AMD Radeon Pro WX 4150/4170 Mobile - custom VBIOS FOR HP ZBook + iMac

[Final_Fighter]

I spend 3 months to get it working on Catalina, to patch fan issues with acpi (gpot user have success with acpi) Windows with NotebookFanControl with custom config.

But this gpu is the last alternative to m2000m for future updates. Amd not sell newer mxm GPUs. So I had no chance to switch, that’s why I spend so many time to get first success. I had 22 resolder spi roms and 72 rom flashes... even brought replacements for spi rom...

your doing this the hard way. get a ch341a and clip. ive been using one for bios recovery and mod for years now. it saves tons of time with soldering.

 

[bigguygeo]

your doing this the hard way. get a ch341a and clip. ive been using one for bios recovery and mod for years now. it saves tons of time with soldering.

Problem with spi flash. It’s so tiny, I tried to different clips, and they jump away from flash. Also for flashing, the mxm should be disconnected from laptop, otherwise it will force start laptop...

 

[WhenMusicAttacks]

if there were more cards avaiable - i would like to work on this. they were so cheap one year ago on aliexpress, but since the performance of m2000m was fine, i never looked into it

new games though run SO MUCH BETTER on the wx - i get double FPS on COD Warzone - i guess Polaris is just a better arch than Maxwell in the long run

 

[bigguygeo]

I tried unlock wx4130 shaders but only get 896. Same as 4150 has. So possibly this type of GPUs as workstation/enterprise are unlocked from scratch, or hardware locked

 

[bigguygeo]

Usefull link to linux atomfirmware

atomfirmware.h source code [linux/drivers/gpu/drm/amd/include/atomfirmware.h] - Codebrowser

code.woboq.org

//// ATOM_PPLIB_POWERPLAYTABLE::ulPlatformCaps
#define ATOM_PP_PLATFORM_CAP_BACKBIAS 1
#define ATOM_PP_PLATFORM_CAP_POWERPLAY 2
#define ATOM_PP_PLATFORM_CAP_SBIOSPOWERSOURCE 4
#define ATOM_PP_PLATFORM_CAP_ASPM_L0s 8
#define ATOM_PP_PLATFORM_CAP_ASPM_L1 16
#define ATOM_PP_PLATFORM_CAP_HARDWAREDC 32
#define ATOM_PP_PLATFORM_CAP_GEMINIPRIMARY 64
#define ATOM_PP_PLATFORM_CAP_STEPVDDC 128
#define ATOM_PP_PLATFORM_CAP_VOLTAGECONTROL 256
#define ATOM_PP_PLATFORM_CAP_SIDEPORTCONTROL 512
#define ATOM_PP_PLATFORM_CAP_TURNOFFPLL_ASPML1 1024
#define ATOM_PP_PLATFORM_CAP_HTLINKCONTROL 2048
#define ATOM_PP_PLATFORM_CAP_MVDDCONTROL 4096
#define ATOM_PP_PLATFORM_CAP_GOTO_BOOT_ON_ALERT 0x2000 // Go to boot state on alerts, e.g. on an AC->DC transition.
#define ATOM_PP_PLATFORM_CAP_DONT_WAIT_FOR_VBLANK_ON_ALERT 0x4000 // Do NOT wait for VBLANK during an alert (e.g. AC->DC transition).
#define ATOM_PP_PLATFORM_CAP_VDDCI_CONTROL 0x8000 // Does the driver control VDDCI independently from VDDC.
#define ATOM_PP_PLATFORM_CAP_REGULATOR_HOT 0x00010000 // Enable the 'regulator hot' feature.
#define ATOM_PP_PLATFORM_CAP_BACO 0x00020000 // Does the driver supports BACO state.
#define ATOM_PP_PLATFORM_CAP_NEW_CAC_VOLTAGE 0x00040000 // Does the driver supports new CAC voltage table.
#define ATOM_PP_PLATFORM_CAP_REVERT_GPIO5_POLARITY 0x00080000 // Does the driver supports revert GPIO5 polarity.
#define ATOM_PP_PLATFORM_CAP_OUTPUT_THERMAL2GPIO17 0x00100000 // Does the driver supports thermal2GPIO17.
#define ATOM_PP_PLATFORM_CAP_VRHOT_GPIO_CONFIGURABLE 0x00200000 // Does the driver supports VR HOT GPIO Configurable.
#define ATOM_PP_PLATFORM_CAP_TEMP_INVERSION 0x00400000 // Does the driver supports Temp Inversion feature.
#define ATOM_PP_PLATFORM_CAP_EVV 0x00800000
#define ATOM_PP_PLATFORM_COMBINE_PCC_WITH_THERMAL_SIGNAL 0x01000000
#define ATOM_PP_PLATFORM_LOAD_POST_PRODUCTION_FIRMWARE 0x02000000
#define ATOM_PP_PLATFORM_CAP_DISABLE_USING_ACTUAL_TEMPERATURE_FOR_POWER_CALC 0x04000000
#define ATOM_PP_PLATFORM_CAP_VRHOT_POLARITY_HIGH 0x08000000

