Hardware FDE with Intel SSD 330 on Intel DH67BL Motherboard

To be able to make full use of the built-in AES encryption on the Intel SSD 330 with the Intel DH67BL desktop motherboard...

1. Move BIOS block jumper to 'maintenance mode' position.
2. Boot.
3. Set hard drive password.
4. Move BIOS block jumper back to normal position.
5. Boot.

Notes:

• To set a longer password than 13 characters, use hdat2 (mhdd seems to have a difficult time with AHCI, and since we're hotplugging...)- boot system without drive powered up, or, hard reset drive when in hdat2 and rescan, and then set password.  The BIOS prompt WILL allow entry of longer passwords, just not setting them. 
• Removing a drive with a password set causes the option to set password in the BIOS security menu to disappear.  However, once maintenance mode has been entered and a password set, it seems from then on, hooking up a drive with a password set will work. (i.e., reattaching drive gets the initial password prompt on boot and menu entries in setup->security.)

That very simple procedure is the hard won wisdom from a week of exploring many much more difficult divergent tangents, since there's nothing in Intel's documentation about this, and Intel's own 'support' crew (Intel Community) apparently aren't familiar with it.

It might seem like a no brainer, and it should have been.

The BIOS prompt to set a hard drive password does not initially appear in 'normal' mode.

If you hook up a hard drive with a password set on it, the BIOS does not prompt for a password, and the prompt to set a hard drive password does not appear in the BIOS security tab.

The BIOS on this board sets SECURITY FREEZE LOCK and has no option to disable it, so just using mhdd/hdat2/victoria after boot every time isn't an option, nor is hacking out an .efi module. (hdat2 seems to be able to power off the drive; it doesn't reset it; hard resetting really seems to be the only way to do it.)   One can't simply use the atasx extension here --- the nasty frankenstein BIOS (it's even worse than an Insyde one, God help us all) is apparently signed, so even if you figured out how to force a PCI ROM module in it you wouldn't be able to flash it.

Finding the 'maintenance mode' was a lucky discovery; I'd found a tool which would sort of let me extract the .bio file (UEFITool), and trying to figure out how to modify the setup forms to display the menu items to allow setting the hdd password.  Donovan6000's blog, filled with astoundingly useful and indepth tutorials, and his Universal IFR Extractor, were instrumental in this.  However, his tool didn't actually parse the dumped VARSTORE data, which made it harder to pursue the solution I wanted to try before actually attempting to mod the BIOS: just change some nvram variables.  I forked his project to display the information, and make the correlation trivial, but, found the whole 'just set the damn jumper' thing prior to going any deeper.

So, for someone adventurous, in an EFI shell ( Tianocore --- I tried 'refind'; seriously gimped piece of crap; doesn't have any of the built-in help, and doesn't implement dmpstore -s or -l!) just try setting 3DD0DE67-02D7-4129-914A-9F377CC34B0D:IDESecDev:00 to 0x01 and save screwing with the jumper... or, perhaps, there are desktop boards out there with the capability but no jumper.

I did have a save of the nvram before and after 'enabling' the hdd password.  For handy reference for anyone who might care, here's what's different after:
Variable NV+RT+BS 'Efi:MonotonicCounter' DataSize = 4
- Seems to track boots; not relevant.

Variable NV+RT+BS 'A56074DB-65FE-45F7-BD21-2D2BDD8E9652:LegacyDevOrder' DataSize = A
  00000000: 02 00 00 00 06 00 11 00-12 00                    *..........*
Variable NV+RT+BS 'A56074DB-65FE-45F7-BD21-2D2BDD8E9652:LegacyDevChecksum' DataSize = 4
  00000000: 11 AC 12 6B                                      *...k*

to
Variable NV+RT+BS 'A56074DB-65FE-45F7-BD21-2D2BDD8E9652:LegacyDevOrder' DataSize = A
  00000000: 02 00 00 00 06 00 01 00-11 00                    *..........*
Variable NV+RT+BS 'A56074DB-65FE-45F7-BD21-2D2BDD8E9652:LegacyDevChecksum' DataSize = 4
  00000000: 01 15 11 6B                                      *...k*
Presumably that's part of the SSD being hooked up (wasn't for initial dump).

