EHCI Debug Port on cMP Machines?

[watkipet]

I'd like to experiment with getting serial debug output from EFI loaders (where the loader is compiled with DEBUG turned on). Based on the following articles, I believe I can do this via the EHCI Debug port:

Intel® UEFI Development Kit Debugger Tool Configuration and Setup Guide
TianoCore Support for EHCI Debugging in Source
EHCI debugging on the BeagleBone Black
Agent Based UEFI Firmware Debugging

However, I don't know if...

1. the Mac Pro even has a USB port enabled for EHCI debugging
2. that port, if it exists, is internal or external
3. if it's external, where it's located physically

I can do some leg-work to attempt to find it, but I thought I'd ask here and see if anyone knows first.

 

[tsialex]

Found anything?

 

[eksu]

Would FireWire debugging with the nvram argument achive what you’re looking for?

 

[tsialex]

Would FireWire debugging with the nvram argument achive what you’re looking for?

Interesting, it works? What you have to do to enable it? What is the output?

 

[startergo]

Found something here:
https://wikileaks.org/ciav7p1/cms/page_17760389.html
[doublepost=1541202354][/doublepost]and this:
https://superuser.com/questions/255176/is-there-a-list-of-available-boot-args-for-darwin-os-x

 

[tsialex]

Found something here:
https://wikileaks.org/ciav7p1/cms/page_17760389.html
[doublepost=1541202354][/doublepost]and this:
https://superuser.com/questions/255176/is-there-a-list-of-available-boot-args-for-darwin-os-x

This very useful to debug the kernel, unfortunately the one I need is the EFI one.

 

[startergo]

This very useful to debug the kernel, unfortunately the one I need is the EFI one.

I just probed the hardware:

00:1a.7 USB controller [0c03]: Intel Corporation 82801JI (ICH10 Family) USB2 EHCI Controller #2 [8086:3a3c]
00:1a.7 0c03: 8086:3a3c (prog-if 20 [EHCI])
    Subsystem: 8086:7270
    Flags: bus master, medium devsel, latency 0, IRQ 18
    Memory at 90926000 (32-bit, non-prefetchable)
    Capabilities: [50] Power Management version 2
    Capabilities: [58] Debug port: BAR=1 offset=00a0
    Capabilities: [98] PCIe advanced features <?>
00:1d.7 USB controller [0c03]: Intel Corporation 82801JI (ICH10 Family) USB2 EHCI Controller #1 [8086:3a3a]
00:1d.7 0c03: 8086:3a3a (prog-if 20 [EHCI])
    Subsystem: 8086:7270
    Flags: bus master, medium devsel, latency 0, IRQ 16
    Memory at 90925000 (32-bit, non-prefetchable)
    Capabilities: [50] Power Management version 2
    Capabilities: [58] Debug port: BAR=1 offset=00a0
    Capabilities: [98] PCIe advanced features <?>

https://wiki.ubuntu.com/Kernel/Debugging/USBearlyprintk
But again this is related to kernel debugging sorry
PikerAlpha surely would know a way to do it now that he works at Cupertino, but I don't know how to ask him

 

[startergo]

An example of Apple EFI firmware debugging:
https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/

 

[tsialex]

An example of Apple EFI firmware debugging:
https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/

This post by Pedro Vilaça is more an example of EFI decompiling using IDA + plugins + his own tools than debugging.

Back to the topic, LPC connector has TTY, we just don't know what to do to get the EFI debug there. BTW, LPC+SPI connector has a way to debug SMC, shame that we can't read the ROM.

 

[watkipet]

Here's what I've found so far (for a Mac Pro 4,1):

The cMP has several USB controllers, two of which are EHCI. The vendor and device IDs of these are:

• 8086:3a3a Intel ICH10
• 8086:3a3c Intel ICH10

According to CoreBoot.org, these support EHCI debugging.

Using USBTreeView, the Debug ports on these are port 1:

The 3A3A controller does expose port 1 on the outside of the machine. It's here:

However, port 1 on the 3A3C controller doesn't appear to be exposed on any of the external ports. Perhaps it's on the mainboard PCB. I don't know if EFI debug info is routed to both controllers or only one of them.

I think the next steps are:

1. Buy and make the BeagleBone EFI Debug interface
2. Make a Linux USB stick installation for a PC with EFI debugging turned on
3. Test the BeagleBone with that machine
4. Test the BeagleBone on the cMP

 

[startergo]

Here's what I've found so far (for a Mac Pro 4,1):

The cMP has several USB controllers, two of which are EHCI. The vendor and device IDs of these are:

• 8086:3a3a Intel ICH10
• 8086:3a3c Intel ICH10

According to CoreBoot.org, these support EHCI debugging.

Using USBTreeView, the Debug ports on these are port 1:

The 3A3A controller does expose port 1 on the outside of the machine. It's here:

However, port 1 on the 3A3C controller doesn't appear to be exposed on any of the external ports. Perhaps it's on the mainboard PCB. I don't know if EFI debug info is routed to both controllers or only one of them.

I think the next steps are:

1. Buy and make the BeagleBone EFI Debug interface
2. Make a Linux USB stick installation for a PC with EFI debugging turned on
3. Test the BeagleBone with that machine
4. Test the BeagleBone on the cMP

Why not using :
https://ami.com/en/products/bios-uefi-tools-and-utilities/amidebug-for-uefi/
Instead of hardware emulators?
[doublepost=1541899833][/doublepost]Just read this on the page:
" It is currently available only to OEM/ODM customers"
disappointing...

 

[watkipet]

Why not using :
https://ami.com/en/products/bios-uefi-tools-and-utilities/amidebug-for-uefi/
Instead of hardware emulators?
[doublepost=1541899833][/doublepost]Just read this on the page:
" It is currently available only to OEM/ODM customers"
disappointing...

I think these are two quite different products. The one I’m trying to make just provides a way to view log messages (provided the firmware and boot loader even attempts to print them).

The product above lets you single-step through code, halt the CPU, etc. That would be much more powerful. However:

• It looks like you need to compile with debug symbols on.
• I’m not sure if it requires the use of other AMI chips on the main board—which I’m not sure if the cMP has.