I.nfraR.ed

Yes, that sounds about right. You configure the desired PCI device register by using the two 32-bit registers PCI_CONFIG_ADDRESS and PCI_CONFIG_DATA in the I/O space. As you have shared (and you can see from tictac's code), the ADDR register is at 0xCF8 and DATA is 0xCFC. The address register format is: 0x80000000 | bus << 16 | device << 11 | function << 8 | offset So e.g. 0x8000006C is bus 0, device 0, function 0, offset 6C. The problem is we only know some of the registers/bits, but others are unknown. What I mean is it would be helpful if we had some sort of a bios and kernel develompent guide for the nvidia chipset. Not all combinations of bits are valid. Usually, if you want to turn on or off certain feature, you need to set several related bits in some register. PS: Actually it says lowest 2 bits should always be 0, so the address offset is then the rest 6 bits?

Yes, if we had the documentation about different MSR and index/data offsets for DRAM controller we could set things with a custom ISA rom. I think (based on the disassembled bios), index/data for one of the extended DRAM controller is 70h/71h, but don't know the base address. If we knew what each bit is, then setting registers is not that hard, basically using bitwise operations and toggling multiple bits in eax using masks, then write back. I know the concept and use it in ZenStates app, but it's not assembly.

Yes, but using a newer modbin 2.04.03 - that might be the difference. I have disassembled the main bios file, but that's a lot to comprehend for my little brain. I've done ARM kernel disassembly and reverse-engineered some of the driver calibration data before, but that nforce2 bios has too many and I don't know where to start.

Yes, that's what I'm currently experimenting with. You can see values changing in b0d0f3 and b0d0f4. Perhaps something else too. I'm only testing at one multiplier (x6) and changing things one by one to hopefully see some relations to affected values and their effect. That upper half of the table is changing things you can't change on the fly with wpcredit. If you search for 65 D0 16 (start of a romsip table), you can see that there are some additional tables in the decompression block, but not sure what they are - perhaps these are the failsafe tables. There are other long tables just under the main romsip tables with bytes that are repeated 4 times each, e.g. 09 09 09 09 25 25 25 25 0D 0D 0D 0D 36 36 36 36 I'm now using a faster method of editing for faster testing. Open the bios rom with modbin and leave it open. It extracts original.bin - this is the main bios decompressed. Change the table of interest with hex editor in original.bin and then save the bios from modbin. It compresses it back and corrects the checksum. @Tzk Regarding the ISA/PCI option rom, you can check D26 Black mantarays bios for NF7, there's a very small custom ISA option rom (Black.bin). Perhaps you can take that as a base if you disassemble it.

Abit boards usually work up to 2 - 2.1V for chipset and I suspect the problem is that Northbridge and Southbridge share the same power plane. On DFI you have separate voltage regulators, perhaps Asus as well? But some boards just hate voltage. VDIMM is derived from 3.3V, so it's better to power it from 5V or 12V rail, otherwise it is unstable. This NF7 does ~267MHz 2.04V and I'm trying to get higher. Basically only work with older CPUs without internal thermistor. AN7 relies on digital reading only, so it was showing 0 degrees for older CPUs that boot and I guess it reads a very high temperature for those with internal sensor and stops it from initializing. And I'm getting a siren (for overheating). NF7 was behaving the same, but was showing normal temperature on the Thunderbird, because it has a physical thermistor in the socket. Abit boards have most of the things unlocked - CPU voltage from 1.1 to 2.3V, AN7 has VDIMM up to 3.3V, multipliers from x5.0 up to x22 and I've unlocked x23 and x24 now, so full range. Default Vcore depends on the CPU, but you can manually select whatever you want. Haven't encountered OCP or OVP up to 2.3V and you can go even higher with vmod

