I.nfraR.ed

Thanks for the explanation, I found how to read the cmos regiser in the pdf you linked before. So I now have the idea how to do it. As for the settings, sometimes you'd want different values for different DIMMs I guess, but we can work with same set of settings for now. Don't know if they are the same as on NF4 or from 1 to 8. I also have just 5 free slots in NF7 bios. NF7 sets drv strength at 3 and slew rate at 10 (33/AA) for all dimms at 200+. BPL 3.19 if that matters. Stock is 3.02. It seems you can add labels at the end of _EN_CODE.BIN, but the question is how to add a brand new submenu with as many items as we want. This might require correcting all pointers of the existing items

I only miss how to read cmos registers value, but haven't tried anything about it yet. The problem is we have 3 drive strengths and 3 slew rates - 2 settings for each DIMM. Then alpha timings, superbypass, scavenged rate. Did you find how to add more items? PS: Do you read actual bios value or you set your custom default option for the new items? If not possible, maybe set to "auto" and when ISA custom code reads it's not set manually then don't alter it.

I have found another version of Award bios editor that shows menu items text (almost) correctly. I don't think it will work for editing, but at least could be used for easier viewing. http://bios.rom.by/ROMutils/Award/awdbedit/re1_25.zip On NF7 I only have 5 unused items, I think. So same as on your Asus.

Got the Nano Flasher too. Tired of the old Willem programmer that requires LPT port, configuration and external power. This should be much easier to work with. PS: By the way, does anyone know how to change the colors of the bios? The modbin option doesn't work, I think it worked for Award 4.xx, but not for 6.00 and I don't know where the colors are hardcoded.

Added the known timings in DRAM Controller 1 (B0D0F1). Most are straightforward, except TRAS is controlled with 2 registers. 91:7 controls lowest bit (e.g. 1111 for 15T), while the rest are controlled by 92[2:0]. Also there's not enough space to list all the options for TRFC (32 in total), so I've written just first and last. Will make B0D0F4 (slew rates, drive strengths and the rest) later, but I will probably need to switch to DFI to test them properly by setting them in bios. Also have a PCR file for the Host Bridge by Áedán, but I'm not sure if it is right (10DE01E0). PCR(PCI Configration Registers) Editor / WPCREDIT for WIN32 Copyright (c) 1998 H.Oda! [COMMENT]=Author: I.nfraR.ed, v.1 [MODEL]=nForce2 [VID]=10DE:nVidia [DID]=01EB:Memory Controller (00)=Vendor Identification (01)=Vendor Identification (02)=Device Identification (03)=Device Identification (86:1)=Auto Precharge (90:3)=TRC (90:2)=0000=0T 0001=1T 0010=2T 0011=3T 0100=4T 0101=5T (90:1)=0110=6T 0111=7T 1000=8T 1001=9T 1010=10T (90:0)=1011=11T 1100=12T 1101=13T 1110=14T 1111=15T (91:4..0)=TRFC 00000=0 ... 11111=31 (91:7)=TRAS = TRAS+1 (92:2)=TRAS 000=0T 001=2T 010=4T (92:1)=011=6T 100=8T 101=10T (92:0)=110=12T 111=14T + (91:7) (92:6)=TRCD-R 000=0T 001=1T (92:5)=010=2T 011=3T 100=4T (92:4)=101=5T 110=6T 111=7T (93:6)=TRP 000=0T 001=1T (93:5)=010=2T 011=3T 100=4T (93:4)=101=5T 110=6T 111=7T (93:2)=TRCD-W 000=0T 001=1T (93:1)=010=2T 011=3T 100=4T (93:0)=101=5T 110=6T 111=7T (94:6)=TRTW 000=0T 001=1T (94:5)=010=2T 011=3T 100=4T (94:4)=101=5T 110=6T 111=7T (95:5)=TREXT 00=0T 01=1T (95:4)=10=2T 11=3T (95:2)=TRTP 000=0T 001=1T (95:1)=010=2T 011=3T 100=4T (95:0)=101=5T 110=6T 111=7T (96:6)=TWTP 000=0T 001=1T (96:5)=010=2T 011=3T 100=4T (96:4)=101=5T 110=6T 111=7T (96:2)=TWTR 000=0T 001=1T (96:1)=010=2T 011=3T 100=4T (96:0)=101=5T 110=6T 111=7T (97:6)=TDOE 000=0T 001=1T (97:5)=010=2T 011=3T 100=4T (97:4)=101=5T 110=6T 111=7T (97:2)=TRRD 000=0T 001=1T (97:1)=010=2T 011=3T 100=4T (97:0)=101=5T 110=6T 111=7T 10DE01EB.pcr 10DE01E0.pcr

