Watchguard XTM 5 Series

stephenw10 · May 10, 2012, 12:21 AM

I agree, that's the LPC device.
After extensive testing I am thinking that the arm/disarm led on the XTM 5 is not driven by GPIO pins on the ICH7.


As other models the GPIO base address is stored in LPC pci config at offset 48H:
[2.0.1-RELEASE][root@pfSense.localdomain]/root(14): pciconf -r pci0:0:31:0: 0x48
00000481

As before bit 1 is hard wired high so the GPIO base is 0x0480\. Same as the X-Peak and X-E.

Experimental findings of ICH7 IO space;  

GPIO 0-31

0x483-0x480 Set pins as gpio or native fuctions. 1=gpio
Default 1F3FF7FF				                0001 1111 0011 1111 1111 0111 1111 1111
Found   1F15F7C1      						0001 1111 0001 0101 1111 0111 1010 0001 

0x0487-0x0484 Set gpios as input or output. 1=Input
Default	E0E8FFFF
Found	E0E87F83	bit 1 is input. Possible outputs are 	1110 0000 1110 1000 0111 1111 1000 0011 

			(set as gpio & set as output)		   1 1111    1  1 1 1           1  

10 possible gpio bits! Far more than previously.

0x048f-0x048c GPIO Levels
Default	02FE0000						0000 0010 1111 1110 0000 0000 0000 0000			
Found	E3EEFBBF				   	        1110 0011 1110 1110 1111 1011 1011 1111

	Set as an output GPIO and are low	(led is off)	   1 11      1    1            
	Test result						   x xxxx    x  x x x           x

0x0487-0x0484 Enable blink. 1=Blink at 1Hz
Default 00040000						0000 0000 0000 0100
Found   00040000						                1

Results: No effect on arm/disarm led. :(

We have a clue from Watchguard OS, gpio2

GPIO 32-63

0x4B3-0x4B0 Set pins as gpio or native fuctions. 1=gpio
Default 000300FF				                0000 0000 0000 0011 0000 0000 1111 1111
Found   000000CF      						0000 0000 0000 0000 0000 0000 1100 1111 

0x04B7-0x04B4 Set gpios as input or output. 1=Input
Default	000000F0						0000 0000 0000 0000 0000 0000 1111 0000
Found	E0E87F83	bit 1 is input. Possible outputs are 	0000 0000 0000 0000 0000 0000 0011 0000 

			(set as gpio & set as output)		                              1100 1111  

6 possible gpio bits.

0x04BB-0x04B8 GPIO Levels
Default	00030003						0000 0000 0000 0011 0000 0000 0000 0011			
Found	000000BB				   	        0000 0000 0000 0000 0000 0000 1011 1011

	Set as an output GPIO and are low			                               1    1            
	Test result						                              xx   xxxx

None found :(

Or maybe the led is damaged on my box.
Next possibility is via the superIO chip but that is way harder to test. :(

Steve

stephenw10 · May 10, 2012, 12:37 AM

Or possibly it's driven from the LCD module in some way.
There is a clue in the boot message from the Watchguard OS:


Parallel LCM Driver Version 0.0.2 is loaded
plcm_drv: LPTx Address = 378
Logical Device GPIO2 disabled, no function, enabling now
GPIO2(bit4) not configured for LED triggering, configuring now
SST_ | <enable_flash_ich_dc_spi> WARNING: SPI Configuration Lockdown activated.</enable_flash_ich_dc_spi>

Hmm. Time to look at the display.

Steve

fmertz · May 10, 2012, 1:56 AM

@stephenw10:

There is a clue in the boot message from the Watchguard OS:
GPIO2(bit4) not configured for LED triggering, configuring now

How about this GPIO 2 area? It is at gpiobase + 0x30. Section 10.10.6 in the spec. Bet you it is bit 4 does stuff…

stephenw10 · May 10, 2012, 9:40 AM

If you mean GPIOs 32-63 on the ICH7 then I already tried that, see test results above. Nothing doing.

