October 20, 2015 by pikeralpha

New GigaByte Motherboard Series are MSR(0xE2) Locked

Just to let you know, and it is a bit of a surprise move from GigaByte… but they now set bit-15 on MSR (MSR_PKG_CST_CONFIG_CONTROL) so it won’t boot without a PM patch.

Man. What a failure!

34 thoughts on “New GigaByte Motherboard Series are MSR(0xE2) Locked”

Matt Geard Crane | October 21, 2015 at 1:03 pm

so you tried one GA board and think all are locked yet you fail to mention which board you have because only the overclocker boards are locked the rest are all good to go

Reply
- pikeralpha | October 21, 2015 at 1:26 pm
  
  Hold on. I have six motherboard here for testing, and they are all lock! Even two ultra cheap motherboards and a brand new one so it doesn’t look good.
  
  Reply
  - Matt Geard Crane | October 21, 2015 at 9:39 pm
    
    well none of the ones i was sent are locked it must be just you
  - pikeralpha | October 21, 2015 at 11:16 pm
    
    That is odd. May I ask when that was? Perhaps they changed the BIOS, because I just checked bit-15 (0x8000) of msr(0xE2) and it is the same story – bit-15 is set in the F2, F3 and the F4 BIOS versions – for the GA-B150M-D3H DDR3 and DDR4 (two boards that I am reviewing right now). Not exactly OC boards.
xxxyyyzzz | October 22, 2015 at 7:00 am

This is disappointing, I’ve waited for skylake support and wanted to buy the GA-Z170MX-Gaming 5 for my hackintosh build, have you happened to test that board?

Reply
- pikeralpha | October 22, 2015 at 2:05 pm
  
  No. I have not. Not yet. You can however download the BIOS from Gigabyte and use UEFIPatch to see if it is locked, and can be unlocked with it.
  
  Reply
tstones | October 22, 2015 at 1:33 pm

Hello Pike,

I have a Z77 with msr locked and I can’t find coderush’s PMpatch, what’s the solution to unlock?

Reply
- pikeralpha | October 22, 2015 at 2:03 pm
  
  Wasn’t that long replaced by UEFITool -> https://github.com/LongSoft/UEFITool/tree/master/UEFIPatch
  
  Reply
tstones | October 22, 2015 at 2:10 pm

Thanks Pike, I will try remove msr on my asrock

Reply
adrian_dsl | October 22, 2015 at 3:36 pm

Do you know if GA-Z170X-UD3 is MSR locked?

Reply
- pikeralpha | October 23, 2015 at 2:50 am
  
  Yes.
  
  Reply
  - adrian_dsl | October 23, 2015 at 8:56 am
    
    That’s bad news, I downloaded F4 bios and tried UEFI patch like you said in a previous comment but it could not find any patch. I then used UEFI tool and found 2 PowerMgmt things in the BIOS (PowerMgmtSmm – .fbd when extracted and PowerMgmtDxe – .ffs when extracted). PowerMgmtDxe has the same GUID as Haswell patch so I guess this is where the patch needs to be applied. How do you exactly check for MSR lock?
  - pikeralpha | October 23, 2015 at 12:41 pm
    
    See if bit-15 (0x8000) is set.
  - adrian_dsl | October 23, 2015 at 12:27 pm
    
    Update: I extracted the body of PE32 image (PowerMgmtDxe) and used an online disassembler to get the ASM. I could not find 0xe2 in the asm. Does this mean that F4 is not MSR locked?
  - pikeralpha | October 23, 2015 at 12:42 pm
    
    MSR 0xe2 is used during the initialising phase of the CPU so you must have missed it.
  - adrian_dsl | October 24, 2015 at 11:57 am
    
    Thanks, I found it in CpuInitDxe( mov $0xe2,%ecx). Can these boards be flashed with patched UEFI?
  - pikeralpha | October 24, 2015 at 12:31 pm
    
    Good. Now let’s talk about the value of %ecx so what is that set to?
  - adrian_dsl | October 24, 2015 at 3:39 pm
    I don’t know ASM, I mostly work with C++ and Objective-C. From what I read this instruction must be soon followed by 0xf.
    Here is part of the code, I hope there is no problem posting it here.
    
    and $0x18000,%eax cmp $0x8000,%eax je 0x0000342f mov $0xe2,%ecx rdmsr shl $0x20,%rdx lea 0x38(%rsp),%r9 lea 0x34(%rsp),%r8 or %rdx,%rax lea 0x30(%rsp),%rdx mov $0x5,%ecx mov %rax,%rbx lea 0x3c(%rsp),%rax mov %rax,0x20(%rsp) and $0xf,%ebx callq 0x00005de0 mov %rdi,%r11 test %bpl,0x38(%rsp)
  - pikeralpha | October 24, 2015 at 4:03 pm
    
