Acer Aspire TimelineX 3820TG mods/tweaks ONLY!

no. the comboboxes are empty the voltages are only text and the screen in my last post is from the wrong vbios.
i'll update it with the right one

 

Time to start using BatteryCare?

What if we just copy over the VBIOS from 4820TG? Isn't it running at higher voltage?

 

for me 1.0v is ok. it clocks up to 700mhz and it gets really hot.

in the bios are more then 1 vbios and OPROM01.ROM seems to be for hd5650. i dont know how the 3820tg selects the right one.

maybe you rename OPROM02.ROM (the one with 1.05v) to OPROM01.ROM
but i will not try this

btw. the tmin of 55°C seems to work the fan of ati switch off below 50°C after some time

and OPROM00.ROM seems to be the intel vbios (RBE cant open it)

 

if dedicated video card's pci-e ID is HD5650 then select OPROM01.ROM
if dedicated video card's pci-e ID is HD6650 then select OPROM02.ROM

 

The last time I checked the cards had the same PCI-E ID. At least in the driver infs. And Acer distributes two drivers, one for each card, maybe for this reason.

 

FGLRX patched with VGA_SWITCHEROO HOW TO :

I've prepared a how-to explaining the necessary steps to install the Catalyst 10.12 patched with VGA_SWITCHEROO allowing the ATI card either to be powered off with the bios option set to switchable, keeping the Intel GPU active or only the discrete for max performance. It is important to highlight the necessity to switch between xorg.confs tailored for each card since only the kernel module is patched not the fglrx X11 driver (no source code). I doubt that ATI will release a switchable linux driver but who knows

It may be necessary to adjusts the xorg.confs for other systems. I have not prepared a script to switch the files for I have to switch the cards manually via BIOS config but fell free to optimize it.

 

Do you think Battery Care does not use EC to get info about battery?

 

maybe little crash_report.exe that only controls main process, and in main process little function that controls crash_report process?

 

Yes, that is the default solution. Full ack.

 

I never had problems running TPFanControl with BatteryCare. I'm not sure on this, but why would a Battery monitoring app need to access the EC? There must be APIs in Windows for that. Or if not, they would call the ACPI not the EC.

 

Ecxellent guide! It's a bit unclear however if one should add "Allow user to modify other modules" and "No SLIC" to the rest of the default marked options, OR if one should ONLY have "Allow user to modify other modules" and "No SLIC" marked.

The author to the Phoenix tool could change the defaults at will and then this guide would be obsolete or even hazardous.

 

"add" this to options leave the rest default !!!

btw. its a good idea to use the modded bios from this post

http://forum.notebookreview.com/ace...nix-bios-bios-mod-request-73.html#post6763651

 

Thanks, I will after I have confirmed the voltage increase to stick and have new OC values for the 5650.

EDIT: It did not stick, no changes in voltage. It did only mess up the bios so that I could not get any VDDC readings and no Powerplay. So, using RBE for upping voltage is useless.

 

Is it possible to make a tweak to change playback devices on the desktop? Like Fn + (random key).

 

It seems as though upping the voltage is going to be the hard part here, I changed the file name of
OPROM01.ROM to OPROM02.ROM and vice versa however once i flashed the bios, nothing had changed. the good news is it didn't Brick my lappie
Keep up the good work Lennong
We must be close to a breakthrough here

On another note,
@Prikolchik I think that a disclaimer applying to all guides contained in this thread would be a neat idea for the front page

 

@All

I still have not found proper way to work with EC under Win7.
So I've started investigation of Acer's KBCs for BIOSes 1.17 and 1.19.

And, seems, I found where FAN speed tables (several entries) are located.
For 1.17 (W07AC114.bin) - offset 0x1c05a.
For 1.19 (W07AC115.bin) - offset 0x1c162.

Not sure if it'll work if change that speeds (maybe there is some sort of CRC used), but think - this is more preferable way to control speeds than EC.

 

@prikolchik Can you write detailed tutorial how to enable lower brightness on Windows? Thanks

 

Could you provide a screenshot with short description? I have looked at W07AC115.bin offset 0x1c062 and don't see anything of interest.