Variable NV+RT+BS '1B838190-4625-4EAD-ABC9-CD5E6AF18FE0:HiiDB' DataSize = 8
  00000000: 18 C0 8A DA 00 00 00 00-                         *........*
to
Variable NV+RT+BS '1B838190-4625-4EAD-ABC9-CD5E6AF18FE0:HiiDB' DataSize = 8
  00000000: 18 F0 8A DA 00 00 00 00-                         *........*

This looks like it might be related to displaying the setup menu item for hard drive passwords(?). HiiDB: UEFI HII (Part 4): Strings

Variable NV+RT+BS 'EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9:MaintenanceSetup' DataSize = 29D
  000000B0: 00 00 00 00 00 02 00 00-00 00 00 01 00 01 00 01  *................*
  000000C0: 00 01 00 01 00 00 00 01-00 00 00 00 00 00 00 00  *................*
  000000D0: 00 07 00 00 00 00 00 00-00 00 00 01 00 01 59 65  *..............Ye*
  000000E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *................*

to: 

Variable NV+RT+BS 'EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9:MaintenanceSetup' DataSize = 29D

  000000B0: 00 00 00 00 00 00 00 00-00 00 00 01 00 01 00 01  *................*

  000000C0: 00 01 00 01 00 00 00 01-00 00 00 00 00 00 00 00  *................*

  000000D0: 00 07 00 00 00 00 00 00-00 00 00 01 00 01 00 61  *...............a*

  000000E0: 07 AC 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *................*

Since these compares are after the jumper is in the normal position, then this may be relevant. 

Variable NV+RT+BS 'Efi:BootOrder' DataSize = 4

  00000000: 01 00 05 00                                      *....*

to

Variable NV+RT+BS 'Efi:BootOrder' DataSize = 4

  00000000: 01 00 02 00                                      *....*

Seems obvious and not relevant.

Variable NV+RT+BS 'EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9:Setup' DataSize = 29D

  000000A0: 00 00 00 01 00 20 00 00-00 00 00 01 00 00 00 00  *..... ..........*

  000000B0: 00 00 00 00 00 02 00 00-00 00 00 01 00 01 00 01  *................*

  000000C0: 00 01 00 01 00 00 00 01-00 00 00 00 00 00 00 00  *................*

  000000D0: 00 07 00 00 00 00 00 00-00 00 00 01 00 01 9D 9F  *................*

  000000E0: D6 98 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *................*

to

Variable NV+RT+BS 'EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9:Setup' DataSize = 29D

  000000A0: 00 00 00 01 00 20 00 00-00 00 00 01 00 00 00 00  *..... ..........*

  000000B0: 00 00 00 00 00 00 00 00-00 00 00 01 00 01 00 01  *................*

  000000C0: 00 01 00 01 00 00 00 01-00 00 00 00 00 00 00 00  *................*

  000000D0: 00 07 00 00 00 00 00 00-00 00 00 01 00 01 EC FF  *................*

  000000E0: 2C 4A 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *,J..............*

And for the truly masochistic, here's the relevant(?) form dump (something to pursue might be seeing if the password's actually stored in the nvram when set from the BIOS...):

Form Set: Security {0E 24 43 D6 87 EC A4 EB B5 4B A1 E5 3F 3E 36 B2 0D A9 A5 03 DD 04 00 00 00 00 00 00 00 00 04 00 00 00 9D 02}

