• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

AMD Radeon Pro WX 4150/4170 Mobile - custom VBIOS FOR HP ZBook + iMac

Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
AMD Radeon Pro WX 4150 (Zbook 15 G1, G3, G4) / WX 4170 (Zbook 17 G5) Mobile
+ iMac vbios build


!!!!!!!!!!!! WARNING !!!!!!!!!!!!!!!
This is risky and was tested only at my platform.
YOUR PLATFORM - YOUR RESPONSIBILITY
Have questions, write!



VBIOS BUILDS LIST:

_0_MyFinBuilds
===> ZBOOK15_G3+G4_WX4150_DELL_OEM+CONNECTORS.rom
===> ZBOOK15_G3+G4_WX4150_HP_PEGABUILD.rom
===> ZBOOK15_G3+G4_WX4150_HP_OEM+UEFIGOP.rom
===> _Legacy
======> OEM - HP WX 4150 - DESKTOP ONLY MXM BIOS BACK UP.rom

_1_4150-4170_AppleStyleBuilds
===> ZBOOK15_G3+G4_WX4150_NEBULA_VBIOS.rom
===> ZBOOK17_G5_WX4170_NEBULA_VBIOS.rom // (Wrong GOP)

_2_ZBOOK17_G5_WX4170_NEBULA_VBIOS_v2(GOP).rom.zip
===> ZBOOK17_G5_WX4170_NEBULA_VBIOS_v2(GOP).rom // Gop replaced to supported

_Builds_for_iMac_WX4150+WX4170.zip
===> +iMacMOD_WX4150_NEBULA_VBIOS.rom // designed to work with iMac DP ports
===> +iMacMOD_WX4170_NEBULA_VBIOS.rom // designed to work with iMac DP ports

eGPU USERS WARNING
Zbook cant work with Nvidia and AMD at the same time. And reason of this is NVIDIA OPTIMUS and AMD ENDURO technology. The problem is simple: if NVIDIA is dGPU and eGPU is AMD then iGPU will handle two technology at same time and as result will corrupt and freezes. To avoid this issue recomend to use same brand for MXM dGPU and Thunderbolt eGPU!


FAN ISSUE SOLUTION:

Fan issue solution:
By replacing TMP431D DUFC with EMC1412-1 with smbus address 0x4Ch. That thermal controller is platform compatible with Zbook G3. Also added two zero resistors to pins Alert and Thermal and now thermal controller has access to mxm connector.
WX_BEFORE.jpgWX_AFTER.jpg
Note: I do own HP card
After that mod gpu temperature is read correct by Embedded Controller and fans working as native with no issues. For additional manual of hardware mod write PM. Later will make public manual.


POST error G3 only:
The catch of POST error with 4 blinks of caps lock and num lock is simple: The gpu boot with read of SPI ROM, it goes shadowed to ram address 0x34CED018 then platform (CPU or chipset) is trying to connect vbios header data to internal shadowed platform preloaded vbioses, but failing and laptop boot with failure GPU (No vbios was connected) for example to address 0x2CC18414 or 0x2DDAB410. But most of other software is working as they can work with additional vbioses stored in RAM. And next is VFCT vbioses that is preloaded from MXM SPI ROM by GOP which is also loaded from MXM at 0x37EAF068. So that will get screen working at Discrete mode. Also @theroadw found the other ACPI vbios, which is VRMB at 0x37E3901C. So theoretically HP Zbook G3 uses 5 shadowed vbioses if gpu is supported.

!!! The latest theory: vbios that is used by any OS isn`t read from SPI when OS boot, but read from PCI BAR that contain shadowed vbios. I have dumped ram with up to address 0x60000000h
.





OTHER:


WARNING: Non of vbioses of post attachment was never tested under non-uefi environment or with secure boot option. Also keep in mind that vbios builds at other posts are partially or non post at discrete mode, only few of them have successfully pass testing. So use only attached vbioses to first post. 4150 vbioses are build for zbook g3, g4 and 4170 for zbook 17 g5. Possible there will be a release of final hybrid builds for iMac 2011 too. For other laptops the vbios requires connectors (objectinfo, tvoutinfo) patches.


ONE MORE THING:
- Hp Zbook 17 G5 throttle stop by @hugodlc
Post in thread 'How can I enable "Disable and Lock Turbo Power Limits" in Linux based system to solve 6 watt throttling issue on 8250u.'
https://www.techpowerup.com/forums/...throttling-issue-on-8250u.280864/post-4653801




The old post is here
AMD Radeon Pro WX 4150 Mobile - moded VBIOS FOR HP ZBook 15 G3


This bios enables almost full support of GPU in Zbook G3 is based on Zbook G4 video bios with UEFI added GOP and UEFI (HEX) enabled. Checksum also patched. All ports working well. Even the displayport to VGA connector, which sounds insane!

The only thing which cant be done with this bios is fan and temperature read and control, as the chip-set read GPU data from main laptop bios, and this one can`t be modded because of RSA security verification.

Two files attached: original ROM of blue HP WX4150 and modded bios.

If someone have idea of fan solution, i will be happy to hear, coz this noise making me mad)

And the WARNING: this bios working for my HP ZBook 15 G3 and not tested on any other laptops.
SO IF YOU ARE NOT READY TO WASTE YOUR TIME IF SOMETHING GOES WRONG - DON`T RISK!!!

RECOMENDATION: DO NOT MODIFY WX4150 VIDEO BIOS WITH popular POLARIS BIOS EDITOR, after I flashed moded bios with this app, the GPU briked, i was repeared by reoldering SPI ROM and reflashing with CH341a programmer.

Wish you luck!




Special thanks to (updating):
@theroadw, @gpot, @hugodlc, @dfranetic, @galkinvv, @nikey22, macrumors (2011 iMac Graphics Card Upgrade thread), @ket (win-raid),
 

Attachments

  • _0_FinBuilds.zip
    454.9 KB · Views: 196
  • _1_4150-4170_AppleStyleBuilds.zip
    241.3 KB · Views: 187
  • _2_ZBOOK17_G5_WX4170_NEBULA_VBIOS_v2(GOP).rom.zip
    115.3 KB · Views: 169
  • _Builds_for_iMac_WX4150+WX4170.zip
    235.4 KB · Views: 233
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
WX4150.png


Revision v2
Not tested yet, but should work

The first version was modified, as there was a conflict on mux chip, which sometimes under windows 10 was creating ghost image or corner glow on edp (laptop display) when connecting vga cable.

