Acer Aspire 5740G BIOS hacking (Switchable Graphics - not yet)

This notebook was proclaimed to have Switchable Graphics (ATI Mobility Radeon 5xxx & Intel Core i3/i5 Integrated Graphics).
Unfortunately there were probably some issues with drivers prior to release the notebook, so Acer has disabled this feature by software (BIOS) (downloads mentioned it many times).

I've been trying to enable the support Switchable Graphics, but without success yet.

Well, there were some interesting things I've discovered yet and I want to share those with other people interested in getting SG in their Aspire 5740G. Maybe somebody could help to get this done.

(if you are interested in the full story, just continue to the second post)

So far we can:
Enable hidden "Intel" tab in BIOS Setup.
Hidden "Intel" tab can be enabled by setting the CMOS token 0x141 to value 1.
See the second post in this thread. Chapter 4 describes the process of setting token's value.

WARNING: DO NOT SET "MCH Control Sub-Menu"→"Primary Display" TO EITHER "IGD" OR "SG" ! (unless you know how to unbrick your BIOS)

CRISIS RECOVERY DISK >>> HERE <<<

Final update: Switchable Graphics is not supported by the hardware.
Look at my comment here: http://forum.notebookreview.com/ace...itchable-graphics-not-yet-10.html#post7540562 (starsay, thank you for photos)

 

1. Preface
As I mentioned before there are rumours that SG was disabled in BIOS just before Acer started to sell 5740G. So I realized there could be some option in BIOS Setup enabling this feature.

There is a tool called Phoenix Bios Editor which can help reveal hidden items in Phoenix BIOSes.
Unfortunately it looks like there is not a version (a leaked one) which can handle BIOS images for Aspire 5740G.

After some digging through internet I found very helpful post which describes how to decode Phoenix BIOS to enable VT-d (Virtualization Technology):
http://forum.notebookreview.com/6124996-post38.html (I will be referencing to it)
It doesn't bother with description how to get those files STRINGS00.ROM and TEMPLAT00.ROM.
There is another tool called Phoenix SLIC mod which can extract (and replace) individual files from Phoenix BIOS image.

2. Brief explanation of TEMPLAT00.ROM and STRINGS00.ROM files
It didn't take much wakeful nights to find that offset 0x232 in TEMPLAT00.ROM contains "links" to Setup menu tabs:
(All informations are related to BIOS version 1.22)

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000230   00 00 [B][COLOR="Red"]77 0D[/COLOR] [COLOR="Blue"]4E 02[/COLOR] [COLOR="Red"]81 0D [/COLOR] [COLOR="Blue"]86 02[/COLOR] [COLOR="Red"]8B 0D[/COLOR] [COLOR="Blue"]DE 02[/COLOR] [COLOR="Red"]A9 0C[/COLOR][/B]   ..w.N...†.‹.Ţ.©.
00000240   [B][COLOR="Blue"]D6 03[/COLOR] [COLOR="Red"]F1 18[/COLOR] [COLOR="Blue"]C0 09[/COLOR] [COLOR="Red"]FF 14[/COLOR]  [COLOR="Blue"]B4 07[/COLOR][/B] 00 00 00 00         Ö.ń.Ŕ.˙.´.....

( RED are addresses of something like menu item headers, while BLUE are addresses of lists of menu items (both are offsets in TEMPLAT00.ROM)
77 0D → 0x0D77 = "Information"
81 0D = "Main"
8B 0D = "Security"
A9 0C = "Intel"
F1 18 = "Boot"
FF 14 = "Exit"

Yes, there is a hidden "Intel" tab in BIOS setup.
If we look to offset 0x0D77 we can see:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000D70                        [B][COLOR="Red"]10[/COLOR]  [COLOR="Lime"]0A[/COLOR] [COLOR="Blue"]48 05[/COLOR] [COLOR="Gray"]00 00[/COLOR] [COLOR="Orange"]A7 35[/COLOR] [COLOR="Purple"]B2[/COLOR][/B]          ..H...§5˛
00000D80   [B][COLOR="Purple"]35[/COLOR][/B]                                                 5

10 = record type (please read excursion quote block in this post for further explanation)
48 05 → 0x548 = address in string table in STRINGS00.ROM which links to string "Information" (again this post describes how to work with STRINGS00.ROM)
0A = total record length (= 10 bytes)
00 00 = don't know (maybe second string can be specified here)
A7 35 = first jump address
B2 35 = second jump address

The jump addresses points to executable code in TEMPLAT00.ROM.
Disas*embled (prohibited) code at the offset A7 35 → 0x35a7 looks like this:

Code:

35A7                 push    bp
35A8                 mov     bp, sp
35AA                 call    sub_35AF
35AD                 pop     bp
35AE                 retf
35AF sub_35AF        proc near
35AF                 xor     ax, ax
35B1                 retn
35B1 sub_35AF        endp

The only thing this code does is that it returns 0 from the function (in AX register).

The return value of these functions (called "Fillers" in referenced post) can somehow influence whether the menu item (in this case "Information" tab) will be visible.

That's enough to know about "item headers".
Now I will shortly describe how the actual menu items in "Information" tab are stored.
Lets go back and look at offset 4E 02 → 0x24e:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000240                                              [COLOR="Blue"]91 18[/COLOR]                 ‘.
00000250   00 00 [COLOR="Blue"]85 18[/COLOR] 00 00 [COLOR="Blue"]A9 18[/COLOR]  00 00 [COLOR="Blue"]C7 0F[/COLOR] 00 00 [COLOR="Blue"]91 2C[/COLOR]   ..…...©...Ç...‘,
00000260   00 00 [COLOR="Blue"]FB 0C[/COLOR] 00 00 [COLOR="Blue"]EF 0C[/COLOR]  00 00 [COLOR="Blue"]2F 0D[/COLOR] 00 00 [COLOR="Blue"]AB 0D[/COLOR]   ..ű...ď.../...«.
00000270   00 00 [COLOR="Blue"]B7 0D[/COLOR] 00 00 [COLOR="Blue"]C3 0D[/COLOR]  00 00 [COLOR="Blue"]CF 0D[/COLOR] 00 00 [COLOR="Blue"]9F 0D[/COLOR]   ..·...Ă...Ď...ź.
00000280   00 00 00 00 00 00                                  ......