0x40FD2 Variable Store (32): {24 20}

Name: [ IDESecDev ] {49 44 45 53 65 63 44 65 76 00}

GUID: [ 3DD0DE67-02D7-4129-914A-9F377CC34B0D ] {67 DE D0 3D D7 02 29 41 91 4A 9F 37 7C C3 4B 0D}

  ID: [ 0xF015 ] {15 F0}

Size: [ 144 ] {90 00}

0x40FF2 Form: Security, Form ID: 0x4 {01 06 04 00 A5 03}

0x40FF8 Suppress If: {0A 03 00}

0x40FFB Variable 0x3B[2] equals 0x0 {12 07 3B 00 02 00 00}

0x41002 Not {17 02}

0x41004 Text: Supervisor Password :  {03 0B 20 00 B7 03 B9 03 00 00 00}

0x4100F End If {18 02}

0x41011 Suppress If: {0A 03 00}

0x41014 Variable 0x3B[2] equals 0x0 {12 07 3B 00 02 00 00}

0x4101B Text: Supervisor Password :  {03 0B 20 00 B7 03 BB 03 00 00 00}

0x41026 End If {18 02}

0x41028 Suppress If: {0A 03 00}

0x4102B Variable 0x13[2] equals 0x0 {12 07 13 00 02 00 00}

0x41032 Not {17 02}

0x41034 Text: User Password :  {03 0B 20 00 B8 03 BA 03 00 00 00}

0x4103F End If {18 02}

0x41041 Suppress If: {0A 03 00}

0x41044 Variable 0x13[2] equals 0x0 {12 07 13 00 02 00 00}

0x4104B Text: User Password :  {03 0B 20 00 B8 03 BC 03 00 00 00}

0x41056 End If {18 02}

0x41058 Suppress If: {0A 03 00}

0x4105B Variable Store Select: 0xF015 {25 04 15 F0}

0x4105F Variable 0xC[2] equals value in list (0x0) {14 09 0C 00 02 01 00 00 00}

0x41068 Variable 0x0[2] equals value in list (0x0) {14 09 00 00 02 01 00 00 00}

0x41071 Variable Store Select: 0x0 {25 04 00 00}

0x41075 Variable 0xB5[1] equals value in list (0x1) {14 09 B5 00 01 01 00 01 00}

0x4107E Or {16 02}

0x41080 Or {16 02}

0x41082 Text: Master Key Hard Disk Drive Password : {03 0B 04 00 97 04 BB 03 00 00 00}

0x4108D End If {18 02}

0x4108F Suppress If: {0A 03 00}

0x41092 Variable Store Select: 0xF015 {25 04 15 F0}

0x41096 Variable 0xC[2] equals value in list (0x1) {14 09 0C 00 02 01 00 01 00}

0x4109F Variable 0x0[2] equals value in list (0x0) {14 09 00 00 02 01 00 00 00}

0x410A8 Variable Store Select: 0x0 {25 04 00 00}

0x410AC Variable 0xB5[1] equals value in list (0x1) {14 09 B5 00 01 01 00 01 00}

0x410B5 Or {16 02}

0x410B7 Or {16 02}

0x410B9 Text: Master Key Hard Disk Drive Password : {03 0B 04 00 97 04 B9 03 00 00 00}

