I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found those not documented.
In a specific point of this BIOS, as an example, I found this function:
0000F575 sub_F575 proc near
0000F575 60 pusha
0000F576 B8 01 00 00 00 mov eax, 1
0000F57B 0F A2 cpuid
0000F57D C1 C8 04 ror eax, 4
0000F580 66 3D 6F 30 cmp ax, 306Fh ; Haswell
0000F584 74 06 jz short HaswellBroadwellStuffs
0000F586 66 3D 6F 40 cmp ax, 406Fh ; Broadwell
0000F58A 75 0E jnz short NoNeed4IvyBridge
0000F58C
0000F58C HaswellBroadwellStuffs:
0000F58C B9 FC 01 00 00 mov ecx, 1FCh
0000F591 0F 32 rdmsr
0000F593 0D 01 00 20 00 or eax, 200001h
0000F598 0F 30 wrmsr
0000F59A
0000F59A NoNeed4IvyBridge:
0000F59A 61 popa
0000F59B E8 02 06 00 00 call DummyProc_1
0000F5A0 C3 retn
0000F5A0 sub_F575 endp
Looking thorough the Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4: Model-Specific Registers I found no evidence this 0x1fc register existence for Haswell, Broadwell or IvyBridge this BIOS is for. Instead few documentation on this register exists for different Intel versions:
- for Goldmont, Nehalem, the register is named MSR_POWER_CTL and only bit #1 is documented
- for Sandy Bridge is still named MSR_POWER_CTL but no further info are provided, instead it just says refer to http://biosbits.org, where nothing useful was found.
- for Skylake, Kaby Lake, Coffee Lake and Cannon Lake datasheet is more verbose; is still named MSR_POWER_CTL and the there bits: #1, #20 and #21 descriptions appears, still no evidences for bits #0 and #21 used in this function.
So my question: If anyone has info on the register I've mentioned, that would be nice if he/her wants to share with me; more important, I would appreciate if anyone would direct me on a reliable source of info on this topic other than Intel official manuals.