These offsets contains individual menu items. For example 91 18 → 0x1891:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00001890      11 0C [COLOR="Blue"][B]B0 02[/B][/COLOR] 00 00 78  69 83 69 8F 69             ..°...xiƒi.i

Please visit excursion quote block in the referred-to post which describes this structure pretty well.
Only thing I mention here is address B0 02 → 0x2b0 which is string "CPU Type:" (this is the first item in "Information" tab in setup menu).

This was explanation how the menu structure looks like.
And now the more interesting part the "Intel" tab.

3. Figuring out the "Intel" tab
If we use the same process for "Intel" tab (offset A9 0C → 0xca9) we will get this:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000CA0                               [B][COLOR="Red"]10[/COLOR] [COLOR="Lime"]0A[/COLOR] [COLOR="Blue"]52 05[/COLOR] [COLOR="Grey"]00 00[/COLOR] [COLOR="Orange"]2F[/COLOR][/B]            ..R.../
00000CB0   [B][COLOR="Orange"]32[/COLOR] [COLOR="Purple"]59 32[/COLOR][/B]                                           2Y2

52 05 = "Intel" string
2F 32 = first function
59 32 = second function

Here is code from offset 0x322F:

Code:

322F                 push    bp
3230                 mov     bp, sp
3232                 call    sub_3237
3235                 pop     bp
3236                 retf

3237 sub_3237        proc near
3237                 push    dx
3238                 mov     ax, 141h
323B                 call    sub_5ED0 ; reads token AX, returns the value to AX
323E                 pop     dx
323F                 cmp     al, 1
3241                 jz      short loc_3245
3243                 jmp     short loc_3255
3245 loc_3245:
3245                 xor     ax, ax
3247                 call    far ptr 0F000h:4443h
324C                 test    al, 4
324E                 jnz     short loc_3255
3250                 mov     ax, 0
3253                 jmp     short locret_3258
3255 loc_3255:
3255                 mov     ax, 13h
3258 locret_3258:
3258                 retn
3258 sub_3237        endp

This is not that simple like return 0;.
The important thing is part 0x3238-0x323B where the token number 0x141 is read and then 0x323F-0x3241 where token's value is compared with 1.
The function simply does something like this (in C language):

Code:

int sub_3237() {
  if (read_token(0x141) == 1) {
    // ... some non-important stuff :-)
    return 0;
  } else {
    return 0x13;
  }
}

Return value 0x13 means something like: No don't display the menu item.
So if we want to make "Intel" tab visible we must set token 0x141 to 1.

Second function 59 32 is just another return 0; code.

4. Setting the NVRAM token value
Tokens are stored in BIOS CMOS (NVRAM) area. If we want to set the values we possibly could make the changes in $NVT section of ROMEXEC.ROM file.
This area stores BIOS Default Settings. (I will not describe this any further.)
But I failed to do this, because of breaking the checksum of CMOS.
(After flashing BIOS image modified this way and rebooting the notebook signalled the checksum error using speaker beep code.)

Much cleaner method to set token's value is using the SYMCMOS tool.
There are many posts that closely describes the process of setting tokens.
For example this one: http://forum.notebookreview.com/sony/189228-how-enable-intel-vt-ahci-napa-santa-rosa-platform-phoenix-bios-vaio-laptop.html
In a nutshell:

Now when we enter the Setup we can see the new "Intel" tab.
There are new many options we can "play" with. (Read the next chapter before any experimenting!)
But can finally enable the Switchable Graphics functionality here?
Bad news. It looks like it cannot be enabled this way.

5. Playing with the options in "Intel" tab
In "Video (Intel IGD) Control Sub-Menu" there is option "IGD - Device 2".
Possible values are:

Code:

0: [Disabled]
1: [Auto] [I](default)[/I]

We are unlucky here, because "IGD - Device 2" is already set to "Auto" and as we know there is no Intel Graphics among PCI devices in Device Manager (in Windows).
I didn't discover any function of this option (whether is set to "Auto" or "Disabled" IGD is not enabled).

In "MCH Control Sub-Menu" there is option "Primary Display".
Possible values are:

Code:

0: [Auto] [I](default)[/I]
1: [IGD]
2: [PEG]
3: [PCI]
4: [SG]

Two of these values looks pretty good: IGD (abbreviation for "Integrated Graphics Device") and SG (abbreviation for "Switchable Graphics")
! DO NOT SET ANY ANY OF THESE TWO VALUES !
Please do not set "Primary Display" to either "IGD" or "SG".
I tried and it bricked my notebook. My notebook didn't booted any more.
I had to clear CMOS settings to defaults by reflashing using Crisis Recovery Disk. (But removing the CMOS battery should be sufficient, too).

By contrast setting to "Auto", "PEG" or "PCI" does - what's the word - NOTHING.
It looks like guys in Acer really wanted not to give us this feature (not that "easy").

Here I'd like to announce that my configuration is 5740G-334G64MN (LX.PMB02.258).
(Core i3-330M, ATI Mobility Radeon HD 5650 1GB, 4GB RAM, Windows 7 Home Premium)

As I know this CPU (Core i3-330M) has integrated graphics, but if anybody with Core i5 have courage and working Crisis Disk you can test the setting "IGD" or "SG".
(Of course I take no responsibility for bricking your lappy, it's only your decision. Not talking about loss of warranty and potential illegality of this whole thing. )

6. Another hidden option in BIOS Setup
Going through STRINGS00.ROM file I found string "Graphic Mode:".
So I backtracked the menu item which uses the string.
String is at offset 0x5AEA (it is not an actual offset in STRINGS00.ROM, because the file has a 28 bytes long header).
If you search EA 5A in STRINGS00.ROM you will find record in address table at 0x6a6.
Searching for A6 06 in TEMPLAT00.ROM will give you two results: 0xddd and 0xdf5.

