a29498f599
The purpose of this tool is to manipulate and get information about the `Back Up Control, Top Swap` mechanism present on most Intel Southbridges. This tool is initially written by Peter Stuge. This tool makes it possible to have a backup mechanism for the bootblock by using the southbridges Back Up Control Top Swap. Sometimes it is also possible to circumvent vendor write protection mechanisms in order to flash coreboot. An example of where this would be useful would be the Lenovo Thinkpad X60 and T60. Change-Id: I12cc2e91396f096fc979e23848e1929cb6c44fc5 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/18224 Reviewed-by: Patrick Georgi <pgeorgi@google.com> Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| bucts.c | ||
| readme.md | ||
readme.md
What is bucts?
Many Intel southbridges provide a mechanism called Back Up Control Top Swap (BUC.TS).
This functionality allows to have the southbridge fetch the reset vector or
the beginning of the bootblock at a 64K/128/256K offset from the usual top of flash.
This can be useful in different ways:
- Have a backup bootblock in case of bootblock hacking;
- Some vendor BIOS only write protect their bootblock so this tool makes it possible to circumvent this protection to allow flashing and booting coreboot.
The BUC.TS status is stored in a nvram bit. To clear it one has to remove the RTC battery.
Operation Description
First compile bucts by running make:
$ make
Then you can view the current system settings:
$ ./bucts --print
To flip the decode address of the bootblock, by setting BUC.TS to 1:
$ ./bucts --set
To set the behavior the regular mapping, by setting BUC.TS to 0
$ ./bucts --unset
Details
Example Bootblock size of 64KB (this is only configurable to be something else like 128 or 256K on PCH Intel targets).
+-------------+ -> 0x200000 +-------------+ -> 0xFFFFFFFF +-------------+ -> 0xFFFFFFFF
| | | | | |
| bootblock_0 | | bootblock_0 | | bootblock_1 |
| | | | | |
+-------------+ -> 0x1F0000 +-------------+ -> 0xFFFF0000 +-------------+ -> 0xFFFF0000
| | | | | |
| bootblock_1 | | bootblock_1 | | bootblock_0 |
| | | | | |
+-------------+ -> 0x1E0000 +-------------+ -> 0xFFFE0000 +-------------+ -> 0xFFFE0000
| | | | | |
| | | | | |
Z Z Z Z Z Z
Z Z Z Z Z Z
| | | | | |
| | | | | |
FLASH (2M) Memory Map BUC.TS=0 Memory Map BUC.TS=1