    There is and AND and CMP instruction with bit-15 in mind, which is the MSR lock bit (0x8000), so it looks like this BIOS is locked, but this is an assumption, because I haven’t seen the code myself.
DeeFarrell | October 22, 2015 at 4:37 pm

Pikeralpha Have you tried the GA-H170N-wifi?.I have the F2 bios but I am not familiar with using UEFITool to check the bios file.Is there a tutorial available.
Thanks

Reply
- pikeralpha | October 23, 2015 at 2:49 am
  
  No and not that I know of. Sorry.
  
  Reply
oscarbg | October 22, 2015 at 9:51 pm

can you list models?
also not related to this post but have you working Intel HD 530 (Skylake iGPU) on OSX?
can you upload some GFXBench and Compubench results to compare to Windows driver?

Reply
- pikeralpha | October 23, 2015 at 2:51 am
  
  Not right now. The problem is that I am very busy with all sorts of things so I have barely time to reply here.
  
  Reply
DeeFarrell | October 23, 2015 at 5:21 am

What about trying KernelPm=true in Clover?

Reply
- pikeralpha | October 23, 2015 at 6:03 am
  
  Should work.
  
  Reply
tonymacx86 (@tonymacx86) | October 26, 2015 at 1:38 pm

The issue should be fixed soon on Gigabyte Z170- got a beta bios today to test. 🙂

Reply
- Dee Farrell | October 26, 2015 at 3:54 pm
  
  Great news .Will this work on the H170?
  Thanks
  
  Reply
  - pikeralpha | October 27, 2015 at 2:47 am
    
    When one BIOS is unlocked, then the rest usually follows a bit later. It may take some time, but things appear to be moving into the right direction.
CodeRushCodeRush | October 28, 2015 at 2:37 pm

Thanks to Adrian_DSL and Pike, I’ve found the real code that locks 0xE2 on Skylake platforms, it’s in SiInit module (GUID 299D6F8B-2EC9-4E40-9EC6-DDAA7EBF5FD9) and looks like this:
mov ecx,0xe2
rdmsr
and eax,0xffff7fff
mov DWORD PTR [ebp-0x8],edx
mov DWORD PTR [ebp-0xc],eax
cmp bl,0x1
jne $+8 <– this jump must be patched to jmp
or eax,0x8000
mov DWORD PTR [ebp-0xc],eax
mov edx,DWORD PTR [ebp-0x8]
mov eax,DWORD PTR [ebp-0xc]
mov ecx,0xe2
wrmsr

Please try to add the following lines to the end of patches.txt and rerun UEFIPatch:
# SiInit| Skylake
299D6F8B-2EC9-4E40-9EC6-DDAA7EBF5FD9 12 P:75080D00800000:EB080D00800000

Reply
- pikeralpha | October 28, 2015 at 3:41 pm
  
  Excellent work, as usual. Thanks!
  
  Reply
- CodeRush | October 28, 2015 at 3:49 pm
  
  If type 12 (TE image) patch doesn’t work on your BIOS, try type 10 (PE32 image) patch. Just repace 12 with 10 in the patch string above and try again.
  I will add both strings into new UEFIPatch release, if someone confirts that the patch really works.
  
  Reply
Andrei L | November 7, 2016 at 3:32 pm

For my MB Asus X99-S Haswell-E CPU the code is like this

mov ecx, 0E2h ; ‘G’
rdmsr
shl rdx, 20h
or rax, rdx
mov [rsp+38h+arg_0], rax
bts dword ptr [rsp+38h+arg_0], 0Fh
mov rdx, [rsp+38h+arg_0]
mov eax, dword ptr [rsp+38h+arg_0]
shr rdx, 20h
wrmsr

Module is PpmInitialize, patch string:
3FFCAE95-23CF-4967-94F5-16352F68E43B 10 P:7428B9E20000000F3248C1E220480BC2:EB28B9E20000000F3248C1E220480BC2

Reply
ajschot | March 10, 2017 at 10:36 am

I have a question i don’t know if i have this problem…
How do i know?
I have a ASRock X99 Extreme 4 with the E5-2658v4 it works very smooth, however with the E5-2683v3 it freezes after some minutes… only when no ssdt file is there it works stable but only at base freqency so no idle and no turbo

Reply
- pikeralpha | March 10, 2017 at 11:20 am
  
  No. This issue is not related to a locked MSR 0xE2 register.
  
  Reply