It seems to be the same as C7G1 capacitor on the left. Based on the size it should be 0805. I don't know how to get the capacitance without desoldering and measuring. My guess is about 10-47uF, but not sure. Don't have a deep electrical knowledge.

I fact this seems to be a factory thing, perhaps some later boards come like that. I think your problem is something else. IMO the Ultra-B is a lot more problematic with bios, although it is the best clocking board out of the box. My 2 older boards don't have this, but they are dead Here's the same on my board: PS: Also my older board without this bridging SMD capacitor (between the mosfets) blew up with a VDIMM mod. I think they added it later to "fix" it.

I don't think that black stuff is molten plastic. It looks like some sort of hot glue that someone put on top of these smd elements. The SMD elements you uncovered seem to be fine. Do you have another bios chip to test?

I've already checked 1/21 and 12/31 - they are almost the same and the resulting FSB is the same. It might be +/- 1MHz, but they both load windows at 270MHz and also still unstable at that frequency. Perhaps it's just my chipset limit. Even with slacker memory timings and single channel BH-5 it can't go much higher. I may have found which byte has the greatest impact on FSB, but will do more tests and then share. At least for me, bandwidth numbers don't change, only maximum bootable FSB changes. Even with a stock 133 table bandwidth at 200MHz FSB is still similar/the same. Memory registers are fairly simple to get. I will make a PCR file with all of them + slew rate and drive strengths. Timings are B0/D0/F0, offsets 90 to 97.

Merlin had been better for me before I made mine, which is very similar anyway. Slew rate and drive strengths can be modified with wpcredit, so I was thinking of using ISA rom to only set SuperBypass and DataScavenged Rate as a starting point. The thing is those registers show different on the NF7 and I'm not 100% sure which bits need to be changed in the whole byte. Will have to test with the DFI board in order to get a better understanding. As for the NF2 Tweaker I can easily make a new similar app to control all timings, since we know the registers already. And there's a openlibsys to help with MSR and PCI read/write operations. I can use the ZenStates app as a base. On a side note, I got 15 sticks of DDR (11 on this picture), but not a single one is Winbond. One of the 2x512 OCZ PC4000 Gold Rev2 (should be Hynix) actually play very nicely on NF2 with default 2.5-3-3-8 1T, but that's not what I'm searching for. Was able to boot 265MHz. Also got the MSI KT880 Delta-FSR, which seems in very good condition, except the CPU VRM capactors, which are bulged and need replacing. Way better built than the Asrock board.

I've seen that code and it is quite easy to understand and modify. We can modify it to support all known timings (and other things) for nforce2, however we can already control most of them with windows tools (memset, nf2 tweaker, wpcrset). Worth trying super bypass and data scavenged rate though. Is there a known Tref for nforce2? On the romsip topic - try with one really tight upper half (some 133 table) and see if your FSB drops dramatically as well. Based on this research, I believe native 200MHz CPUs would work good even with stock roms (unless the multiplier table is completely broken). Back in the days those 200MHz locked CPUs were rather limited in frequency by the high multi x 200 FSB combination. And there are just a few 200MHz models. It was all about 133 and 166MHz cpus. I have tried to change some of the bytes in a table, but it was not booting. e.g. (using @TerraRaptor's screenshot) Changing byte 12h to 49 or 89 was no POST, 61 and 69 works (have seen both in tables). The problem is we don't know what are these. PS: Ah, CPU Interface doesn't seem to work on NF7 bios, it always loads the "Disabled" table. That's why I never saw a difference between them - same performance, same max FSB. Have to try if it is broken after the bios menu rearrangement, though. Will have to test with a stock bios.