0x410C4 End If {18 02}

0x410C6 Suppress If: {0A 03 00}

0x410C9 Variable Store Select: 0xF015 {25 04 15 F0}

0x410CD Variable 0xA[2] equals value in list (0x0) {14 09 0A 00 02 01 00 00 00}

0x410D6 Variable 0x0[2] equals value in list (0x0) {14 09 00 00 02 01 00 00 00}

0x410DF Variable Store Select: 0x0 {25 04 00 00}

0x410E3 Variable 0xB5[1] equals value in list (0x1) {14 09 B5 00 01 01 00 01 00}

0x410EC Or {16 02}

0x410EE Or {16 02}

0x410F0 Text: Hard Disk Drive Password : {03 0B 04 00 96 04 BB 03 00 00 00}

0x410FB End If {18 02}

0x410FD Suppress If: {0A 03 00}

0x41100 Variable Store Select: 0xF015 {25 04 15 F0}

0x41104 Variable 0xA[2] equals value in list (0x1) {14 09 0A 00 02 01 00 01 00}

0x4110D Variable 0x0[2] equals value in list (0x0) {14 09 00 00 02 01 00 00 00}

0x41116 Variable Store Select: 0x0 {25 04 00 00}

0x4111A Variable 0xB5[1] equals value in list (0x1) {14 09 B5 00 01 01 00 01 00}

0x41123 Or {16 02}

0x41125 Or {16 02}

0x41127 Text: Hard Disk Drive Password : {03 0B 04 00 96 04 B9 03 00 00 00}

0x41132 End If {18 02}

0x41134 Subtitle:  {02 04 20 00}

0x41138 Suppress If: {0A 03 00}

0x4113B Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x41141 Variable 0x41 equals 0x2 {22 06 41 00 02 00}

0x41147 Or {16 02}

0x41149 Password: Set Supervisor Password, Variable: 0x3B[40] {08 10 3B 00 28 A8 03 A9 03 04 00 10 02 14 01 00}

0x41159 End If {18 02}

0x4115B Grayout If: {19 03 00}

0x4115E Variable 0x42 equals 0x1 {22 06 42 00 01 00}

0x41164 Password: Set User Password, Variable: 0x13[40] {08 10 13 00 28 A6 03 A7 03 04 01 10 02 14 01 00}

0x41174 End If {18 02}

0x41176 Grayout If: {19 03 00}

0x41179 Variable 0x42 equals 0x1 {22 06 42 00 01 00}

0x4117F Suppress If: {0A 03 00}

0x41182 Variable 0x13[2] equals 0x0 {12 07 13 00 02 00 00}

0x41189 Selectable: Clear User Password, Form ID: 0x4 {0F 0B 04 00 AC 03 AD 03 04 04 10}

0x41194 End If0x41194 End If {18 02}

0x41196 Grayout If: {19 03 00}

0x41199 Variable 0x21E[1] equals 0x2 {12 07 1E 02 01 02 00}

0x411A0 Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x411A6 Or {16 02}

0x411A8 Suppress If: {0A 03 00}

0x411AB Variable 0x21E[1] equals 0x1 {12 07 1E 02 01 01 00}

0x411B2 Variable 0x41 equals 0x2 {22 06 41 00 02 00}

0x411B8 Variable 0x3B[2] equals 0x0 {12 07 3B 00 02 00 00}

0x411BF Or {16 02}

0x411C1 Or {16 02}

0x411C3 Setting: User Access Level, Variable: 0x21D[1] {05 09 1D 02 01 BD 03 BE 03}

0x411CC Option: No Access, Value: 0x0 {09 09 BF 03 00 00 10 00 00}

0x411D5 Option: View Only, Value: 0x1 {09 09 C0 03 01 00 13 00 00}

0x411DE Option: Limited, Value: 0x2 {09 09 C1 03 02 00 10 00 00}

0x411E7 Option: Full Access, Value: 0x3 {09 09 C2 03 03 00 10 00 00}

0x411F0 End of Options {10 02}

0x411F2 End If0x411F2 End If {18 02}

0x411F4 Subtitle:  {02 04 20 00}

0x411F8 Suppress If: {0A 03 00}

0x411FB Variable Store Select: 0xF015 {25 04 15 F0}

0x411FF Variable 0x0[2] equals 0x0 {12 07 00 00 02 00 00}

0x41206 Variable Store Select: 0x0 {25 04 00 00}

0x4120A Variable 0xB5[1] equals 0x1 {12 07 B5 00 01 01 00}

0x41211 Or {16 02}

0x41213 Grayout If: {19 03 00}

0x41216 Variable Store Select: 0xF015 {25 04 15 F0}

0x4121A Variable 0xE[2] equals 0x0 {12 07 0E 00 02 00 00}

0x41221 Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x41227 Or {16 02}

0x41229 Password: Set Master Key Hard Disk Drive Password, Variable: 0x50[64] {08 10 50 00 40 9B 04 9C 04 00 00 00 02 20 01 00}

