M18x Unlocked BIOS Modification Info

Hmm? I didn't say that you added SLICs.. I was referring to the program written by AndyP, which is focused on adding/replacing SLIC module from BIOS. I am working on a similar program, but focused on modifying menus and options rather than SLIC addition/modification.

It wasn't clear that you unlocked the BIOS from your post, I understood the opposite in fact, that it was someone else. That's why I asked to speak with them. But it is now that you made it clear, thanks.

Anyway, could we please leave that drama in the past, that particular domesticated equine has already been bludgeoned repeatedly, and doesn't deserve further!

My question was about a pointer to the VSS table in BIOS, not SLIC...

Hopefully the information about EC FW will be helpful to determine part to modify, thanks! Anything with the BIOS requires alot of time and effort, that is for sure

 

@ahmed hossam
Why don't you give to Da_G a way to contact your contact, or a way to your contact to contact Da_G ?

Thanks to everyone here that working to gives the full control of our loved hardware

ps: my English is bad too

 

that was to me da_g. about the slic stuff...

looking at this untouched a00 bios...i noticed that it only used the a and b bclk(populated - untill you unlock the options in the bios). so im wondering if that is attached to something else some where else.

 

DA_G , this reply was for johnkss as he said ( but adding modded slic's to bios is not nda approved.
that's why i said what i said. (i apologize for that) )

you didn`t say anything about slic and i understand your reply.............. you misunderstood this as the reply wasn`t for you .

and yes , i have learned the method , then i have unlocked the 18x myself .

my reply to you was in post 202 .
i will give you more info. about the EC FW tonight .

 

johnkss , can you post a link to the untouched a00 bios then i can look into its EC FW later time today !

 

Oh, oops! Sorry, I mentioned SLIC in my post also so it wasn't clear that you were not replying to me Ahmed, I posted before I saw your second reply

Interesting! Maybe BCLK_C is only set after manually toggling the option in the BIOS. It should become more clear after I finish dumping the forms in SetupUtility.

I would just modify the python scripts to work with the m18x BIOS and dump the SetupUtility, but there is so much hard-coded there that should be able to be determined on-the-fly, instead of hard-coding values specific to each model and BIOS revision. I decided to re-write it in C++0x instead. I'm much more comfortable with C than python anyway, so less likely to make mistakes

The SetupUtility has a very easy to understand flow of logic, comparing the forms from A00 to A03 should easily reveal why that register differs. Take a look here if you want to see how the SetupUtility logic flows (my program will generate a similar output to this)

 

sure. ill dump it in bit.
bios version A00
ec version 1.00
me version 7.0.4.1197
http://www.say-it-loud.com/m18xr1.bin
dumped using insyde bios utility
file size is 4096kb for this

 

Thanks Johnksss, much appreciated!

 

no problem..
side note:
just noticed this...and i haven't flashed anything yet.

 

Interesting, looking at the setup and setup default values, both are set to have that register locked, but it's showing unlocked, that's odd!

@Ahmed, you mentioned using IDA, does it support reading out of the EFI_IFR forms?

I'm working on adding support for reading out the formsets right now to my app, but it would be a waste of time if IDA supports it already Or did you just use IDA for the x86_64 instructions part and not the EFI IFR forms?

 

Finally thanks Johnksss +rep

 

In the ThrottleStop Power Limits window, if Enable Limit is not checked, what turbo power limits does the CPU use? Does it use the default limits for the CPU or does it totally ignore this value and give you as much Turbo Boost as you like? Just curious.

 

Da_G , i have never checked the EFI_IFR forms , i only used the IDA for the setup module disassembly then i edit it using hex edit .
you can check the full intel UEFI documentation for it and it will be very useful for you ( i can upload it if you didn`t find or you can directly download from intel website ) ............ i hadn`t alot of time to read this documentation but i kept it in my notebook to make it like a refrence if i faced any problem .
but be sure to download ver 0.92 as its for INSYDE .
i will help you in developing you tool soon , but first i`m working on the EC FW
i will upload some pics and information about the EC FW which will greatly help us in the mod in few hours .
i will upload it in the 3 threads :-
DELL M18X A03 BIOS THROTTLE REMOVAL GTX580M SLI

http://forum.notebookreview.com/ali...tal-has-been-unlocked-modded-a03-bios-15.html

http://forum.notebookreview.com/alienware-m18x/605380-m18x-a03-bios-modification-infos-22.html

just be patient i`m writing the post now

 

Hi ALL ,


-- i will discuss the throttle problem now and all solutions available for it .
please read this post carefully to ba able to fix your problems .