I have not found an easy way to lower brightness on Windows when on Intel-only or Switchable graphics. You CAN lower brightness when on ATI-only card. You can do it by using RWEverything and in EC window select [0x84] register and write a value of 0x03-0x64 (3% to 100% in hexadecimal).
However, you CAN set to lower brightness on Windows if you have a modified BIOS with extra brightness levels added. I have created a test BIOS image and it works great. It needs further testing before I release it to the public. I want to add even more levels and Linux support too.

 

Wrong offset, sorry . 0x1c 162 is correct

 

About the fan control, what I found out is that it doesn't matter what BIOS version is being used, it's entirely dependent on the KBC.

On my machine I have the really annoying never ending sine-wave cycle on ATI fan, when I have KBC from 1.17 or 1.19. So I still have to use KBC 1.13 (no probs with BIOS 1.19). The fan controller was changed between 1.13 and 1.17. There is no difference I found between 1.17 and 1.19 (just from experience).

The fan controller from 1.13:
- makes a big noise when switched on
- controls fan in discreet levels, like 0,1,2,3,4,5

The fan controller from 1.17 or 1.19
- much more quiet
- doesn't make a big noise
- controls fans in smooth levels, there is a continous gradient between levels.
- has an infinite loop bug on my ATI fan

 

Ok. I'd asked several BIOS modding gurus and they've told me that it seems there is no checksum here. So this is unlikely that such modification could brick the laptop. But no warranties of course. Sadly I can't try this modification by myself mainly because of warranty policy in my country (it will take 3 weeks min to get notebook back ), so I need volunteer from country with better warranty policy (RMA, etc...) to test this BIOS modding.

I can provide test version. Anybody wants to try?

Here are two reasons why you need this comparing with software fan control:
1. FAN control software itself eats battery (I've measured +0.2-0.3W for mine, it could be less for others but still is)
2. Direct read/write Embedding controller could interfere with other applications doing same thing (e.g. Battery meters) which could lead to any unexpected behavior.

 

Please provide the test version with a list of changes enough to recreate the modded KBC from original. I want to know what I am flashing. 1.19 KBC. Thanks.

 

Could you send me your email in private message? Don't want to post test version here yet.

 

what is KBC ???

 

Which tool did you use to disassemble the EC code?

I think you haven't only take a look at the code.

 

I think KBC stands for KeyBoard Controller. If you download a BIOS update v1.19, you will find a KBC folder. The firmware file in that folder is what we are all talking about.

According to the pdf included in KBC folder, flupdate.exe is a Flash Update Application for programming Nuvoton EC (Embedded Controller) flash. Basically, what KBC folder has is firmware for a micro-chip that control fans, battery, brightness levels, etc. (see first page, 2nd post of this thread)

He did not disassemble the firmware. He just searched for the fan speeds (0xFF 0xD0 0xB6 0x9E 0x81...) in the binary file. He explains what he did right here.

Original EC firmware file W07AC115.bin (came with BIOS 1.19 update, you can download KBC folder here)

Code:

001c160: 7e7e [B]ffd0 b69e 81[/B]6f 6f6f 6fb0 [B]ffd0 b69e[/B]  ~~.....oooo.....
001c170: [B]81[/B]6f 6f6f 6fb0 [B]ffd0 b69e 81[/B]6f 6f6f 6fb0  .oooo......oooo.

As you can see, there seems to be THREE fan tables. I don't know why three, if there are only two fans in 3820TG.

For testing purposes, what _InKr_ did is change ALL fan speeds to max speed of 0x6f:

Code:

001c160: 7e7e [B]6f6f 6f6f 6f[/B]6f 6f6f 6fb0 [B]6f6f 6f6f[/B]  ~~ooooooooo.oooo
001c170: [B]6f[/B]6f 6f6f 6fb0 [B]6f6f 6f6f 6f6f 6f[/B]6f 6fb0  ooooo.ooooooooo.

Once it is confirmed that it is possible to flash to this modified EC firmware (since there could be a checksum that will not allow us to flash) and it DOES make fan rotate at maximum speed at all times, then it is possible to set different fan speeds and/or change when the fan kicks in.



We can make things a lot easier if we can somehow get the firmware source code (or at least assembly). We need to find a disassembler for our Embedded Controller firmware. I did some research, and arrived at an interesting thread here, by middleton. What he did was modify Embedded Controller firmware to swap Fn and Ctl key on IBM laptops. According to him in this post, we need to find the Embedded Controller's CPU model and then look for a disassembler for that CPU.