More: port info was edit based on AMD vbioses from G3 bios update Vbioses
 

Attachments

  • WX4150-moded_edp+port-as-ZbookG3+UEFI-Rev02+.rom.zip
    107 KB · Views: 157
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
from G4 vbios (biosupdate).png


Continue to research ports and working on hotplug detect

this 4 and 4 values is part of ports info
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
previous revision:
for some reason there was a mistake with byte 0x04 in second connector type. But this byte is perfectly working under original wx4150 firmware, i replace it with 0x02. as it was in original


next step:
bolded and underlined is hotplugID values


in

01 2021 000000040C010010010000020000000104930002040400
01 2022 000000040C010010020000080000000104920002040300
01 1E22 000000040C010020020000800000000104900002040100
01 1E21 000000040C010030020000000200000104910002040200

....0400
........0000
2021
....F200
....F800
........0000
2022
....FD00
....0301
........0000
1E22
....0801
....0E01
........0000
1E21
....1301
....1901
........0000
01001101143114040F00
FF
01001101133114040F00
FF
01001101133214040F00
FF
01001101133314040F00
FF
D40202010000.........cut

out
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Comparing AMD vbioses presented in BIOS.rom, find out that this part of Vbios is same on any AMD rom device


SAME G3 BIOS PART and same in byte count (332bytes) as G2

ORIGINAL HEX HP Tropo XT Venetian GDDR5 128Mx32 --- Venus XTX [Radeon HD 8890M / R9 M275X/M375X]


1E0101038A023E000000CE000000120000000401000002000A0014310011212108000A0013310011212280000A0013320011202100020A0013330011202204000000143162006800000013317D0083000000133298009E0000001333B300B9000000012121000000040C010010010000020000000104920002040300FF012122000000040C010010020000080000000104930002040400FF012021000000040C010020020000800000000104900002040100FF012022000000040C010030020000000200000104910002040200FF040000002121F200F80000002122FD0003010000202108010E010000202213011901000001001101143114040300FF01001101133114040300FF01001101133214040300FF01001101133314040300FF7D00010101020420000620000003910A02920A09100001820420000620000003910A0820000003920A0926000103

NEXT G3
SAME G3 BIOS PART

1E0101038A023E000000CE00000012000000040100000200

0A001431001121210800
0A001331001121228000
0A001332001120210002
0A001333001120220400


0000

1431

62006800
0000

1331

7D008300
0000

1332

98009E00
0000

1333

B300B900
0000

012121000000040C010010010000020000000104920002040300
FF
012122000000040C010010020000080000000104930002040400
FF
012021000000040C010020020000800000000104900002040100
FF
012022000000040C010030020000000200000104910002040200
FF

04000000

2121
F200F8000000
2122
FD0003010000
2021
08010E010000
2022
130119010000

01001101143114040300
FF
01001101133114040300
FF
01001101133214040300
FF
01001101133314040300
FF
7D00010101020420000620000003910A02920A09100001820420000620000003910A0820000003920A0926000103

SAME LINE CAN BE FOUND IN G4 AMD
1E0101038A023E000000CE00000012000000040100000200

AND The whole 332 bytes is in G4 VBIOS
1E0101038A023E000000CE000000120000000401000002000A0014310011202108000A0013310011202280000A00133200111E2200020A00133300111E2104000000143162006800000013317D0083000000133298009E0000001333B300B9000000012021000000040C010010010000020000000104930002040400FF012022000000040C010010020000080000000104920002040300FF011E22000000040C010020020000800000000104900002040100FF011E21000000040C010030020000000200000104910002040200FF040000002021F200F80000002022FD00030100001E2208010E0100001E2113011901000001001101143114040F00FF01001101133114040F00FF01001101133214040F00FF01001101133314040F00FFD402020100000000000000000000000014000000DC0C14000000D50C33030000D40C00020C00000B2900200FD30B

NEXT G4
Delete 24 bytes And normalise

1E0101038A023E000000CE00000012000000040100000200

0A001431001120210800
0A001331001120228000
0A00133200111E220002
0A00133300111E210400

0000
1431
620068000000
1331
7D0083000000
1332
98009E000000
1333
B300B9000000

012021000000040C010010010000020000000104930002040400
FF
012022000000040C010010020000080000000104920002040300
FF
011E22000000040C010020020000800000000104900002040100
FF
011E21000000040C010030020000000200000104910002040200
FF
04000000
2021
F200F8000000
2022
FD0003010000
1E22
08010E010000
1E21
130119010000

01001101143114040F00

FF
01001101133114040F00
FF
01001101133214040F00
FF
01001101133314040F00
FF
D402020100000000000000000000000014000000DC0C14000000D50C33030000D40C00020C00000B2900200FD30B

PORTS HP G4:

11020404 - EDP
21030303 - VGA
20010101 - DP
10000202 - HDMI


PORTS HP G3:
12040303
22050404
11020101
21030202

So this ports have a lot difference




Another part info of connectors in vbios G4

007C014E 0C071200 00640002 03140000 00FD2C00 00700502 05000000 001E2152 004C0003 FFFF001E 2255004C 0009FFFF 00202158 004C000A FFFF0020 225B004C 000B


Normalize
007C014E0C071200006400020314000000FD2C000070050205000000
00
1E21
52004C0003
FFFF
00
1E22
55004C0009
FFFF
00
2021
58004C000A
FFFF
00
2022
5B004C000B
FFFF
00
2121
5E004C000C
FFFF
00
2122
61004C000D
FFFF

SAME G4. Normalize
FFFFFF007D00B80B01000000FFFFFF00C800B80B02000000FFFFFF00C800B80B03000000FFFFFF008F00A00F06010000FFFFFF002600450C070000006D00020314000000963100003E0602030100000015216600180000FFFF0014216600080007FFFF00
1E21
66004C0003FFFF00
1E22
66004C0409FFFF00
2021
66004C400AFFFF00
2022
66004C440BFFFF00
2121
66004C800CFFFF00
2122
66004C840DFFFF00

FFFF020300040104FF0018000201020008008000000200040008400001001000FFFF5B04030141010E002A006B0377038019001F8119001F8219001F8319001F8B190010841908170819181F1900A438023C0000A02A000010000000000E29010000004178080FFFFF023C0000A02A000010000404070E69010000



SO Will try test this patch
THIS IS MOD 01
FIND
1E0101038A023E000000CE000000120000000401000002000A0014310011202108000A0013310011202280000A00133200111E2200020A00133300111E2104000000143162006800000013317D0083000000133298009E0000001333B300B9000000012021000000040C010010010000020000000104930002040400FF012022000000040C010010020000080000000104920002040300FF011E22000000040C010020020000800000000104900002040100FF011E21000000040C010030020000000200000104910002040200FF040000002021F200F80000002022FD00030100001E2208010E0100001E2113011901000001001101143114040F00FF01001101133114040F00FF01001101133214040F00FF01001101133314040F00FFD402020100000000000000000000000014000000DC0C14000000D50C33030000D40C00020C00000B2900200FD30B



REPLACE
1E0101038A023E000000CE000000120000000401000002000A0014310011212108000A0013310011212280000A0013320011202100020A0013330011202204000000143162006800000013317D0083000000133298009E0000001333B300B9000000012121000000040C010010010000020000000104920002040300FF012122000000040C010010020000080000000104930002040400FF012021000000040C010020020000800000000104900002040100FF012022000000040C010030020000000200000104910002040200FF040000002121F200F80000002122FD0003010000202108010E010000202213011901000001001101143114040300FF01001101133114040300FF01001101133214040300FF01001101133314040300FFD402020100000000000000000000000014000000DC0C14000000D50C33030000D40C00020C00000B2900200FD30B