I've "rebooted" the mod project and started from scratch. So far I've done a "base" bios file from the latest D27 official bios for NF7-S Updated SATA RAID Silicon Image to latest 4.4.02 Removed /fnt1 "font1.awd", which doesn't seem to have any negative effect Replaced NIC ROM with Plop Boot manager and adjusted labels/menus to match that Changed "Unknown CPU Type" string to "AMD Athlon XP-M" Reorganized BIOS layout, renamed labels, changed setup and failsafe defaults Enabled x23 and x24 multiplier selection and verified to work - I had to change trailing bit in _EN_CODE.BIN with HEX editor (01 -> 00), 00 means "Selectable", 01 - "Non-Selectable". Modbin was not able to change it. So I now have a nice "clean" base bios to experiment with BPL and ROMSIP tables, timings, etc. This came at a price, though. One of the bios iterations was somewhat corrupted and WinFlash complained about verification issue of Main bios block, however I was smart enough to program the flash chip with a programmer, then insert that chip into the bios socket and try to boot it. As a result, my NF7 was not POST-ing, not beeping, just the fans spinning. Changing bios chips didn't help at all. Tried to clear CMOS numerous times (jumper, battery, no power, completely disassemble and assemble the system again, change components - CPU, VGA, RAM) - still dead. When suddenly a bell ringed and decided to try an old Thunderbird CPU without integrated temperature sensor. And it booted, just like my AN7 - same behavior. From that point I flashed the bios+bootblock with uniflash, bent the thermistor in the socket and eventually it worked with T-Bred and Barton again. A lesson learned: Don't flash a bad bios, although it appeared ok in modbin. Always check with as many tools as possible. Always save a new file after making changes in modbin. Don't just overwrite the one you've opened, sometimes it messes it up. For example, trying to cbrom such a bios it was constantly inflating up to 4GB, when I stopped it Guess it went in an infinite loop. Happened twice! Started form NF7_D27a, currently at NF7_D27j. This way you always have a previous step that worked and you can roll back. Bios chip extractor tool is your best friend. I have a few from DFI Ultra-D s.939 boards. Next, I will try to find how to show certain hidden things from bios. They appear as active in modbin, but probably get removed runtime, or there might be a similar way to unhide them, just like the multipliers. Not that there's much to be enabled, but there's one power management menu I want to try. PS: Actually that bios POST-ed, but loading and saving defaults is what "killed" the board. Edit: Another advanced bios modding source that is interesting: https://sites.google.com/site/pinczakko/bios-articles Additional info if someone is interested in modding under linux $ sudo apt install dosbox $ dosbox $ mount c ~/NF7 $ c: Then use the tools, e.g. modbin nf7.bin If it is a windows executable, like cbrom, use wine cbrom.exe nf7.bin

ACPI. Modded ACPI HAL by @diderius66. It was long time ago. https://hwbot.org/submission/4211718_i.nfrar.ed_superpi___32m_ryzen_5_3600_7min_26sec_359ms There's also a thread about it on the forums:

Have you tested the performance? On Ryzen2 (3000 series) XP is not that fast.

I'm going to experiment with that spectrum.exe. If that is invoked based on the spread spectrum options in bios and there are no other complications by replacing it with a DOS memtest.exe, then it might work. The other possibility is as you say replace one of the option ROM, e.g. NIC with memtest, like I did with the plop boot manager - it works well on NF7-S and I can boot from USB and install Windows from that flash drive. I can turn it on/off from bios with enable/disabled of the "LAN Boot Option ROM" menu item. Couldn't make Acronis boot up from the same flash drive, because there's some collision with the PLOP boot manager, but I might try different options when compressing it. e.g. hook to INT19 instead of INT18. Maybe look into some of the tictac bioses. I remember seeing a changelog which mentioned additional tweaks injected into the SATA RAID option rom. Perhaps that would be the easiest one for your project. Will let you know If I find which bios (I believe it was for NF7-S) has these extra tweaks. I'm unaware of what exactly he have changed, but we can compare. PS: That spectrum.exe is just 13KB, while memtest is 150+, so that might be a problem. At least cbrom doesn't complain. Edit: Modbin works under wine + dosbox

I have found that awardeco (a.k.a. AwardDeco) linux package can list and extract BIOS modules, but there's no tool to compress them back. However, cbrom appears to be working under wine. Haven't flashed a modded bios this way, since I'm at work, but will test once back home. If that works, then I would be able to use my main linux PC I know AwardBiosEditor works under wine, but never tested cbrom before. Can someone link me the proper cbrom and modbin versions? @Tzk Did you manage to add memtest module? There's an EOM rom (spectrum.exe) and I wonder if we can do something with it.