The first one is part of menu item (starting at 0xddb):

Code:

[B][COLOR="Red"]00[/COLOR] [COLOR="Lime"]18[/COLOR] [COLOR="Blue"]a6 06[/COLOR] [COLOR="Grey"]a8 06[/COLOR] [COLOR="Orange"]de 37[/COLOR] [COLOR="Purple"]30 38[/COLOR] [COLOR="SandyBrown"]0b 38[/COLOR] [COLOR="DarkOrchid"]16 38[/COLOR] [COLOR="SeaGreen"]3b 01[/COLOR] [COLOR="Sienna"]b8 06[/COLOR] [COLOR="DarkGreen"]00 00[/COLOR] [COLOR="Olive"]b4 06[/COLOR] [COLOR="Green"]00 00[/COLOR][/B]

Human readable:

Code:

[B][COLOR="Blue"]Graphic Mode:[/COLOR]
---
Functions: [COLOR="Orange"]0x37DE[/COLOR], [COLOR="Purple"]0x3830[/COLOR], [COLOR="SandyBrown"]0x380B[/COLOR], [COLOR="DarkOrchid"]0x3816[/COLOR]
Token: [COLOR="SeaGreen"]0x13B[/COLOR]
[COLOR="Sienna"]0: [Switchable][/COLOR]
[COLOR="DarkGreen"]1: [][/COLOR]
[COLOR="Olive"]2: [Discrete][/COLOR]
[COLOR="Green"]3: [][/COLOR][/B]

(The second one "Graphic Mode" is similar menu item, but it has 1: [Integrated] and 2: [] and it looks like it isn't used in any menu.)

Further backtracking (searching for DB 0D) will bring us to address 0x2a2.
Here we are somewhere in the middle of list of menu items.
This list begins at 0x286 (what a luck ).
Bytes 86 02 are at 0x238 (the second occurrence at 0x205b is only coincidence).
Yes, we've already been near this address. Remember the chapter 2?
Actually, we've just found that item "Graphic Mode:" is placed in tab "Main". More precisely between items "Video Memory" and "Quiet Boot:".

Now let's find out why the option is hidden.
Function at 0x37DE is wrapping function (only it does is calling another function) for another function at 0x37E6:

Code:

37E6 sub_37E6
37E6                 push    dx
37E7                 mov     dx, 11B8h
37EA                 in      eax, dx
37EC                 and     eax, 20h
37F0                 jnz     short loc_3806
37F2                 mov     ax, 13Bh
37F5                 call    read_token_sub_5ED0
37F8                 cmp     al, 1
37FA                 jnz     short loc_3801
37FC                 mov     ax, 13h
37FF                 jmp     short loc_3809
3801 loc_3801:
3801                 mov     ax, 0
3804                 jmp     short loc_3809
3806 loc_3806:
3806                 mov     ax, 13h
3809 loc_3809:
3809                 pop     dx
380A                 retn
380A sub_37E6        endp

OK, here is C interpretation (better, isn't it?):

Code:

int sub_37E6() {
  if (cpuio_in(0x11b8) & 0x20 == 0) {
    if (read_token(0x13b) != 1) {
      return 0;
    }
  }
  return 0x13;
}

Address 0x1180 is base offset of GPIO (General Purpose Input-Output) registers (now we talk about CPU I/O address space).
GPIOs in principle are pins which can be configured either as input or as output. They are used in digital circuits for various purposes.
Commonly GPIO pin is configured as input and used to read some status in circuit (eg. button press) or configured as output pin to control other devices in circuit (eg. powering them up and down, blinking LED).
Register 38h (0x1180+0x38=0x11b8) is GP_LVL2 (GPIO Level for Input or Output 2). Each bit in this register corresponds to one GPIO pin.
From Intel's manual p.552:

So cpuio_in(0x11b8) & 0x20 is nothing else than reading pin GPIO37.

To sum it up, if we want the option "Graphic Mode" visible then GPIO37 must be 0 (low) and NVRAM token 0x13b must not be equal 1.
The question is what's connected to GPIO pin 37.
(At this point it would be very useful to have motherboard schematic diagram.
This notebook has motherboard "JV50-CP" build by Wistron.
I found few sites specialized on notebook motherboard schematics, but haven't found schematics for this motherboard yet).

The second function 0x3830 I haven't understood yet (but returns 0 in default, so don't care of it).
The third function 0x380B is "returns 0;".
The fourth function 0x3816 wraps 0x381E:

Code:

sub_381E proc near
push    dx
mov     ax, 13Bh
call    read_token_sub_5ED0
mov     dx, 3C3h
call    write_token_sub_5EF3
pop     dx
mov     ax, 0
retn
sub_381E endp

This function always returns zero, so it doesn't look interesting. Actually it is partially interesting. Let me explain.
When we discussed the "Primary Display" option in chapter 5, I talked only about possible values. Here is whole detail of this option:

Code:

Primary Display
---
Select which of 
IGD/PEG/PCI
Graphics device
should be Primary
Display
Filters: 0x7AB6, 0x7ACC, 0x7AD7, 0x7AC1
Token: [COLOR="Red"][B]0x3C3[/B][/COLOR]

0: [Auto]
1: [IGD]
2: [PEG]
3: [PCI]
4: [SG]
5: []
6: []
7: []

The interesting part is the token address 0x3C3.

Maybe I should explain one thing first. The main purpose of NVRAM tokens is to store the selected value of option in BIOS Setup.
For example if we set option "Graphics device" to value "PEG", then token 0x3C3 will hold value 2.

No what sub_381E does? Setting "Graphic Mode" (token 0x13B) is automatically stored to the token 0x3C3 aka. "Primary Display", too.
Eg. If we set "Graphic Mode" to "Switchable" then "Primary Display" is automatically set to "Auto" and setting "Graphic Mode" to "Discrete" sets "Primary Display" to "PEG".

Actually it looks like the only purpose of "Graphic Mode" option is controlling the "Primary Display" option.

And as we realized before (chapter 5), IGD can't be enabled simply by "Primary display" option (will not boot).
I thing the only useful information from this chapter is that there is something connected to GPIO37 input pin.
The open question is what is connected there.

7. ACPI SSDT Tables
I think we already need some optimistic information.
Do they (Acer) really worked on Switchable Graphics for this laptop or is it only a myth (and the BIOS Setup options are only coincidence)?
I want show you an evidence that Acer meant it seriously with Switchable Graphics.