Checksum location (those was wrong))))))
Picture is also wrong
Screen Shot 2021-05-01 at 21.38.37.png




MOD V2 = V1+ THIS =>
FIND
007C014E0C071200006400020314000000FD2C000070050205000000001E2152004C0003FFFF001E2255004C0009FFFF00202158004C000AFFFF0020225B004C000BFFFF0021215E004C000CFFFF00212261004C000DFFFF


REPLACE
007C014E0C071200006400020314000000FD2C000070050205000000001E2166004C0003FFFF001E2266004C0409FFFF00202166004C400AFFFF00202266004C440BFFFF00212166004C800CFFFF00212266004C840DFFFF


Checksums are okay now
 

Attachments

  • Zbook G3 bios + mod - HP WX4150 MODV1.rom.zip
    107 KB · Views: 148
  • Zbook G3 bios + mod - HP WX4150 MODV2.rom.zip
    107 KB · Views: 143
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Testing method:
Bios graphics as auto or hybrid. Otherwise wrong vbios will freeze system and you will never unbrick by software method.


Vbios v2 is glitching have errors
8EB96642-EDDD-4C19-9909-E7615580BBE9.jpeg


Vbios1 is stable except connectors. Edp is only working.

I use Windows for testing by disabling igpu in device manager. After reboot it will work only with amd.

Flashing on Ubuntu as corrupted vbios can’t be flashed, I mean recovered from Windows. It will fully brick gpu. So, it will erase it

So if only edp is working, I need to find out how this patch make it.

My suggestion is the best patch of vbios is change hotplug info, to meet zbook g3 requirements .


UPD1. Vga only port was occupied by igpu. Edp was fully accelerated by AMD, even if this gpu is supposed to be a second one

UPD2. I think I should patch original rom from oem mxm. Idea is simply switch first dp port to edp and compare other ports working. The reason is why I come to this conclusion is that I pay attention to what’s going with the ports on G4 vbios choosing in auto bios. The HDMI and DP was occupied by AMD, the VGA and EDP by Intel. So I think that happens because two this ports are selected in vbios as normal resolution, while HDMI and DP is high resolution
 
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
I also compare Baffin generation vbioses for laptops, and find that they are the same. So when i was comparing GPU from Zbook G2, G3, G4, the reason why they are almost the same, is because they use the same Generation of GPUs.

COMPAIRING WX4130 and RX 560M (Use tool called redsock_bios_decoder, as it is faster then hexcode)
Screen Shot 2021-05-03 at 10.54.39.png



Conclusion: there is no need to patch connectors, as they already good enough to work.
 

gpot

New Member
Joined
May 14, 2021
Messages
3 (0.00/day)
I happen to be looking for this exact thing, so thanks for posting it. What is the status of this mod? You've uploaded a few files here and I'm not sure which I should be flashing to my card. As for the fan and temperature stuff. I'd look into the OpenCore bootloader. It's what the hackintosh community uses to make ACPI mods before the OS boots. That should allow you to redirect the ACPI to the proper addresses for the temperature sensor.
 
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
I happen to be looking for this exact thing, so thanks for posting it. What is the status of this mod? You've uploaded a few files here and I'm not sure which I should be flashing to my card.

Which laptop you are using?

The most stable yet is here:

File
MODED - Zbook G4 bios + GOP (UEFI) FOR Zbook G3.rom.zip
Gop from original MXM vbios


The other is port mod, but in the end i realized, that all baffin generatiion have same ports, and there is no need to patch it. The only port difference i saw in Apple and Dells vbioses, which using 5 ports, but phisicaly there are 4 DP or 3 DP and one eDP. So i guess the 5 port is virtual, and designed for driver or mux chip.
 

gpot

New Member
Joined
May 14, 2021
Messages
3 (0.00/day)
Same as you. zBook 15 G3. I'm working on a Hackintosh with it and currently tackling the huge task of getting switchable graphics working on it. But for that, I need the card working on the internal display first. The fan stuff should be ACPI based. Most likely in the code for the embedded controller. Since I'm using OpenCore on my hackintosh build, I figured that would be a good test platform for potentially doing those ACPI mods without having to flash modded BIOS which apparently we can't do on this laptop.
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
The fan stuff should be ACPI based
Hmm. Really interesting idea. But I closely compare acpi tables of zbook g3 and g4, and they are close same.

If you are on hackintosh, create the thread on Tonymacx86 and we can more discuss hack there. I am also going to switch from clover to opencore as clover has a lot gpu issues, as doing something like pre-inject ports on boot.

About switchable all we can do is use it in 3 modes. And Auto will use IGPU for UI, Hybrid can be solved be giving only edp (lvds framebuffer) to intel and others to AMD, and Discrete with powermanagment problems (Default Framebuffer by whatevergreen is Baladi) but connectors are related to (Palena, Berbice, and the third i cant remember). Actually this framebuffers wont work, because they aren`t using flags like 403, 406. I think they are related to forming resolution. Original mbp 13.3 using igpu edp (only) and amd (edp) to operate on screen by one small mux, but other AMD ports are connected to the next (second) mux and after to Thunderbolt controller.

I solved fan control by adding PWM with temperature probe directly on graphic processor as close to crystal as possible and with thermal paste get the same temperature as hw showing. The funniest thing is that the PWM controller is faster reacts to temperature changes than the chipset. So have less noise and lower temperature. The other problem apeared (POST waring) with recomendadtion too clean or replace the fan.


This device patch for WX4150, also need backlight SSDT for adding control
<key>PciRoot(0x0)/Pci(0x1,0x0)/Pci(0x0,0x0)</key>
<dict>
<key>AAPL,slot-name</key>
<string>Internal@0,1,0/0,0</string>
<key>applbkl</key>
<data>
AQAAAA==
</data>
<key>applbkl-data</key>
<data>
ABEAAAAEAAsAEAAUABoAIwArADQAPwBOAGIAeQCUALUA2gD/
</data>
<key>applbkl-name</key>
<data>
RjE5VHh4eHgA
</data>
<key>connector-count</key>
<data>
BAAAAA==
</data>
<key>connectors</key>
<data>
AgAAAAABAAA5BQQIEQIEBAAEAAAEAwAAAAEDACEDAwMABAAABAMAAAABAQAg
AQEBAAQAAAQDAAAAAQIAEAACAg==
</data>
<key>hda-gfx</key>
<string>onboard-1</string>
<key>model</key>
<string>AMD Radeon WX 4150</string>
</dict>





UPD 1
Forgot to say: you may have experience issues with eGPU
 
Last edited:

gpot

New Member
Joined
May 14, 2021
Messages
3 (0.00/day)
Thanks. I'll look into it more when I get home from work. I'll create a forum post later on Tonymacx86 later this evening and DM it or post it as a reply here. Clever idea to use a separate fan controller. I might go that route as well if I can't figure out how to get the card's sensor to work.
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Thanks. I'll look into it more when I get home from work. I'll create a forum post later on Tonymacx86 later this evening and DM it or post it as a reply here.
waiting for link! :toast:

recommend also read this thread:
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
WX4150 BIOS UPDATE BASED ON ZBOOK G5 INTERNAL BIOS + UEFI ADDED !!!!!!!!!

