AMD Radeon Pro WX 4150/4170 Mobile - custom VBIOS FOR HP ZBook + iMac

[bigguygeo]

Is that power reading on MacOS accurate? Or is that the combined power of CPU and GPU?

Otherwise the WX4150 uses 70-80W on MacOS, but only 32-35W on Windows?

I think that this one is iStatMenus reading values issue. Because gpu port is limited to 50W, or it will do emergency power off if power consumption will be higher.
But still under MacOs when using some Adobe apps, the ram frequency drops to 300 mhz, and this happens only on discrete mode. That is some kind of driver issue i think. As wx4150 is the first my AMD for mac, i almost nothing know about it








FOR FUTURE VBIOS BUILD FOR 4170

Modules collection:
modules_Affleck-4170
modules_Aomorhid-4170
modules_Apple_560x
modules_dell-4150
modules_hp_Pegatron-4150Desktop
modules_hp_Vaughn-4150
modules_hp_Vortex-4150

///////////////////////////////




I found the reason why Catalina won’t work with HP vbioses! The reason is Memorytraininginfo and memorytraining command . The easiest way to get 4170 Affleck and Aomorhid work on Catalina is disable Memorytraininginfo, delete module and replace memorytraining command from Polaris vbios that not contains Memorytraininginfo.

The second way is use Apple 560x vbios, replace modules section with 4170, then replace Memorytraininginfo with Apple one and patch vbios header, decode it and make it same function as 4170.

Here is some proves how 4150 with same problem but dirty patched header:




Anyway latest build working fine on Catalina, because does not have memory training function

 

[bigguygeo]

Finished 2 tools that can help to analyze atom bios tables, reposition them and even patch modules positions, or switch them off.

I can share google sheet link for testing. Later will add excel sheet export, but I am afraid that it won’t work there.

I was use different builds of that sheets before I revealed java app ATOMTableResize. But this app can’t resize vgafirmware, cannot disable modules. So that’s why I have to get back to that project to make final 4150, 4170 hp vbios builds that will work on Catalina and higher!



AS EXPECTED, EXCEL NOT SUPPORT "SORT" FORMULA. HOW TO FIX IT, I DONT KNOW...



/////////////////////////////////////////////////

I think I found reason why gpu has problems with initializing. Everything is easier than I thought. When system boot, the chipset loads shadow vbios into ram. If vbios is not present in system bios, then it possibly loads to address reserved for second gpu, but if this ram address is assigned to mxm, the mxm is working in address space of second gpu. But when Windows or other os books, then os load vbios from acpi or directly from mxm. Then possibly those registers are reassigning. But in MacOS, they are stays wrong. And acpi powermanagment working wrong.

 

[bigguygeo]

NEW TESTING BUILD FOR WX 4170
(Aomorhid)
(Zbook G5)​

Beta testing Aomorhid builds. For Zbook G5


Deleted memory traininginfo data
Replaced memory training command
Replaced EnableGraphSurfaces command
Replaced EnableHW_IconCursor command
Replaced MC_InitParameter_AdjustARB_SEQ data
Patched Data_Object_Info_Aomorhid-patched data


Rebuild to structure of Crane\Pegatron, so there is nothing to patch anymore.


Everything other is 100% vanila.


New builds are here, as i cant to modify old posts on TechpowerUp

<< Solved >> - AMD WX4170 dGPU on ZBook G5 17 Laptop

This is simple tool to reposition all modules. Working fine if need to replace all modules from one vbios to another. I was used that sheet to copy Vaughn modules to 560X Vbios.

www.tonymacx86.com

Attachment is a second build of WX4170 (not tested in discrete)
- Aomorhid-nomemtrain-02-Connectors_V2-PatchedConnectors.rom.zip - Should work on discrete mode.

 

[bigguygeo]

FAN SPEED, GPU POWER MANAGEMENT, POST ERRORS PROBLEMS​

The method to dump memory, and other EFI info using EFISHELL64.
The idea is upload vbios of WX4150 into address C0000, to make it working in right space, as on G3 at address C0000 is empty space. So there is to possible suggestions:
1. Unsupported Vbios is located as PEG0, and not as GFX0 at address C000 + 65536 (Hex 1000) = d0000
2. Hp block shadowing of vbios on MXM as requires injection from system bios.
= Anyway Gpu are not initialized at boot fully, so when Windows boots, the MXM reinitialized for vbios reading and as results problems with Pci host ram addressing, some drivers failing to load

// it seems like RAM used for that task is limited to 32 megabytes, 33 554 432 Bytes, Hex numeral: 2000000.

