Undocumented Model-Specific Register on Broadwell Microarchitecture

Question

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found those not documented.

In a specific point of this BIOS, as an example, I found this function:

0000F575                    sub_F575        proc near               
0000F575 60                                 pusha
0000F576 B8 01 00 00 00                     mov     eax, 1
0000F57B 0F A2                              cpuid
0000F57D C1 C8 04                           ror     eax, 4
0000F580 66 3D 6F 30                        cmp     ax, 306Fh       ; Haswell
0000F584 74 06                              jz      short HaswellBroadwellStuffs
0000F586 66 3D 6F 40                        cmp     ax, 406Fh       ; Broadwell
0000F58A 75 0E                              jnz     short NoNeed4IvyBridge
0000F58C
0000F58C                    HaswellBroadwellStuffs:
0000F58C B9 FC 01 00 00                     mov     ecx, 1FCh
0000F591 0F 32                              rdmsr
0000F593 0D 01 00 20 00                     or      eax, 200001h
0000F598 0F 30                              wrmsr
0000F59A
0000F59A                    NoNeed4IvyBridge:
0000F59A 61                                 popa
0000F59B E8 02 06 00 00                     call    DummyProc_1
0000F5A0 C3                                 retn
0000F5A0                    sub_F575        endp

Looking thorough the Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4: Model-Specific Registers I found no evidence this 0x1fc register existence for Haswell, Broadwell or IvyBridge this BIOS is for. Instead few documentation on this register exists for different Intel versions:

• for Goldmont, Nehalem, the register is named MSR_POWER_CTL and only bit #1 is documented
• for Sandy Bridge is still named MSR_POWER_CTL but no further info are provided, instead it just says refer to http://biosbits.org, where nothing useful was found.
• for Skylake, Kaby Lake, Coffee Lake and Cannon Lake datasheet is more verbose; is still named MSR_POWER_CTL and the there bits: #1, #20 and #21 descriptions appears, still no evidences for bits #0 and #21 used in this function.

So my question: If anyone has info on the register I've mentioned, that would be nice if he/her wants to share with me; more important, I would appreciate if anyone would direct me on a reliable source of info on this topic other than Intel official manuals.

Answer 1

Details of such low-level registers are often disclosed only to Intel's trusted partners under NDA since they're not intended to be accessed by the general application programmer but only by writers of BIOS or other system-level code. That said, sometimes you can find info in unexpected places...

#define MSR_POWER_CTL                           0x1FC
#define PCH_NEG_DISABLE                         (1 << 30)
#define PCH_NEG_DISABLE_SHIFT                   30
#define LTR_SW_DISABLE                          (1 << 29)  //LTR_IIO_DISABLE
#define LTR_SW_DISABLE_SHIFT                    29
#define PROCHOT_LOCK                            (1 << 27)
#define PROCHOT_LOCK_SHIFT                      27
#define PROCHOT_RESPONSE                    (1 << 26)
#define PROCHOT_RESPONSE_SHIFT              26
#define PWR_PERF_TUNING_CFG_MODE                (1 << 25)
#define PWR_PERF_TUNING_CFG_MODE_SHIFT          25
#define PWR_PERF_TUNING_ENABLE_DYN_SWITCHING    (1 << 24)
#define PWR_PERF_TUNING_ENABLE_DYN_SHIFT        24
#define PWR_PERF_TUNING_DISABLE_EEP_CTRL        (1 << 23)
#define PWR_PERF_TUNING_DISABLE_EEP_SHIFT       23
#define PWR_PERF_TUNING_DISABLE_SAPM_CTRL       (1 << 22)
#define PWR_PERF_TUNING_DISABLE_SAPM_SHIFT      22
#define DIS_PROCHOT_OUT                         (1 << 21)
#define DIS_PROCHOT_OUT_SHIFT                   21
#define EE_TURBO_DISABLE                    (1 << 19)
#define EE_TURBO_DISABLE_SHIFT              19
#define ENERGY_EFFICIENT_PSTATE_ENABLE          (1 << 18)
#define ENERGY_EFFICIENT_PSTATE_ENABLE_SHIFT    18
#define PHOLD_SR_DISABLE                        (1 << 17)
#define PHOLD_SR_DISABLE_SHIFT                  17
#define PHOLD_CST_PREVENTION_INIT               (1 << 16)
#define PHOLD_CST_PREVENTION_INIT_SHIFT         16
#define FAST_BRK_INT_EN                         (1 << 4)
#define FAST_BRK_INT_EN_SHIFT                   4
#define FAST_BRK_SNP_EN                         (1 << 3)
#define FAST_BRK_SNP_EN_SHIFT                   3
#define SAPM_IMC_C2_POLICY_EN                   (1 << 2)
#define SAPM_IMC_C2_POLICY_SHIFT                2
#define C1E_ENABLE                              (1 << 1)
#define C1E_ENABLE_SHIFT                        1
#define ENABLE_BIDIR_PROCHOT_EN                 (1 << 0)
#define ENABLE_BIDIR_PROCHOT_EN_SHIFT           0
#define POWER_CTL_MASK                          (PCH_NEG_DISABLE + LTR_SW_DISABLE + PWR_PERF_TUNING_CFG_MODE + \
    PWR_PERF_TUNING_ENABLE_DYN_SWITCHING + PWR_PERF_TUNING_DISABLE_EEP_CTRL + \
    PWR_PERF_TUNING_DISABLE_SAPM_CTRL + DIS_PROCHOT_OUT + ENABLE_BIDIR_PROCHOT_EN + C1E_ENABLE)

This is not like a full datasheet but still better than nothing...