New GigaByte Motherboard Series are MSR(0xE2) Locked

Just to let you know, and it is a bit of a surprise move from GigaByte… but they now set bit-15 on MSR (MSR_PKG_CST_CONFIG_CONTROL) so it won’t boot without a PM patch.

Man. What a failure!

31 thoughts on “New GigaByte Motherboard Series are MSR(0xE2) Locked

      • That is odd. May I ask when that was? Perhaps they changed the BIOS, because I just checked bit-15 (0x8000) of msr(0xE2) and it is the same story – bit-15 is set in the F2, F3 and the F4 BIOS versions – for the GA-B150M-D3H DDR3 and DDR4 (two boards that I am reviewing right now). Not exactly OC boards.

  1. This is disappointing, I’ve waited for skylake support and wanted to buy the GA-Z170MX-Gaming 5 for my hackintosh build, have you happened to test that board?

      • That’s bad news, I downloaded F4 bios and tried UEFI patch like you said in a previous comment but it could not find any patch. I then used UEFI tool and found 2 PowerMgmt things in the BIOS (PowerMgmtSmm – .fbd when extracted and PowerMgmtDxe – .ffs when extracted). PowerMgmtDxe has the same GUID as Haswell patch so I guess this is where the patch needs to be applied. How do you exactly check for MSR lock?

      • Update: I extracted the body of PE32 image (PowerMgmtDxe) and used an online disassembler to get the ASM. I could not find 0xe2 in the asm. Does this mean that F4 is not MSR locked?

      • I don’t know ASM, I mostly work with C++ and Objective-C. From what I read this instruction must be soon followed by 0xf.
        Here is part of the code, I hope there is no problem posting it here.

        and    $0x18000,%eax
        cmp    $0x8000,%eax
        je     0x0000342f
        mov    $0xe2,%ecx
        shl    $0x20,%rdx
        lea    0x38(%rsp),%r9
        lea    0x34(%rsp),%r8
        or     %rdx,%rax
        lea    0x30(%rsp),%rdx
        mov    $0x5,%ecx
        mov    %rax,%rbx
        lea    0x3c(%rsp),%rax
        mov    %rax,0x20(%rsp)
        and    $0xf,%ebx
        callq  0x00005de0
        mov    %rdi,%r11
        test   %bpl,0x38(%rsp)
      • There is and AND and CMP instruction with bit-15 in mind, which is the MSR lock bit (0x8000), so it looks like this BIOS is locked, but this is an assumption, because I haven’t seen the code myself.

  2. Pikeralpha Have you tried the GA-H170N-wifi?.I have the F2 bios but I am not familiar with using UEFITool to check the bios file.Is there a tutorial available.

  3. can you list models?
    also not related to this post but have you working Intel HD 530 (Skylake iGPU) on OSX?
    can you upload some GFXBench and Compubench results to compare to Windows driver?

  4. Thanks to Adrian_DSL and Pike, I’ve found the real code that locks 0xE2 on Skylake platforms, it’s in SiInit module (GUID 299D6F8B-2EC9-4E40-9EC6-DDAA7EBF5FD9) and looks like this:
    mov ecx,0xe2
    and eax,0xffff7fff
    mov DWORD PTR [ebp-0x8],edx
    mov DWORD PTR [ebp-0xc],eax
    cmp bl,0x1
    jne $+8 <– this jump must be patched to jmp
    or eax,0x8000
    mov DWORD PTR [ebp-0xc],eax
    mov edx,DWORD PTR [ebp-0x8]
    mov eax,DWORD PTR [ebp-0xc]
    mov ecx,0xe2

    Please try to add the following lines to the end of patches.txt and rerun UEFIPatch:
    # SiInit| Skylake
    299D6F8B-2EC9-4E40-9EC6-DDAA7EBF5FD9 12 P:75080D00800000:EB080D00800000

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s