EDIT 01
Useful link for moding Polaris

Polaris Bios Editing ( RX5xx / RX4xx )

www.overclock.net

Fiji Bios Editing ( Fury / Fury X / Nano / Radeon Pro Duo )

www.overclock.net

atomtool.py

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

[WIP - Early Release] jYABE - Yet Another BIOS Editor...

www.overclock.net

EDIT 02
Still working under simple method of import, zeros analyze and build new tables map. Will add all connections Sets and Calls CMD+DAT_TABLES ANALYZER_Vaguhn.zip

 

[bigguygeo]

I finished Diff comparison vbioses OF WX4150 (HP MXM, DELL MXM, HP BIOS UPDATE) and APPLE 560X IOREG. Maybe it will help to get GPU working. But i have a feeling, like HP laptop vbios is like DEMO or cut version

P.S. 40000800 ( aka **801,**802) is auto number modification by Google Sheets. The plain mode sometimes wont work.

As i cant find any other differences with method: Vaughn is main, if any Crane, Pegatron, module are same with Vaughn, then I will delete it from comparison as they can be related to SubVendor code style, and are not related to get functionality on Catalina Os and higher. So backing to differences: the only mistery module for me is VRAM_Info, MemoryTrainingInfo, as they are extremely big, I missed extended analysis of them. But other modules confirm that vbios modules itself have no Offsets!!! The modules uses Registers, Parsers, CALL TO DATA, SET COMMAND, SET REG BLOCK or SET_ATI_PORT(INDIRECT_IO_MM), and other type of buffer communication. So the reason why replacing modules causing problems, are simply buffer missmatching. If replace all buffer relations after module replacing - then it should work.

 

[bigguygeo]

This is only VGA_FIRMWARE part of WX4150 and APPLE 5xx, which can contain other elements.
Will upload this for future research, as replacement of Crane modules to WX4170 not get it working under Catalina, so not only modules are related to success. Somehow this method work for my 4150, but failed to 4170

Fun fact: Apple 550,555,560 VGA FIRMWARE ARE FULLY SAME. BUT!!!! BUT THEY ARE DESIGNED FOR DIFFERENT GPUS, BUT SAME GEN!!! SO IF APPLE CAN USE SAME VGA FIRMWARE, BUT WITH DIFFERENT SPECS, THEN WE CAN USE ANY FIRMWARE AS WE WANT AND WHICH IS RELATED TO SAME GENERATION OF GPUS!!!!

THIS TELL AS THAT MODULES ARE CONTAIN ALL GPU SPECS!!!

VGA_FIRMWARE-APPLE_550
VGA_FIRMWARE-APPLE_555
VGA_FIRMWARE-APPLE_560
VGA_FIRMWARE-APPLE_560X
VGA_FIRMWARE-CRANE
VGA_FIRMWARE-PEGATRON
VGA_FIRMWARE-VAUGHN-ZbookG4
VGA_FIRMWARE-VORTEX-ZbookG5

If VgaFirmware is identical, then it can’t contain any security verification. The modules also not include any securities, the only security is PCI CRC in pcir config, so this crc is what secure boot is used!


GOOD NEWS! I compare G5 AOMORHID (4170) and VORTEX (4150) VGAFirmware (aka bootloader), and they are fully the Same!!!

