Overclocking extreme CPU without BIOS options?

Final update:

Seems there is a quick and easy way to do it, see this:
http://forum.notebookreview.com/acer/489140-how-unlock-core-2-extreme-multiplier-windows.html


_____________________________________________________________________________________

Update:
User Darth_nVader has found a way which should work, see the following posts:

http://forum.notebookreview.com/showpost.php?p=5640922&postcount=42
http://forum.notebookreview.com/showpost.php?p=5646001&postcount=47




---------------------------------------------------------------------------------------------------------------------
Hi,

I was hoping to buy an X9000 or X7900 or X7800, but I know there is no multi settings in my BIOS.

So is it possible to increase the multi of these CPUs with software (crystalCPUID)?

Also, does anyone know the maximum supported multi of these CPUs?

Thanks

EDIT: How can the X9000 have the same TDP as the X7900 and X7800?

And why would someone buy the X7900 if you could just OC the X7800?

 

I've been thinking of this too, as may Bios does not have support for changing the Multiplier of an Extreme CPU.

I've not found any reports of Software that can change the Default Multiplier.

One way could be, write the Multiplier and voltage you want to the IA32_PERF_CTL MSR(I'll have to look up the address).(0x199h)

If someone with an 7800/7900 or X9000 could Read the Value of the IA32_PERF_STATUS MSR, that would tell us if it could be done this way.

It's a 64bit Register @198h and would be something like x06130B2406000B18

0x0613 <--Boot Up Ratio(0x06) Volts (13 I'll have to look up the Math, but it's the same as SpeedStep).

0x0B24 MAX Ratio (0x0B = 11) Max Volts (24)

0x0600 Min Ratio (0x06) Some stuff that won't matter (00)

0x0B18 Ratio and Volts your CPU is Running at NOW.(You Write the Value you want to the IA32_PERF_CTL MRS and this value should change).

 

Not that I know of, Moral. I have tried using Crystal's and as far as I know it wouldn't work for most notebooks. The only way is through BIOS settings or SetFSB. But still in most cases, it doesn't work for all either. I know I can see that you've done what you can.

Perhaps the X9000 is well known for the appearance in the M1730. I have it, and it goes up to 3.4GHz via BIOS overclock.

As for why there the X7900 and X7800 exist, can't really answer directly but I guess this is perhaps where marketing tactics comes in; X7800 @ 2.6Ghz, and X7900 @ 2.8GHz. X9000 same clocked as X7900 but has a 45nm prefab, thus it runs cooler than the two.

The X9000 has a highest multiplier of 17x, which will be clocked to 3.4GHz. At stock 2.8 it as a 14x multiplier.

Also not every one of the same chip can run stable at an overclocked speed.

 

Interesting, you can use crystalcpuid to edit the MSR. I believe you have something there, definatly worth trying.
I guess that even with the default 14x multi you can still get far (just put the FSB to 285mhz and you have 4ghz).

I will watch ebay to see if I can find a cheap one, hopefully your MSR trick works

Thanks for the info, just what I was looking for

Maybe you can tell us what your MSR value is?

Very nice, I hope that it isn't too hot at 3.4

Again, great info, just what I wanted. +rep

 

Haha, thanks Moral

Erm, to be honest, I do not "study" computing, (Laptoping is just my hobby anyway, not the extreme like what you do) so I have absolutely no idea the MSR value or how do I go about finding it? LOL. How do I access the value? And what does it actually do? Thanks.

EDIT: Well actually my highest temp recorded is just 75*C @ 100% load for 5 hours straight rendering a 3ds Max scene. So quite cool actually. Undervolted and I got 65*C max. The BIOS settings for the fans of the M1730 is set to run at max RPMs when the CPU is OC'ed to 3.2 - 3.4GHz

 

If you would Down Load MSR Tool, put 0x198 in the bottom field and click Read.

That should give you some values for each Core, please post that.

Thanks

 

I was hoping Darth_nVader could find the address and all you would have to do is use crystalcpuid to read it, should be really simple.

Not quite sure how it works yet, I will read up on it.

But just reading the value shouldn't cause any problems, though changing it may...