So to dump whole ram need next command: dmem 0 2000000 > dmemdump.log
It will take 10-20 minutes. Some variables could change during logging

EFI RESEARCH ARTICLES
Moderators, please don’t delete those links, they are important for research:

"Video BIOS Shadow" Enable or Disable?

Some tweaker's guides claim enabling is better. Others claim disabling is better (video BIOS has gotten fast enough). Why does a video BIOS need to be "shadowed" in RAM anyways? And when is the video BIOS accessed? (other than at bootup)

forums.anandtech.com

UEFI Shell: Описание командной оболочки

Описание оболочки EFI Shell и ее команд. Инструкция по EFI Shell на русском.

www.bootdev.ru

https://uefi.org/sites/default/files/resources/UEFI_Shell_Spec_2_0.pdf

dmem

Syntax dmem[-b][ address ][ size ][-MMIO] Description Displays the contents of system or device memory. Options -b Displays one screen at a time. address Displays memory contents from a specific ...

techlibrary.hpe.com

Command Reference for EFI Shell Commands

Using Management Interfaces and Tools -- nPartition Administrator's Guide, HP Part Number '5991-1247B', Publication Date 'February 2007'

docstore.mik.ua

What I have done?:
map (find your File System)
map FS0 (map propper FAT32 FS)
FS0: (enter file system)
CD (LS as in mac)
devices >devices.txt
devtree > devtree.txt
dmem 0 350000 > dmem0000to350000.txt (i dont know how to dump as HEX)
drivers > drivers.txt
memmap > memmap.txt
pci > pci.txt

And results:
(devices.txt)
(devtree.txt)
(dmem>0000to350000.txt)
(drivers.txt)
(memmap.txt)
(pci.txt)

THEORY:​

After series of dumps of dmem, i cant find WX4150 shadowed rom. So that is clear, that if rom is missing, then gpu executed its own rom (SPI), but system have no access to work with GPU on low level hardware. So that's why everything onboard will not response to gpu, as there is no GPU present for chipset. On the other hand, when OS loads, it load vbios to registers / IO Registry, and only then the OS start to communicate with GPU, but fan, power management of GPU s missing, that's why if non supported GPU is used, than we have that bugs. Going forward: to control fan speed, GPU send data through SMBUS to EC controller. The controller read data and control fan. But possibly EC controller doesn't receive any data but recieve GPU sel gpio pin and start to wait data. Thats is why laptop POSTing GPU error. Because GPU present, but it cant initialize!

 

[bigguygeo]

Awesome short tutorial by @nikey22 about how to dump ACPI shadow vbios here:

Post in thread '2011 iMac Graphics Card Upgrade'
https://forums.macrumors.com/threads/2011-imac-graphics-card-upgrade.1596614/post-30130169

I will test it soon with zbook. If not supported vbios is there, then it will change the way of research!

Thank you for your research!


////////////////////////////////////////////////////

RESULTS (EFISHELL64):

devices -b

devices -b > devices.log

T D
Y C I
P F A
CTRL E G G #P #D #C Device Name
==== = = = == == === =========================================================
AB R - - 0 1 25 PciRoot(0x0)
2AD D - - 7 0 0 Primary Console Input Device
2AE D - - 1 0 0 Primary Console Output Device
2D1 D - - 1 0 0 PciRoot(0x0)/Pci(0x0,0x0)
2D2 D - - 1 0 0 PciRoot(0x0)/Pci(0x1,0x0)
2D3 D - - 1 1 0 AMD Radeon BAFFIN Graphics
2D4 B - - 1 1 1 AMD Buffin HD Audio Controller
2D5 B - - 1 1 1 Intel(R) Graphics Controller

dh -b 2D3 //Gpu AMD Radeon BAFFIN Graphics

dh -b 2D3 > 2D3.log


2D3: FirmwareManagement(FirmwareManagement) LoadFile2 PCIIO DevicePath(..0)/Pci(0x1,0x0)/Pci(0x0,0x0))

LoadFile2.h File Reference

TianoCore EDK2: MdePkg/Include/Protocol/LoadFile2.h File Reference

LoadFile2.h
Detailed Description​

Load File protocol as defined in the UEFI 2.0 specification.
Load file protocol exists to supports the addition of new boot devices, and to support booting from devices that do not map well to file system. Network boot is done via a LoadFile protocol.
UEFI 2.0 can boot from any device that produces a LoadFile protocol.