First of all, we need to know what are ACPI SSDT tables.
In a nutshell, DSDT and SSDTs are tables which describes ACPI-compliant hardware which is present in the system.
A table consists of objects (eg. pci device), methods (eg. power-up) and data.
There is exactly one DSDT table and zero or more SSDT tables. The DSDT table is part of the system fixed description. It is loaded always when BIOS boots and cannot be unloaded. SSDT tables can extend (but not override) DSDT table.
More detailed information can be found here: http://www.drdobbs.com/mobility/222600829?pgno=3

I the first chapter I mentioned the Phoenix SLIC mod.
This tool extracts individual files from BIOS image.
Most of the files are the uEFI BIOS modules.
Also there is a file ACPI00.AML. This file contains compiled DSDT table.
You can decompile this file into DSL source code using iASL compiler.
Running the following command will do the job:

Code:

./iasl.exe -d ACPI00.AML

This will create a new file ACPI00.dsl, which contains decompiled source code of DSDT table in ACPI Source Language.

There is another file 697CFA95-B1F2-4ED7-A0D2-7AC6E47B3C99.ff.
If you look inside this file you can see well known MZ-PE header.
Yes, in fact this file is 64-bit Portable Executable file.
You can copy the content starting at 0x84 to a new file with suffix .DLL and then open it in your favourite disassembler.

After some digging I found this string in the file.

Code:

E:\JV50CP\fw\PROJECT\JV50\X64.VS2005.GreenHV1\X64\HybridGraphicDxe.pdb

So the original name of this module is HybridGraphicDxe.

After deeper investigation of this module I found that a sub-procedure at 0x186C loads PCI Vendor ID of PCI device located at 02:00.0 (bus=2, device=0, function=0) address in PCI tree.
This is the address of discreete VGA adapter on PCI-Express bus.
If the Vendor ID is 0x10DE (NVIDIA Corporation) it loads value 8E8FF4521D9E1C834F5434D87E1CABE3h into register xmm0.
If the vendor ID is 0x1002 (ATI Technologies Inc. / Advanced Micro Devices, Inc.) it loads value C706F61DD7E9278C42CA77DE76AED82Eh to the same register.

I haven't realised what exactly it does with this value yet.
But I guess that it loads the SSDT table from module identified by corresponding GUID.
You may already noticed that the uEFI BIOS modules are extracted to files named as some kind of hashes.
Actually every uEFI module has this unique GUID number.

Let's transform hexadecimal number C7 06 F6 1D D7 E9 27 8C 42 CA 77 DE 76 AE D8 2Eh
into this string (note that last two fields are backwards): 76AED82E-77DE-42CA-8C27-E9D71DF606C7.

Actually this is GUID number of another extracted file.
Inside this file (76AED82E-77DE-42CA-8C27-E9D71DF606C7.PEI) you can find "SSDT" string which starts a SSDT table.
Just copy the content of this file starting at offset 0x1c into a new file, eg. AMD.aml.
Now extract the AMD.aml using the iASL tool.

Code:

./iasl.exe -d AMD.aml

The decompiled AMD.dsl file is the interesting part of this chapter.
This SSDT Table defines methods _ON and _OFF to scope _SB.PCI0.P0P2.PEGP (discreete graphic card).
It's not a big surprise that these two methods can switch on/off the discreete graphics card.
Additionally the table defines method ATPX to scope _SB.PCI0.GFX0 (integrated graphics card).
The ATPX method can be called by operating system (or graphics card driver) to switch between integrated and discreete graphics cards.

Normally this SSDT table is not loaded. There's one condition that must be met so that sub-procedure 0x186C is called.
The input value on GPIO 37 pin must be zero. Again that mysterious GPIO 37 pin!

8. So AMD never released drivers with SG support?
Here is another one evidence that Acer really worked on Switchable Graphics for model Aspire 5740G.
There are rumours that Acer disabled this feature because there weren't drivers available when the model was released.

I fact there is one version of drivers VGA_AMD_8.713.3.3000_Win7x64 which looks like it supports chable Graphics for Aspire 5740G.
You cat get it from Acer support page if you choose model Aspire 5820TZG ( direct link).

Extract the ZIP archive and go into the following folder: VGA_AMD_8.713.3.3000_Win7x64\Packages\Drivers\Display\W76A_INF
Here you can see two interesting things.
The first one is the "Intel" folder, which contains drivers for integrated graphics.
The second one is the file C7_99253.inf which contains description of AMD/ATI graphics drivers.
Look into this file and search for sting "JV50-CP" (Aspire 5740G platform name).
You will find this line:

Code:

%iILKGM0_SG% = iILKM1_PROXY, PCI\VEN_8086&DEV_0046&SUBSYS_033F1025 ; Acer/Wistron JV50-CP

Strange thing is that my laptop has subsystem ID 033E1025 not 033 F1025.

But SUBSYS_033E1025 is also mentioned in this file.
Here are all the occurrences of "SUBSYS_033F1025":

Code:

"ATI Mobility Radeon HD 5470     " = ati2mtag_Manhattan_[COLOR="Red"]PXAI[/COLOR], PCI\VEN_1002&DEV_68E0&SUBSYS_[COLOR="Red"]033F1025[/COLOR]
"ATI Mobility Radeon HD 5650          " = ati2mtag_Manhattan_[COLOR="Red"]PXAI[/COLOR], PCI\VEN_1002&DEV_68C1&SUBSYS_[COLOR="Red"]033F1025[/COLOR]
%iILKGM0[COLOR="Red"]_SG[/COLOR]% = [COLOR="Red"]iILKM1_PROXY[/COLOR], PCI\VEN_8086&DEV_0046&SUBSYS_[COLOR="Red"]033F1025[/COLOR] ; Acer/Wistron JV50-CP

And here are all occurrences of "SUBSYS_033E1025" (my laptop):

Code:

"ATI Mobility Radeon HD 5470              " = ati2mtag_Manhattan_[COLOR="SeaGreen"]PRAI[/COLOR], PCI\VEN_1002&DEV_68E0&SUBSYS_[COLOR="SeaGreen"]033E1025[/COLOR]
"ATI Mobility Radeon HD 5650                        " = ati2mtag_Manhattan_[COLOR="SeaGreen"]PRAI[/COLOR], PCI\VEN_1002&DEV_68C1&SUBSYS_[COLOR="SeaGreen"]033E1025[/COLOR]
%iILKGM0% = [COLOR="SeaGreen"]iILKM0[/COLOR], PCI\VEN_8086&DEV_0046&SUBSYS_[COLOR="SeaGreen"]033E1025[/COLOR]

I marked the main differences.
You can see that JV50-CP from the file has ati2mtag_Manhattan_ PXAI while my laptop has ati2mtag_Manhattan_ PRAI.
At the beginning of this INF there's following comment:

Code:

; PX - PX Proxy mode
; PR - PX Proxy Ready

So their JV50-CP has "PX Proxy mode" while mine is "PX Proxy Ready".