1 ) For increasing the fan speeds , you have these solutions :-


a ) using the HWinfo tool to controll fan speeds .
b ) disassembling your note book , then you can find the fan connectors has 4 or 3 wires
there is GND , + , - , Smart fan .
you should remove the smart fan wire from the connector ( don`t cut it , its just could be removed and connected again if you needed it ) but this solution will put the fans in 100% of its speed all time then you will not reach the throttle temp too

c ) using the DSDT modifying solution ( will be dicussed later )

D ) using the EC FW modifying solution ( will be discussed later too )


2 ) For the throttle problem , you have these solutions :-

a ) Finding the flag controlling throttle in DSDT and replace 1 with 0 .

b ) Finding the routine controlling fan speeds and throttle as well then modifying it .

----Now i will explain the DSDT modification solution :-
the DSDT is the Differentiated System Description Table .
it`s found in the system registery in windows and could be extraced then modified and replace the original with the modified one , refer to this thread for info about extracting and inserting DSDT How to Reduce Fan Noise on HP Notebooks
i have requested all ACPI tables from BARCODE and he uploaded it along with the EC RAM VALUES ( taken from the RW report ).
if you EC-RAM ( taken from RW report ) you can find these values or small different one :-





then you should knew what these values mean to edit it ........... open the DSDT.RW file in notepad ann search for EMBEDDED CONTROLLER then you find it like in this pic :-




and find all fans controlled via values ( flags ) infront of it , like thiS pic :-



you can edit these values in the DSDT and the EC RAM as well ( insert the new EC RAM values using RW REPORT )

how can you knew what you are modifying in the EC-RAM and why !

you can find all offests in the EC-RAM region in the DSDT like this pic :-



The next value will be in the next offest .
tmpi at AB and so on .

and some values ( sometimes all values ) must be edited in binary like these pics :-








convert the hex number to binary like this 0100010
every bit from the previous numbers ( 0100010 ) is a flag for an option or special setting or even reserved .
in RW you can show the binary value and edit it ( manually , you should convert the value like 8 into binary numbers ( 0 and 1 ) then edit the binary and convert the new modified binary into hex to be a new value like 7 or 6.....etc )


there are alot of words like FASN , CPUT ........etc that we should guess the meaning of it to edit or just try editing it and test what will happen then as i`m sure the throttle option is there .



also here is the FAN SPEEDS inside the DSDT table and you can easily edit it :-



convert hex to dec to knew the real value :-

64 ------> 100%
3c -------> 60%
0c -------> 12%
18 -------> 24%
24 -------> 63%
30-------> 48%
48-------> 72%
54 -------> 54%

you can easily modify these values and control fan speeds or let me knew if any one want to insert the modified fan speeds inside the modified bios .

NOTE : The modified DSDT which will be inserted into windows is removed when installing new windows or just recovered the registry using back up will rewrite the DSDT too .

3 ) concerning the A00 bios , this bios didn`t include the EC FW inside it unlike the A02 and A03 , sothat i guess it will not work for you and you will need to make a blind flasah after it ( if any one can test it and share the result )
i will make some modifications into the A00 now and upload it .


All the previous pics are taken from the DSDT and EC-RAM for the A03 bios , thanks for barcode who uploaded these tables .

 

Stay away from Gotham's if its still called that.

 

This is great stuff man! + rep for you sir!!

 

Hi Ahmed,

I noticed in the screenshot where you talk about fan speeds you have _BCL method highlighted, isn't this ACPI Query Backlight Control method?

These values should be {when on AC power, when on batteries, {all other supported backlight values} } rather than fan speeds, per ACPI specification: http://www.acpi.info/DOWNLOADS/ACPIspec-2-0b.pdf

On another older dell machine (studio XPS 16) I had I had to fix DSDT _BCL, _BCM, _BCQ methods for proper backlighting control on linux.. wouldn't target methods for modification be something like _CRT, _AC0, _AC1, _PSV? Except those methods are for CPU fan control, does ACPI support similar for GPU?

Thanks for info about IDA, I am not wasting time writing EFI disassembler then, good to know

 

ahmed_hossam, thanks for your work here. Re throttle, we are getting close. I noticed on the other forum Mumak's idea to implement throttle control into hwinfo, if found. That's excellent. Couldn't be easier/more handy.