More on the ROMSIP. Testing with XP-M 2500+ and x6 multi. Usual ED multiplier tables, it appears the 133MHz (CPU Interface ON) is loaded. So far, so good. Loads Windows at ~270MHz and goes half way through Pi 1M, but almost impossible to finish it without error. That's what I was experiencing and what I expect. Changing the top part of the particual table with the same part from stock 133MHz table makes the board a little faster, but also drops the maximum FSB to about 240MHz. It seems this is the key for high FSB and that's why modded bioses work - they use the 200MHz table for all. Based on these tests, I think we need to: - Make one "performance" bios with tighter tables for CPUs that are benched at lower FSB and another bios for high FSB, basically 200MHz table copied to 166 and 133 tables (most of the modbioses) - Try to slacken the first part further to allow higher FSB, even with small performance loss (still should be better for super-locked low-multi CPUs). Good for validations, too - Maybe even combine both in one bios, e.g. use the high FSB tables for CPU interface on or off and the performance tables for the other one. Have to check if the difference between CPU Interface ON/OFF is just the tables or it affects the performance in other ways too. PS: That's why L12 hard mod worked as well - making the CPU detect as 200MHz default FSB, so the bios loads 200MHz table, which then allows higher FSB.

Yes, that sounds about right. You configure the desired PCI device register by using the two 32-bit registers PCI_CONFIG_ADDRESS and PCI_CONFIG_DATA in the I/O space. As you have shared (and you can see from tictac's code), the ADDR register is at 0xCF8 and DATA is 0xCFC. The address register format is: 0x80000000 | bus << 16 | device << 11 | function << 8 | offset So e.g. 0x8000006C is bus 0, device 0, function 0, offset 6C. The problem is we only know some of the registers/bits, but others are unknown. What I mean is it would be helpful if we had some sort of a bios and kernel develompent guide for the nvidia chipset. Not all combinations of bits are valid. Usually, if you want to turn on or off certain feature, you need to set several related bits in some register. PS: Actually it says lowest 2 bits should always be 0, so the address offset is then the rest 6 bits?

Yes, if we had the documentation about different MSR and index/data offsets for DRAM controller we could set things with a custom ISA rom. I think (based on the disassembled bios), index/data for one of the extended DRAM controller is 70h/71h, but don't know the base address. If we knew what each bit is, then setting registers is not that hard, basically using bitwise operations and toggling multiple bits in eax using masks, then write back. I know the concept and use it in ZenStates app, but it's not assembly.

Yes, but using a newer modbin 2.04.03 - that might be the difference. I have disassembled the main bios file, but that's a lot to comprehend for my little brain. I've done ARM kernel disassembly and reverse-engineered some of the driver calibration data before, but that nforce2 bios has too many and I don't know where to start.

Yes, that's what I'm currently experimenting with. You can see values changing in b0d0f3 and b0d0f4. Perhaps something else too. I'm only testing at one multiplier (x6) and changing things one by one to hopefully see some relations to affected values and their effect. That upper half of the table is changing things you can't change on the fly with wpcredit. If you search for 65 D0 16 (start of a romsip table), you can see that there are some additional tables in the decompression block, but not sure what they are - perhaps these are the failsafe tables. There are other long tables just under the main romsip tables with bytes that are repeated 4 times each, e.g. 09 09 09 09 25 25 25 25 0D 0D 0D 0D 36 36 36 36 I'm now using a faster method of editing for faster testing. Open the bios rom with modbin and leave it open. It extracts original.bin - this is the main bios decompressed. Change the table of interest with hex editor in original.bin and then save the bios from modbin. It compresses it back and corrects the checksum. @Tzk Regarding the ISA/PCI option rom, you can check D26 Black mantarays bios for NF7, there's a very small custom ISA option rom (Black.bin). Perhaps you can take that as a base if you disassemble it.