Edit:
Suported ONLY ram chips
H5GC8H24AJ (HYNIX_4)
MT51J256M3 (MICRON)



Not tested Yet

WX4150 G5 INFO

Command Tables:
0000: c23e Len 007c (ASIC_Init)
0001: - (GetDisplaySurfaceSize)
0002: c2ba Len 00b7 (ASIC_RegistersInit)
0003: dfac Len 009e (VRAM_BlockVenderDetection)
0004: eaa2 Len 0267 (SetClocksRatio/DIGxEncoderControl)
0005: c372 Len 0113 (MemoryControllerInit)
0006: - (EnableCRTCMemReq)
0007: e04a Len 001a (MemoryParamAdjust)
0008: - (DVOEncoderControl)
0009: c486 Len 00ff (GPIOPinControl)
000a: c586 Len 01ac (SetEngineClock)
000b: c732 Len 0122 (SetMemoryClock)
000c: c854 Len 04cb (SetPixelClock)
000d: cd20 Len 0187 (DynamicClockGating)
000e: cea8 Len 0007 (ResetMemoryDLL)
000f: ceb0 Len 0007 (ResetMemoryDevice)
0010: e80a Len 0031 (MemoryPLLInit)
0011: e83c Len 0010 (AdjustDisplayPll)
0012: d2da Len 0111 (AdjustMemoryController)
0013: d3ec Len 0021 (EnableASIC_StaticPwrMgt)
0014: d40e Len 008e (ASIC_StaticPwrMgtStatusChange/SetUniphyInstance)
0015: - (DAC_LoadDetection)
0016: - (LVTMAEncoderControl)
0017: - (LCD1OutputControl)
0018: - (DAC1EncoderControl)
0019: - (DAC2EncoderControl)
001a: - (DVOOutputControl)
001b: d49c Len 02bf (CV1OutputControl)
001c: - (GetConditionalGoldenSetting/SetCRTC_DPM_State)
001d: - (TVEncoderControl)
001e: f45a Len 0096 (TMDSAEncoderControl)
001f: f4f0 Len 01ba (LVDSEncoderControl)
0020: - (TV1OutputControl)
0021: d75c Len 0078 (EnableScaler)
0022: d7d4 Len 0074 (BlankCRTC)
0023: d848 Len 003e (EnableCRTC)
0024: - (GetPixelClock)
0025: d886 Len 002c (EnableVGA_Render)
0026: d8b2 Len 0022 (EnableVGA_Access/GetSCLKOverMCLKRatio)
0027: - (SetCRTC_Timing)
0028: d8d4 Len 0019 (SetCRTC_OverScan)
0029: d8ee Len 0080 (SetCRTC_Replication)
002a: d96e Len 00c6 (SelectCRTC_Source)
002b: da34 Len 016f (EnableGraphSurfaces)
002c: dba4 Len 0049 (UpdateCRTC_DoubleBufferRegisters)
002d: dbee Len 0095 (LUT_AutoFill)
002e: faa2 Len 0297 (EnableHW_IconCursor)
002f: dc84 Len 003d (GetMemoryClock)
0030: dcc2 Len 00d8 (GetEngineClock)
0031: dd9a Len 0153 (SetCRTC_UsingDTDTiming)
0032: - (ExternalEncoderControl)
0033: f790 Len 01d1 (LVTMAOutputControl)
0034: deee Len 00be (VRAM_BlockDetectionByStrap)
0035: f9d4 Len 00ce (MemoryCleanUp)
0036: e064 Len 0231 (ReadEDIDFromHWAssistedI2C/ProcessI2cChannelTransaction)
0037: f6aa Len 00e5 (WriteOneByteToHWAssistedI2C)
0038: e296 Len 005f (ReadHWAssistedI2CStatus/HPDInterruptService)
0039: e2f6 Len 000a (SpeedFanControl)
003a: e300 Len 000a (PowerConnectorDetection)
003b: e30a Len 003c (MC_Synchronization)
003c: e346 Len 01af (ComputeMemoryEnginePLL)
003d: e4f6 Len 0007 (MemoryRefreshConversion)
003e: ed0a Len 0029 (VRAM_GetCurrentInfoBlock)
003f: e4fe Len 0165 (DynamicMemorySettings)
0040: e664 Len 011a (MemoryTraining)
0041: e77e Len 008c (EnableSpreadSpectrumOnPPLL)
0042: - (TMDSAOutputControl)
0043: e84c Len 01d2 (SetVoltage)
0044: - (DAC1OutputControl)
0045: f962 Len 0071 (DAC2OutputControl)
0046: - (SetupHWAssistedI2CStatus)
0047: ceb8 Len 03d0 (ClockSource)
0048: d288 Len 0052 (MemoryDeviceInit)
0049: - (EnableYUV)
004a: - (DIG1EncoderControl)
004b: - (DIG2EncoderControl)
004c: ed34 Len 0146 (DIG1TransmitterControl/UNIPHYTransmitterControl)
004d: ee7a Len 0338 (DIG2TransmitterControl/LVTMATransmitterControl)
004e: f1b2 Len 024c (ProcessAuxChannelTransaction)
004f: f3fe Len 005c (DPEncoderService)

Data Tables:
0000: - (UtilityPipeLine)
0001: - (MultimediaCapabilityInfo)
0002: - (MultimediaConfigInfo)
0003: 8bc4 Len 00e4 Rev 01:02 (StandardVESA_Timing)
0004: 8ca8 Len 006c Rev 02:02 (FirmwareInfo)
0005: 8d14 Len 0034 Rev 02:01 (DAC_Info)
0006: 8d48 Len 004e Rev 01:03 (LVDS_Info)
0007: - (TMDS_Info)
0008: c1b0 Len 0038 Rev 02:01 (AnalogTV_Info)
0009: - (SupportedDevicesInfo)
000a: 8d96 Len 00dc Rev 01:01 (GPIO_I2C_Info)
000b: 8e72 Len 000c Rev 01:05 (VRAM_UsageByFirmware)
000c: 8e7e Len 0020 Rev 01:01 (GPIO_Pin_LUT)
000d: 8e9e Len 0074 Rev 01:01 (VESA_ToInternalModeLUT)
000e: 8f12 Len 0018 Rev 02:03 (ComponentVideoInfo)
000f: 8f2a Len 02fa Rev 07:01 (PowerPlayInfo)
0010: - (CompassionateData)
0011: c198 Len 0018 Rev 02:01 (SaveRestoreInfo/DispDevicePriorityInfo)
0012: - (PPLL_SS_Info/SS_Info)
0013: - (OemInfo)
0014: - (XTMDS_Info)
0015: - (MclkSS_Info)
0016: 9224 Len 011e Rev 01:03 (Object_Info/Object_Header)
0017: 9616 Len 007d Rev 01:01 (IndirectIOAccess)
0018: 9342 Len 02d4 Rev 02:01 (MC_InitParameter/AdjustARB_SEQ)
0019: - (ASIC_VDDC_Info)
001a: c118 Len 0028 Rev 03:01 (ASIC_InternalSS_Info/ASIC_MVDDC_Info)
001b: c140 Len 0057 Rev 02:03 (TV_VideoMode/DispOutInfo)
001c: 9694 Len 032a Rev 02:02 (VRAM_Info)
001d: 99be Len 261a Rev 03:01 (MemoryTrainingInfo/ASIC_MVDDQ_Info)
001e: - (IntegratedSystemInfo)
001f: bfd8 Len 010c Rev 03:06 (ASIC_ProfilingInfo/ASIC_VDDCI_Info)
0020: c0e4 Len 0034 Rev 03:01 (VoltageObjectInfo/VRAM_GPIO_DetectionInfo)
0021: - (PowerSourceInfo)\