Based on the dates, it should be the same bios with a slightly different tables, which won't give you much difference, if any at all. I've never found working links for other Merlin bioses for DFI Ultra B. The linked bios is the only one from Merlin I have in my collection.

It seems default timings come from BPL, so probably drive strengths and slew rates too. Abit doesn't have them in the bios, I'm using wpcredit in Windows. BTW, what do you use to edit the layout, modbin? It's the tool I've managed to make work in the past.

I've tried my current best NF7-S and can't pass 267MHz no matter what. Optimal Vdd is 2.08V. Lower and it crashes while loading windows at 267, anything significantly higher - BSOD. Hooked up an external Vdimm source (removed the Vdimm MOSFET) and it helped to drop required Vdimm (like 0.2V less or more), but didn't help with max FSB. Played with ROMSIPs again and tried using the one from NF4, but it is slower. It has the last value higher, e.g. 18 -> 1D, 20 -> 25 and this made superpi 1M much slower, while it didn't help with FSB. I can also change drive strengths and slew rates registers. Abit bios has drv strength at 3 (33) and slew rates at 10 (AA). 4/6 or 4/7 seems to work better, but haven't tested a lot of combinations. Can't change Data Scavenged Rate and SuperBypass, plus they are set differently on my board - perhaps just on of the bits is the relevant setting and not the whole register. Probably can get a better score, but wanted to pass that 267MHz limit I have. Will test one "new" AN7 next. This is a Sempron 2200+ (Thoroughbred) with bridge mods.

Maybe, just maybe, the CPU is also a factor? ?

I don't think MSI would be able to help. The documents, describing all the SMU features and MSR are under NDA. AMD never released "Kernel and Bios Development Guide" for Zen, while it is available for older generations. I don't have any industry contacts, but even if I manage to sign NDA and get my hands on these documents, it still wouldn't work for me, because "ZenStates" is now open-source. Signing NDA would mean I will have to close it again, which I don't want. So, basically, this leaves me with the only option to reverse-engineer what I can. More about my request. Performance Bias options set different bits in different MSRs. The easiest way to "copy" these and re-use in ZenStates is to read the MSRs from a running system, then compare changes and extract just the bits of interest, which I don't actually know what they are. I only have an uneducated guess. The other option would be to disassemble those binary (.exe) files. Since you have pointed me to the VIII thread thread, I will get the binaries from there and test on my machine instead. I'm using public tools like R-W Everything, CrystalCPUID. Cheers.

Thanks, I don't have a MSI board, only have Crosshair VI Hero. I've tweaked these profiles for ZenStates app, but wanted to see if MSI does something different. That's why I need to read MSR on a running system or somehow get the source code, which ain't gonna happen. Aggressive doesn't boot for me on the CH6H, but I was not aware there are updated exe files. Will take a look, thank you. Having to reverse-engineer everything is very demotivating

All my Sempron CPUs scale equally with cold in terms of HTRef, but I haven't tested many, so that might not be valid for all. I have 2 untested 150's, but can't find time for all the projects I have, so they'll wait. Nowadays, you need a high clocking DDR3 board to be competitive, unless you find a CPU that runs 6.7+ CB15 on DDR2 board. But anyway, you won't find a CPU better than mine ?

Can you do me a favor? AFAIK MSI also has Performance Bias options in bios (that's how it is called on ASUS). If so, could you dump them for me? I can tell you the exact steps - would require several reboots and quick MSR dump for each option.