But have small differences in G4 Zbook. So this two GPU are same chip, same gen and different only in few modules!!! That is why this modules making 4170 as 4170:

Cmd_ASIC_Init.rom
Cmd_ClockSource.rom
Cmd_SetVoltage.rom
Cmd_SpeedFanControl.rom
Cmd_Unknown.rom
Data_ASIC_ProfilingInfo l ASIC_VDDCI_Info.rom
Data_FirmwareInfo.rom
Data_Object_Info.rom
Data_PowerPlayInfo.rom
Data_VoltageObjectInfo.rom
Data_VRAM_Info.rom

 

[bigguygeo]

Will leave here as this info is extremely useful when changing vbios size

/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////
This FFFFF padding outside of the file is used to fill unexpected end of file and nothing more. Still can't understand how file size equals hexfile length

Ok, FILE SIZE?

73E9 = E973 = E600
74E9 = E974 = E800
76E9 = E976 = EC00
78E9 = E978 = F000
79E9 = E979 = F200
7FE9 = E97F = FE00
80E9 = E980 = 10000



/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////

Edit1

I have an idea for patching l2c bus registers of vbios to get fan control working. I think that the gpu use special registers to talk with chipset. And registers are somewhere in system bios located. Supported GPUs by laptop can use same registers, but unsupported use another registers which is simply missing in system bios. So that’s why they can’t be read. If I will disassemble working gpu and copy that registers, put them in non supported vbios gpu, then theoretically they will work, and communication will be fine. Chipset will read registers and generate pwm. As if data is missing, pwm is not generating pwm, and the fan is 100% speed. This is crazy idea, but could be real ability for get it native working and solve problems of upgrade amd mxm GPUs! Sad thing is amd not manufacturing mxm GPUs anymore... the 41xx, 7100 and 550 is the last...


/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// /////////////////////////////////
Edit2
Adding DSDT of zbook G3 and G4 with no errors

 

[bigguygeo]

Good news! Parser found!

Every vbios has offset with call to this hex! Driver calls it ptrMainCallParserFar, AND ITS LOCATED HERE: (TV_VideoMode/DispOutInfo)

CALL TO THIS VGA FIRMWARE LOCATION
E80100CB83EC068BEC8946006633C0C646040089.....

/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// /////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// /////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// /////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// /////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////

NEW VBIOS BUILD
AMD RADEON WX4150 (HP Zbook G3)

DESCRIPTION:
Vaughn VgaFirmware as bootloader
Crane modules

WHATS NEW?
Strusture rebuild (All modules was realocated - this is proof that modules have no call offsets to other modules, only to firmware with parsers, table offsets. As all offsets are based on begining of the rom, the offsets are easy to patch)
Firmware patch (Backlight controller)
TV_VideoMode patch (Parser replaced)


FEATURES:
More Stable than previous build​

 

[bigguygeo]

WARNING!!!!!!!!

PLEASE READ CAREFULLY:

If you are going to use WX4150 with ZBOOK 15 G3, You need to buy G4 AMD HEATSINK!!!!!!
W5170M IS DIFFERENT WITH COMPONENTS LOCATION and G3 AMD HEATSINK WILL KILL YOUR WX4150, AS VRMs AND COILS ARE NOT COVERED WITH HEATSINK!!!!

​

 

[bigguygeo]

I decided to find the bad guy that maximize fan speed for unsupported GPU.
First of all find module that reporting "Fan Speed Failure (90F)", then find the trace to it.

The system has detected that a cooling fan may not be working properly. Before continued operation it is recommended to:
-Press enter to clear the message and allow the system to arrive at Windows Desktop
-Perform a Windows shutdown
-Clean the exterior of the vents to remove dust buildup while the computer is off
-Check for BIOS update

Fan Speed Failure (90F)

For more information, please visit: www.hp.com/go/techcenter/startup

File generating this message "Section_PE32_image_330B7378-3486-431A-A19C-7D64C116C15D_0312_body.efi"

 

[bigguygeo]

Have good news. I identified the fourth mux chip onboard

So this is a proof that laptop has mux design and not amd switchable or nvidia Optimus

https://www.diodes.com/assets/Datasheets/PI3VDP3212.pdf

The screenshot is so good quality and you can see traces.