WX4150 G4 INFO (PREVIOUS)
Command Tables:
0000: c306 Len 0073 (ASIC_Init)
0001: c37a Len 0057 (GetDisplaySurfaceSize)
0002: c3d2 Len 00b7 (ASIC_RegistersInit)
0003: e018 Len 009e (VRAM_BlockVenderDetection)
0004: eaae Len 0267 (SetClocksRatio/DIGxEncoderControl)
0005: c48a Len 010b (MemoryControllerInit)
0006: - (EnableCRTCMemReq)
0007: e0b6 Len 001a (MemoryParamAdjust)
0008: - (DVOEncoderControl)
0009: c596 Len 00ff (GPIOPinControl)
000a: c696 Len 01ac (SetEngineClock)
000b: c842 Len 0122 (SetMemoryClock)
000c: c964 Len 04cb (SetPixelClock)
000d: ce30 Len 0187 (DynamicClockGating)
000e: cfb8 Len 0007 (ResetMemoryDLL)
000f: cfc0 Len 0007 (ResetMemoryDevice)
0010: e876 Len 0031 (MemoryPLLInit)
0011: e8a8 Len 0010 (AdjustDisplayPll)
0012: d348 Len 0111 (AdjustMemoryController)
0013: d45a Len 0021 (EnableASIC_StaticPwrMgt)
0014: d47c Len 008e (ASIC_StaticPwrMgtStatusChange/SetUniphyInstance)
0015: - (DAC_LoadDetection)
0016: - (LVTMAEncoderControl)
0017: - (LCD1OutputControl)
0018: - (DAC1EncoderControl)
0019: - (DAC2EncoderControl)
001a: - (DVOOutputControl)
001b: d50a Len 02bf (CV1OutputControl)
001c: - (GetConditionalGoldenSetting/SetCRTC_DPM_State)
001d: - (TVEncoderControl)
001e: f466 Len 0096 (TMDSAEncoderControl)
001f: f4fc Len 0189 (LVDSEncoderControl)
0020: - (TV1OutputControl)
0021: d7ca Len 0078 (EnableScaler)
0022: d842 Len 0074 (BlankCRTC)
0023: d8b6 Len 003e (EnableCRTC)
0024: - (GetPixelClock)
0025: d8f4 Len 002c (EnableVGA_Render)
0026: d920 Len 0022 (EnableVGA_Access/GetSCLKOverMCLKRatio)
0027: - (SetCRTC_Timing)
0028: d942 Len 0019 (SetCRTC_OverScan)
0029: d95c Len 0080 (SetCRTC_Replication)
002a: d9dc Len 00c6 (SelectCRTC_Source)
002b: daa2 Len 016f (EnableGraphSurfaces)
002c: dc12 Len 004e (UpdateCRTC_DoubleBufferRegisters)
002d: dc60 Len 0090 (LUT_AutoFill)
002e: fa80 Len 0297 (EnableHW_IconCursor)
002f: dcf0 Len 003d (GetMemoryClock)
0030: dd2e Len 00d8 (GetEngineClock)
0031: de06 Len 0153 (SetCRTC_UsingDTDTiming)
0032: - (ExternalEncoderControl)
0033: f76c Len 01d1 (LVTMAOutputControl)
0034: df5a Len 00be (VRAM_BlockDetectionByStrap)
0035: f9b0 Len 00cf (MemoryCleanUp)
0036: e0d0 Len 0231 (ReadEDIDFromHWAssistedI2C/ProcessI2cChannelTransaction)
0037: f686 Len 00e5 (WriteOneByteToHWAssistedI2C)
0038: e302 Len 005f (ReadHWAssistedI2CStatus/HPDInterruptService)
0039: e362 Len 000a (SpeedFanControl)
003a: e36c Len 000a (PowerConnectorDetection)
003b: e376 Len 003c (MC_Synchronization)
003c: e3b2 Len 01af (ComputeMemoryEnginePLL)
003d: e562 Len 0007 (MemoryRefreshConversion)
003e: ed16 Len 0029 (VRAM_GetCurrentInfoBlock)
003f: e56a Len 0165 (DynamicMemorySettings)
0040: e6d0 Len 011a (MemoryTraining)
0041: e7ea Len 008c (EnableSpreadSpectrumOnPPLL)
0042: - (TMDSAOutputControl)
0043: e8b8 Len 0171 (SetVoltage)
0044: - (DAC1OutputControl)
0045: f93e Len 0071 (DAC2OutputControl)
0046: - (SetupHWAssistedI2CStatus)
0047: cfc8 Len 032d (ClockSource)
0048: d2f6 Len 0052 (MemoryDeviceInit)
0049: - (EnableYUV)
004a: - (DIG1EncoderControl)
004b: - (DIG2EncoderControl)
004c: ed40 Len 0146 (DIG1TransmitterControl/UNIPHYTransmitterControl)
004d: ee86 Len 0338 (DIG2TransmitterControl/LVTMATransmitterControl)
004e: f1be Len 024c (ProcessAuxChannelTransaction)
004f: f40a Len 005c (DPEncoderService)