0x41239 End If0x41239 End If {18 02}

0x4123B Suppress If: {0A 03 00}

0x4123E Variable 0x0[2] equals 0x0 {12 07 00 00 02 00 00}

0x41245 Variable Store Select: 0x0 {25 04 00 00}

0x41249 Variable 0xB5[1] equals 0x1 {12 07 B5 00 01 01 00}

0x41250 Or {16 02}

0x41252 Grayout If: {19 03 00}

0x41255 Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x4125B Variable Store Select: 0xF015 {25 04 15 F0}

0x4125F Password: Set Hard Disk Drive Password, Variable: 0x10[64] {08 10 10 00 40 99 04 9A 04 04 40 10 02 20 01 00}

0x4126F End If0x4126F End If {18 02}

0x41271 Subtitle:  {02 04 20 00}

0x41275 Grayout If: {19 03 00}

0x41278 Variable Store Select: 0x0 {25 04 00 00}

0x4127C Variable 0x220[1] equals 0x2 {12 07 20 02 01 02 00}

0x41283 Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x41289 Or {16 02}

0x4128B Suppress If: {0A 03 00}

0x4128E Variable 0x220[1] equals 0x1 {12 07 20 02 01 01 00}

0x41295 Setting: Chassis Intrusion, Variable: 0x21F[1] {05 09 1F 02 01 C3 03 C5 03}

0x4129E Option: Disable, Value: 0x0 {09 09 E6 00 00 00 10 00 00}

0x412A7 Option: Log Only, Value: 0x1 {09 09 90 04 01 00 13 00 00}

0x412B0 Option: Pause POST, Value: 0x2 {09 09 C4 03 02 00 10 00 00}

0x412B9 End of Options {10 02}

0x412BB End If0x412BB End If {18 02}

0x412BD Grayout If: {19 03 00}

0x412C0 Variable 0x222[1] equals 0x2 {12 07 22 02 01 02 00}

0x412C7 Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x412CD Or {16 02}

0x412CF Suppress If: {0A 03 00}

0x412D2 Variable 0x222[1] equals 0x1 {12 07 22 02 01 01 00}

0x412D9 Variable 0x4E equals 0x0 {22 06 4E 00 00 00}

0x412DF Or {16 02}

0x412E1 Setting: Execute Disable Bit, Variable: 0x221[1] {05 09 21 02 01 C7 03 C8 03}

0x412EA Option: Disable, Value: 0x0 {09 09 E6 00 00 00 10 00 00}

0x412F3 Option: Enable, Value: 0x1 {09 09 E5 00 01 00 13 00 00}

0x412FC End of Options {10 02}

0x412FE End If0x412FE End If {18 02}

0x41300 Grayout If: {19 03 00}

0x41303 Variable 0x224[1] equals 0x2 {12 07 24 02 01 02 00}

0x4130A Variable 0x41 equals 0x1 {22 06 41 00 01 00}

0x41310 Or {16 02}

0x41312 Suppress If: {0A 03 00}

0x41315 Variable 0x224[1] equals 0x1 {12 07 24 02 01 01 00}

0x4131C Variable 0x6C equals 0x0 {22 06 6C 00 00 00}

0x41322 Or {16 02}

0x41324 Setting: Intel® Virtualization Technology, Variable: 0x223[1] {05 09 23 02 01 AE 03 AF 03}

0x4132D Option: Disable, Value: 0x0 {09 09 E6 00 00 00 10 00 00}

0x41336 Option: Enable, Value: 0x1 {09 09 E5 00 01 00 13 00 00}

0x4133F End of Options {10 02}

0x41341 End If0x41341 End If {18 02}

0x41343 End Form {0B 02}

0x41345 End Form Set {0D 02}

References (Link Dump):