That is quite cool.
My T8100 was 75C when it was @ 2.7ghz and I thought that was ok.

 

Here ya go, good luck guys.

 

On the X7800/X7900: The X7800 came out first. At the time, the fastest mobile chip was the 2.4 GHz T7700. The X7800 is 2.6 GHz; the X7900 followed a very short time later (5.5 weeks according to Wikipedia, which seems about right as I recall) at 2.8 GHz and the same price the X7800 had debuted at, with the T7800 at 2.6 GHz not long after. Perhaps Intel was able to get more top-bin chips than they expected, and thus quickly increased the default clocks on their top-of-the-line, and added the T7800 as top non-extreme. Either way, the X7800 and X7900 should be essentially equal if you can overclock both. Maybe a slightly better chance of reaching higher clocks on X7900, maybe not.

 

Thanks SomeFormOFhuman for the screenshot

I'm wondering if it's even worth buying an extreme CPU even if you can change the multi. Because you can overclock further if you keep the multi low and the FSB high, you need less voltage to be stable.

The T9500 is about the same price as an X7900.
I have seen a T9500 at 4ghz, but the X7900 only at 3.4:
http://valid.canardpc.com/show_oc.php?id=270271

Is the X7900 worth $230 or is it better to go for a T9500?
I see they are both the same price on ebay.

EDIT: Can anyone with an X7800 or X7900 tell me what voltage they run at (3ghz+)?

 

Thanks, that seems to show:

0x0617<--Boot Up Clock(Ratio 6x Bus) and Volts

0x113C<--Max Ratio 0x11h = 17x Bus and Volts

So, writing this (00000000 0000113C) to the IA32_PERF_CTL MSR (0x199 in MSR Tool), should change the ratio to 17 x Bus Speed.

However, if your using Intel SpeedStep, it won't stay that way unless the CPU is under FULL LOAD.

Best to make sure your P-States define the Max Multiplier and voltage you would like to use, a DSDT override should work fine.

It seems that RMClock should be able to do this???

SomeFormOFhuman, if you get time, would you be so kind as to read the IA32_PLATFORM_ID MSR.

Put 0x17 in the MSR NUMBER field and click read.

 

Would this work for the QX9300?

Here's the screenshot:

 

ScreenShot not showing up for me.

 

It should be there now, I just switched to Imageshack.

 

I'll need to put 0x198 in the MSR Number Field and Click Read MSR.

 

Is this good?

 

For the first three Cores that seems to show the Ratio Max of 10.5 x Bus (4A)

But, for Core 3( The 4th Core), it only shows the Default speed of 9.5 x Bus(49)

So, I'm not sure, maybe 3 cores can be set to: 266.7 x 10.5 = 2800Mhz and the last Core would run at 2530Mhz.

It looks like maybe bad news, Intel's Extreme Tuning Utility

It seems the QX9300 should be able to go to 3700Mhz, so more research is needed.

Note for 1/2 Multipliers setting Bit 14 = 1.

So, if someone want's 8.5 x Bus (0x00000000 0x000048zz) where zz = Volts

 

That may be Speedstep at work, the values fluctuate between "0x061B4924" and "0x061B4A2E" every time I refresh it.

 

So, the Data in the EDX Field is Changing?

If so, that maybe good, seems the QX9300 has some changes.

Read 0x17 in MSR Tool and post that, please.

 

Looks like 9.5 x Bus EAX 0x90D4 4924.

It's going to take more research for the QX9300, Intel's XTU maybe ups the FSB.

When you Read MSR Number 0x198:

 

Yes, the EDX values change with every read.

 

That is odd, so I assume your QX9300 runs @ 2530Mhz and you can't change it via the Bios?

I could tell you how to test to see if you can change your Multiplier if you like.

 

There's no options at all in the BIOS, for changing multipliers or overclocking.

You know of an alternative way I cant attempt to change the multiplier?

 

Something odd I've noticed: For whatever reason, my QX9300 occasionally jumps to a 10.5X multiplier for a brief period of time.

Is there any way to keep it there?

 

Is it IDA?

 

I'd say yes, IDA Mode.

Bad news for the QX9300, you'll need Bios support.