I could still try the hex modded EC firmware, but I would rather wait and see what middleton has to say. There just might be a more scientific way to mod the firmware.

I have already contacted middleton and asked him to help us in our noble quest.

 

I think you could add USB 3.0 with this

Mini PCI Express USB 3.0 Card - 2-port | StarTech.com

you would have to solder the port and replace one of the 2.0 ports on the motherboard though.

 

Actually I've contacted him too. He was the one of experts I mentioned above .
His answer is that he can't disassembly this firmware - custom module is needed for IDA Pro .
He also found that only bootblock is protected by checksum.

I've also asked kizwan and mask89. Mask89 did similar modification for 3810. There was no checksum there.

 

I think you could write a script or program to watch temp and fan speeds and intuit the temperature controlled switching points at least. Then you could program varying speeds, one set always on, one always very low, one in the middle. Just don't push the machine while it's running at medium / idle conditions, just enough to switch up one level. I'm just guessing on all this.

Wow, I would pay good money ($20 or so) to switch the CTRL Fn keys on my S10. Might go have a look.

 

Yes, you can. But we wanted to try and see if there is a solution to modify the EC to control the fan. In addition, on Windows _InKr_ had problems reading from EC, because he kept getting garbage values. There might be a better way to work with EC on Windows, but we just haven't found it. What we could also do is add the fan as a device (with methods that poll the temperature and then change the speed according to the fan table by writing to EC) to ACPI DSDT table and mod the BIOS or simply load the modded DSDT in Windows. That way we would have ACPI way to control the fans, and as far as I know it is much easier to communicate with ACPI on Windows than it is to read/write to EC directly. It might even work with generic fan control tools!

On Linux, it is WAY easier to work with EC and fan control software can be created simply by modifying a few of the existing scripts or programs. acerhdf module comes to mind.

OK, I see. You should have given more information in your post about who you contacted. That way I wouldn't spend so much time on researching what has already been researched by you.

Anyway, I gave your modded EC firmware a try. Here is what happened:
1. When I press Y to flash, my fans immediately went on FULL speed and my brightness was turned off (could only see the screen by pointing light directly on it)
2. All the LEDs started blinking with about 1 second frequency.
3. The message on the screen said flash was successful, so I manually restarted the computer. When it was off, for about 5 seconds there was very weird sound coming out of the computer near the GPU fan (sounded like static, maybe computer was hissing at me? ). After restart, fans were immediately on MAX and LCD backlight was back. LEDs kept blinking.
4. I flashed back to original KBC and all was back to normal. The flashing takes about 2 seconds.

I think we should try modding each of the three fan tables separately to see what kind of effect that will have. It does not seem like you can brick your computer by changing those fan tables as my experiment has proved. It could give you a scare though

On a side note, can you give me a formula that is used to convert temperature read from EC to Celsius? I want to try and see if I can find HDD, GPU and battery temperature in the EC.

 

According to middleton three fan tables here are most likely for different CPU types (eg. i3, i5, ???) in order to have different speeds for different CPUs. But do you mean both fans was run at max speed after flashing? In such case he is definitely wrong.
I'll try to modify tables one by one.
LEDs are really concerns me. I wonder maybe EC uses this method to indicate that something wrong with firmware?

There is no formula here. EC values from 0xA8/0xA9 are already temp in Celsius.
I also wanted to find Temp tables in firmware, but still can't find time to determine temps when Fan speeds are changed.

 

Yes, both fans were running full speed after flashing to modded EC. Different fan tables for CPUs doesn't make much sense, since in some models Acer puts CPUs other than i3/i5/i7 (P4200 or something?). Also, the fan speeds are all identical, so why store it in 3 places?

Yes, I think so too. Unless, one of those fan tables is not really a fan table, but has LEDs or backlight control or settings? It is highly unlikely, but it is possible.
Maybe it indicates that the firmware checksum failed?

Excellent!

I will try and look into it today, no promises though.

 

Well, I have 2 news: good and bad.

The bad is: there is a checksum. I have changed only one speed D0 -> FF and got same symptoms as yours: no backlight, LED blinks + no mouse . Was really scared .
But the good: it seems like to be a XOR. I have swapped D0 with FF from another table (first table became FF FF ..., second: D0 D0 ...) and all have flashed fine.