Abit boards usually work up to 2 - 2.1V for chipset and I suspect the problem is that Northbridge and Southbridge share the same power plane. On DFI you have separate voltage regulators, perhaps Asus as well? But some boards just hate voltage. VDIMM is derived from 3.3V, so it's better to power it from 5V or 12V rail, otherwise it is unstable. This NF7 does ~267MHz 2.04V and I'm trying to get higher. Basically only work with older CPUs without internal thermistor. AN7 relies on digital reading only, so it was showing 0 degrees for older CPUs that boot and I guess it reads a very high temperature for those with internal sensor and stops it from initializing. And I'm getting a siren (for overheating). NF7 was behaving the same, but was showing normal temperature on the Thunderbird, because it has a physical thermistor in the socket. Abit boards have most of the things unlocked - CPU voltage from 1.1 to 2.3V, AN7 has VDIMM up to 3.3V, multipliers from x5.0 up to x22 and I've unlocked x23 and x24 now, so full range. Default Vcore depends on the CPU, but you can manually select whatever you want. Haven't encountered OCP or OVP up to 2.3V and you can go even higher with vmod

I've "rebooted" the mod project and started from scratch. So far I've done a "base" bios file from the latest D27 official bios for NF7-S Updated SATA RAID Silicon Image to latest 4.4.02 Removed /fnt1 "font1.awd", which doesn't seem to have any negative effect Replaced NIC ROM with Plop Boot manager and adjusted labels/menus to match that Changed "Unknown CPU Type" string to "AMD Athlon XP-M" Reorganized BIOS layout, renamed labels, changed setup and failsafe defaults Enabled x23 and x24 multiplier selection and verified to work - I had to change trailing bit in _EN_CODE.BIN with HEX editor (01 -> 00), 00 means "Selectable", 01 - "Non-Selectable". Modbin was not able to change it. So I now have a nice "clean" base bios to experiment with BPL and ROMSIP tables, timings, etc. This came at a price, though. One of the bios iterations was somewhat corrupted and WinFlash complained about verification issue of Main bios block, however I was smart enough to program the flash chip with a programmer, then insert that chip into the bios socket and try to boot it. As a result, my NF7 was not POST-ing, not beeping, just the fans spinning. Changing bios chips didn't help at all. Tried to clear CMOS numerous times (jumper, battery, no power, completely disassemble and assemble the system again, change components - CPU, VGA, RAM) - still dead. When suddenly a bell ringed and decided to try an old Thunderbird CPU without integrated temperature sensor. And it booted, just like my AN7 - same behavior. From that point I flashed the bios+bootblock with uniflash, bent the thermistor in the socket and eventually it worked with T-Bred and Barton again. A lesson learned: Don't flash a bad bios, although it appeared ok in modbin. Always check with as many tools as possible. Always save a new file after making changes in modbin. Don't just overwrite the one you've opened, sometimes it messes it up. For example, trying to cbrom such a bios it was constantly inflating up to 4GB, when I stopped it Guess it went in an infinite loop. Happened twice! Started form NF7_D27a, currently at NF7_D27j. This way you always have a previous step that worked and you can roll back. Bios chip extractor tool is your best friend. I have a few from DFI Ultra-D s.939 boards. Next, I will try to find how to show certain hidden things from bios. They appear as active in modbin, but probably get removed runtime, or there might be a similar way to unhide them, just like the multipliers. Not that there's much to be enabled, but there's one power management menu I want to try. PS: Actually that bios POST-ed, but loading and saving defaults is what "killed" the board. Edit: Another advanced bios modding source that is interesting: https://sites.google.com/site/pinczakko/bios-articles Additional info if someone is interested in modding under linux $ sudo apt install dosbox $ dosbox $ mount c ~/NF7 $ c: Then use the tools, e.g. modbin nf7.bin If it is a windows executable, like cbrom, use wine cbrom.exe nf7.bin