1. http://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/
2. http://ark.intel.com/products/67288/Intel-SSD-330-Series-180GB-SATA-6Gbs-25nm-MLC
3. http://www.intel.com/p/en_US/support/highlights/ssdc/ssd-330
4. http://www.intel.com/content/www/us/en/motherboards/desktop-motherboards/desktop-board-dh67bl.html
5. https://communities.intel.com/thread/53404
6. http://www.intel.com/support/ssdc/hpssd/sb/CS-034543.htm
7. https://github.com/NikolajSchlej/UEFITool
8. http://donovan6000.blogspot.com/2014/02/universal-ifr-extractor.html
9. http://wiki.phoenix.com/wiki/index.php/EFI_IFR_VARSTORE
10. http://uefidk.intel.com/blog/accessing-uefi-variables-linux
11. https://github.com/sstahlman/Universal-IFR-Extractor/releases/tag/v0.6.1a
12. http://www.thepromisedlan.org/archives/tag/firmware
13. https://svn.code.sf.net/p/edk2/code/trunk/edk2/EdkShellBinPkg/FullShell/X64/Shell_Full.efi
14. http://uefi.blogspot.com/2009/10/uefi-hii-part-4-strings.html

... In Which It Is Revealed How An AHCI Bug Makes One's Insyde(s) Freeze

I found this code in Intel's AHCI Option ROM from the Insyde BIOS. It appears to be code to build the Translated Device Parameter Table (which is a slightly different¹ implementation than the one documented in the Enhanced Working T13 Draft 1126DT).

Psuedo code  (version: Serial ATA AHCI BIOS, Version iSrc 1.20_E.0019 07092009):

Function Create TDPT for drive
    Read partition table with INT13 0x201
    If read fails, or 0xAA55 signature isn't present, goto Calculate
    Get head,sectors from FIRST Partition table entry, Ending CHS values
    heads = head+1  (because of 255 limit in partition table)
    For each partition entry
        If BOOTABLE (entry[0] == 0x80) goto UsePartition
    EndFor
    For each partition entry
        if (entry[0] == 0) and (entry[4] != 0) goto UsePartition
    EndFor


Calculate
    Call CalculateCHS - using DPT and physical size
    if no need for translation, return GOOD
    Goto CreateTDPT with cylinders, heads, sectors


UsePartition:
    Read first sector of partition with INT13 0x4200
    If the word at offset 0x1A is less than 0x100,
      and the word at offset 0x18 is less than 0x40
    then
        set heads to the byte at offset 0x1A
        set sectors to the byte at offset 0x18
    fi
    tracksize = heads * sectors
    if tracksize == 0, Goto Calculate
    DWORD size = (DPT[heads]*DPT[sectors])*DPT[cylinders]
    WORD cylinders = size / tracksize <--- Bad!
    -- if the result is greater than 65536, a divide overflow occurs

    -- which isn't handled by the BIOSes

    if (cylinders > 1024) cylinders = 1024
    if ((heads == DPT[heads]) && (sectors == DPT[sectors])) return GOOD


CreateTDPT:
    WORD at DPT[8]  = DPT[0] - Save original cylinders
    BYTE at DPT[10] = DPT[2] - Save original heads
    BYTE at DPT[7]  = DPT[3] - Save original sectors
    WORD at DPT[0]  = cylinders
    BYTE at DPT[2]  = heads
    BYTE at DPT[3]  = sectors
    BYTE at DPT[5]  = 8 if heads greater than 8, otherwise 0
    BYTE at DPT[4]  = 0xA0
    BYTE at DPT[15] = SUM( DPT[0] .. DPT[14] )

So, what goes wrong? When it breaks, it starts with bad values from the partition table, and tries to fix it with values from the boot parameter block, if it finds "valid" numbers there for heads and sectors (that is, less than or equal to 0xFF and 0x3F, respectively). When these values aren't right,  due to full disk encryption, an operating system other than Microsoft Windows, or malicious intent:

• It uses the ending head/sector of the first partition to size the translation layer.
• Windows 7 with 100MB partition results in unexpected values for INT13, FUNCTION=8 (eg, 0x13 heads).
• It stores those values into the Translated Device Parameter Table..  and then some other code comes along and uses those values. While I can't find where those values are causing the exception, anything doing C/H/S translation will be unhappy.