The fact that is refer to 'logical device gpio2' makes me think it could be the superio chip as that is how it is referred to in the datasheet. Also gpio2 bit 4 happens to be a dedicated gpio.

There is the other winbond chip which looks to be only accessible via i2c. That would be difficult.

Steve

stephenw10 · May 10, 2012, 9:53 AM

Aha! ;D
Found it!
The arm/disarm led is controlled by bits 4 and 5 of logical device 8 (GPIO2) on the SuperIO chip.

In order to use the led two things must first be set. The GPIO2 device must be enabled by setting CR30 on logical device 8 to 0x01. Then bits 4 and 5 must be set to output but setting CRF0 on logical device 8 to 0xCF. This ties in with the clue in the previous post.
The odd thing about this is that I would have expected these to be setup by the bios and set the LED as red from the outset. In fact my box never shows red at all if I boot the Watchguard OS.

Then the led can be controlled via CRF1:

Control Register F1     Bit5 Bit4	Arm/Disarm LED
0x00			0 0		Off
0x10			0 1		Green
0x20			1 0		Red
0x30			1 1		Off

Accessing these control registers is a proper PITA! A great string of commands have to be sent. For example, setting CRF1 to 0x10 to set the led green:


[2.0.1-RELEASE][root@pfSense.localdomain]/conf(85): ./writeio 2e 87
Setting 2e to 87
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(86): ./writeio 2e 87
Setting 2e to 87
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(87): ./writeio 2e 7
Setting 2e to 7
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(88): ./writeio 2f 8
Setting 2f to 8
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(89): ./writeio 2e f1
Setting 2e to f1
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(90): ./writeio 2f 10
Setting 2f to 10
[2.0.1-RELEASE][root@pfSense.localdomain]/conf(91): ./writeio 2e aa
Setting 2e to aa

Fortunately you can use superiotool to read back what we have done:


[2.0.1-RELEASE][root@pfSense.localdomain]/conf(92): superiotool -d
superiotool r
Found Winbond W83627THF/THG (id=0x82, rev=0x85) at 0x2e
Register dump:
idx 20 21 22 23 24 25 26 28  29 2a 2b 2c 2d 2e 2f
val 82 85 ff fe c6 00 00 00  00 00 00 00 01 00 ff
def 82 NA ff 00 MM 00 MM 00  00 00 MM MM MM 00 00
LDN 0x00 (Floppy)
idx 30 60 61 70 74 f0 f1 f2  f4 f5
val 00 00 00 00 02 0e 00 ff  00 00
def 01 03 f0 06 02 0e 00 ff  00 00
LDN 0x01 (Parallel port)
idx 30 60 61 70 74 f0
val 01 03 78 07 04 3c
def 01 03 78 07 04 3f
LDN 0x02 (COM1)
idx 30 60 61 70 f0
val 01 03 f8 04 00
def 01 03 f8 04 00
LDN 0x03 (COM2)
idx 30 60 61 70 f0 f1
val 01 02 f8 03 00 04
def 01 02 f8 03 00 00
LDN 0x05 (Keyboard)
idx 30 60 61 62 63 70 72 f0
val 01 00 60 00 64 01 0c 82
def 01 00 60 00 64 01 0c 80
LDN 0x07 (GPIO 1, GPIO 5, game port, MIDI port)
idx 30 60 61 62 63 70 f0 f1  f2 f3 f4 f5
val 00 02 01 03 30 09 ff ff  ff ff ff ff
def 00 02 01 03 30 09 ff 00  00 ff 00 00
LDN 0x08 (GPIO 2)
idx 30 f0 f1 f2 f3 f4 f5 f6  f7
val 01 83 10 00 00 ff 00 00  00
def 00 ff 00 00 00 RR 00 00  00
LDN 0x09 (GPIO 3, GPIO 4)
idx 30 f0 f1 f2 f3 f4 f5 f6
val 00 ff ff ff 00 ff ff ff
def 00 ff 00 00 00 ff 00 00
LDN 0x0a (ACPI)
idx 30 70 e0 e1 e2 e3 e4 e5  e6 e7 f0 f1 f3 f4 f6 f7  f9 fe ff
val 00 00 01 00 09 00 30 00  00 00 00 8f 32 00 00 00  00 00 00
def 00 00 00 00 MM MM 00 00  00 00 00 00 00 00 00 00  00 RR RR
LDN 0x0b (Hardware monitor)
idx 30 60 61 70
val 01 0a 00 00
def 00 00 00 00