 

I`m sorry , the uploaded pic for fan speeds is the wrong one...........this was for the the back light control ( query list of brightness control levels )...........the real fan speed list will have both 0x0 and 0x64 levels as these two speeds will work as buffers .

any one can remove the smart fan wire from the connector and then the fan will work on only two status 0x0 ( 0% ) and the 0x64 ( 100% )

the right pic will be uploaded soon and it hasn`t got the fann speeds , it`s just flags for the fans in a routine ( not in the EC region )

- also , has any one flashed the A00 bios and confirmed that it worked !! it seems like it didn`t contain the EC FW and will not work properly .

-- i need some time to work on the DSDT and the EC FW at the same time , i will upload some information now if any one can help or has any idea about it .

 

Thanks Ahmed, _BCL pic really confused me, i thought maybe Dell was trying to hide fan control in some really odd place

A00 BIOS dump flashes correctly (you are right that it contains no EC, the InsydeFlash tool does not dump EC section, only flash it)

I'm around if you'd like another set of eyes for the EC infos.

BTW - I really think ACPI DSDT would have no bearing on (GPU) fan speeds, only perhaps CPU, as there are no established ACPI protocols for GPU control, only CPU control. And for CPU, we have full control over throttling triggers and thresholds now from unlocked BIOS and access to registers. I did some minor testing with DSDT modification in Linux and did not observe effect from modifying thermal trigger thresholds for CPU, I suspect control is also handled by EC for this as a result.

Current problem lies with GPU throttle, and only with 580m part (that I unfortunately do not own for testing), which I suspect is wholly controlled by EC, with ACPI playing no part. So I think looking elsewhere than DSDT is advised for this issue (EC).

 

the DSDT contains flags for enabling and disabling throttle , active cooling , passive cooling , critical temps ,..etc ( all these options aren`t in the EC-RAM region in the DSDT but its under GNVS system memory region.......and i think all of these flags will be for cpu .
But there are alot of thermal and throttle flags and for fans as well under the EC-RAM region in the DSDT ( i think this control both GPU and CPU fans and throttle as well )
i will upload a modified DSDT and modified A03 bios as well that contains modified values in the EC-RAM region for test............this way i will be 100% sure if modifying the DSDT will make changes .

-- i have commands which controls throttle and fan speeds as well in most of EC FW but it requires writting a device that access i/o ports and give the command..................only the HWINFO tool can do that.........so , it will be up to Mumak to do this .
but now i will need someone with the 580M to try the modified DSDT and A03 bios as well .

 

The methods you mention in DSDT for throttle, active cooling policy, etc. Are all definitely for CPU and related thermal zones, I have modified these parts before. This will have no bearing on GPU throttling, except if GPU throttle in EC reads from DSDT GNVS at run-time to determine throttle status (i doubt it)

However ERAM region is probably deployed at boot time to EC, so here would be potential target for sure.

Did you try yet to disassemble EC FW in IDA? There should be a method there that reads from GPU thermistor and sets throttle status accordingly. The proper register to modify should be deducible from that disassembly.

If we approach from modifying registers first and observing effects method, it could be dangerous for a tester!

BTW, I don't think we have to bother Mumak to write to EC, RW Everything should be capable to write direct to registers without problem.

 

The EC FW disassembly will be very hard and will take alot of time and effort , so that i will begin with modifying the EC region in the DSDT as i`m sure this controls throttle and fans .
also the fan for the GPU is put on the D1 state in the DSDT it`s not on the D0 state ( means in operation ) .
in the upcoming mod i will modify alot of things in the DSDT , just be patient i`m working on it now and will be ready in few hours.

 

Sure, but EC RAM modified this way may not disable throttle, if for example, throttle activation is determined at real time reading from GPU thermistor, with a bool never being set in register for throttle toggle.. in that case method would need to be patched in EC FW to block throttle, and EC-RAM modification wouldn't have effect. So, in that case disassembly is required anyway. But yes, trying to blindly modify is much easier to start, but so dangerous with EC i think, what if some register controls a voltage and becomes set wildly out of range, for example

Also, like you say GPU fan starts at D1 state, later is triggered to D0 on thermistor reading, modifying that value wouldn't have some effect either, except at very early bootup time.

But, good luck, be sure to document well which registers are modified for which test, it will be complicated Do we have some documentation on EC chip to give us a good start?

BTW: do we know address for EC I/O?

 

BTW in that image:



from 0x10 to 0x0C is clearly visible ASCII "DELL V48RM14B" - and our battery is V48RM. Comparing ERAM register contents in ACPI DSDT to my current values in EC RAM region don't seem to match up correctly at all. However it may be that initialized values are quickly overwritten by routines in EC FW.