Looking back at version Serial ATA AHCI BIOS, Version iSrc 1.20E (Gigabyte Desktop Motherboard), I found that it doesn't read from the BPB at all.  I speculate the extra read of the NTFS boot-sector was to workaround a problem on Insyde BIOS.   This version can be crashed if the two bytes in the partition table are small enough and will hang with error code 23. Award BIOS will function OK with the other unexpected values, but Insyde BIOS will still crash if it sees them.

Finally, one HP system with an Insyde BIOS has the latest(?) 'fixed' version (Serial ATA AHCI BIOS, Version iSrc 1.20_E.0024 12212009), which reads from both the partition table and the BPB, also adding  still more checks. Unfortunately, it seems as though someone messed up and added a further bug, as it doesn't actually use any of the values it reads, but rather discards them all.

New and improved UsePartition (Serial ATA AHCI BIOS, Version iSrc 1.20_E.0024 12212009):

Read first sector of partition with INT13 0x4200

if the word at offset 0x1FE is not equal 0xAA55

   and the byte at offset 0 is not equal 0xEB

   and the word at offset 0x1A is less than 0x100

then

    set heads to the byte at offset 0x1A

fi

if (tracks == 0) or ((sectors & 0x3F) == 0) Goto Calculate

-- New bug: Since sectors can be at most 0x3F from partition table

-- the newer version ALWAYS goes off to Calculate the CHS

if (sectors & 0xC0) == 0)  Goto Calculate

tracksize = heads * sectors

if tracksize == 0, Goto Calculate

DWORD size = (DPT[heads]*DPT[sectors])*DPT[cylinders]

WORD cylinders = size / tracksize <-- Uber dangerous

-- if the result is greater than 65536, a divide overflow occurs

-- which isn't handled by the BIOSes.

if (cylinders > 1024) cylinders = 1024

if ((heads == DPT[heads]) && (sectors == DPT[sectors])) return GOOD

Goto CreateTDPT

A year later and neither Acer nor Gigabyte are providing fixed BIOSes.

¹Expected Final TDPT Values from a 60GB SSD:

          WORD Logical Cylinders   0x400

    BYTE Heads               0xFF

    BYTE Sectors             0x3F

    BYTE Signature           0xA0

    BYTE HeadsAbove8Flag     0x08

    BYTE Ignored             0x00

    BYTE Physical Sectors    0x3F

    WORD Physical Cylinders  0x3FFF

    BYTE Physical Heads      0x10

    BYTE Ignored[4]          0x0

    BYTE Checksum            0x89

Acer 5810tz's "Secret" BIOS Menu

As described in http://marcansoft.com/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/ and on NotebookReview's Forum, there are hidden menus in Insyde's Acer  BIOS.  Some folks modify their BIOSes to enable them; however,  on the Acer 5810, it's possible to enable some of these menus with just a setup change, which is, of course, safer than having to flash your whole BIOS just to modify a single boolean.

To do so, you need:

•  a DOS-bootable USB stick
• the flashit.exe binary from the BIOS update
• grdb from http://ladsoft.tripod.com/grdb.htm

Copy the utilities to the usb disk and create a batchfile (ex. modify.bat) and add the following:

flashit Setup A04A27F4-DF00-4D42-B552-39511302113D /rb:setup

grdb setup

flashit Setup A04A27F4-DF00-4D42-B552-39511302113D /wb:setup

     

Reboot to DOS on the USB stick, run the batchfile and in GRDB type:
e 31a 1 

w 

q

When you reboot, you should have an extra menu "Intel" below "D2D Recovery"