 

When did I tell you that the three fan tables in Acer's EC are for different CPU types. I haven't said that. Though it may be so. Acer uses the reference EC code from Insyde software. It's possible that Insyde created universal code for all different CPUs but Acer simply doesn't use this feature. Maybe Acer just decided to use only one fan table for all CPUs. But it's just my assumption.

By the way some Toshiba laptops have 12 fan tables in the EC firmware and all 12 tables are different. In this case the tables are definitely for different CPU types.

And just for your information: I've found temperature tables in Acer's EC firmware. I bet you can find it too it's very easy.

 

Why don't you tell and save us a huge amount of time?

Great! Do you know where that checksum is stored? We could do a hexcompare on v1.13 and v1.19 firmwares. They changed the way fan behaves, so maybe we can find where checksum changed?

 

I've found it only today and immediately posted information here. Search "THM01" string in the firmware. Right after that string you can find three temp tables. At least one of them is different. So if we put two and two together, then conclusion is the following:

There are three cooling strategies in the firmware for three different hardware configurations but Acer prefers to change temperature thresholds instead of changing the fan speeds (as we know all three fan tables are the same).

By the way, I can try to find the checksum if you wish.

 

Wow, thanks a lot! That makes sense. But why changing all 3 tables changed both CPU and GPU fans? Does that mean 1 table controls both fans or there is a separate table for GPU fan? We should probably test it more and see what table is active and what it controls.

Yes, can you look for checksum please? It is probably something generic.

In the pdf provided in KBC folder, it mentions that there is an option to dump EC firmware to a file. What if we flash to modded firmware with incorrect checksum and then dump it to a file. Would that give us a firmware file with a "fixed" checksum? I have a feeling it wouldn't, just throwing the idea out there.

 

Sorry. Have incorrectly interpreted your words. My mistake .

It would be great because this is some unusual XOR. Here is my findings:
This is orig speed table:
FF D0 B6 9E 81 6F 6F 6F 6F
1 step:
FF 9E B6 D0 81 6F 6F 6F 6F - Flashed OK
2 step:
FF FF B6 D0 81 6F 6F 6F 0E - Flashed OK
0E = 9E xor FF xor 6F
3a step:
FF FF FF D0 81 6F 6F 6F 47 - Flashed FAILED
47 = B6 xor FF xor 0E
3b step:
FF FF FF D0 81 6F 6F 26 0E - Flashed OK
26 = B6 xor FF xor 6F

Very strange...

 

I believe GPU fan has its own tables: I've changed all 3 tables with values above, but GPU fan still turns on with different speed (according to RW everything).

 

I've just found nine temperature tables:

Code:

1) 302B 3531 3A36 423C 5544 6253 6769
2) 2D28 322F 3A34 423C 4944 554B 585A
3) 302B 3531 3A36 423C 5544 6253 6769
4) 3C38 3F3D 4340 4844 4D49 574E 5C5D
5) 2B26 342D 3E36 4740 5049 5F56 6062
6) 3C38 3F3D 4340 4844 4D49 574E 5C5D
7) 2E2B 342F 3B35 463D 5448 6756 696A
8) 302C 3632 3E38 4640 5048 6964 6A6C
9) 2E2B 342F 3B35 463D 5448 6756 696A

And it seems that quantity of fan tables is above three:

Code:

01) FF D0 B6 9E 81 6F 6F 6F 6F B0 
02) FF D0 B6 9E 81 6F 6F 6F 6F B0
03) FF D0 B6 9E 81 6F 6F 6F 6F B0
04) FF BD A9 99 8C 7E 7E 7E 75 97
05) FF BD A9 99 8C 7E 7E 7E 7E 7E
06) FF 84 75 66 62 7B 7B 7B 7B B0
07) FF 84 75 66 62 7B 7B 7B 7B B0
08) FF 84 75 66 62 7B 7B 7B 7B B0
09) FF D6 B6 9E 9E 81 81 81 81 B0 
10) FF D6 B6 9E 9E 81 81 81 81 B0
11) FF D6 B6 9E 9E 81 81 81 81 B0

Maybe GPU fan speeds are in the additional fan tables.
Come on 3820TG owners, patch them all .

