I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found those not documented.
In a specific point of this BIOS, as an example, I found this function:
0000F575 sub_F575 proc near 0000F575 60 pusha 0000F576 B8 01 00 00 00 mov eax, 1 0000F57B 0F A2 cpuid 0000F57D C1 C8 04 ror eax, 4 0000F580 66 3D 6F 30 cmp ax, 306Fh ; Haswell 0000F584 74 06 jz short HaswellBroadwellStuffs 0000F586 66 3D 6F 40 cmp ax, 406Fh ; Broadwell 0000F58A 75 0E jnz short NoNeed4IvyBridge 0000F58C 0000F58C HaswellBroadwellStuffs: 0000F58C B9 FC 01 00 00 mov ecx, 1FCh 0000F591 0F 32 rdmsr 0000F593 0D 01 00 20 00 or eax, 200001h 0000F598 0F 30 wrmsr 0000F59A 0000F59A NoNeed4IvyBridge: 0000F59A 61 popa 0000F59B E8 02 06 00 00 call DummyProc_1 0000F5A0 C3 retn 0000F5A0 sub_F575 endp
Looking thorough the Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4: Model-Specific Registers I found no evidence this 0x1fc register existence for Haswell, Broadwell or IvyBridge this BIOS is for. Instead few documentation on this register exists for different Intel versions:
- for Goldmont, Nehalem, the register is named MSR_POWER_CTL and only bit #1 is documented
- for Sandy Bridge is still named MSR_POWER_CTL but no further info are provided, instead it just says refer to http://biosbits.org, where nothing useful was found.
- for Skylake, Kaby Lake, Coffee Lake and Cannon Lake datasheet is more verbose; is still named MSR_POWER_CTL and the there bits: #1, #20 and #21 descriptions appears, still no evidences for bits #0 and #21 used in this function.
So my question: If anyone has info on the register I've mentioned, that would be nice if he/her wants to share with me; more important, I would appreciate if anyone would direct me on a reliable source of info on this topic other than Intel official manuals.