Here is a link to the Correct XTU for QX9300, you can try it, however it won't work unless your Bios supports it.

SetFSB maybe the best way if XTU won't work.

 

Just tried XTU, seems it doesn't work, looks like I'll have to go the hardware route.

 

I have a X9100 on gateway p7811 FX.
The bios do not allow to change my multiplier.
With crystalCPUID, i tried to push x12 instead of x11.5 (the default).

Result is a BSOD or computer freeze
Do you think that MSR stuff can do something good ?

 

Some nice information about MSR:

http://blogs.koolwal.net/2009/09/19/howto-using-cpu-msr-tools-rdmsrwrmsr-in-debian-linux/

 

As I understand it, the MSR @ 0x198 is for Intel SpeedStep, most OS's read the P-States from the ACPI Tables of your Bios, so changes to the MSR won't last. You'll need some software to Override/Control SpeedStep or OverRide/OverWrite your ACPI Tables with the P-State's you want to use.

I use a BootLoader that can OverWrite the ACPI Tables, I edited my DSDT so I could define the P-States I want to use for SpeedStep( HP's Bios had 3 P-States defined in some of the SSDT's), I wanted to use 6 P-States and it's just easy for me to edit the DSDT for this:

Code:

Scope (_PR)
    {
        Processor (CPU0, 0x00, 0x00001010, 0x06)
        {
            Name (_PPC, Zero)
            Name (_PCT, Package (0x02)
            {
                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x10,               // Bit Width
                        0x00,               // Bit Offset
                        0x0000000000000199, // Address
                        ,)
                },

                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x10,               // Bit Width
                        0x00,               // Bit Offset
                        0x0000000000000198, // Address
                        ,)
                }
            })
            Name (_PSS, Package (0x06)
            {
                Package (0x06)
                {
                    0x0722,
                    0xF9D4,
                    0x0A,
                    0x0A,
                    0x0B18, [COLOR="Red"]<--My MSR says max Ratio of 11(B) and Max Volts 24, but my CPU Runs too hot so I lower the Max Volts to 18[/COLOR] :D
                    0x0B18
                },

                Package (0x06)
                {
                    0x067C,
                    0xDFC3,
                    0x0A,
                    0x0A,
                    0x0A17,
                    0x0A17
                },

                Package (0x06)
                {
                    0x05D6,
                    0xC65E,
                    0x0A,
                    0x0A,
                    0x0916,
                    0x0916
                },

                Package (0x06)
                {
                    0x0530,
                    0xADA5,
                    0x0A,
                    0x0A,
                    0x0815,
                    0x0815
                },

                Package (0x06)
                {
                    0x048A,
                    0x9598,
                    0x0A,
                    0x0A,
                    0x0714,
                    0x0714
                },

                Package (0x06)
                {
                    0x03E4,
                    0x7E36,
                    0x0A,
                    0x0A,
                    0x0613,
                    0x0613
                }
            })
        }

        Processor (CPU1, 0x01, 0x00001010, 0x06)
        {
            Name (_PPC, Zero)
            Name (_PCT, Package (0x02)
            {
                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x10,               // Bit Width
                        0x00,               // Bit Offset
                        0x0000000000000199, // Address
                        ,)
                },

                ResourceTemplate ()
                {
                    Register (FFixedHW,
                        0x10,               // Bit Width
                        0x00,               // Bit Offset
                        0x0000000000000198, // Address
                        ,)
                }
            })
            Name (_PSS, Package (0x06)
            {
                Package (0x06)
                {
                    0x0722,
                    0xF9D4,
                    0x0A,
                    0x0A,
                    0x0B18,
                    0x0B18
                },

                Package (0x06)
                {
                    0x067C,
                    0xDFC3,
                    0x0A,
                    0x0A,
                    0x0A17,
                    0x0A17
                },

                Package (0x06)
                {
                    0x05D6,
                    0xC65E,
                    0x0A,
                    0x0A,
                    0x0916,
                    0x0916
                },

                Package (0x06)
                {
                    0x0530,
                    0xADA5,
                    0x0A,
                    0x0A,
                    0x0815,
                    0x0815
                },

                Package (0x06)
                {
                    0x048A,
                    0x9598,
                    0x0A,
                    0x0A,
                    0x0714,
                    0x0714
                },

                Package (0x06)
                {
                    0x03E4,
                    0x7E36,
                    0x0A,
                    0x0A,
                    0x0613,
                    0x0613
                }
            })
        }
    }

Note: For P-States you can't go Higher than the Ratio MAX defined in the MSR 0x198 for your CPU ( It seems that IDA Mode can Change the Ratio Max Value, but I assume it's predefined logic specific to the CPU ).