The "hidden setup" is usually located immediately after the "D2D recovery" variable.  If you wish to locate it on a different version of Acer Insyde bios, you can write out the setup variable ( the /RB command-line) with and without D2D recovery enabled.  The location one past that will be what you need. For example:

fc /b setup1 setup2

Comparing files SETUP1 and SETUP2

00000219: 00 01

Which is 21A (or 31a if you are using GRDB, because GRDB pretends it's a .COM file )

Although its unlikely that messing up the setup variables will cause the laptop to not boot, prudence would be to know how to use the FN-ESC "Crisis Recovery mode" and know what the filename is for your particular laptop.  (Mine is JM41X64.fd)

Possibly Useful Reference:

Post On Lenovo Forum With FlashIt Parameters

Pictures:

"Secret" menu available. 

Intel->

Intel->Power

Intel->Advanced

Intel->Advanced->Boot

The Byte That Bit Me Insyde

Since Insyde doesn't seem interested in patching its BIOS, I thought I'd share a neat way to make a laptop with an Insyde BIOS hang on boot by changing a single byte.

Caution: Back up any important data, if you're silly enough to do this on a live system; while this shouldn't mangle any of your bits, it's certainly possible it could.

Also, if you're not terribly fond of grasping naked sectors and pushing values into unfilled gaps, you might want to bail out now.

The Prerequisites:

• Laptop with buggy Insyde EFI BIOS.
• SSD or HDD (physical medium unimportant)
• Two or more partitions (which is the default Windows 7 configuration, and tends to be the default Linux installation as well).
• The SATA port configured as AHCI in BIOS.

My hardware configuration:
Acer 5810tz Timeline Notebook, with InsydeBIOS Release 1.35.

Now, with your personal favorite disk editor of choice (I'm using the very excellent, free and portable HxD):

HxD with Physical Disk 1

The Byte To Change

• Select the first partition of your first physical disk (labelled Physical Drive 1 in HxD).
• Go to sector 2048.    
• Go to offset 0x19 (25 decimal) and change from 0 to any value.
• Reboot
• Watch your laptop with an Insyde BIOS freeze.

Don't panic!  Simply:

•  disconnect the laptop drive,
•  bop into BIOS (F2)
•  change the SATA mode from AHCI to IDE.
•  Reconnect your hard drive, and boot.  You'll hit the usual Windows BSOD complaining about you trying to boot with the wrong set of disk drivers; boot into the 32 bit recovery console (since many utilities don't yet have 64bit equivalents and the WOW64 subsystem probably won't be available (especially if you're booting a mini-xp environment off a thumb drive instead))
•  Run your sector editor, and change byte at offset 0x19 back to 0.
•  Reboot normally.

So, what's going on here?

Sector 2048's where Windows 7 puts the start of its first partition.  From the partition boot sector layout we can see the particular byte is part of the boot parameter block, specifically the high byte of the Sectors Per Track word, which happens to be ignored by Windows 7.

What's a BIOS doing, caring about this?

Near as I can tell, this could be an attempt at an AHCI optimization, and the BIOS code simply fails to do a sanity check on the range.

Q. Except for the occasional black hat looking for a chuckle, who'd want to hang their laptop?

A. Anyone installing Linux, BSD, or full disk encryption such as Truecrypt and PGPwde.

These, as part of their normal operation, can change that special byte, giving much excitement and hair pulling to the lucky person whose BIOS, in an effort to be a most helpful puppy, manages to decorate the newspaper with excrement after having a chew with it.

I'm so glad EFI has led us away from incompabitle, buggy BIOSes!

Tools mentioned:

HxD Hex Editor (used for sector editing)

References:
Homepage of Insyde

Others probably running into this specific issue:
Seen on HPs, blamed on encryption
And Lenovos, blamed on Truecrypt.
Seen again, attributed to AHCI+Truecrypt conflict.
Even with BSD!