It looks like there are drivers that could be able to do Switchable Graphics.
But note that this drivers are installed only if there is present a PCI device with Vendor ID 8086, Device ID 0046, Subsystem Vendor ID 1025 and Subsystem Device ID 033E (or 033F or any else from the list in the INF file).

9. Will there be working SG on Aspire 5740G ever?
You probably don't want to hear this answer... but I don't know.
Sometimes it looks like we already were very close to the goal and sometimes I want to give it up...

I have already mentioned it few times, but in this stage it will be very helpful to have schematics of the laptop's motherboard, so we can finally puzzle out what is that mysterious GPIO 37 input pin. There are few sites which sell laptop schematics, but I haven't found any that provides schematics for this laptop, yet.

Also I would appreciate if anybody who has Aspire 5740 without discreete graphics card could help us to get some low-level informations (eg. PCI configuration registers) from working system with IGD.

I'm very sorry, but I will no more update this post as I don't have enough time to write this "hacking guide".
Instead, I will post short updates in this thread any time I get some new interesting informations about Switchable Graphics on this laptop.
---
If you got this far thanks for reading.

 

With the DIY ViDock testing I found that XP uses a round-robbin method to try and use whatever video card is acive. Win7 uses only the post device so it's not possible to disable the discrete graphics prior to chainloading into Win7.

Now other problem is I believe the switchable graphics *probably* just checks for an assert signal when the ATI/NVidia card is active and drives it's LVDS signals through it. So the discrete graphics would need to be disabled with the equivalent of 'setpci -s 0:0.0 54.w=0:2' for the IGP to be able to display anything. The switching designed to boot with the IGP active.

Knowing the limitation with Win7 requiring the post device active would mean needing to hot-switch to the IGP. Eg:

- boot with the discrete graphics active into DIY ViDock Setup
- ensure IGP is enabled, perform compaction on it.
- boot Win7, ensure there is no error 12 against the IGP.
- disable the discrete graphics using scripting, hwdirect/r-w everything
- do a device manager scan (devcon) to get it to now switch to the IGP.

The above is all hypothetical but I believe it adds some more variables to the mix that have not bee considered. XP would be easier to get going as a proof-of-concept.

 

@sustmi, one reputation from me. Good discussion thread. Yes, we can find a lot of information when tracing the offset. I believe you will be able solve the 5740G's switchable graphic card mystery. I have one request though. Can you share the CRISIS package for 5740G, including the BIOS recovery procedure & also the type of media you use (Floppy, USB flash drive, etc)? This will help a lot of people. Most unsuccessful BIOS recovery is because they're using wrong media (USB flash drive instead the floppy disk).

 

In first time sorry for my english.

One question, in the 1.22 bios is updated the bios of the graphics with the intel bios unusable switchable graphics option in full. Have you tested with any previous version of BIOS if you change to have a choice?

 

I second that request- if you've already recovered 5740G could you please share the package and describe the process- preferably in the first post so that those who try and fail know what to do.

And my polite request to other posters- if you cannot contribute technically to this thread don't post here. Questions like "why did Acer disable SG" and similar do not help in any way especially that it's been already answered multiple times. Let people who really do something discuss the matters- keep other matters in the Owners Lounge. Thanks

 

CRISIS RECOVERY DISK:
Build:
1. Download this archive containing WINCRIS utility and Aspire 5740G BIOS v1.22
2. Insert your USB flash drive
3. Run WINCRIS.EXE (in Vista and 7 you will need "Run as Administrator")
4. Select your drive and leave other options on default
5. Press "Start" (will overwrite all data on selected drive!!!)

Usage:
1. Turn notebook off
2. Press and hold keys: Fn + ESC
3. Turn notebook on
4. Release the keys (approx. 10 seconds after powering up)
5. Wait for until flashing process completes

It should take approx. 5 minutes and all the time screen should be black.
After flashing it automatically reboots (if not, CRISIS DISK is probably not build correctly or your flash drive is somehow not supported).

 

Hey, i found a way to open the BIOS-File with Phoenix BIOS Editor. Or better, Kizwan found the way. I only read his post in the Phoenix Bios Modding Request Thread. It's an introducing how to open a BIOS file from a PackardBell Notebook, but this notebook has the same bios like the 5740G. I tried it and it works, but i have no idea how to use PBE. But maybe someone other can use it to find a solution. I copy his post:

"
It is original BIOS. I haven't modified it yet because this BIOS have same problem as Aspire 5740G have; PBE can't open the BIOS image without error. The Intel menu is there the whole time. It is hidden from end-user. I can unhidden it but I'm not sure if PBE can re-build the BIOS image successfully (meaning without bricking your notebook). I was going to modify it, just take my time to do research about it a little bit.

In the meantime, if you want to take a look yourself:-
1) Download the BIOS image from (packard bell) Acer website
2) Extract it & go to DOS folder
3) Open the JV50122.WPH file with HEX editor
4) Split JV50122.WPH to three part:-
- 1st 200000 length: 000000 - 1FFFFF: save it as JV50122_1.ROM
- 2nd 200000 length: 200000 - 3FFFFF: save it as JV50122_2.ROM
- 3rd: 400000 - end: save it as JV50122_3.ROM
5) Open JV50122_2.ROM with PBE. At the first attempt, you will get "ROMEXEC not available!". Try open it again, PBE should be able to open it."

