of microcode strings), I've found 2 entries in the ASUS microcode that don't appear in UPDATE0 from the MSI BIOS. However, UPDATE0 seems to contain a lot more information than just microcode, and I need to figure out how, and where to attach these entries. A quick scan through the separate microcode files I extracted shows that the missing entries correspond to the ASUS entries 01 and 05, which are CPUID 0413 and 041B, hopefully Athlon64 FX

EDIT: A little illustration

[karbonkid]

Well, this morning I started a compare using the length of individual microcode patches - 2048 bytes - and a window of 524288. This is going to take a long time; if only I had some kind of 2CPU system to speed it up...

[karbonkid]

OK, so I've been doing some more digging around.

As we have seen, the ASUS microcode module is just the individual microcode modules (numbered 01 to 08), one after the other.

The data that the MSI UPDATE0 file starts with exactly matches with what ASUS refers to as microcode number 03 (CPURevID 0414):



After this, the MSI file has what ASUS refers to as 04 (CPURevID 040A). However, as you can see from the below screenshot, MSI begins this microcode with an extra "00" register (and of course deletes one off the end to make sure the offsets line up).



Now, my question is - Are all subsequent microcodes in the MSI file to be also preceded in this way (ie. extra 00 at beginning of microcode and microcode shifted accordingly)? Is it a mistake on MSI's part (Or indeed ASUS's)? Or does it not actually matter (Likely the 00 instruction doesn't do anything, but still, could incorrectly lined-up offsets mess up timings?..) MSI must have added/ASUS must have removed that extra "00" for a reason, unless it's a mistake, and I need to know if it's a system to be followed for all but the first microcode...

These two appear to be the only microcodes that appear on both BIOSs. The MSI file continues after microcode "04" with what looks like a few more microcodes, and then some other code.

EDIT: I may have found the solution. I've found another matching microcode and, again, the offsets don't line up. Will report back once I've found out...

EDIT EDIT:




The next microcode in UPDATE0 is "06" (CPURevID 1000) and it begins with two "00" registers, showing that microcodes END with an extra 00, which makes more sense...

[karbonkid]

All done I cross-referenced the microcodes with those from the ASUS L1N64 board (Like WS/B but no quad-core support) to find that AthlonFX is CPURevID 0413. I then compared the UPDATE0 ROMs from 2 versions of the MSI BIOS to find how to pad out the file in order to line up offsets - turns out I just had to fill the last line with "00"s. It turns out that UPDATE0 also contains the AGESA code, which should make updating that a fairly trivial process, too



Screenshots coming soon, hopefully.

[Ket]

If you need more info and tools for BIOS modding search rebels haven forums I would of said a much faster way to add FX support to the MSI board would of been to go to the "CPU Patch" tab in MMTOOL, extract the small chunk of code instead of the whole P6 table, then just slot that small bit of code in. You kinda took the long route

[karbonkid]

If you need more info and tools for BIOS modding search rebels haven forums I would of said a much faster way to add FX support to the MSI board would of been to go to the "CPU Patch" tab in MMTOOL, extract the small chunk of code instead of the whole P6 table, then just slot that small bit of code in. You kinda took the long route

That's what I did
I used the whole P6 table only for comparison with the UPDATE0 ROM, in which case it was very useful.

And yeah, Rebels Haven is an invaluable resource. Don't know why I haven't signed up yet!

[karbonkid]

Sorry for the bumpage... just to let you know there is a mini-howto up on Rebels Haven if you want to achieve something similar:

http://www.rebelshavenforum.com/sis-...;f=52;t=000135

[Vienna]

Is this motherboard support quad core opterons?

[karbonkid]

Is this motherboard support quad core opterons?

Yes, it supports Quad-core Barcelona. It might also be possible to mod the BIOS to support Shanghai, but it might prove too difficult...