My suggestion that this muxes are controlled via EC controller as it has GPIO

/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////



Solution of fan control could be here

53, 54 registers are Gpu fan read and fan custom target speed

46, 47 registers are cpu fan read speed and cpu fan target custom speed

I’m not specialist in ACPI, but someone could create ssdt table for control speed, on Windows and Ubuntu this registers can be controlled by NotebookFanControll app with custom config

/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////
/////////////////////////////////// ////////////////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// ////////////////////////////////////////// ///////////////////////////////// //////////////////////////////////////////

EC_READER.xlsx

Is experimental analyzer. Need help to finish it for future researchers.

 

[bigguygeo]

Adding mux\demux ICs onboard

PI3VDP3212
PI3WVR12412

https://www.diodes.com/assets/Datasheets/PI3VDP3212.pdf

https://www.diodes.com/assets/Datasheets/PI3WVR12412.pdf

The MUX switch are made with PCH (Chipset) GPIO (Azalia related) though resistor to SOT-323 MOSFET, and then Connected to GPUSEL on MUX.

Based on similar MUX DEVICE (PI3VDP12412) used in Zbook G2

https://www.diodes.com/assets/Datasheets/PI3VDP12412.pdf

EC controller
Nuvoton NPCE586HA0MX

 

[bigguygeo]

Statement on freezing the project for the development of alternative versions of the Video BIOS


Project will be closed for sometime as future modifications related to build 54’ are unstable and modules are modded to much to continue. Any new builds are failing to work. So that’s 54 build is the last.

What’s unsolved:
1. PowerManagment issues with MacOS with Discrete mode: after some time gpu core losing frequencies and stuck on 3xx MHz, this could be DeInit issue.
2. Artifacts with eGPU in macOS. Solved by disabling dGPU by Acpi.
3. Ubuntu won’t work without internal screen on Hybrid mode.


The possible future of the project:
Patch Wx4150 Pegatron vbios, to make this mobile type vbios (patch voltages configs and firmware info, PowerPlayInfo), patch connectors to add eDP connector.

So if one day someone will try to do this, I will help.

 

[bigguygeo]

Found EC firmware (Partial) inside of system bios

Fan2 TachTarget=%hu\n" Found
Tach - means Tachometer

Possibly this will help to make workaround to deal with GPU Fan noise (High speed)

ACPI

 

[bigguygeo]

This is not 100% proof, but thermal reading possibly related to missmatch of SMBus Adresses, Commands or Data Signaling
And possibly why EC getting wrong thermal registers (or even getting zero info) and fan goes mad, noisy and highest speed

 

[bigguygeo]

I found security boot white list of Zbook G4 + G3

Added System Bios files containing GPUs vendor ID



Zbook G3 15+17

86803A15 - 8086 153A - INTEL
86800619 - 8086 1906 - INTEL
86801319 - 8086 1913 - INTEL
86801619 - 8086 1916 - INTEL
86802119 - 8086 1921 - INTEL
86802619 - 8086 1926 - INTEL
86800B19 - 8086 190B - INTEL
86801B19 - 8086 191B - INTEL
86801D19 - 8086 191D - INTEL
86802B19 - 8086 192B - INTEL
86803B19 - 8086 193B - INTEL
86803D19 - 8086 193D - INTEL
86800E19 - 8086 190E - INTEL
86801519 - 8086 1915 - INTEL
86801E19 - 8086 191E - INTEL
86800A19 - 8086 190A - INTEL
86801A19 - 8086 191A - INTEL
86802A19 - 8086 192A - INTEL
86803A19 - 8086 193A - INTEL
86800219 - 8086 1902 - INTEL
86801219 - 8086 1912 - INTEL
86801719 - 8086 1917 - INTEL
86803219 - 8086 1932 - INTEL
86802228 - 8086 2822 - INTEL SATA Controller
DE10FA13 - 10DE 13FA - NVIDIA Quadro M3000M
DE10F913 - 10DE 13F9 - NVIDIA Quadro M4000M
DE10F813 - 10DE 13F8 - NVIDIA Quadro M5000M / M5000 SE
DE10B113 - 10DE 13B1 - NVIDIA Quadro M1000M
DE10B013 - 10DE 13B0 - NVIDIA Quadro M2000M
DE10B213 - 10DE 13B2 - NVIDIA Quadro M600M
DE10B613 - 10DE 13B6 - NVIDIA Quadro M1200 Mobile
DE103614 - 10DE 1436 - NVIDIA Quadro M2200 Mobile
02104666 - 1002 6646 - AMD Bonaire XT [Radeon R9 M280X]
02102068 - 1002 6820 - AMD Venus XTX [Radeon HD 8890M / R9 M275X/M375X]
E4148216 - 14E4 1682 - BROADCOM NetXtreme BCM57762 Gigabit Ethernet PCIe