 

is possible to mod notebook.
When I open lid, notebook starts from hibernate, sleep, off state?

 

You are probably wrong. It's not XOR. Checksum is just a simple sum of all bytes. Let's see:

0xFF + 0xD0 + 0xB6 + 0x9E + 0x81 + 0x6F + 0x6F + 0x6F + 0x6F = 0x0560

0xFF + 0x9E + 0xB6 + 0xD0 + 0x81 + 0x6F + 0x6F + 0x6F + 0x6F = 0x0560

0xFF + 0xFF + 0xB6 + 0xD0 + 0x81 + 0x6F + 0x6F + 0x6F + 0x0E = 0x0560

0xFF + 0xFF + 0xFF + 0xD0 + 0x81 + 0x6F + 0x6F + 0x6F + 0x47 = 0x05E2

0xFF + 0xFF + 0xFF + 0xD0 + 0x81 + 0x6F + 0x6F + 0x26 + 0x0E = 0x0560

So we even don't need to find the exact place where checksum is stored. We can take an unused fan table and change bytes in it so that all firmware bytes would be summed to the original value.

 

Hmm, this really makes sense. But what do you think is checksum stored as BYTE, WORD or DWORD value?

I mean for BYTE checksum of FD+43+8E will be CE (01 CE), for WORD - 01CE, for DWORD - 000001CE.

 

At the moment I don't know for sure. There are several suspicious places that could store checksum but we should be 100% sure before trying to change bytes in such places.
I'll inform you here when I get positive (or negative) results.

 

Basic mod, and sorry if this has been asked before:

When I first read about the 3820 (then the 3820tg) well before it came out (i kept searching and searching until one day it finally appeared on google lol), I had originally read that there was some massive keyboard flex. Now, my keyboard has been nothing but sturdy, and I've always wondered what those people were talking about.. No flex in the middle of my keyboard, nothing. Is that because we have the 13.3" model? I'm not sure.

Nonetheless, I come bearing questions. I'm looking to ditch my stupid bilingual keyboard as I've had enough of the left shift key and the stupid symbols on my keyboard lol. How are the quality of keyboards from ebay? Are there any recommendations on where to buy from (maybe you bought from this person/store online and you're happy). And what about flex? I'm still unsure about this whole flex issue and if it even exists, but I ask anyways because hey, you never know.

Cheers.

I know it can't be done from the off-state. The sleep/hibernate lid-open doesn't work with the acer, unfortunately. Or at least not mine. Apparently it's a bios option, but not built in to our acers. I wonder if anybody has figured this out..? I've been curious too.

 

Could be done if we able to compile code for the EC, but not at the moment.

Or just hardwire the function.

 

I've checked versions W07AC110.bin, W07AC114.bin, W07AC115.bin. Insyde's code part (from 0x8000 to 0x20000) is definitely checksummed because this part is always summed to 0x5C in all three versions. So in our case, checksum is a BYTE value.

I suspect a byte at offset 0x8012 to be a checksum. After modifying the firmware we have to change the byte at offset 0x8012 so that all the bytes from 0x8000 to 0x20000 would be summed to 0x5C.

But you have to remember that all I said above is only an assumption. If you decide to make this modification, then you'll do it at your own risk. I can't guarantee on 100% that 0x8012 is a really checksum.

 

Yes, I confirm: this is BYTE sum. Which means that it is not so important where checksum actually is: any unused BYTE (from speed tables, for example) can be used in order to get checksum back to 0x5C value.

@all

So let us state that initial research part is over. Now we need to investigate which exact temp/speed tables are used in our laptops in order to modify only needed tables.

For speed tables it is relatively easy, just set all speed tables, for example, first 4 values to noticeable markers, e.g. first table: FE, FD, FC, FB; 2nd table EE, ED, EC, EB, etc...
*Don't forget about checksum

Flash resulted EC firmware. Then open EC view in RW-Everything and play with battery/AC power, Active/Passive cooling policy (in Advanced Power Plan options) and check in RW-Everything what markers are showed for what mode.

For temp tables - utility is needed which will allow us to change CPU/GPU load for any required level 0..100%. Any suggestions? If no - I can try to write such, at least for CPU (hopefully - new week).

 

Anybody care to share their keyboard mod experiences?

 

Just a few lines of informations.