I used HxD as HexEditor and PBE 2.2.13 beta. I got some messages that some modules were not found, I clicked yes to continue.
I hope it helps someone to help us =)

 

I've been trying to flash but I can not. My notebook has an i5 430M. You can put any easy way to flash it?

 

Hi sustmi,

Have you tried enabling extra PCI express root port under "PCH Control Sub-Menu"? If you haven't play around with it, can you try enabling the extra PCI express root port? I we're lucky, it may enabled the Intel HD Graphics which may connected to one of the disabled PCI express root port. Please let us know the results. Thanks.

 

hello, did anyone have success in trying this option that kizan mentioned?

 

@Athlon1,

This is sustmi's respond to my post/request. I share it here.

Hi kizwan, sorry for the delay. I was quiet busy (read "lazy") last few weeks.
I'm pretty sure that playing with "PCI Express Root Port" have no effect on graphics. Let me explain.

If you look at the file I attached, you will see the structure of PCI tree.
If you are not familiar with PCI on this level, please see first few sentences here: PCI bus info and code
Addressing on PCI is done by bus:device.function triples (eg. 02:00.1, bus 2, device 0, function 1).
Basically there is only CPU and bus 0. Other buses are connected via bridges.
See Figure 6.1 here: http://clicker.sourceforge.net/docs/...iew-draft.html

On bus 0 ([0000:00] in the file) we have most of devices.
There are few bridges also.

The first one is 00:01.0. It's so called PCI EXPRESS-G (PCI Express graphics) port. This bridge connects the bus 2, where the Radeon HD 5650 resides (02:00.0 and 02:00.1).

Another one bridge is 00:1e.0, the DMI-to-PCI Bridge. (I don't think this one is interesting for us.)

The last bridge(s) I want to mention is(are) device 00:1c.0 (functions 0-7).
These are so called PCI Express Root Ports. Each function of device 00:1c is one Root Port, so we have overall eight ports (actually HM55 doesn't have the last two so it only has six ports).
These Root Ports are the settings you asked me to play with.

As you can see there are two Root Ports (bridges) enabled/configured:
1. 00:1c.0 which connects buses 03-04 (It's not 03 <--> 04! It connects bus 00 on one side to range of buses 03..04 on the other side).
BCM57780 Gigabit Ethernet (03:00.0) resides there.
2. 00:1c.1 which connects bus 05, where BCM43225 802.11b/g/n (05:00.0) resides.

Now, you probably already know, that this setting can't affect the Intel Corporation Core Processor Integrated Graphics Controller which resides on bus 0 (00:02.0).

But to be fair, I tried few combinations of these settings, before I knew the things I just explained. You already know the result...

Code:

-+-[0000:ff]-+-00.0  Intel Corporation Core Processor QuickPath Architecture Generic Non-core Registers
 |           +-00.1  Intel Corporation Core Processor QuickPath Architecture System Address Decoder
 |           +-02.0  Intel Corporation Core Processor QPI Link 0
 |           +-02.1  Intel Corporation Core Processor QPI Physical 0
 |           +-02.2  Intel Corporation Core Processor Reserved
 |           \-02.3  Intel Corporation Core Processor Reserved
 \-[0000:00]-+-00.0  Intel Corporation Core Processor DRAM Controller
             [B][COLOR=Red]+-01.0-[02]--[/COLOR]+-00.0  ATI Technologies Inc Redwood [Radeon HD 5600 Series]
             |            \-00.1  ATI Technologies Inc Redwood HDMI Audio [Radeon HD 5600 Series]
             +-02.0  Intel Corporation Core Processor Integrated Graphics Controller[/B]
             +-16.0  Intel Corporation 5 Series/3400 Series Chipset HECI Controller
             +-1a.0  Intel Corporation 5 Series/3400 Series Chipset USB2 Enhanced Host Controller
             +-1b.0  Intel Corporation 5 Series/3400 Series Chipset High Definition Audio
             [B][COLOR=Green]+-1c.0-[03-04]----[/COLOR]00.0  Broadcom Corporation NetLink BCM57780 Gigabit Ethernet PCIe
             [COLOR=Green]+-1c.1-[05]----[/COLOR]00.0  Broadcom Corporation BCM43225 802.11b/g/n[/B]
             +-1d.0  Intel Corporation 5 Series/3400 Series Chipset USB2 Enhanced Host Controller
             [COLOR=Sienna]+-1e.0-[0f]--[/COLOR]
             +-1f.0  Intel Corporation Mobile 5 Series Chipset LPC Interface Controller
             +-1f.2  Intel Corporation 5 Series/3400 Series Chipset 4 port SATA AHCI Controller
             \-1f.3  Intel Corporation 5 Series/3400 Series Chipset SMBus Controller

(Note that I manually enabled the IGD by setting bit 3 of register 0x54 in 00:00:0 PCI configuration registers.)

 

Just a tip!

The Packard Bell Easynote TJ-75 BIOS and the 5740G BIOS are the same just with different brandings. I'm running the latest 5740 BIOS on my TJ-75.

The PB bios always comes out after the acer bios, but this time PB has released version 1.26.

Maybe the PB bios is easier to debug? Two of the same can be easier to figure out. Keep up the excellent work! I admire you!

Attached is the bios sites of both PB and ACER:

Support Download

Service & Support

 

Interesting. I remember when I first got this laptop, before I got the Bluetooth module I would have issues with an error when coming out of standby, and the camera wouldn't work. I haven't had that since getting rid of the dongle. I wonder if that's the issue they're referring to by "USB ports not working after standby?"

I'm not certain I'd want to flash BIOS of a different computer tho unless I was certain it was the same. A seemly minor difference, can become a big concern.

I don't have the 5740G, just the regular model. Is there anything else of interest in the Intel menu?

 

The IGP is enabled in the non-G versions (since they don't have the extra ATI graphics card), perhaps we should also look into their BIOS if they are similar enough to see how it's enabled.

 

It's the same BIOS for G and non-G models- it includes both VBIOSes and it's exactly the same package so there's nothing to compare.

 

Does it detect the ATI card and auto disable the intel only if it finds the ATI card?