Zbook G4 15+17

8680B715 - 8086 15B7 - INTEL Ethernet Connection (2) I219-LM
86801B59 - 8086 591B - INTEL HD Graphics 630
86801D59 - 8086 591D - INTEL HD Graphics P630
DE10B81B - 10DE 1BB8 - NVIDIA Quadro P3000 Mobile
DE10B71B - 10DE 1BB7 - NVIDIA Quadro P4000 Mobile
DE10B61B - 10DE 1BB6 - NVIDIA Quadro M1200 Mobile
DE10B413 - 10DE 13B6 - NVIDIA Quadro M1200 Mobile
DE10B61301 - 10DE 13B6 - NVIDIA Quadro M1200 Mobile
DE10B61302 - 10DE 13B6 - NVIDIA Quadro M1200 Mobile
DE10361401 - 10DE 1436 - NVIDIA Quadro M2200 Mobile
DE10361402 - 10DE 1436 - NVIDIA Quadro M2200 Mobile
0210E067 - 1002 67E0 - AMD WX 4170
0210E867 - 1002 67E8 - AMD WX 4150
E4148216 - 14E4 1682 - BROADCOM NetXtreme BCM57762 Gigabit Ethernet PCIe
86802228 - 8086 2822 - INTEL SATA Controller

8680B715FF
000000F80B0000000000000000000000000000000000000000000002000000000000000000000000000000
86801B59FF
000000F80B0000000000000000000000000000000000000000000002000000000000000000000000000000
86801D59FF
000000780C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B81BFF
000000A80C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B71BFF
000000280C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B61BFF
000000680C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B413FF
000000E80B0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B61301
000000480C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10B61302
000000D80B0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10361401
000000880C0000000000000000000000000000010000000000000000000000000000000000000000000000
DE10361402
000000080C0000000000000000000000000000010000000000000000000000000000000000000000000000
0210E067FF - Amd 4170
000000B80C0000000000000000000000000000010000000000000000000000000000000000000000000000
0210E867FF- Amd 4150
000000580C000000000000000000000000000000000000000000001C000000000000000400000000000000
E4148216FF
000000980C0000000000000000000000000000000000000000000017000000000000000000000000000000
86802228FF
0000000000000000000000

Added

g3 GPIO_I2C_Info.rom
g3 SpeedFanControl.rom
g4 GPIO_I2C_Info.rom
g4 SpeedFanControl.rom

 

[bigguygeo]

After deeper analyze of system bios, reporting:

• Why we see 4 post led beeps?
  • mxm module initialization not passed secure boot white list
  • mxm initialization method read device ID and then looking for vbios inside system bios, but after fail to found simply not initialize device. when OS boots, the mxm GPU will be initialized through internal gpu spi rom.
  • as device not properly recognized by HP boot, but VGA device is recognized, then Intel Gpu trying to unload and result problems with external screens on boot.
• Why fan so loud?
  • when the OS boots, the driver is initialized. the driver starting thermal device and starting sharing thermal registers, but there is a lot different thermal devices, and G3 support thermal devices for VERDE (Southern Islands thermal sensor) and BONAIRE (Sea Islands (CI) thermal sensor) gpus. So POLARIS sharing thermal device "Arctic Islands (Polaris) thermal sensor" registers, and they couldnt be read by EC firmware because this thermal device is missing. As result EC not reading temperatures at all. But MXM gpu SMBus is still communicating with Embedded Controller, but even communication I2C registers to embedded controller could be wrong, but they can be fixed with vbios modding.

Adding not confirmed EC pinout for fan research. Next to find how firmware connected to pin

 

[bigguygeo]

Latest VBIOS build contain Encoder mismatch with digital transmitter, and wont work in discrete mode.
Working on vbios bug patch, will load new version later!