Steve

stephenw10 · May 10, 2012, 5:30 PM

Here are the keyboard mappings for the LCD:


Button Pressed	0x379
None		87
Up		E7
None		A7
Down		C7
None		87
Left		CF
None		8F
Right		EF
None		AF

Unfortunately I think that's going to cause a conflict with the existing codes. :-\

Steve

fmertz · May 10, 2012, 7:32 PM

@stephenw10:

Here are the keyboard mappings for the LCD:
Unfortunately I think that's going to cause a conflict with the existing codes. :-\

Good find. After applying the mask, all these codes are in conflict with existing codes, and map differently. We need to find a (portable/easy) way to tell the boxes apart…

stephenw10 · May 16, 2012, 7:41 PM

There seemed to be quite a lot of potential in this box for unlocking additional features in the bios, boot from USB various power saving tweaks etc. Also the arm/disarm led is not correctly set to red at boot. I suspect that Watchguard must have fixed this with bios update them selves but I have no proof of that.
You can easily read and write the bios flash chip from pfSense with the flashrom package:

pkg_add -r ftp://ftp-archive.freebsd.org/pub/FreeBSD-Archive/ports/i386/packages-8.1-release/Latest/flashrom.tbz

Initially I read the bios image to a file so I could look at it with various tools. This was all mostly new to me, I have played around with award bios mods before but not AMI. Much reading later I realised the bios is locked down because the 'user access level' is set to 2, 'limited', in which the only thing that can be modified by the normal user is the time and date.
As a first test I changed the access level to 3, full, using amibcp. Although I had read that newer AMI bioses could be corrupted by amibcp this did not seem to be the case for this one modification. I got brave and flashed back the modified image, success! I now had access to all the available settings.

However many of the interesting settings are hidden in the standard bios so in order to enable USB boot I modified the bios image again to unhide most options. I chose to hide the LAN bypass menu since that relays are not included on the board. I reflashed the image, disaster! ??? It appears that, as reported on many other sites, amibcp does indeed often or almost always corrupt the bios. The first time I had just been lucky. Since the bios flash chip is soldered to the board there is no possibility for a 'hot flash' and I only have one of these anyway.

Looking on the positive side the board does have an SPI header next to bios chip for programming it and this seemed like an excellent opportunity to learn how to use it! ::)

Much reading later… I came across the website of this genius from the Czech republic. As well as providing a useful, and incredibly simple, circuit this man has provided code to the flashrom project to use it. Alternatively use his own code from DOS. Awesome job!
Now unfortunately you need a later version of flashrom than 8.1 provides but fortunately the most recent version from 8-stable installs and runs fine on an 8.1 box (for parallel port use anyway).

Lanner helpfully provide the pinout of the SPI header but you can easily find it with a multimeter anyway. Interestingly the WP (write protect) pin is not connected which I thought was going to be a show stopper
but it's not needed. Also useful is that the motherboard, when plugged in but not powered up, provides the required 3.3V to power the chip pull the HOLD pin high. So some soldering and five minutes crossing my fingers later I'm back in business. :)

You don't want to be doing this but it's nice to know you can if you have to! :)

Steve

Brak · May 27, 2012, 8:04 PM

How's the progress on these units? If you need help getting the LCD working, I have a hacky script that should work. And do you think any more will be hitting the second-hand market anytime soon? They seem okay on specs, but I guess Watchguard will EOL them anyways at some point.