 

hello , how to modify bios 1.22 witch intel micro code for support cpu? i have installed intel i5 460m in my 5740g and when i turn on pc system don bios don't recosigne 460m i5 . is when tou install another cpu and system watch this enchanchement

 

Maybe you can find more information about the enabled IGP in the Bios of the Acer 7745G! We have this machine in our company and it have switchable graphics enabled, using Corei5, ATI 5850 and so on, so ithink the mainboard may also be the same as in our 5740!

 

Can we try and install the Aspire 5820TG Bios? It´s identical to the 5740G only with a metal body.

I might try it. Only thing that stops me is the Crisis disk thing. Will it work?

 

bios is identical?

 

I don´t know. The hardware itself is identical, or at least the specs say so.

I don´t know how to edit a BIOS or anything like that, I´m just throwing that option on the table.

Maybe kizwan can shed dome light on this matter.

 

By "hardware is identical" you mean chipset and GPU. By this rationale 5740G/3820G/4820G/5820G/7740G would all have the same BIOS.
Basically all notebooks with HD5650 use HM55 chipset (some may use PM55 though) but this doesn't mean they are identical.

I don't know how clock generators would work, what is the KBC that controls thermal sensors, fan, flash, internal keyboard etc.
Also just to prove these are not the same- 5820TG uses ALC269 audio chip while 5740G uses ALC272.

All in all you'd brick your laptop so don't do it

 

I have a 5470 mobility set to 850/950

 

How did you do that?

 

You will most probably kill it.
Sometimes it is how they solder the board that makes the difference.

 

I'd like to announce that I added new chapters (6 to 9) to the second post of this thread which is some kind of BIOS hacking guide.

Unfortunately I don't have enough time to continue with this post.
Instead, I will make new brief post in this thread any time I get some new interesting informations about Switchable Graphics on this laptop.

Thank you for your understanding.

 

keep a good work up, checking this thread almost every day since i bought my laptop thanks

 

What happens if you??

1. enable the IGP using DIY ViDock Setup 1.x, do a PCI compaction on it
2. chainload to Win7, load the driver for the IGP ensuring it's enabled with no error 12.
3. try disabling/enabling the IGP and the primary video card.

Does the LCD flash during (3). If so, then that would indicate there is a MUX present and indeed bios hacking to enable the IGP and make it the primary bootup card is worth pursuing.

 

p.s. just flashed my 5740g with packard bell easynote tj75 bios with version 1.26 http://global-download.packardbell.com/GDFiles/BIOS/BIOS/BIOS_PackardBell_1.26_A_A.zip?acerid=634224415408878887&Step1=Notebook&Step2=EasyNote&Step3=EN%20TJ75&OS=722&LC=en&BC=Packard%20Bell&SC=EMEA_27P don't know if it helps someone in any way, btw flashing bios to tj75 v1.26 some why made windows to reinstall almost all drivers, including ati 5650 drivers,
p.s. anyone needing service manual for tj75 can look for easynote_tj75_tj76_tj77_tj78.pdf by google
and for 5740g try looking for aspire_5740_5740d_5340_jv50_cp_from_slovelissimo.blogspot.com.pdf,
both files have same block scheme posted somewhere in hm55 switchable graphics thread.
sadly that's all for now what i managed to find myself good luck everybody

 

Hello and thanks for your work so far! I've contacted some people who might get the schematics and I'll let you know if I get them as well.

 

I tried to play with DIY ViDock, but everytime I enable IGD and try to boot W7,
I get BSOD with STOP 0x000000A5 and immediate reboot.
Linux boots, but IGD doesn't work.
The problem is in configuration of GGC - Processor Graphics Control Register of PCI device 00:00.0 (see documentation p. 57).

My configuration is:
IGD VGA Disable (IVD) = 1h

Graphics Mode Select (GMS) = 0h

GTT Graphics Memory Size (GGMS) = 0h

These settings fundamentally means, that IGD is disabled. Yes, it's powered-on by DEVEN PCI register of 00:00.0, bit 3 = 1.
But the IGD device (00:02.0) doesn't play like VGA adapter.
Unfortunately this configuration can be set only in BIOS boot stage (in DIY ViDock it's already locked).

I found PCI dump from HP G62 140 which should have IGD working.
This is the configuration:
IGD VGA Disable (IVD) = 0h

Graphics Mode Select (GMS) = 5h (32MB)

GTT Graphics Memory Size (GGMS) = 3h

 

Actually I found the part of code in one of the BIOS modules which configures this register (GGC).
It's PlatformStage2 (file 30303030-3030-3732-0000-000000000000.PEI).
The configuration is done when the Primary Display option (in BIOS Setup) is set to SG.
I'm not an expert, but I think that BIOS configures the register properly (according to DVMT Preallocated option).
However, when Primary Display[/I is set to SG, laptop doesn't boot (hangs probably somewhere in early BIOS stages).

Currently, I see the only way how to find out the cause of hang in hacking the PlatformStage2 module.
I mean trying to bypass individual parts of code until the cause is identified.
Unluckily this is not an easy task, because you can't just use printf, to print out checkpoints where the code get yet.

If anybody knows a way how to "output" in BIOS stage, I'm listening.
I've been thinking about something like blinking the num-lock LED or beeping with the speaker, but I'm not sure if this is possible in the early boot stages.

 

Maybe some BIOS POST code reading debug board could help.
I must look for a board which can be used with my laptop.
I remember I saw POST displays for USB port, but I wonder if they can catch POST codes in early stages...

EDIT: Nope, there probably aren't any boards for USB (USB is used only for power supply).
So, only Mini PCI-E comes into the account. (I suppose 5740G does have one.)
Something like this: http://www.dealextreme.com/photogallery.dx/sku.37916

 

5740g has 2 pcie slots, one is used for wireless and an other it's free

 

Hi Sustmi, sorry for a bit out of topic but very related to your research,

I bought 5740dg and managed to install 1 HDD caddy into the DVD slot. But this caddy only works for bios v1.16 and suffered from some random screen artifacts. As long as I know 1.22 has changed its VGA bios to fix some powerplay stuff, but it also removed the support of the 2nd ATAPI device. Do you think it's possible to replace the VGA part of 1.16 with the 1.22 one? Thanks in advance,

 

I broke my bios trying to flash it with the 1.10 version. Now when I switch it on it turns the screen in black and makes nothing!.