Data Tables:
0000: - (UtilityPipeLine)
0001: - (MultimediaCapabilityInfo)
0002: - (MultimediaConfigInfo)
0003: 8c76 Len 00e4 Rev 01:02 (StandardVESA_Timing)
0004: 8d5a Len 006c Rev 02:02 (FirmwareInfo)
0005: 8dc6 Len 0034 Rev 02:01 (DAC_Info)
0006: 8dfa Len 004e Rev 01:03 (LVDS_Info)
0007: - (TMDS_Info)
0008: c278 Len 0038 Rev 02:01 (AnalogTV_Info)
0009: - (SupportedDevicesInfo)
000a: 8e48 Len 00dc Rev 01:01 (GPIO_I2C_Info)
000b: 8f24 Len 000c Rev 01:05 (VRAM_UsageByFirmware)
000c: 8f30 Len 0020 Rev 01:01 (GPIO_Pin_LUT)
000d: 8f50 Len 0074 Rev 01:01 (VESA_ToInternalModeLUT)
000e: 8fc4 Len 0018 Rev 02:03 (ComponentVideoInfo)
000f: 8fdc Len 032a Rev 07:01 (PowerPlayInfo)
0010: - (CompassionateData)
0011: c260 Len 0018 Rev 02:01 (SaveRestoreInfo/DispDevicePriorityInfo)
0012: - (PPLL_SS_Info/SS_Info)
0013: - (OemInfo)
0014: - (XTMDS_Info)
0015: - (MclkSS_Info)
0016: 9306 Len 011e Rev 01:03 (Object_Info/Object_Header)
0017: 96f8 Len 007d Rev 01:01 (IndirectIOAccess)
0018: 9424 Len 02d4 Rev 02:01 (MC_InitParameter/AdjustARB_SEQ)
0019: - (ASIC_VDDC_Info)
001a: c1d4 Len 0028 Rev 03:01 (ASIC_InternalSS_Info/ASIC_MVDDC_Info)
001b: c1fc Len 0064 Rev 02:03 (TV_VideoMode/DispOutInfo)
001c: 9776 Len 0310 Rev 02:02 (VRAM_Info)
001d: 9a86 Len 261a Rev 03:01 (MemoryTrainingInfo/ASIC_MVDDQ_Info)
001e: - (IntegratedSystemInfo)
001f: c0a0 Len 010c Rev 03:06 (ASIC_ProfilingInfo/ASIC_VDDCI_Info)
0020: c1ac Len 0028 Rev 03:01 (VoltageObjectInfo/VRAM_GPIO_DetectionInfo)
0021: - (PowerSourceInfo)




UPD1
Something wrong with Anoraks ATOMBIOSReader.exe, I mean it reading wrong values, or wrong offsets.

UPD2
CURRENTLY WORKING ON RAM UPDATE (IN PROGRESS)

Difinitions of ram update (before and after)

before
0701004D0062060000312500001A

after
C800F44CA8610000D4300000C819


before
4835474338483234414A
after
4B344738303332354642


RAMUPDATED(TIMINGS)

BEFORE

409C0001
555
0000000000000
22AA1C00849C1312205F0A0A9484F1020020420033031420AA8800A00000000008050B0E2F12150F


F0490201
999
0000000000000
22229D00316A7D44805F121238CD350B004C0401750414204A8900A0020000001B122A33B32B3916


30750002
999
0000000000000
22AA1C006010220CC0540C079203010200226100150114209A8800A2000000000501080C200C130D

F0490202
777
0000000000000
22AA1C00315A5B3C80550F13B68C450A0068C4006C041420CA8980A9020000001712262BA4293715





AFTER:

B8880001
333
0000000000000
22CC1C006294221230570B0A114461020022620032021420AA8800A00000000006030D1026111210

F0490201
555
0000000000000
22CC1C0010E68C4AE057101636CD450A006E270113041420FA8900A0030000001A11313AA42F3718

409C0002
999
0000000000000
22AA1C006094220FD0540C081544F102004261001D0314201A8980A20000000006010A0F2F0E160D

F0490202
777
0000000000000
22AA1C00315A6B3CA0550F15B68C350B006AE4007C041420CA8980A9020000001712262BB32B3715
 

Attachments

  • ID67E8 - G5 - WX4150 + GOP - HP Vortex C98501 BaffinM GLPro A0 GDDR5 4GB 214e_300m_SecondRevis...zip
    106.6 KB · Views: 131
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Only for reverse engineering research
Goal: 1. upgrade wx4150 vbios from zbook G5 with Samsung ram support, because G5 version of vbios have 15% better performance.
Goal: 2. add support of Catalina OSX for imacs with G5 vbios.


Recently extracted all data and commands From Dell WX4150, HP WX4150(ZbookG4 - Mobile), HP WX4150 (Workstation - Desktop)
Also extracted header.

P.S.
1.
Data tables are replaced with DDDDDDDDDD
2. Command tables are replaced with FFFFFFFFFFFFFFF
3. Sometimes, between two images one zeros byte "00" are located. Tried to find call offsets to them, but no success. So those zeros could be simple zeros of no data, or used for some integrity check.
4. Planing to decompile entire 36-38kb firmware to locate offsets to command and data tables, because replacement of if inserting extra bytes, even patching offset calls from data and command tables bricking gpu

Attachments:
roms_withoutGop - zip with shorted roms
reports before editing - zip with vbioses reports
_modules_hp_Pegatron - one of 3 vbioses with extracted modules
_modules_hp_Vaughn - one of 3 vbioses with extracted modules
_modules_dell - one of 3 vbioses with extracted modules


_+_vbios_***********_no_cmd&dat_head - vbios without command tables, data tables and ATOM Header
_+_vbios_***********_without commandstables and datatables - vbios without command tables, data tables and ATOM Header

Unformulated info:

Here is jump to command and data tables located (Header????)


///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
01.png

i`ve made extended dump report (86megabytes) of vauguhn vbios with


///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Screen Shot 2021-05-27 at 07.36.44.png


:clap:

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////


All offsets are open to hexeditor. So if offset cant be found with littleendian reverse code, than this one is not exist. So we can make everithing we want

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
03.png



so possibly data tables opening from ram (preloaded), because there no jump offset


///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

04.png


all data have easy access
 

Attachments

  • _modules_hp_Pegatron.zip
    86.7 KB · Views: 152
  • _modules_dell.zip
    285.6 KB · Views: 138
  • _modules_hp_Vaughn.zip
    92.4 KB · Views: 110
  • reports before editing.zip
    30.9 KB · Views: 152
  • roms_withoutGop.zip
    120.2 KB · Views: 114
  • 02.png
    02.png
    112.3 KB · Views: 180
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Good news! Firmware is isolated environment bootloader and controller. So there is no need even to look on it! So all I did is: replacing offsets in header to data and command modules, if some of modules are realoceted , then need to correct offsets in data or command location tables. If one module is replaced, we need to repear all chain which calls or connected to modified table.
AC179A12-9F13-493F-998B-7EAFCBFBC899.jpeg
5EA913D7-75BA-4E43-8E80-1174F406C2A4.png




Here is Pegatron modules executed by Vaughn firmware



So now I planing to put back all different data modules to Frankenstein and reconstruct all chain related to data calls. If this will work, then we can disassemble command tablet and spend weeks trying to find differences in them. If problem in data tables, it will be easy to fix them, as they are not programs
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Only for reverse engineering research

One click disassembler for data and command tables.

The file names based on HP Vaughn and Pegatron pattern. Differences of periodical numbering is for Zero byte add.

Video tutorial inside

Based on compiled disassembler for Mac Os
 

Attachments

  • Decompiling ATOMBIOS DATA AND CMD.zip
    5.5 MB · Views: 192
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
This link is useful for those who want to patch UEFI GOP for non UEFI vbios. There are simply command to execute. Recommend.