The stepdowns are here and I've hooked one of them to the Asrock board. Didn't help with freezes when in dual channel and high Vdimm. At ~3.37V real Vdimm I can only see the VGA OPROM message, but the board doesn't POST. Works with one dimm, but not with two and high Vdimm. It's not visible in the photo, but the MOSFET leg is desoldered and bent up, so I can solder the external wire. The green display is what I was using before to monitor Vdimm, but it's now disconnected, thus showing 0.00. So the next idea is to desolder all VDD pins of the DRAM PLL ICS93735 and connect to external 2.5V. If that doesn't work, I give up. PS: The board is probably dead, shorted 2 pins on the PLL

I don't think it's worth it, since you can tweak these things in OS. It's good for gaining some experience, but personally I don't have so much time to waste for this. I waste it on other projects You need to know assembly to successfully implement new functionality. On a side note, I will have MSI KT880 Delta to try as well, should be a little better than the Asrock and its bios is standard AMI, which I could open with AMIBCP and edit - no hidden options though. BTW, does anyone know how to display text correctly in Award Bios Editor? It is some problem with encoding or font and all the setup screen labels show as scrambled symbols. Perhaps it needs to be edited on Windows 98? I can edit it with modbin, but it's less functional.

Many of the registers match, but the primary timings don't. Not much to be gained, though. Everything is already set to fastest values. Slackening the timings and turning some things off might help with FSB, but I'm searching for performance boost.

I usually hot-flash in windows with WinFlash. Have a bios extractor clip, many spare Winbond bios chips and if anything goes wrong I just pop the bad chip out and put the working one. Have a willem programmer as well. Useful for full wipe and re-program, prepare several backup bios chips, etc. But that nanoflasher is much easier to use, since it is just USB.

Starting from KT400A through KT600 and KT880 should be similar. KT400A and KT600 are almost the same (same part numbers), KT880 is an evolution of KT600, but most registers are probably the same. To be honest, I expected a bit better performance from KT880. It might be just the Asrock board/bios, but it's not much faster than single-channel KT600. I believe performance could be improved by tweaking DRAM and V-Link registers, but need the documentation for this. Found this site, so it seems KT333 and KT400 PCR files exist, but downloads are broken and can't find them anywhere else: http://www.georgebreese.com/net/software/ It's probably incompatible anyway, because the part number is different and I need at least KT400A or newer. KT880 was so late in the game that it never got popular. People only bought boards based on it for cost-saving systems.

Unfortunately offsets don't match. Haven't found a tool which can read all the timings. AIDA reads more than others, but if I change a timing with wpcredit cpuz is the only one reflecting it. AIDA always reads 2-2-2-6, even if I set e.g. 2-2-2-9.

Thanks, that would definitely help. Slew rate and drive strengths are exposed in DFI Ultra-B bioses, but I haven't played much with them. In fact haven't played with the DFI board much, since it is much more unstable and picky than Abit. It is important to see the correlation between different bits, for example, one needs to set BYP (bypass) bit to 1 first in order to use the external values for N and P transistors. That's why nothing happened when I tried to set them by had on a running system. I might get my hands on a new tool with all the options included, not just the well-known timings. Depends what can be R/W runtime. Edit: That's the maximum DRAM frequency I can do with BH5@~3.08V in Dual Channel 1T. Higher than 3.1V and the board freaks out. Most of the screens on the desktop got corrupt after some subsequent crashes. Should have saved it on usb earlier, but it is still visible. Interestingly enough, I can't do 250 stable anymore and could not go to 260 for "a screen", no matter the volts (raised or "stock"). Perhaps I did it on a later bios, don't remember. Spent some time figuring out the timings in wpcredit, however I'm able to control the main timings only. Others seem to be read-only b0/d0/f3x56 [1,0] tRP (11-5, 10-4, 01-3, 00-2) [3,2] tRCD (11-5, 10-4, 01-3, 00-2) [5,4] tCL (11-3, 10-2.5, 01-2, 00-1.5 or reserved) - readonly [7,6] tRAS (11-9, 10-8, 01-7, 00-6) Lowest is 10 -> 00010000 -> 2-2-2-6 If someone finds PCR file for KT400/A or datasheet for KT400/600/880 please let me know.