• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

AMD Radeon Pro WX 4150/4170 Mobile - custom VBIOS FOR HP ZBook

Joined
May 22, 2020
Messages
116 (0.19/day)
AIDA64 Acpi browser to query VRMB (edited)

dmem to view address and buffer size (edited)

edit memory with hexedit

patched few date symbols (edited)

No results

I thought it would work, but nope



VRMB and VRMS discovery by @theroadw




////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////// ////////////////////////////// //////////////////////////////////////////////////////////////
//////////////////////////////////////////
C16A52E5-BD7E-4832-AD94-AC92BD498D81.png
00111265-F7A9-49F3-BFB8-DBD435106F36.jpeg
D73DC228-B434-48AC-9862-CC76293B0D77.jpeg
Third shadowed vbios location







/////////////////////////////////
/////////////////////////////////
/////////////////////////////////
/////////////////////////////////
Shadowed locations:
34D49018 - Unknown
37E3901C - VRMB
37EAF000 - VFCT




??????
VFCT IS CREATED BY GOP. As my gpu contains GOP, it will be always created. So VFCT is vbios for GOP
 
Last edited:
Joined
May 22, 2020
Messages
116 (0.19/day)
/////////////
VFCT IS CREATED BY GOP. As my gpu contains GOP, it will be always created. So VFCT is vbios for GOP

I have found 5 shadowed vbioses at ram for supported GPUs

/////////////

Strato vbios locations at ram:

9C0E00001530003000440034000000 = 0xF BYTES
FFFFFFFFFFFF = 0x6 BYTES
804FBF2BFCB769418C0C90 97C42E6B7238AA02002AF800F804F80019 = 0x1c BYTES

0x2CC18414
0x2DDAB410

0x34CED018 - MXM (Reserved by default for mxm SPI ROM)
0x34CFB818 - MXM GOP (Reserved by default for mxm SPI ROM)

0x37E3901C - MXM - ACPI VRMB
0x37E4781C - MXM GOP (Reserved by default for mxm SPI ROM)

0x37EAF068 - MXM - ACPI VCFT GOP


WX4150 ID (AT RAM)
0x34E1A478
0x369F8002
0x0F100000





Intel VBIOS is at:
0x2DCC3040
0x34CCA020
0x34CDB034
0x3CB30064
 
Last edited:
Joined
May 22, 2020
Messages
116 (0.19/day)
Finally got a proof that non of oses use mxm spi read event. So possibly that those hidden addresses are storing the vbios used by default. So even clover does not have access to mxm. I done four Catalina boot: uma, hybrid, discrete and with load vbios option at clover

69CB6B50-33C6-4871-B8F3-1C23341530D0.png
 

W1zzard

Administrator
Staff member
Joined
May 14, 2004
Messages
23,496 (3.63/day)
Processor Core i7-8700K
Memory 32 GB
Video Card(s) RTX 3080
Display(s) 30" 2560x1600 + 19" 1280x1024
Software Windows 10 64-bit
Do you have access to the full BIOS in the location pointed to by the VCFT table, or only part of it?
 

W1zzard

Administrator
Staff member
Joined
May 14, 2004
Messages
23,496 (3.63/day)
Processor Core i7-8700K
Memory 32 GB
Video Card(s) RTX 3080
Display(s) 30" 2560x1600 + 19" 1280x1024
Software Windows 10 64-bit
Joined
May 22, 2020
Messages
116 (0.19/day)
So I looked some more into the VCFT table (which seems to be AMD-only)

Struct definition around here: https://elixir.bootlin.com/linux/v4.1.45/source/drivers/gpu/drm/radeon/atombios.h#L7950

With a 6800 XT


this table is only 44 KB long in total and contains only part of the full VBIOS


The full VBIOS is 1 MB
Yes, that vbios is acpi way to interact with hardware. If you compare in with original vbios, you will see that in firmware module it has post states and other editions. Also the display part is injected and a lot other stuff: https://www.techpowerup.com/forums/...custom-vbios-for-hp-zbook.279373/post-4572977


What app is showing you structure viewer?