 
Joined
Dec 5, 2019
Messages
82 (0.05/day)
Hello fellow hackintosher
I am also in the process of using the wx4150 on Zbook g3. I got it with HP vbios already inside. I did some modding using polaris bios editor 1.7.5 and it worked fine, i tried to do the offset undervolt on the overclock forum
"
Search for the hex values "8D 00 00 00 FF" with a hex editor and change the red byte:
8D 00 00 00 -> hex value x * 6,25mV
4 -> +25mV, 8 -> +50mV, 10 -> +100mV
negative: FF - x +1
FC -> -25mV, F8 -> -50mV
Then open the file with Polaris Bios Editor -> Update CRC -> done."

But it had no effect in performance or voltage reading.

I did undervolt the ram controller to 095 and the base voltage to 725, overcocked ram to 1700 from base 1500. Overclocking the frequencies did rise the voltage too much, throttling.

Tried unlocking the shaders: Replace 6F 22 70 22 for 6F 22 6F 22 , but could not find that value

I am yet to boot in macos, want to tune the performance using windows first, as the machine use will be audio production on macos and COD Warzone on Windows (wich performs so much better than with the m2000m)
 

Attachments

  • BaffinHP.zip
    113.8 KB · Views: 124
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Hello fellow hackintosher
I am also in the process of using the wx4150 on Zbook g3. I got it with HP vbios already inside. I did some modding using polaris bios editor 1.7.5 and it worked fine, i tried to do the offset undervolt on the overclock forum
"
Search for the hex values "8D 00 00 00 FF" with a hex editor and change the red byte:
8D 00 00 00 -> hex value x * 6,25mV
4 -> +25mV, 8 -> +50mV, 10 -> +100mV
negative: FF - x +1
FC -> -25mV, F8 -> -50mV
Then open the file with Polaris Bios Editor -> Update CRC -> done."

But it had no effect in performance or voltage reading.

I did undervolt the ram controller to 095 and the base voltage to 725, overcocked ram to 1700 from base 1500. Overclocking the frequencies did rise the voltage too much, throttling.

Tried unlocking the shaders: Replace 6F 22 70 22 for 6F 22 6F 22 , but could not find that value

I am yet to boot in macos, want to tune the performance using windows first, as the machine use will be audio production on macos and COD Warzone on Windows (wich performs so much better than with the m2000m)
What MacOs version you are using?

We made a huge step forward working on this project (WX4150+WX4170), but can`t get Catalina and higher working with HP vbioses. Dells are working fine, but have mismatch with connectors, so that's why Dell vbios will not use backlight on screen, as it matches display as DisplayPort.

Now we designed simple tool with Googsheets to rebuild Data and Command Offsets LookUpTables (can be imported to Excel), but need small modification, because various vbios have their own Zero byte Map. Those Zeroes are located between some modules and appear 10-15 times.

All was ok, but after changing module offsets, the os ejects aceleration of GPU, because of vbios driver signature check is failing. Someone with knowledge of reverse engineering could find this operation and get the related module to this. The modules part from tables to End of file could be replaced to any position with padding offset, but changes length inside this part bricking security signature. I think that this signature could be related to formula that searching those Zeroes, or possibly some length check.
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Adding results from galkinvv/PolarisBiosEditor-xml

Generated under Ubuntu with preinstalled Mono library


HP Aomorhid C99501 BaffinM XT(GL) A1 GDDR5 4GB TYPEB.GALK.txt
HP Vaughn G1-50 GDDR5.GALK.txt
Pegatron BaffinM GL PRO A1 G.GALK.txt
WX 4150 - Dell_Compal Crane 15 BaffinM GL Pro A1 GDDR5 4GB 300e_300m - dump by Gpot.GALK.txt

PCI CONFIG CRCs
VAGUHN
02 10 E8 67 00 00 18 00 00 00 00 03 7F 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
B7 28 39 10
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

PEGATRON
02 10 E8 67 00 00 18 00 00 00 00 03 74 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
79 01 BC 40
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DELL 4150
02 10 E8 67 00 00 18 00 00 00 00 03 76 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
9C 45 55 0D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


DELL 4130
02 10 E8 67 00 00 18 00 00 00 00 03 73 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
EB FE 56 86
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Apple Falcon
02 10 EF 67 00 00 18 00 00 00 80 03 74 00 32 0F 00 80 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
BF 57 F4 2D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 

Attachments

  • HP Aomorhid C99501 BaffinM XT(GL) A1 GDDR5 4GB TYPEB.GALK.txt
    49.8 KB · Views: 135
  • HP Vaughn G1-50 GDDR5.GALK.txt
    46.4 KB · Views: 145
  • Pegatron BaffinM GL PRO A1 G.GALK.txt
    50.4 KB · Views: 154
  • WX 4150 - Dell_Compal Crane 15 BaffinM GL Pro A1 GDDR5 4GB 300e_300m - dump by Gpot.GALK.txt
    57 KB · Views: 181
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
Then i tried to understand Vbios header, and that is what i made:


55 AA FILE MASK
7F E9 FILE SIZE

A1 02 OFFSET TO “MP” FILE INSIDE VGA FIRMWARE ??????????????????????????

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

44 02 OFFSET TO PCIR (0x0244)

00 00 00 00

49 42 4D IBM (ASCII)

04 CRC-8 FileChecksum (Based on Filesize E97F)

3A 88 OFFSET TO PFR IMAGE ??????????????????????????????

00 00 00 00 00 00 00 00 00 00 00

04 20

37 36 31 32 39 35 35 32 30 761295520

00 00 00 00 00 00

99 02 OFFSET TO VGA FIRMWARE (0x0299)

00 00 00 00 00 00

20 02 OFFSET TO ATOM SIGNATURE (0x0220) (ATOM)

00 00 00 00 00 00

31 32 2F 30 32 2F 31 36 2C 31 30 3A 31 34 3A 30 30 12/02/16,10:14:00 - RELEASE DATE (loc 0x0050) (ASCII)

00 00 00 E9 A7 03 00 E9 B1 03 00 00 00 F4 00 00 15 00 00 00 D0 01 00 AA 01 21 E1 02 80 7E 00 22 0F 44 02 12 00 00 00 00 00 00 3C 40 0E 02 07 3C 01 1A 00 04 00 00 00 EE A0 FF 06 00 08 30 40 0E 01 00 00 00 00 00 00 14 03 00 00 00 00 00 00 BE 7E 11 00 B9 07 1A D6 50 2C 00 00 00 00 00 00 00 00 00 00 0C 40 41 43 00 00 00 00 10 00 00 00 42 00 00 00 80 7E 06 00 20 00 20 00 12 00 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 52 30 31 30 39 30 2E 30 30 31 00 46 47 4C 20 42 41 46 46 49 4E 4D 00 50 43 49 5F 45 58 50 52 45 53 53 00 47 44 44 52 35 00 0D 0A 48