 

Ok at x0198 in read i get:

EDX: 0x061B4B2A for core1 and core2
EAX: 0x86004B2A for core1 and core2

What are the value so ?

PS: I use CPUGenie maybe it can change the 0x198 value ?

 

I've uninstalled CPUGenie and reboot the PC.

It's the same value.
4B seems to be 11.5x so the BIOS is telling that my X9100 can not run more than 11.5x (default 3.06Ghz).
That's sucks or there is another way to unluck the multiplier ??

 

Can you update for me your code for test x12 multiplier with a voltage of 1.25V please ?

How can i run the code ?

 

With RW Everything program, i have this information:

SBBIOS Entry

Processor entry:

Code:

[Processor Information] (Type 4)
04 28 04 00 01 03 BE 02 76 06 01 00 FF FB EB BF	.(......v.......
03 02 0A 01 F4 0B F4 0B 41 04 05 00 06 00 FF FF	........A.......
00 00 00 02 02 02 04 00 55 32 45 31 00 49 6E 74	........U2E1.Int
65 6C 00 43 50 55 20 56 65 72 73 69 6F 6E 00 00	el.CPU Version..
Type	0x04 (4)
Length	0x28 (40)
Handle	0x0004 (4)
Socket Designation	String1 - "U2E1"
Processor Type	0x03 - Central Processor
Processor Family	0xBE
Processor Manufacturer	String2 - "Intel"
Processor ID	0xBFEBFBFF00010676
Processor Version	String3 - "CPU Version"
Processor Voltage	0x02
  Bit0	5V - 0 (No)
  Bit1	3.3V - 1 (Yes)
  Bit2	2.9V - 0 (No)
External Clock	0x010A (266)MHz
Max Speed	0x0BF4 (3060)MHz
Current Speed	0x0BF4 (3060)MHz
Processor Status	0x41
  Bit6 = 1	CPU Socket Populated
Processor Upgrade	0x04 - ZIF Socket
L1 Cache Handle	0x0005 (5)
L2 Cache Handle	0x0006 (6)
L3 Cache Handle	 0xFFFF - Cache Information unknown
Serial Number	NULL
Asset Tag	NULL
Part Number	NULL
Core Count	0x02 (2)
Core Enabled	0x02 (2)
Thread Count	0x02 (2)
Processor Characteristics	0x0004
  Bit0x01	Unknown - 0 (No)
  Bit0x02	64-bit Capable - 1 (Yes)

First, there is something strange. As you can see the "max speed" is 3.06Ghz. So there is something "hardcoded" in the bios that say the max for x9100 is 3.06ghz ???


This is my SSDT:

Secondary System Description Table: 0xBFDE6000

Code:

Signature	"SSDT"
Length	0x00000655 (1621)
Revision	0x01 (1)
Checksum	0x43 (67)
OEM ID	"PmRef"
OEM Table ID	"CpuPm"
OEM Revision	0x00003000 (12288)
Creator ID	"INTL"
Creator Revision	0x20050624 (537200164)

