Opening pipes in Radeon Mobility 9800

[hulk]

This work has been going on for awhile at notebookforums.com

http://notebookforums.com/forumdisplay.php?f=85

we know the m9800 is based off the x800 desktop core. we trust the data from benchmarks done at beyond3d.com which imply the m9800 actually has 6 active vertext shaders instead of the 4 advertised by dell and ati.

so the we wanted to know if unlocking extra pipes was possible for added performance. we have both the m9800 and mx800 bioses. we believe the mx800 bios to be important as they both share the same general architecture but the mx800 has 12 active pipes instead of just 8 and uses a pci-e interface instead of agp.

w1zzard was kind enough to browse over the m9800 and concluded that the bios supported 16 pipes, so the lockout must be something else. we've hypothesized that it maybe due to hardware masking.

rivatuner has a component called nvstrap that can remove hardware masks for nvidia cards to unlock pipes, but no such support exists for ati.

i've come here to both describe our work in progress as well as ask members of this forum that may be skilled at bios editting and manipulation for help. specifically, could someone suggest a good bios editor? we've been using hex editors (hex workshop 4.23), but they're not very convenient as none of us are skilled at interpreting hex. are there any editors that offer higher level translation of the code?

thanks

 

[Urlyin]

Hulk... sounds pretty interesting, most members here use Rabit (here ) ATI BIOS editor. It will allow you to change Device ID, core/mem clocks, memory bus width 32/64/128/256 bit and memory type.

Kind of tuff testing a BIOS in a laptop, without the ability to slap in a PCI card should it corrupt... I see Mad Matt here on the Forums using Rabit alot. Shoot him a PM to see if he can help... Good luck and let us know how you make out ...

 

[W1zzard]

Hulk sent me some register data from his 8P notebook:

Config_die_fuses 0xeff39fff
Config_substrate_fuses 0xfffffcbd
Config_rom_fuses 0x340
Gb_pipe_select 0x199940 (means 8P active)

the final pipelines settings are determined from a combination of die, substrate and rom fuses. so far there is no way to change the die or substrate fuses. the rom fuses value can be changed by editing the bios file.

 

[hulk]

here are some more numbers from a few other m9800 users:

CONFIG_DIE_FUSES 0xEFF3DFFF
CONFIG_SUBSTRATE_FUSES 0xFFFFFCBD
CONFIG_ROM_FUSES 0x340
GB_PIPE_SELECT 0x9550

CONFIG_DIE_FUSES 0xEFF37FFF
CONFIG_SUBSTRATE_FUSES 0xFFFFFCBD
CONFIG_ROM_FUSES 0x340
GB_PIPE_SELECT 0x21550

to me, the die and pipe select values seem very different. can you tell me how you determine the number of pipes based on these values?

also you mentioned that there is no way to change the die and substrate values. is it simply because they're not found anywhere in bios?

well thanks for your help on this project.

 

[whackamac]

here are some more numbers from a few other m9800 users:

CONFIG_DIE_FUSES 0xEFF3DFFF
CONFIG_SUBSTRATE_FUSES 0xFFFFFCBD
CONFIG_ROM_FUSES 0x340
GB_PIPE_SELECT 0x9550

CONFIG_DIE_FUSES 0xEFF37FFF
CONFIG_SUBSTRATE_FUSES 0xFFFFFCBD
CONFIG_ROM_FUSES 0x340
GB_PIPE_SELECT 0x21550

to me, the die and pipe select values seem very different. can you tell me how you determine the number of pipes based on these values?

also you mentioned that there is no way to change the die and substrate values. is it simply because they're not found anywhere in bios?

well thanks for your help on this project.

Hello this is Whackamac, I am the other "crazy" one trying to crack this puppy. I have within ati tool at one point registered 9 pipes with a hacked MR9800/desktop X800 bios, but the route I was using was suicidal... hee hee. Dont want to continue my suicidal ways as im now on my third card.

We appreciate any help you all can give, as the team (me, hulk, and whoever else) that cracks the X800 technology will be famous! This will not only give us the ability to crack our card , but possibly any X800 there is...

From the info above, it appears it has something to do with the substrate or rom fuses sections... They are the only common strings between all examples.

Once again, greetings from all of us at www.notebookforums.com!

Oh... and good to see you here Hulk!

 

[hulk]

yo whack! i've been everywhere this week. glad you're here too.

i posted this at notebookforums also, but i thought i might share this idea here as well.

whack's been able to flash desktop x800 bioses except he gets no video. when he uses a dvi-vga connector, he gets corrupted video, so we've been hypothesizing that a desktop may actually be fully functional except the video output ports are mixed up

with hexworkshop, you can compare 2 files. why not compare the 9800 and a desktop x800 bios and look at the areas that are different. the 1st few sections you can probably ignore as it's just copyright, tech info, etc. but i bet one of the later sections deals w/ the output ports.

you can flash a partial bios right? so maybe flash part of the the x800 bios, then part of the 9800 bios that you think may deal with video outputs, then the rest of the x800 bios omitting its video output section.

that may work... or dell may receive another one of those oh so familiar late night calls. hehe

but if anybody here knows where in the bios video output ports are coded in the both the m9800 and desktop x800 bios can you let us know. or if you wouldn't mind changing the values for us, we'd be very grateful. thanks.

 

[W1zzard]

was he able to find out the # of pipelines with that bios?

an idea could be to install a remote control application, boot into windows with borked video, run atitool from remote and check the # of pipes ..

 

[W1zzard]

the die and subtrate fuses seem to be some kind of per gpu chip configuration value which is stored inside the chip .. the reason for the differences i think is that different pipelines are marked as bad