stephenw10 · May 27, 2012, 9:18 PM

The LCD is configured exactly the same as the previous models so existing drivers work fine.
The EOL on these is not going to be for a long time (sometime after 2016) so right now you just have to get lucky. ;)

I have been playing around with a Core2Duo E4500. First of all it works in there no problems, it's detected by the bios and by pfSense. It's a nice upgrade from single core Celeron to Dual core C2D and it's not expensive. The platform should support many other processors. The peak power consumption goes up, 41W in the bios and around 47W while booting, but the idle consumption is identical at 30W so the fans remain slow unless it's pushed.
There is potential to actually reduce this by using Speedstep which is in the C2D but not the Celeron. However the required components are not all there. I think I'm about 90% of the way to making it work but something is eluding me.
So far I have:
Extracted and modified the DSDT table from the bios (including fixing a few errors on the way) to include code to pass the P-state information to the est(4) driver via ACPI.
Found and disabled the code that sets the EIST lock bit in the bios. This required extracting the relevant bios module and disassembling it.
Set the EIST enable bit. Both these are MSRs in the CPU.

So far the est driver attaches to the 2 cpus at boot and provides the various frequency/voltage combinations to powerd. Everything appears to be working great except that the power consumtion remains steadily at 30W. I don't think it's actually changing anything. :-\

I'm learning a lot though! :)

Steve

Brak · May 28, 2012, 3:07 AM

Oh, so the SDECLCD firebox driver works pretty much out of the box with these units? That makes life pretty easy. It looked different in your pics, but I would assume Watchguard made them make it the same for ease of use.

stephenw10 · May 28, 2012, 11:04 AM

Exactly. Only the the X-Core had an actual SDEC LCD all the other models have LCDs made by someone else but with custom part numbers. I assumed Watchguard didn't want to have to include code for many types of LCD in their OS.

Steve

fmertz · May 28, 2012, 2:44 PM

@stephenw10:

I have been playing around with a Core2Duo E4500.

Wikipedia mentions that series has 64bit support.

http://en.wikipedia.org/wiki/List_of_Intel_Core_2_microprocessors#.22Allendale.22.2C_.22Conroe.22_.2865_nm.29

We need to put a 64 bit lcdproc/sdeclcd package on the radar…

stephenw10 · May 28, 2012, 2:54 PM

Indeed, though I'm running it 32bit. It would be interesting to see whether there's much advantage to running 64bit. There are plenty of reports that it makes almost no difference.
I haven't tried your new driver yet but thanks for doing it :). Still trying to make EIST function correctly. It doesn't help that the SuperIO is not compatible with mbmon so I can't read the core voltage directly.

Steve

Brak · May 31, 2012, 5:22 PM

I'd love to get the lcdproc-dev and SDECLCD driver working on 64bit. Does that require a whole driver rewrite or a recompile? I'm not even sure if lcdproc-dev is amd64 capable…

stephenw10 · May 31, 2012, 5:57 PM

I think I'm losing my mind over EIST. ::)
I have eventually come to the conclusion that EIST is in fact working with my modified bios and loading a custom DSDT.

[2.0.1-RELEASE][root@pfSense.localdomain]/root(1): sysctl dev.cpu
dev.cpu.0.%desc: ACPI CPU
dev.cpu.0.%driver: cpu
dev.cpu.0.%location: handle=\_PR_.CPU0
dev.cpu.0.%pnpinfo: _HID=none _UID=0
dev.cpu.0.%parent: acpi0
dev.cpu.0.temperature: 25.0C
dev.cpu.0.cx_supported: C1/1 C2/96
dev.cpu.0.cx_lowest: C1
dev.cpu.0.cx_usage: 100.00% 0.00% last 5000us
dev.cpu.0.freq: 1200
dev.cpu.0.freq_levels: 2200/65000 2000/55000 1800/50000 1600/45000 1400/40000 1200/30000
dev.cpu.1.%desc: ACPI CPU
dev.cpu.1.%driver: cpu
dev.cpu.1.%location: handle=\_PR_.CPU1
dev.cpu.1.%pnpinfo: _HID=none _UID=0
dev.cpu.1.%parent: acpi0
dev.cpu.1.temperature: 25.0C
dev.cpu.1.cx_supported: C1/1 C2/96
dev.cpu.1.cx_lowest: C1
dev.cpu.1.cx_usage: 100.00% 0.00% last 5000us