I suspect that VFCT is generated by GOP driver which which is second part of bios and PCI connected efi compressed driver. You can easy decompress driver.VFCT.png
 
Joined
May 22, 2020
Messages
116 (0.19/day)
Easy RAM dump method:

IMPORTANT: At efishell environment there is no thermal control, so CPU will heat, but fans wont work. If bios is set to quite mode (fans on without AC) then it will work for 2-3 minutes and system will perform safety shutdown. But this can damage CPU


Boot EFISHEELL first as default boot and recommend storage with recording speed at least 40 mb\s (/EFI/BOOT/BOOTX64.efi). Nothing before that should be loaded, even BIOS. Boot fresh after 15-30 seconds of full system shutdown to release capacitors, otherwise you will get dirty ram or a lot of win/clover/macos data there

After efisheel loaded:

Mount fs0
Fs0:
Ls
Mkdir ramdump1
Cd ramdump1
hexditor



After hex editor executed:
Ctrl+M


Dump address map:
00000000
05000000
0A000000
0F000000
14000000
19000000
1E000000
23000000
28000000
2D000000
32000000
37000000
3C000000
41000000
46000000
4B000000
50000000
55000000
5A000000
5F000000
64000000
69000000

Buffer=05000000

05000000 = 83,886,080 bytes (83.9 MB on disk)


Then press Ctrl+G
Write 00000000
Press F4 to set input
Press Ctrl+G
Write 04FFFFFF
Press F5 to set output
Press Ctrl+X to cut buffer
Press Ctrl+O to open file
It will ask you to patch ram, Press N - No
Write filename (example 00+05.bin) 00 start address, 05 buffer size
After new empty file will be opened, press Ctrl+V to paste buffer
Press Ctrl+S to save buffer to disk
Press UP or any key which is not influence on data at buffer to unfreeze hex editor
Press Enter to confirm Save

You will see at left bottom corner: XXXXXX lines were saved


After the file was saved press Ctrl+M and make same procedure with new Address


I don't see reason to dump empty space, after 55 I have only FFFFFFFFFFFF



Efisheel and RU efi which can run on ZBook
 

Attachments

  • EFI.zip
    533.1 KB · Views: 14
Last edited:
Joined
May 22, 2020
Messages
116 (0.19/day)
1639137767961.png


NEW VERSION WHICH IS MORE STABLE FOR MOVING ALL MODULES OFFSETS AT 3 CLICKS !






//////////////////////////////////////////////////////////////




Apple Pitcairn Saturn Tonga Venus Whistler EFI
GOPS
 

Attachments

  • RepositionAllModules_V2.zip
    16.1 KB · Views: 17
  • Apple_Pitcairn-Saturn-Tonga-Venus-Whistler_GOPS.zip
    280 KB · Views: 7
Last edited:
Joined
May 22, 2020
Messages
116 (0.19/day)
Clockrequest pin is important for nvidia mxm gpus but not for amd.

Working on pci to mxm adapter modding:
B87DD612-D91C-417C-8C5A-A58A75136478.jpeg914421F6-F3F9-4E36-8A5B-1AAAC87E6F3B.jpegCAF0E1A2-8B1F-4449-B118-23E8C267BBF9.jpeg402F38BE-8AAB-4A1A-9F8F-2BEE2E853456.jpeg
 
Joined
May 22, 2020
Messages
116 (0.19/day)
MUX IC PS8461 Schematic for Zbook G5, G6
Screen Shot 2021-12-17 at 11.02.20 AM.png
 

Attachments

  • ESM5 - PC50HS(-G) PC50HR(-G) PC50HP(-G) PC51HS(-G) PC51HR(-G) PC51HP(-G).pdf
    8 MB · Views: 51
Top