ACPI. Modded ACPI HAL by @diderius66. It was long time ago. https://hwbot.org/submission/4211718_i.nfrar.ed_superpi___32m_ryzen_5_3600_7min_26sec_359ms There's also a thread about it on the forums:

Have you tested the performance? On Ryzen2 (3000 series) XP is not that fast.

I'm going to experiment with that spectrum.exe. If that is invoked based on the spread spectrum options in bios and there are no other complications by replacing it with a DOS memtest.exe, then it might work. The other possibility is as you say replace one of the option ROM, e.g. NIC with memtest, like I did with the plop boot manager - it works well on NF7-S and I can boot from USB and install Windows from that flash drive. I can turn it on/off from bios with enable/disabled of the "LAN Boot Option ROM" menu item. Couldn't make Acronis boot up from the same flash drive, because there's some collision with the PLOP boot manager, but I might try different options when compressing it. e.g. hook to INT19 instead of INT18. Maybe look into some of the tictac bioses. I remember seeing a changelog which mentioned additional tweaks injected into the SATA RAID option rom. Perhaps that would be the easiest one for your project. Will let you know If I find which bios (I believe it was for NF7-S) has these extra tweaks. I'm unaware of what exactly he have changed, but we can compare. PS: That spectrum.exe is just 13KB, while memtest is 150+, so that might be a problem. At least cbrom doesn't complain. Edit: Modbin works under wine + dosbox

I have found that awardeco (a.k.a. AwardDeco) linux package can list and extract BIOS modules, but there's no tool to compress them back. However, cbrom appears to be working under wine. Haven't flashed a modded bios this way, since I'm at work, but will test once back home. If that works, then I would be able to use my main linux PC I know AwardBiosEditor works under wine, but never tested cbrom before. Can someone link me the proper cbrom and modbin versions? @Tzk Did you manage to add memtest module? There's an EOM rom (spectrum.exe) and I wonder if we can do something with it.

Based on the dates, it should be the same bios with a slightly different tables, which won't give you much difference, if any at all. I've never found working links for other Merlin bioses for DFI Ultra B. The linked bios is the only one from Merlin I have in my collection.

It seems default timings come from BPL, so probably drive strengths and slew rates too. Abit doesn't have them in the bios, I'm using wpcredit in Windows. BTW, what do you use to edit the layout, modbin? It's the tool I've managed to make work in the past.

I've tried my current best NF7-S and can't pass 267MHz no matter what. Optimal Vdd is 2.08V. Lower and it crashes while loading windows at 267, anything significantly higher - BSOD. Hooked up an external Vdimm source (removed the Vdimm MOSFET) and it helped to drop required Vdimm (like 0.2V less or more), but didn't help with max FSB. Played with ROMSIPs again and tried using the one from NF4, but it is slower. It has the last value higher, e.g. 18 -> 1D, 20 -> 25 and this made superpi 1M much slower, while it didn't help with FSB. I can also change drive strengths and slew rates registers. Abit bios has drv strength at 3 (33) and slew rates at 10 (AA). 4/6 or 4/7 seems to work better, but haven't tested a lot of combinations. Can't change Data Scavenged Rate and SuperBypass, plus they are set differently on my board - perhaps just on of the bits is the relevant setting and not the whole register. Probably can get a better score, but wanted to pass that 267MHz limit I have. Will test one "new" AN7 next. This is a Sempron 2200+ (Thoroughbred) with bridge mods.