WindSLIC - PCI Replacement ROM for SLIC Injection

Yep. It's true. It's just not very useful, because the BCV (unlike the BEV) is called before the POST has completed, so the ACPI tables aren't necessarily there/finalized yet.

The BIOS Boot Specification is pretty good. I just wish they would have released an updated version with examples of how to architect the BCV, etc.

edit:

No, but on all but the AMI BIOSes (of the one's I've encountered), the BEV gets executed again and thus re-hooks int15h, so there's no apparent break to the hibernated OS.

Let me get my specs,
-tij-

 

Probably, but that's somewhat undefined, I guess. The real problem is that from the perspective of whatever moved the EBDA, that memory is (at least in the case of, say, a SCSI card firmware), exactly the memory that it would then think was its to overwrite with whatever it wanted.

PCI FW 3.0 has a mechanism (POST Memory Manager (PMM)) to gain non-moving permanent memory at INIT time, but with neither of the VMs (QEMU and the latest VMWare (I'm assuming VirtualBox is no better)) supporting PCI-FW 3.0, testing it would be... fun.

I think the Int15H stuff works okay for us, but it's not as good as the PMM method.

Given the different options for different boards, so far I have tried to go with the "most compatible" rather than the "most capable" solution. If there is a need to, we can expand WindSLIC to be huge-on-ROM (64K is as big as I think we can safely go) and include all the various tools we have found in past versions at our disposal. Or, if size is an issue, compile-time options could be made for specific chipsets/motherboards/etc.

Right now, WindSLIC puts RSDP into the EBDA, and then puts RSDT/XSDT/SLIC into HA-MEM (my word for High-Address Memory, meaning the highest non-reserved memory found by the E820 mechanism, up to near 4GB). Both of these are sub-optimal, in that the old RSDP isn't removed (read-only), and there are two sets of RSDT/XSDT in memory.

On Intel-Chipset Intel P4, Core and Core2 (but not Core-i3,5,7) boards, old versions of WindSLIC have the capability to alter the original RSDP, etc. That's nice.

From my research, I think every AMD memory-controller-having Athlon/Opteron/Phenom/etc chip has some capaiblity to do the same thing, regardless of motherboard. Untested, but also nice.

Intel Core-i3,i5, and -i7chips *supposedly* have the same mechanism (configuration mechanisms are purported to be on the on-chip PCI BUS #255) but I don't own one to test, and at least one person says he's tried and can't find any trace of them on a real board.

Nvidia, ATI, and other chipset Intel boards don't have published datasheets explaining how to accomplish the same thing, unfortunately. If we tore apart the BIOS ROMs, we could probably discern the mechanism, but I haven't attempted it yet.

-tij-

 

Any volunteer developers out there?

On a separate note:

Would anyone here like to try helping to develop WindSLIC (or similar things)?

I'm willing to write a thread on the mechanisms I use to develop it, if anyone wants to try to do the same thing.

The basics are:

• Program is written in FASM assembly for 16-bit x86 CPUs
• Development Environment is actually Fedora Linux
• GNU Make is used to make and test most things
• QEMU (and now VMWare) are used to do most of the dev/testing runs

If a few people want to volunteer to learn, I'll give the forum all the tricks I've learned. Might be kind of fun.

-tij-

 

I don't remember right off the top of my head what was the last version that could do that completely. The bits of code that deprotected the memory area are still around but remmed out (ws_pcifn.inc), but the actual RSDP-alteration code is almost still there, used after the RSDP gets copied into EBDA.

It varies. That's one outcome. If the Int15H doesn't get re-hooked, it also pops up a nasty-gram that yells about the E820 map being different and proceeds to boot without restoring the hibernated state.

-tij-

 

Hmm. Sorry to hear that. Sounds like Windows 2008 R2 may do something that Win7 doesn't.

To fix the card, you'll want to hit "F5" the moment you see the card's WindSLIC show up.

That should disable the card's WindSLIC, and the boot should occur normally.

Assuming that works, you then should be able to flash the card's firmware back to normal/PXE however you flashed it before.

Good luck!
-tij-

 

If you didn't save the old Firmware, I don't think you're in too much trouble. The WindSLIC flash using IBAUTIL doesn't overwrite the card's EEPROM, so the MAC address and whatnot should be intact.

I usually just recommend doing IBAUTIL -upgrade when I want to remove WindSLIC. That will put the newest (or whatever version was included with your IBAUTIL, at least) version of the Intel PXE Firmware on the card.

If you need a specific version of the real Intel ROM for the card, you can restore it as DSpyder suggested (if you have access to one), but the recommended way is to track down the proper PROBOOT version from Intel and use that (since its version of IBAUTIL will include/use a clean non-saved-card-specific PXE firmware).

-tij-

 

Well, I ran a boot test with a VM Windows 2008 R2 installation.

It seemed to boot and run fine with my development version.

As for what to do next, I had a couple of questions for the Windows 2008 R2 users here.

How much RAM do you have in the machines you're trying this on? I don't have any machines with more than 4GB.

Can you boot to DOS and run the WSCOMFIL debugging test with BS_DEBUG enabled? That would allow the WindSLIC internal debugging text to be captured and uploaded here.

Failing that, can you set:

Code:

BOOTSPLASH_VERBOSITY = BS_DEBUG ; OR USE BS_DETAILED, It would probably be sufficient
BOOTSPLASH_USE_TIMELY_PAUSES = 1

Then, run through the boot and see if it finds an E820 High Water Mark?

Edit:
There's also an advanced E820 Diagnostic mode (DEBUG_SYS_E820_ENABLED) included in WindSLIC, but I haven't used it in a while and I think it's a bit neglected/broken (wrong function name for displaying dwords as hex, and bad linefeeds) in the current version.

Thanks,
-tij-

 

Well, that's encouraging. So, it at least sounds like there's nothing intrinsically wrong with the interaction between WindSLIC and Windows 2008 R2, necessarily. That leaves a million possibilities, of course, but that's better than a million and one, I suppose.

Sure thing. Thanks for your feedback!

 

I worked on it for a little while today. I finally figured out why it's hard:

If WindSLIC doesn't get loaded as a ROM, we'll have to reserve some (low) memory for WindSLIC itself (including the Int15H Handler we use), not just the final ACPI tables.

Ah, fun.

-tij-

 

Potentially, yes. But, what benefit would that have over the existing loaders that can do that?

-tij-

 

Hm. Well, it's an idea, I guess. I never really considered positioning WindSLIC in the "loader" arena, but there's nothing preventing it, necessarily, I guess.

I would upgrade, since the new version fixes a number of possible failure modes, but if the old version is working for you, I suppose there's no official reason why you'd have to upgrade.

If it ain't broke, don't fix it?
-tij-

 

You know, I haven't found much either. I think the BCV part of the BBS specification was sort of written to rely on knowledge in the bailiwick of the BIOS engineer crowd. I've found bits and pieces of the knowledge needed, but not a whole how-to about it, or even a great example.

Haven't done much in the last day or two. The two things I'm working on are the BCV stuff and the Floppy-Loader stuff, but neither is in a position where it entices me to work on it much.

The BCV stuff seems to actually work in the VM test cases, but the last version I tried on a real PC (AMI BIOS) didn't, so I need to pick apart more of the bits of sketchy Int13H handler stuff from the internet to see if I can figure out how to fully hook a drive number.

The Floppy thing hit a roadblock when I realized that because it's not in the UMB area, I would have to find a way to reserve/protect the WindSLIC after loading. I'm sure there's a way (for example, extending the EBDA another 8K or so and shoving all of WindSLIC there), but I'm not done letting the idea percolate.

-tij-