DefinitionBlock ("SSDT.AML", "SSDT", 0x01, "PmRef", "CpuPm", 0x00003000)
{
	Scope(\)
	{
		Name(SSDT, Package(12)
		{
			"CPU0IST ", 0xBFD1AC20, 0x00000265, "APIST   ", 0xBFD19CA0, 0x000001CF,
			"CPU0CST ", 0xBFD18620, 0x00000549, "APCST   ", 0xBFD19F20, 0x0000008D
		})
		Name(CFGD, 0x0D306BF1)
		Name(\PDC0, 0x80000000)
		Name(\PDC1, 0x80000000)
		Name(\PDC2, 0x80000000)
		Name(\PDC3, 0x80000000)
		Name(\SDTL, Zero)
	}
	Scope(\_PR.CPU0)
	{
		Name(HI0, Zero)
		Name(HC0, Zero)
		Method(_PDC, 1, NotSerialized)
		{
			Store(CPDC(Arg0), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(_OSC, 4, NotSerialized)
		{
			Store(COSC(Arg0, Arg1, Arg2, Arg3), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(CPDC, 1, NotSerialized)
		{
			CreateDWordField(Arg0, Zero, REVS)
			CreateDWordField(Arg0, 0x04, SIZE)
			Store(SizeOf(Arg0), Local0)
			Store(Subtract(Local0, 0x08), Local1)
			CreateField(Arg0,0x40,Multiply(Local1, 0x08),TEMP)
			Name(STS0, Buffer(0x04)
			{
				0x00, 0x00, 0x00, 0x00
			})
			Concatenate(STS0, TEMP, Local2)
			Return(COSC(Buffer(0x10)
			{
				0x16, 0xA6, 0x77, 0x40, 0x0C, 0x29, 0xBE, 0x47,
				0x9E, 0xBD, 0xD8, 0x70, 0x58, 0x71, 0x39, 0x53
			}, REVS, SIZE, Local2))
		}
		Method(COSC, 4, NotSerialized)
		{
			CreateDWordField(Arg3, Zero, STS0)
			CreateDWordField(Arg3, 0x04, CAP0)
			CreateDWordField(Arg0, Zero, IID0)
			CreateDWordField(Arg0, 0x04, IID1)
			CreateDWordField(Arg0, 0x08, IID2)
			CreateDWordField(Arg0, 0x0C, IID3)
			Name(UID0, Buffer(0x10)
			{
				0x16, 0xA6, 0x77, 0x40, 0x0C, 0x29, 0xBE, 0x47,
				0x9E, 0xBD, 0xD8, 0x70, 0x58, 0x71, 0x39, 0x53
			})
			CreateDWordField(UID0, Zero, EID0)
			CreateDWordField(UID0, 0x04, EID1)
			CreateDWordField(UID0, 0x08, EID2)
			CreateDWordField(UID0, 0x0C, EID3)
			If(LNot(LAnd(LAnd(LEqual(IID0, EID0), LEqual(IID1, EID1)), LAnd(LEqual(IID2, EID2), LEqual(IID3, EID3)))))
			{
				Store(0x06, STS0)
				Return(Arg3)
			}
			If(LNotEqual(Arg1, One))
			{
				Store(0x0A, STS0)
				Return(Arg3)
			}
			Return(Arg3)
		}
		Method(GCAP, 1, NotSerialized)
		{
			CreateDWordField(Arg0, Zero, STS0)
			CreateDWordField(Arg0, 0x04, CAP0)
			If(LOr(LEqual(STS0, 0x06), LEqual(STS0, 0x0A)))
			{
				Return(Zero)
			}
			If(And(STS0, One))
			{
				And(CAP0, 0x0BFF, CAP0)
				Return(Zero)
			}
			Or(And(PDC0, 0x7FFFFFFF), CAP0, PDC0)
			If(And(CFGD, One))
			{
				If(LAnd(LAnd(And(CFGD, 0x01000000), LEqual(And(PDC0, 0x09), 0x09)), LNot(And(SDTL, One))))
				{
					Or(SDTL, One, SDTL)
					OperationRegion(IST0, SystemMemory, DerefOf(Index(SSDT, One)), DerefOf(Index(SSDT, 0x02)))
					Load(IST0, HI0)
				}
			}
			If(And(CFGD, 0xF0))
			{
				If(LAnd(LAnd(And(CFGD, 0x01000000), And(PDC0, 0x18)), LNot(And(SDTL, 0x02))))
				{
					Or(SDTL, 0x02, SDTL)