VAUGHN	PEGATRON	CRANE
1E01 0103 8A02 3E00 0000 CE00 0000 1200 0000	1E01 0103 8806 3E00 0000 CE00 0000 1200 0000	5E01 0103 8A06 4800 0000 FB00 0000 1200 0000
04010000 02000A00143100112021 08000A00133100112022 80000A00133200111E22 00020A00133300111E21	04010000 08000A00133100111E22 80000A00133200111E21 00020A00133300112022 00040A00133400112021	05010000 02000A00143100112022 08000A00133100111E22 80000A00133200111E21 00020A00133300112021 00040A00133400112121
04000000 1431620068000000 13317D0083000000 133298009E000000 1333B300B9000000	04000000 1331620068000000 13327D0083000000 133398009E000000 1334B300B9000000	05000000 143174007A000000 13318F0095000000 1332AA00B0000000 1333C500CB000000 1334E000E6000000
012021000000040C010010010000020000000104930002040400FF 012022000000040C010010020000080000000104920002040300FF 011E22000000040C010020020000800000000104900002040100FF 011E21000000040C010030020000000200000104910002040200FF	011E22000000040C010010020000080000000104900002040100FF 011E21000000040C010020020000800000000104910002040200FF 012022000000040C010030020000000200000104920002040300FF 012021000000040C010040020000000400000104930002040400FF	012022000000040C010010010000020000000104920002040300FF 011E22000000040C010010020000080000000104900002040100FF 011E21000000040C010020020000800000000104910002040200FF 012021000000040C010030020000000200000104930002040400FF 012121000000040C010040020000000400000104940002040500FF
4000000 2021F200F8000000 2022FD0003010000 1E2208010E010000 1E21130119010000	04000000 1E22F200F8000000 1E21FD0003010000 202208010E010000 2021130119010000	05000000 202227012D010000 1E22320138010000 1E213D0143010000 202148014E010000 2121530159010000
01001101143114040F00FF 01001101133114040F00FF 01001101133214040F00FF 01001101133314040F00FF	01001101133114040F00FF 01001101133214040F00FF 01001101133314040F00FF 01001101133414040F00FF	01001101143114040F00FF 01001101133114040F00FF 01001101133214040F00FF 01001101133314040F00FF 01001101133414040F00FF

 

[bigguygeo]

Will leave it here:
Padding with firm of EC.
Possibly EC is loading from SPI system bios

Partially firmware is base architecture is X86, partially Thumb2. For some reason only disassembler that can read opcodes is Binary Ninja. Conclusion (from my POV): Part of firmware is executed by EC micro-controller, part is for PCH execution. Public key check use a lot of x86 opcodes, but other stuff is for ARM Cortex (Nuvoton NPCE586HA0MX)

I think i can try to compare G3 and G4 EC TachControl instructions, maybe i will find SMBus address reading codes for fan control.

But problem: I dont have enough skills for reverse engineering.


Also i`m trying to find info of cortex arm used in EC, if its possible to find, then it will be possible to read Memory mappings, Pinout mapping (GPIO, PWM, TACH)

 

[bigguygeo]

Wow! I dont test it, but this one is better then my sheets method

If this app is working, then latest vBios build is cumming soon! This build will be original HP, but with additional registers and voltage table reconstruction!


Actualy this app is using same method, but i dont think that support random zero bytes

[GUI TOOL] ATOMTableResize​

[GUI TOOL] ATOMTableResize

www.overclock.net

Hex Fiend binary template for PCI option ROMs

Hex Fiend binary template for PCI option ROMs

Hex Fiend binary template for PCI option ROMs. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

 

[OMTDesign]

Hello,

I am very surprised to see just how much work you have done on this project.

I happened to stumble across this thread while looking for a way to overclock my WX4150, but I just found out the max power of this card is 35W, and not 50W as listed on techpowerup.

I just uploaded my vBIOS here: https://www.techpowerup.com/vgabios/235704/235704
maybe you will find that useful?

My laptop is a Zbook 15 G1, and recently I switched out my Quadro M1000m for a WX4150 at the end of last year, and have been enjoying a tear-free experience on Linux thanks to the opensource drivers.
Also I no longer need to modify and install unsigned drivers on Windows!

I did some testing on Ubuntu 20.04 and Windows 10 for of both GPUs before and after upgrade. The results were inconclusive as I didn't see much performance improvement in my charts, but it felt like games ran faster likely due to the WX4150 having 4GB of vRAM compared to the 2GB of the M1000m. But the most important thing was that the WX4150 supported HVEC video decoding, so now I can watch 4k movies without overtaxing my CPU.