If I read the MSRs directly from the CPU using cpucontrol I can see that the multiplier and VID are set as requested by the DSDT.

[2.0.1-RELEASE][root@pfSense.localdomain]/root(3): cpucontrol -m 198 /dev/cpuctl0
MSR 0x198: 0x0b280b28 0x0600061d

As well as that I can see the core voltage is reduced by reading the SuperIO chip registers directly.

At 1200 V-Core is at register 20\. 

idx 00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f  10 11 12 13 14 15 16 17  18 19 1a 1b 1c 1d 1e 1f  20 21 22 23 24 25 26 27  28 29 2b 2c 2d 2e 2f 30  31 32 33 34 35 36 37 38  39 3a 3b 3c 3d 3e 3f 40  41 42 43 44 45 46 47 48  49 4a 4b 4c 4d 4e 4f
val 01 78 01 ff 04 37 00 01  78 01 50 01 3c 3c 01 05  01 ff 20 00 00 01 01 3c  43 00 ff ff 24 32 00 e3  64 c8 25 ba d0 80 00 26  1f ff f0 00 de 5f 9d b4  04 0a 54 7c 5a 08 26 28  a4 15 3d 20 12 00 00 03  9c 00 fe ff 00 00 af 2d  03 01 84 18 95 80 5c
def RR ff RR ff 00 00 00 00  01 01 01 01 3c 3c 0a 0a  RR ff 00 00 00 01 01 3c  43 RR ff ff RR RR NA NA  NA NA NA NA NA RR RR NA  NA NA NA NA NA NA NA NA  NA NA NA NA RR RR RR RR  NA NA NA NA NA RR RR 03  00 00 fe ff RR RR 5f NA  03 RR 44 18 15 80 5c

At 2200

idx 00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f  10 11 12 13 14 15 16 17  18 19 1a 1b 1c 1d 1e 1f  20 21 22 23 24 25 26 27  28 29 2b 2c 2d 2e 2f 30  31 32 33 34 35 36 37 38  39 3a 3b 3c 3d 3e 3f 40  41 42 43 44 45 46 47 48  49 4a 4b 4c 4d 4e 4f
val 01 78 01 ff 04 37 00 01  78 01 50 01 3c 3c 01 05  01 ff 20 00 00 01 01 3c  43 00 ff ff 24 32 00 e1  64 c8 26 ba d0 80 00 26  1f ff f0 00 de 5f 9d b4  04 0a 54 7c 5a 08 26 28  a4 15 3d 20 12 00 00 03  00 00 fe ff 00 00 af 2d  03 01 84 18 95 06 a3
def RR ff RR ff 00 00 00 00  01 01 01 01 3c 3c 0a 0a  RR ff 00 00 00 01 01 3c  43 RR ff ff RR RR NA NA  NA NA NA NA NA RR RR NA  NA NA NA NA NA NA NA NA  NA NA NA NA RR RR RR RR  NA NA NA NA NA RR RR 03  00 00 fe ff RR RR 5f NA  03 RR 44 18 15 80 5c

VID is 0x1D is 29  Voltage is VIDx12.5 + 825 = 1187.5

Vcore reading is 0x64 is 100: 100x4.8 + 690 = 1170     Seems pretty close!