					OperationRegion(CST0, SystemMemory, DerefOf(Index(SSDT, 0x07)), DerefOf(Index(SSDT, 0x08)))
					Load(CST0, HC0)
				}
			}
			Return(Zero)
		}
	}
	Scope(\_PR.CPU1)
	{
		Name(HI1, Zero)
		Name(HC1, Zero)
		Method(_PDC, 1, NotSerialized)
		{
			Store(\_PR.CPU0.CPDC(Arg0), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(_OSC, 4, NotSerialized)
		{
			Store(\_PR.CPU0.COSC(Arg0, Arg1, Arg2, Arg3), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(GCAP, 1, NotSerialized)
		{
			CreateDWordField(Arg0, Zero, STS1)
			CreateDWordField(Arg0, 0x04, CAP1)
			If(LOr(LEqual(STS1, 0x06), LEqual(STS1, 0x0A)))
			{
				Return(Zero)
			}
			If(And(STS1, One))
			{
				And(CAP1, 0x0BFF, CAP1)
				Return(Zero)
			}
			Or(And(PDC1, 0x7FFFFFFF), CAP1, PDC1)
			If(LEqual(And(PDC0, 0x09), 0x09))
			{
				APPT()
			}
			If(And(PDC0, 0x18))
			{
				APCT()
			}
			Return(Zero)
		}
		Method(APCT, 0, NotSerialized)
		{
			If(LAnd(And(CFGD, 0xF0), LNot(And(SDTL, 0x20))))
			{
				Or(SDTL, 0x20, SDTL)
				OperationRegion(CST1, SystemMemory, DerefOf(Index(SSDT, 0x0A)), DerefOf(Index(SSDT, 0x0B)))
				Load(CST1, HC1)
			}
		}
		Method(APPT, 0, NotSerialized)
		{
			If(LAnd(And(CFGD, One), LNot(And(SDTL, 0x10))))
			{
				Or(SDTL, 0x10, SDTL)
				OperationRegion(IST1, SystemMemory, DerefOf(Index(SSDT, 0x04)), DerefOf(Index(SSDT, 0x05)))
				Load(IST1, HI1)
			}
		}
	}
	Scope(\_PR.CPU2)
	{
		Method(_PDC, 1, NotSerialized)
		{
			Store(\_PR.CPU0.CPDC(Arg0), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(_OSC, 4, NotSerialized)
		{
			Store(\_PR.CPU0.COSC(Arg0, Arg1, Arg2, Arg3), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(GCAP, 1, NotSerialized)
		{
			CreateDWordField(Arg0, Zero, STS2)
			CreateDWordField(Arg0, 0x04, CAP2)
			If(LOr(LEqual(STS2, 0x06), LEqual(STS2, 0x0A)))
			{
				Return(Zero)
			}
			If(And(STS2, One))
			{
				And(CAP2, 0x0BFF, CAP2)
				Return(Zero)
			}
			Or(And(PDC2, 0x7FFFFFFF), CAP2, PDC2)
			If(LEqual(And(PDC2, 0x09), 0x09))
			{
				\_PR.CPU1.APPT()
			}
			If(And(PDC2, 0x18))
			{
				\_PR.CPU1.APCT()
			}
			Return(Zero)
		}
	}
	Scope(\_PR.CPU3)
	{
		Method(_PDC, 1, NotSerialized)
		{
			Store(\_PR.CPU0.CPDC(Arg0), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(_OSC, 4, NotSerialized)
		{
			Store(\_PR.CPU0.COSC(Arg0, Arg1, Arg2, Arg3), Local0)
			GCAP(Local0)
			Return(Local0)
		}
		Method(GCAP, 1, NotSerialized)
		{
			CreateDWordField(Arg0, Zero, STS3)
			CreateDWordField(Arg0, 0x04, CAP3)
			If(LOr(LEqual(STS3, 0x06), LEqual(STS3, 0x0A)))
			{
				Return(Zero)
			}
			If(And(STS3, One))
			{
				And(CAP3, 0x0BFF, CAP3)
				Return(Zero)
			}
			Or(And(PDC3, 0x7FFFFFFF), CAP3, PDC3)
			If(LEqual(And(PDC2, 0x09), 0x09))
			{
				\_PR.CPU1.APPT()
			}
			If(And(PDC2, 0x18))
			{
				\_PR.CPU1.APCT()
			}
			Return(Zero)
		}
	}
}