 

[bigguygeo]

Hello,

I am very surprised to see just how much work you have done on this project.

I happened to stumble across this thread while looking for a way to overclock my WX4150, but I just found out the max power of this card is 35W, and not 50W as listed on techpowerup.

I just uploaded my vBIOS here: https://www.techpowerup.com/vgabios/235704/235704
maybe you will find that useful?

My laptop is a Zbook 15 G1, and recently I switched out my Quadro M1000m for a WX4150 at the end of last year, and have been enjoying a tear-free experience on Linux thanks to the opensource drivers.
Also I no longer need to modify and install unsigned drivers on Windows!

I did some testing on Ubuntu 20.04 and Windows 10 for of both GPUs before and after upgrade. The results were inconclusive as I didn't see much performance improvement in my charts, but it felt like games ran faster likely due to the WX4150 having 4GB of vRAM compared to the 2GB of the M1000m. But the most important thing was that the WX4150 supported HVEC video decoding, so now I can watch 4k movies without overtaxing my CPU.

Thanks!

Yeah power controller is limited by low power ics. They can fail if overclock.

Pegatron is desktop version 4150. Last night I have successfully done new build, but this time base on Pegatron, I find out how to make desktop switch to mobile with GPIO data modding. I am currently debugging it, I think at the end of this week I will release new build.

I am trying to debug gpu display transmitting... there is unknown for me problem which related to hp port and transmission of signal.

So my story: all my builds have problems with discrete mode: some of them are not posting, some of them can’t work with Gop, some of them fails to transmit image. Anyway they all can boot Ubuntu (gpu doctor in this case) after many rebootings.

And that all begins from Objectinfo (connectors). Fun fact: I start troubleshooting from it, then I made more then 100 builds and now back to the start of this project.

I compared Crane, Pegatron 560x and seems like they use same style of connectors data. I done test: test my latest Pegatron build with crane, 560x objectinfo and I have boot screen. Add Vaughn, Aomorhid and no boot screen, Windows restarting, Linux work fine.

Then I use clean Vaughn with Pegatron, Crane, 560x objectinfo and it failed to boot Windows, and no boot screen.

And somehow I feel that that’s the reason why Catalina won’t boot. But I we made patched Vaughn with original objectinfo, but with Pegatron(Crane, 560x) registers patch of memorycontrollerinit, enablegraphsurfaces, lutautofill, Updatecrts, MemoryCleanUp and no boot Catalina results, but discrete working fine. So something I can’t catch is the reason why objectinfo can’t work on discrete and that is something that responsible for Catalina boot.











PegSubIDGpioFiTVPP+Pegatron+Vau-PP-Fi-Obj-gpiopinlut.zip
Are debug versions
PegSubIDGpioFiTVPP - working on discrete, but no edp
Vau-PP-Fi-Obj-gpiopinlut - not working on discrete

 

[bigguygeo]

FINALY NEW WORKING BUILD!!!

FULLY WORKING DISCRETE!!!!



For ZBOOK G3-G4 Only (or need additional output patches)



​

The base is Pegatron:
- SSID was replaced with zbook ssid
- Gpio was patched to make it mobile (one of gpio is responsible for voltages droping when no AC power connected, or otherwise that will kill VRMs or charger controller)
- Firmware was patched to added backlight support by GPU
- PowerPlay was fully replaced from Vaughn (it has more voltage states)
- TvOutInfo was replaced to meet HP mobile style (one port encoder is not connected anywhere)
- ObjectInfo was patched to remove bug of similiar ConnObjectId which was freazing output on Discrete (1123) => (1234) three

If you are testing New Rom, please write feedback about everything strange or unexpected GPU errors!

//// New explanation of EFI FILE SIZE ////
//////////////////////////////////////////////////////////
73 = E600
74 = E800
75 = EA00
76 = EC00
77 = EE00
78 = F000
79 = F200
7A = F400
7B = F600
7C = F800
7D = FA00
7E = FC00
80 = 10000

Every step = 512 bytes or 0x200 hex
//////////////////////////////////////////////////////////

 

[OMTDesign]

Is that power reading on MacOS accurate? Or is that the combined power of CPU and GPU?

Otherwise the WX4150 uses 70-80W on MacOS, but only 32-35W on Windows?