However it is almost impossible to see any effect because the CPU supports C1/E state which is already as low power if not lower. In fact I believe that EIST will only operate in C0 anyway. It will probably reduce the total power consumption when the box is under a moderate load since it can only enter C1 when the CPU is idle for a time.
Unfortunately the minimum core voltage either for C1/E or the lowest EIST P-state is VID=1D (decimal 29) which is 1.19V. I'm not sure if that's just because my CPU is bad quality or that's a MB limitation. The full speed core voltage is 1.325V but the spec is down to 0.85V :-\ (or 0.962 depending where you look)
It doesn't seem to support SLFM (Dymnamic FSB) either, or at least I can't seem to trigger it, which would otherwise enable a lower core voltage.
You might think that reducing the CPU frequency would have a measurable effect on the power draw. :-
Disappointing in some ways since using EIST on the Core-E box reduced the power consumption and CPU temps quite a bit.

I've been staring at register values in hex for so long now I'm starting to dream about it! ;)

If you want to know about EIST and such just read this:
http://www.projectosx.com/forum/index.php?showtopic=610
It has almost all the information I found on many other sites in one article. :)

Steve

fmertz · May 31, 2012, 8:07 PM

@Brak:

I'd love to get the lcdproc-dev and SDECLCD driver working on 64bit. Does that require a whole driver rewrite or a recompile? I'm not even sure if lcdproc-dev is amd64 capable…

amd64 is one of the supported architectures for lcdproc as a project, so I would not expect problems there. The sdec driver, though, has never been compiled, much less run, in that arch. If/when someone manages to run a 64bit OS on this box, I'll be happy to provide a binary for testing. Just need to download/install a 64bit FreeBSD virtual machine, and recompile.

Brak · Jun 1, 2012, 12:29 PM

@fmertz:

@Brak:

I'd love to get the lcdproc-dev and SDECLCD driver working on 64bit. Does that require a whole driver rewrite or a recompile? I'm not even sure if lcdproc-dev is amd64 capable…

amd64 is one of the supported architectures for lcdproc as a project, so I would not expect problems there. The sdec driver, though, has never been compiled, much less run, in that arch. If/when someone manages to run a 64bit OS on this box, I'll be happy to provide a binary for testing. Just need to download/install a 64bit FreeBSD virtual machine, and recompile.

I have hardware from Watchguards OEM (Lanner calls it thier LCM) that uses the same screen and is 64bit. I'd be more than willing to try out any binaries you need tested. Only differences is that the screen on my units are 20x2 and not 16x2. I'm sure that really isn't an issue tho. Currently the 32bit SDECLCD works fine, except the screens don't seem to use the full 20x2, although the "Next|Prev" popups show in the extra characters so they work.

Let me know what you need done/tested. I assume what works for me will work perfectly on stephen's unit.

fmertz · Jun 1, 2012, 9:13 PM

@Brak:

Let me know what you need done/tested.

If you have a 64bit version of FreeBSD running, make sure you have a 64bit version of the lcdproc package. The catch is that with a 32 bit compatibility layer, 32bit packages run fine on 64bit systems. You can find out with the file command on the LCDd executable: "file LCDd"

Once this is running, you can get the 64bit driver from here (rename it to sdeclcd.so):

https://github.com/downloads/fmertz/sdeclcd/sdeclcd64.so

This file is the sdeclcd driver code as accepted upstream, compiled under FreeBSD 8.3 AMD64. No LED, or XTM code in this just yet.

Keep us posted.

stephenw10 · Oct 27, 2012, 3:38 PM

While re-reading this I realised I never posted the bios version in my box.
The original bios shows in the POST as:

MB-7580 Ver.WC0 02/03/2010

When it boots it shows on the LCD:

WG BIOS V1.2

This version of the bios code does not set the arm/disarm LED to red during boot as it should. It requires some additional values to be added to the bootblock SIO table which I have not found a way to do (that doesn't corrupt the bios).

If you have a more recent version please let me know.

Steve