50 20 56 61 75 67 68 6E 20 47 31 2D 35 30 20 47 44 44 52 35 HP Vaughn G1-50 GDDR5 (Product Name) (ASCII)

20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

0D 0A 00 0D 0A 20 0D 0A 00

28 43 29 20 31 39 38 38 2D 32 30 31 30 2C 20 41 64 76 61 6E 63 65 64 20 4D 69 63 72 6F 20 44 65 76 69 63 65 73 2C 20 49 6E 63 2E (C) 1988-2010, Advanced Micro Devices, Inc. (ASCII)

00

41 54 4F 4D 42 49 4F 53 42 4B 2D 41 4D 44 ATOMBIOSBK-AMD (ASCII)

20

56 45 52 VER (ASCII)
30 31 35 2E 30 35 30 2E 30 30 30 2E 30 30 30 2E 30 30 31 30 39 30 015.050.000.000.001090 (BIOS VERSION) (ASCII)

00 42 52 30 31 30 39 30 2E 30 30 31 20 00 31 33 34 38 38 34 37 20 00 33 36 38 31 32 34 20 20 00 20 20 20 20 20 20 20 20 00 48 50 5F 42 41 46 46 49 4E 4D 5F 47 4C 50 52 4F 5F 56 41 55 47 48 4E 5F 47 44 44 52 35 5F 4D 58 4D 5C 63 6F 6E 66 69 67 2E 68 00 00 00 90

24 00 FileSize (0024)
01 01 Version (0101)
41 54 4F 4D ATOM (ASCII) (Atom Magic) uaFirmWareSignature[4]
00 C0 OFFSET TO BIOS Runtime Segment Address (0x00C0)
C5 03 OFFSET TO ProtectedModeInfo (0x03C5) (PM IMAGE)
CA 01 OFFSET TO ConfigFileName (0x01CA) BR01090.001 (ASCII)
69 02 OFFSET TO CRC_Block (0x0269) (HEX = B7 28 39 10)
1E 01 OFFSET TO BiosBootupMessage (0x011E)
EA 03 OFFSET TO (0x03EA) Int 10
00 00 PCI Bus Device Init Code
00 00 IO Base Address
3C 10 SUBVENDOR ID (HP)
D5 80 SSID (80D5)
44 02 OFFSET TO PCIR (0x0244)
86 8B OFFSET TO COMMAND TABLE (0x8B86)
2C 8C OFFSET TO DATA TABLE (0x8C2C)
A0 Extended Function Code
00 Reserved



PCI CONFIG

50 43 49 52 PCIR (ASCII)
02 10 VENDOR ID
E8 67 DEVICE ID
00 00
18 00
00 00
00 03
7F 00
32 0F
00 00
00 00
41 4D
44 20
41 54 4F 4D 42 49 4F 53 AMD ATOMBIOS (ASCII)
00 B7 28 39 10 00 CRC_Block
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00





So vbios has two checksums:
CRC-8 for check spi rom for faulty. If this value is Ok - then Gpu core will load firmware
CRC-32 is based in PCI config, and probably checking data and command tables for checksum ok.

Also i compared this value with 4 gpus


PCI CONFIG CRCs

VAGUHN
02 10 E8 67 00 00 18 00 00 00 00 03 7F 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
B7 28 39 10
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

PEGATRON
02 10 E8 67 00 00 18 00 00 00 00 03 74 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
79 01 BC 40
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DELL 4150
02 10 E8 67 00 00 18 00 00 00 00 03 76 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
9C 45 55 0D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


DELL 4130
02 10 E8 67 00 00 18 00 00 00 00 03 73 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
EB FE 56 86
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Apple Falcon 560X
02 10 EF 67 00 00 18 00 00 00 80 03 74 00 32 0F 00 80 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
BF 57 F4 2D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



\\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ ========= \\\\\\\\\\\\\\\\ =========





EDIT 1.


I`ve made Hybrid vbios. Based on Vaguhn VGA firmware and Dell modules.
For me working.
But sharing only for research and experience sharing. It could not work, but it is first step to custom vbios.
_50_Vaguhn+DellModules.jpg
 

Attachments

  • _50_Vaguhn+DellModules.rom.zip
    109 KB · Views: 127
  • _50_Vaguhn+DellModules.txt
    5.9 KB · Views: 157
Last edited:
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine


Possibly callouts to IndirectIO/Access are mades from internal part of all modules, or could be only modules or something

IndirectIO/Access - could be

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

Okay!. Then you should leave this IndirectIO/ Access module in place and circle everything around it. Although I still did not find a single mention in the offsets, we will obey the Linux driver and do as he says - maybe he knows more. So what will we do? Let's replace Object Info, DispOutInfo, change the lengths and patch the LUT for the date, it will go in the opposite direction.


015e(Object_Info/Object_Header)Shared by various SW0103011e
Called from (DynamicClockGating) (EnableDispPowerGating)

0057(TV_VideoMode/DispOutInfo)Only used by command table02030064


As DispOutInfo is for command table, then why we need it know?
Object_Header is software.
Object_Header old size 015e
Object_Header new size 011e
015e - 011e = 40
Add 40 to start point
Cmd 9764 + 40 = 97a4
Data 980A + 40 = 984a
Module loc 9854 + 40 = 9894
All modules affected also offset replaced

Image here:

Patch affects only on modules ahead. Flash it!

Working Fine! All ports are amazing working!!! Sorry, Edp+HDMI tested. Other ports will test later. Also Win10 drivers working without failure. Test experience 5 minutes.


/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

Made simply benchmarks
Vag+Cran_GTA.png

1623277705376.png
 

Attachments

  • _50_Vaguhn+DellModules+Display(SW).rom.zip
    109 KB · Views: 165
  • _50_Vaguhn+DellModules+Display(SW).rom.txt
    5.9 KB · Views: 178
  • 1623277705291.png
    1623277705291.png
    177.1 KB · Views: 134
  • 1623277705595.jpeg
    1623277705595.jpeg
    674.9 KB · Views: 205
Last edited:
Joined
Dec 5, 2019
Messages
82 (0.05/day)
The very sad situation is that i cannot find more cards to test on! And i had to sell the one i had. The performance is very good under windows, macos part is hard to tell - luxmark and final cut were able to use the card, but had no time to test all.
 
Joined
May 22, 2020
Messages
148 (0.09/day)
Location
Ukraine
The very sad situation is that i cannot find more cards to test on! And i had to sell the one i had. The performance is very good under windows, macos part is hard to tell - luxmark and final cut were able to use the card, but had no time to test all.
I spend 3 months to get it working on Catalina, to patch fan issues with acpi (gpot user have success with acpi) Windows with NotebookFanControl with custom config.

But this gpu is the last alternative to m2000m for future updates. Amd not sell newer mxm GPUs. So I had no chance to switch, that’s why I spend so many time to get first success. I had 22 resolder spi roms and 72 rom flashes... even brought replacements for spi rom...
 
Top