Dunno what i can do with this :/
Anyhelp will be appreciated

 

I can't find any Intel documentation that states the QX9300 or X9100 have Unlocked Multipliers???

If someone can find Intel documentation that does state that, I have a theory.

Otherwise, don't assume that Extreme = Unlocked Multiplier ( I hope I'm wrong, this seems Very Dishonest On Intel's part ).

 

http://www.intel.com/products/processor/core2xe/mobile/index.htm?iid=prod_laptopcore+body_core2ex

That said the bus ratio is unlocked on extreme processor

 

Ok, thanks, I'm happy to be wrong.

Theory: It seems that the Bios is able to Write the Max Ratio Value to the MSR's 0x198 0xCE 0x17. I assume the Bios LOCKS some of these BITS after that, You'll need Ring0 access to change them.

The bad news is, unless your Bios supports Changing the Multiplier, it won't write a Value Higher than the Default Ratio for Extreme CPU's.

Maybe, these MSR's are RW for Extreme and RO for other Core2 CPU's.

Without an NDA with Intel, we can't get Access to the Bios Programers Guide, and find out for sure.

I have a few Bios's I can poke around with and try to fallow the Hops/Far Calls and see how it access these MSR's, but it's going to take a long time.

Anyone with a Extreme CPU could just try to Write the Ratio to each of these MSR's and see if they read back.

k4b4l74, Change EDX: 0x061B 4B2A to 0x061B 0C2A for MSR 0x198 and click Write MSR and see if it changes.

 

i can write x199 but x198 do not want to write.

Seems to be READ ONLY

 

And i think there is something in the bios (but WHERE ?) that fix the maximum cpu clock ratio the motherboard can handle (or the maximum ghz ?)

If we find this and put it to x17, the X9100 will be unlocked for more than 3.06ghz.

 

I had a look at the OCZ 0.28 Bios that works with XTU and some OCZ/AW systems.

It's a Phoenix Trusted Core, but it seems to be some ized Bios/UEFI.

While I'm sure, with lots of free time, someone with x86 Assembly skills could find how the "Bios" does it's Magic, I just don't see anyone putting that kind of time into it.

Essentially, unless the OEM includes the option to change the Multiplier in the Bios for Extreme CPU's, the "Unlocked Multiplier" is not UNLOCKED.

So, take care when Ordering.

For systems that use the Old true Phoenix Trusted Core BIOS, I can link to a way that this COULD be hacked in, but it does require x86 Assembly knowledge as well as basic low-level IO understanding.

As NOTE: DUET II (UEFI) could be booted from a USB stick and one could try to load the EFI Modules from the OCZ bios, and then boot Vista SP2 or Win7 or any other OS that will boot from EFI. That could work, but it's a long shot.

Also, it's been theorized that one maybe able to compromise the Multiplier lock using a Intel CPU Macro Code update(Errata), I gave it a shot with the T5550, however it did not have any effect, but I'm not sure if when I flash my bios that part was flashed and have not checked.

In summery, it's not likely that this will ever be fixed/hacked.

 

I missed this before, MSR @ 0x17:

BIT 15 = 1 <--Ratio Locked
BIT 15 = 0 <--Extreme CPU or ES/QS

I looked at a few ICH8m bios's and it seem they check this BIT before writing the Value for MSR 0x198.

It seem my HP F.59a bios checks this, tho it does not support changing the multiplier.

So, after this bit is checked, it writes the value of bits 0-14 to bits 32-46 of the MSR 0x198, however it seems to check a value in NVRAM first.

IF MSR 0x17 bit 15 = 0 check the value of the NVRAM Token and ADD it to this then write the result to MSR 0x198.

Even if your Bios does not have the option to change the Multiplier, it may well be checking, so if you know the address in NVRAM it checks and what value to write to it, you should be able to set a BUS_RATIO_MAX for an Extreme CPU.

I think my F.59a Bios read the NVRAM Token @ 0x2a0.

And it seem Gateway's Godzilla Bios reads it from 0x240.

Also, because the Ratio of an Extreme CPU is Unlocked, anyone with Bios Control for Multipliers should also be able to go to a Multiplier Higher than the Highest you could chose in the Bios.

