1# Intel DQ67SW 2 3The Intel DQ67SW is a microATX-sized desktop board for Intel Sandy Bridge CPUs. 4 5## Technology 6 7```{eval-rst} 8+------------------+--------------------------------------------------+ 9| Northbridge | :doc:`../../northbridge/intel/sandybridge/index` | 10+------------------+--------------------------------------------------+ 11| Southbridge | Intel Q67 (bd82x6x) | 12+------------------+--------------------------------------------------+ 13| CPU socket | LGA 1155 | 14+------------------+--------------------------------------------------+ 15| RAM | 4 x DDR3-1333 | 16+------------------+--------------------------------------------------+ 17| Super I/O | Nuvoton/Winbond W83677HG-i | 18+------------------+--------------------------------------------------+ 19| Audio | Realtek ALC888S | 20+------------------+--------------------------------------------------+ 21| Network | Intel 82579LM Gigabit Ethernet | 22+------------------+--------------------------------------------------+ 23| Serial | Internal header | 24+------------------+--------------------------------------------------+ 25``` 26 27## Status 28 29### Working 30 31- Sandy Bridge and Ivy Bridge CPUs (tested: i5-2500, Pentium G2120) 32- Native RAM initialization with four DIMMs 33- Integrated GPU with libgfxinit 34- PCIe graphics in the PEG slot 35- Additional PCIe slots 36- PCI slot 37- All rear (4x) and internal (8x) USB2 ports 38- Rear USB3 ports (2x) 39- All four internal SATA ports (two 6 Gb/s, two 3 Gb/s) 40- Two rear eSATA connectors (3 Gb/s) 41- SATA at 6 Gb/s 42- Gigabit Ethernet 43- SeaBIOS 1.16.1 + libgfxinit (legacy VGA) to boot slackware64 (Linux 5.15) 44- SeaBIOS 1.16.1 + extracted VGA BIOS to boot Windows 10 (21H2) 45- edk2 UefiPayload (uefipayload_202207) + libgfxinit (high-res) to boot: 46 - slackware64 (Linux 5.15) 47 - Windows 10 (22H2) 48- External in-circuit flashing with flashrom-1.2 and a Raspberry Pi 1 49- Poweroff 50- Resume from S3 51- Console output on the serial port 52 53### Not working 54 55- Automatic fan control. One can still use OS-based fan control programs, 56 such as fancontrol on Linux or SpeedFan on Windows. 57- Windows 10 booted from SeaBIOS + libgfxinit (high-res). The installation 58 works, but once Windows Update installs drivers, it crashes and enters a 59 bootloop. 60 61### Untested 62 63- Firewire (LSI L-FW3227-100) 64- EHCI debug 65- S/PDIF audio 66- Audio jacks other than the green one 67 68## Flashing coreboot 69 70```{eval-rst} 71+---------------------+------------+ 72| Type | Value | 73+=====================+============+ 74| Socketed flash | no | 75+---------------------+------------+ 76| Model | W25Q64.V | 77+---------------------+------------+ 78| Size | 8 MiB | 79+---------------------+------------+ 80| Package | SOIC-8 | 81+---------------------+------------+ 82| Write protection | yes | 83+---------------------+------------+ 84| Dual BIOS feature | no | 85+---------------------+------------+ 86| Internal flashing | see below | 87+---------------------+------------+ 88| In circuit flashing | see below | 89+---------------------+------------+ 90``` 91 92The flash is divided into the following regions, as obtained with 93`ifdtool -f rom.layout backup.rom`: 94 95 00000000:00000fff fd 96 00580000:007fffff bios 97 00003000:0057ffff me 98 00001000:00002fff gbe 99 100Unfortunately the SPI interface to the chip is locked down by the vendor 101firmware. The BIOS Lock Enable (BLE) bit of the `BIOS_CNTL` register, part of 102the PCI configuration space of the LPC Interface Bridge, is set. 103 104It is possible to program the chip is to attach an external programmer 105with an SOIC-8 clip. 106 107```{eval-rst} 108Another way is to boot the vendor firmware in UEFI mode and exploit the 109unpatched S3 Boot Script vulnerability. See this page for a similar procedure: 110:doc:`../lenovo/ivb_internal_flashing`. 111``` 112 113On this specific board it is possible to prevent the BLE bit from being set 114when it resumes from S3. One entry in the S3 Boot Script must be modified, 115e.g. with a patched version of [CHIPSEC](https://github.com/chipsec/chipsec) 116that supports this specific type of S3 Boot Script, for example from strobo5: 117 118 $ git clone -b headerless https://github.com/strobo5/chipsec.git 119 $ cd chipsec 120 $ python setup.py build_ext -i 121 $ sudo python chipsec_main.py -m tools.uefi.s3script_modify -a replace_op,mmio_wr,0xe00f80dc,0x00,1 122 123The boot script contains an entry that writes 0x02 to memory at address 1240xe00f80dc. This address points at the PCIe configuration register at offset 1250xdc for the PCIe device 0:1f.0, which is the BIOS Control Register of the LPC 126Interface Bridge [0][1]. The value 0x02 sets the BLE bit, and the modification 127prevents this by making it write a 0 instead. 128 129```{eval-rst} 130After suspending and resuming the board, the BIOS region can be flashed with 131a coreboot image, e.g. using flashrom. Note that the ME region is not readable, 132so the `--noverify-all` flag is necessary. Please refer to the 133:doc:`../../tutorial/flashing_firmware/index`. 134``` 135 136## Hardware monitoring and fan control 137 138Currently there is no automatic, OS-independent fan control. 139 140## Serial port header 141 142Serial port 1, provided by the Super I/O, is exposed on a pin header. The 143RS-232 signals are assigned to the header so that its pin numbers map directly 144to the pin numbers of a DE-9 connector. If your serial port doesn't seem to 145work, check if your bracket expects a different assignment. 146 147Here is a top view of the serial port header found on this board: 148 149 +---+---+ 150 N/C | | 9 | RI -> pin 9 151 +---+---+ 152 Pin 8 <- CTS | 8 | 7 | RTS -> pin 7 153 +---+---+ 154 Pin 6 <- DSR | 6 | 5 | GND -> pin 5 155 +---+---+ 156 Pin 4 <- DTR | 4 | 3 | TxD -> pin 3 157 +---+---+ 158 Pin 2 <- RxD | 2 | 1 | DCD -> pin 1 159 +---+---+ 160 161## References 162 163[0]: Intel 6 Series Chipset and Intel C200 Series Chipset Datasheet, 164May 2011, 165Document number 324645-006 166 167[1]: Accessing PCI Express Configuration Registers Using Intel Chipsets, 168December 2008, 169Document number 321090 170 171