But then, at a closer look, it appears you modified those values in the ASCII text to new values in your screenshot, rather than incomplete dump, so now part of that string is gone. But why? I don't think that string would have a bearing on GPU throttle?

For comparison, here is my EC RAM with battery:



Without:



Offsets 0xB4, 0xB5, 0xF0 change on each reading when not on battery. Some more offsets change on each reading when on battery in addition. Looking at values, some is voltage, some time charging, etc. - So here are many values that can immediately be eliminated from potential candidates

You see there 2 values marked 100 without battery at AC and BD.. check what those are mapping to in DSDT ERAM section..

Some more captures from on/off battery from owner of 580m and also off battery with throttle active/inactive is all that should be needed to pinpoint the proper flag(s), i think..

[Edit:]
Thinking more, for EC-RAM modification in DSDT to work, means throttle must be a constant. Or else as soon as EC routine attempts to toggle throttle status would overwrite, rendering the EC-RAM change ineffective..

So really, analyzing these screeenshots our pool of canidates is very small, if we assume NULL to be out. (Since likely the throttle would be a bit set to 1 not zero) - also assume the ASCII values for battery name to be out.

So that leaves us with 0x02, 0x07, 0x0B, 0xA3, 0xA4, 0xA7, 0xA8, 0xAB, 0xAC, 0xAD, 0xB9, 0xBB, 0xBC, 0xBD, 0xC1. By process of elimination all other non-zero, non-ASCII registers have a variable value, eliminating them from possibility of success using this method. So user of 580m could try toggling bits in these offsets of EC-RAM during throttle behavior to determine offset. Wouldn't take so long, only a pool of 15*8=120 candidates. Assuming you would toggle 1 bit every 5 seconds (don't go faster to allow EC and GPU to react) - that's only 10 minutes of testing to find a bit that can repeatedly toggle throttle behavior on and off. It's nothing, who volunteers (Again very dangerous to directly modify EC RAM, danger will robinson)

 

the values under the EC-RAM region is the only one responsible for throttle and fans for both GPU and CPU ............. i will only edit this not the system memory as values in GNVS region is for CPU .
and i have not edited strings in the pic , i just clicked compare ec to load EC FW into my RW report .
also you should knew ( this is from Mumak to you ) :-
1. RW-Everything won't help you, since it can only read/modify EC RAM region. The command for fan/throttle control are different to EC
2. The readout of EC you posted is from MOBO EC, there's no other EC in system. The reason why you see battery info there is because it's common that the EC performs battery monitoring too

 

Yes I changed that info in post edit, see again

I thought you were targetting to modify ERAM rather than by sending CMD to EC? At least I understood that from this post and that post. You think instead ERAM region of DSDT is a command buffer sent to EC for initialization? Do we have documentation for the part? Looking to your post again, I am sure you are talking about setting registers in the EC-RAM and not sending the EC a command? Is your target modification completely unrelated to the screenshots? I am now very confused.

Oh, you used compare EC function rather than load, now that screenshot makes sense why so much differs. To what machine were you comparing? And what EC in it?

 

We have 2 documentations for this now :-
ACPI documentation ( you have posted it and i have it too )
ene EC documentation ( Mumak has posted it before in the thread @bios-mods )

i have read few parts of the ene documentation and i can edit the fan speeds but not the throttle ( i have to read more to knew how to edit throttle )

but now i modify the DSDT to test if it will change anything then i will modify the ECfw .
infact , yes the ECRAM region works as buffer in the but for special ports not all i/o ports ( only 0x80 , 0x81......etc )

 

I'm still confused. Here Mumak says:

RW-Everything won't help you, since it can only read/modify EC RAM region. The command for fan/throttle control are different to EC

Seeming to mean that the EC-RAM region we see in DSDT and RW-Everything EC RAM readout won't have an effect on EC throttle/fan function.. which I said in an earlier post, I think we'd have to diassem EC FW for it. But you are modifying DSDT, which is why I am confused I guess, if DSDT EC-RAM section is not a command buffer, why are we looking to modify that? it seems Mumak concurs..

 

I`m doing this as i have seen people modified fan speeds through editing the DSDT so i thought it will be possible to disable throttle too.

and don`t be confused i will begin modifying the EC now and i hope you will help me as it will be difficult

 

Sure, of course

Do we know what instruction set the EC is using? I haven't yet had a chance to read the whitepaper other than a quick overview where i saw 66h/62h as the default port which matches with RW-Everything EC RAM readout, I will do so tonight.