I think the highest Multiplier for a Core 2 Extreme would be 21.5 x BUS.

If anyone has a ES or QS CPU, you could check BIT 15 of MSR 0x17 to see if your Multiplier is unlocked.

 

Here it is. I have a "QX9200" ES quadcore QAVR 2.4GHz. Max multi is locked by my HP 8530w BIOS. I really hope we can get somewhere with this.

Let me know if there is anything you want me to try.

 

stumo, bit 15 = 0, so you should be able to reach a Multiplier up to 21.5 x BUS.

However, I think I've only unlocked half the puzzle.

I still need to find what NVRam location to edit.

If you could link to a Bios update for your 8530w, that would be helpful.

 

Try this. if that link doesn't work, its in HP's product webpage for 8530w, click "support and drivers", click XP, click BIOS. I'm pretty sure there is some sort of unknown encryption on these HP BIOSes, so don't waste too much time on it if it looks odd.

I have tried writing to 0x17 and 0x198 and it doesn't write the values. (I was changing the 0x09 with an 0x0a as I think that is the max multi setting). So there must be some setting that has locked these regs.

 

The MSR @ 0x199 can be used to write the lower 14bits of MSR 0x198.

However, bits 32-48 are locked by the Bios/UEFI.

Looks like your "Bios" is UEFI.

I'm not sure how to deal with them, yet.

You could try Symcmos, it only runs in Dos.

I'm not sure it can read the NVRAM on your system, but it could be helpful:

Code:

symcmos -v2 -lDefault.txt

If it works, it will make a file Default.txt, upload that file, if you run it.

 

Ok, I think I found the last part needed for Phoenix Trusted Core Bios.

Looks like my HP F.59A Bios Supports Changing Multipliers for X7800/X7900/X9000 CPU's as well as any ES or QS CPU's that have BIT 15 of MSR 0x17 Unlocked ( 0 ).

Code:

Advanced
      Extreme_CPU_Speed
         ( token 0x1EF  start 0x60  width 0x8 )
         ( maximum 0xFF  default 0x0  PICK_FIELD )
            =   [0]  _2.6_GHz
            =   [1]  _2.8_GHz
            =   [2]  _3.0_GHz
            =   [3]  _3.2_GHz
            =   [4]  _3.4_GHz
            =   [5]  _3.6_GHz

Code:

 mov ecx,0x198
00002FC4  0F32              rdmsr
00002FC6  66A900000080      test eax,0x80000000
00002FCC  742F              jz 0x2ffd
00002FCE  66B917000000      mov ecx,0x17
00002FD4  0F32              rdmsr
00002FD6  53                push bx
00002FD7  8BD8              mov bx,ax
00002FD9  80FC0D            cmp ah,0xd
00002FDC  7419              jz 0x2ff7
00002FDE  B8EF01            mov ax,0x1ef
00002FE1  E87D0A            call 0x3a61
00002FE4  0AC0              or al,al
00002FE6  750F              jnz 0x2ff7
00002FE8  BAEF01            mov dx,0x1ef

So, for me, if I set the NVRAM Token 0x2A0 to TRUE ( 1 ) and set the Correct Value ( 00 - FF ) in the NVRAM Token 0x1EF, I can Control the Multiplier.

But, I don't know the Correct Value for 0x1FE at this time, as I do not have a Unlocked CPU to test with.

Moral_Hazard, if the system you were thinking of using an Extreme CPU in is Phoenix Trusted Core Bios, I can test to see if your bios should work.

Just post a link to your Bios.

 

Hello, i have a phoenix trusted bios too.

0x17 MSR
EDX[63..32] 0x001C0000
EAX[31..0] 0x90F44B2A
got x9100

You can dl the bios here:

http://www.mediafire.com/?oydmmqemmem

or here:

http://rapidshare.com/files/158940876/7811_BIOSES.zip (9C.12)

 

Here's a link to the M860ETU's BIOS as well.

Direct link:
M86TU17S.rom

 

I have attached my bios file. But it's not in the right form.
Anyway I'm pretty sure it's not a Phoenix BIOS.