Do you think I can repair the laptop with that crisis disk?

Thank you guys =).

 

@ AlexFLCL That's what the crisis disk is for- go ahead.

 

Hi. Yes, it could be possible.
VGA BIOS is just one of the files you get when you extract BIN/WPH image using Phoenix SLIC mod tool.
I'll try to build it for you soon. But be aware that it is possible that BIOS will not boot.
Better prepare the Crisis Disk.

 

Ok, Then I will ask for my laptop.

 

That would be great- if we could swap vBIOSes at will and successfully flash them we could think of possibly overvolting HD5650 to 1.1V

 

Oh that would be really helpful! I also know that some guys are also using v1.16 because of that reason.
I've split the bios myself and found the possible file that contains the VGA version strings. but for now I have no idea of how to properly merge them back.

 

How did you do that?
Do you have both the DVD drive and HDD caddy connected at once?

Did you try playing with "SATA Control Sub-Menu" options in the hidden Intel tab?

EDIT:
These are default settings from BIOS version 1.16:



And these are the defaults from the latest BIOS 1.22:



And finally here is Aspire 5740G BIOS version 1.16 with video BIOS for ATI MADISON (Mobility Radeon 5650) from BIOS version 1.22.
Better try the original 1.22 BIOS and tune the "SATA Control Sub-Menu" settings instead of flashing this one.

 

Hi, it's pretty easy.

When you open the BIOS image in the Phoenix SLIC tool, it extracts the files into DUMP folder.
So extract the BIOS v1.22 and look for files OPROM xx.ROM.
These are "secondary" (I can't find better word) BIOSes for ATI/Intel graphics cards and for Broadcom network adapters.
In this BIOS ("primary") the file OPROM00.BIN contains BIOS for ATI Mobility Radeon HD5650 (aka. "MADISON").

Now open BIOS v1.16 image in the Phoenix SLIC tool.
To build a BIOS image you will need two files: 1. SLIC File and 2. RW file.
Both files can be obtained with RW-Everything tool.

Run the RW-Everything tool and click the ACPI (ACPI Tables) button.
Wait until loaded and then select the "SLIC" tab.
Now, click on "Save as binary" (Shift+F2). Save as SLIC.bin.
Next, click on the "Save all" (Ctrl+F2). Save as AcpiTbls.rw.
(You can close the RW-Everything tool.)

Now select these files in Phoenix SLIC tool ( 1. SLIC File= SLIC.bin, 2. RW file= AcpiTbls.rw )
Go to the "Advanced" options where uncheck option "Remove manufacturer specific locks"
and check options "Allow user to modify other modules" and "No SLIC".
Click "Done".

Now you can press "Go" button.
It will ask you to modify the modules in DUMP directory.
So simply copy file OPROM00.ROM from v1.22 DUMP directory to 1.16 DUMP directory.
Then press OK.
Your BIOS image will be named &lt;opened_bios_image_name&gt;_SLIC.WPH.

NOTES:
1. Don't try this.
2. If you have older version of the Phoenix SLIC tool (this guide assumes v1.64) you have to set "Manufacturer" to "Other" after you open the image.
Also, some Advanced options can be absent.
3. When I tried to put the ATI PARK XT (Mobility Radeon HD5470) BIOS ROM file (OPROM01.ROM) from v1.22 into v1.16, it didn't boot.

 

On 7740G both OPROM00 and OPROM01 are VGA bioses but for two different ATI cards.

EDIT:

OPROM02 "1890Intel(R)Ironlake Mobile PCI Accelerated SVGA BIOS"

 

On 5740G BIOS v1.22:
OPROM00.ROM

Code:

03/17/10,10:30:34
Acer JV50-CP Madison SG DDR3 64Mx16 550E/750M
(C) 1988-2005, ATI Technologies Inc.
ATOMBIOSBK-ATI VER012.020.000.013.035223

OPROM01.ROM

Code:

03/17/10,06:06:44
Acer JV50CP PARK M2 XT DDR3 64Mx16 1GB
(C) 1988-2005, ATI Technologies Inc.
ATOMBIOSBK-ATI VER012.020.000.013.035534

OPROM02.ROM

Code:

Intel(R)Ironlake Mobile PCI Accelerated SVGA BIOS
Build Number: 1994.0 PC 14.34  03/18/2010  10:22:03

OPROM03.ROM

Code:

IBM VGA Compatible
08/05/09
HWEAE698 N10M-GS VGA BIOS for SJV50
Version 70.18.28.00.FF
Copyright (C) 1996-2009 NVIDIA Corp.
GT218 Board - 0698a7d0

OPROM04.ROM

Code:

IBM VGA Compatible
08/03/09
HWEAE698 N10M-GS VGA BIOS for SJV50
Version 70.16.29.00.FF
Copyright (C) 1996-2009 NVIDIA Corp
GT216 Board - 0696a3d0

OPROM05.ROM

Code:

Broadcom NetXtreme Ethernet Boot Agent v12.2.2
Copyright (C) 2000-2009 Broadcom Corporation
Copyright (C) 1997-2000 Intel Corporation
Broadcom UNDI PXE-2.1 v12.2.2
Slot 0000

 

No. The DVD is removed and replaced with the 2nd HDD caddy. It's a China brand called "Fenvi 12.7mm general HDD caddy" which costs about 12$ without shipping here. The purpose is to use an extra SSD for the OS.

The DvD-RW drive is now placed in an external USB2.0 box(also made by Fenvi).

No, could you show me where I can find the modded bios with Intel tab?
I've went though this thread and are too technical for me to try..

Many thanks! I'll try the modded bios first and keep this one!

 

Hi sustmi, thanks and it works well!!

I didn't tried the hidden menu but your bios seems good enough for me!!

 

Yep, ordered and the package is already on the way.
(Hope it arrives before Christmas holidays... )

 

Have you tried to compare the bios'es example 5820t with 5740g or load to 5740g bios from another one with the sg enabled?