First thing we need is entry point, I see it uses 8051 CPU, so we know IDA supports that instruction set well. Do you see anything in datasheet to indicate a possible entry point/ram loading offset?

BTW: It would be helpful if we had a structure for Insyde BIOS, so we can easily separate only EC firmware from rest of BIOS Binary BLOB. Do we have this information?

Probably starting jump and memory offsets along with other initialization params are in a header near the start.

 

BTW - 2 of the hidden options control if a device is exposed or not,

Thermal_Monitor and CHAP_Device
PCI\VEN_8086&DEV_0103
PCI\VEN_8086&DEV_0107
Anyone aware of drivers for those?
First one shows up on a russian site as "Sandy Bridge Thermal Management Controller" - no mention of the other.

 

The EC fw is always the first 128KB of the bios file and you can easily seperate it

I have never disassembled any file using 8051 instruction set and this is the first time for me
i will post more information tomorrow as I'm outside today , I'm sorry for this and I'm using mobile now

I found the fan control routine but I'm searching for throttle and i knew its in the same routine but haven't got time to complete as i had to go outside the city yesterday and will return tomorrow .

 

Stupid question, but do I go into the RAR file and launch the InsydeFlash64.exe?

I did so and the flash window came up so I am assuming this is correct, just to be sure.

Thanks.

 

Hi All ,

i was free for 2 hours and decided to make something for test

try this modified A03 :-
- Modified EC FW for fan speeds ( fans should run at 4000RPM at fixed mod and one should run at 4000RPM in automatic mod )
- kept menus and options unlocked .

try it and it and i`m waiting your reply

http://www.mediafire.com/?thk6q2aenca1qxm

 

will give it a try

 

well, just bricked the bios.

 

Ouch! USB recovery should work as the bootblock should still be intact.

 

JohnKss , no problem.....just recover using usb stick and it will boot normally again...............also , have you flashed with the modified flash ( attached with the modified bios ) or using the original one .

Da_G , have you discovered anything else about throttle the EC FW !

 

Hi ahmed,

Well I read through the whitepaper, but it's not so helpful with the firmware modification. I haven't looked further into the disassembly yet as this is a long weekend for me (holiday in USA), i'm taking it easy, i'm actually sitting in my back yard on my m18x cooking a BBQ listening to pandora one

I probably won't get a chance to look further into monday. Sorry, but we have to take some time out to enjoy our fancy unlocked systems sometime, right?

BTW: I recommend pulling that version of the modified BIOS until we can determine what's wrong. Suggest a comparison vs. stock A02 BIOS to check if EC FW was altered between A02, A03, if so look for a checksum in the header and footer of both over-all BIOS and just EC part. Could be that failure was due to simple checksum failure.

 

where might these files be at?

 

There's a dedicated thread posted to the USB recovery method, also here in this thread somewhere,

Basically you get a USB stick, format it FAT32,

Copy stock bios.fd to the root of the drive, named a certain way (something similar to PARMECx64.fd, but not that exactly, the post has it)

Then you power off completely (no battery or AC) and power on while holding down a set of keys (the post has that too)

That'll kick the system on and the BIOS into recovery mode, and it should automagically flash the BIOS from the copy on the USB stick and be up and running.

 

can i ask , the 18X has got 2 fans or 3 !!
and whats the max speed for them , is it 4000RPM !

 

I'm not sure on max speed as i've never monitored it, but there are 3 fans, 2 GPU fans and a CPU fan. Not sure what happens in a single-GPU configuration as I don't have one!

 

the PDF shows only how to control fan0 and fan1 ( only 2 fans ) and i think we have to find fan2 ourselves

 

GPU fans spin at 3900 max, I think. The sound does not change when I set higher value with hwinfo.

edit: note that hwinfo isn't exactly accurate about the fans readings and also confuses the CPU fan with the GPU fans. At least it seems so.

 

One of those is prolly the CPU fan. The other is valid for both GPU fans at once as they both turn on/off or kick into higher gears at the very same temperature thresholds.

 

Thanks a lot 0x28A for this confirm
So , the modified bios worked for you with max 3900rpm .
I have moded it to be one at fixed speed and the other at automatic , can you tell me which one worked at fixed speed .
also whts the changes you have noiced in this bios. Comparing to the original.

 

Correct me if i'm wrong, but I think he's speaking to stock BIOS (stock as in non-modified EC FW) rather than your recently posted modded BIOS, as that resulted in a brick?

 

still bricked at that