UefiHandleParsingLib ()
Detailed Description​

Provides interface to advanced shell functionality for parsing both handle and protocol database.

FirmwareManagementProgress.h​

Detailed Description​

UEFI Firmware Management Protocol definition Firmware Management Protocol provides an abstraction for device to provide firmware management support. The base requirements for managing device firmware images include identifying firmware image revision level and programming the image into the device.

GetImageInfo() is the only required function. GetImage(), SetImage(), CheckImage(), GetPackageInfo(), and SetPackageInfo() shall return EFI_UNSUPPORTED if not supported by the driver.

EDK II Firmware Management Progress Protocol.

 

[nikey22]

Excellent work @bigguygeo and @hugodlc

I wonder if HP has security against viewing anything in the ACPI segments. Hopefully your unsupported bios is there. Show me full log of device handles, it should be about 2 pages.
Also, try dumping something irrelevant just to see what is present.

dh -b 2D3 > 2D3.log

 

[bigguygeo]

Look for any EFI VBIOS ROMS (DarwinDumper Open Source)

ACPI (SYSTEM BIOS) and IOREGISTRY (MXM SPI)
Two different methods of bios. Mxm is injected by clover, opencore. The ACPI with VFCT

DarwinDumper.sh

# Look for any EFI VBIOS ROMS (Thanks to xsmile for info).
# The only place to look for now is in an ACPI table named VFCT
acpiTableToFind="VFCT"

Lets see what is there VFCT. This one is not present at any of the SSDT files.
**** Unknown ACPI table signature [VFCT]
found at Section_PE32_image_8B7C2CD8-818E-4973-B403-9AC0F2B81DC0_body.efi

# Find and read ACPI table data
WriteToLog "${gLogIndent}Looking for existence of ACPI table: $acpiTableToFind"
SendToUI "@DS@Checking for VCFT ACPI table:biosVideo@"

if [ $gSystemVersion -le 13 ]; then
acpi_tbls=$( ioreg -lw0 | grep "ACPI Tables" | cut -f2 -d"{" | tr "," " " )
else # Yosemite no longer has ACPI tables in ioreg.
"$dumpACPI" > "$TEMPDIR"/acpiTables.plist
acpi_tbls=$( /usr/bin/plutil -p "$TEMPDIR"/acpiTables.plist | sed 's/ //g' | cut -f2 -d "{" | tr "," " " | tr -d "}" )
fi

# Does ACPI Table exist?
if [ ! "$acpi_tbls" == "" ]; then
for tbl in $acpi_tbls
do
tbl_name=$( echo $tbl | cut -f1 -d"=" | tr -d "\"" )
if [ $tbl_name == "$acpiTableToFind" ]; then
WriteToLog "${gLogIndent}Found ACPI table: $tbl_name"
tbl_data=$( echo $tbl | cut -f2 -d"<" | tr -d ">" )
break
fi
done
fi

# Extract GOP EFI ROM
if [ ! "$tbl_data" == "" ]; then

# Check to see if table data contains signature.
if [[ "$tbl_data" == *55aa* ]]; then
WriteToLog "${gLogIndent}ACPI table $tbl_name contains signature"
SendToUI "@DS@Extracting GOP ROM data:biosVideo@"

# Scan ROM for Vendor & Device ID
hexToFind="55aa"
romImage="${tbl_data#*$hexToFind}"
romImage="55aa${romImage}"

hexToFind="50434952"
hexPosition="${romImage%%$hexToFind*}"
hexPosition="${#hexPosition}"

# Read the next 4 bytes (taking in to account little endian)
romVendorID=${romImage:$(($hexPosition+10)):2}${romImage:$(($hexPosition+8)):2}
romDeviceID=${romImage:$(($hexPosition+14)):2}${romImage:$(($hexPosition+12)):2}

WriteToLog "${gLogIndent}Identified ROM VendorID:$romVendorID | DeviceID:$romDeviceID"

filename="$gDumpFolderBiosVideo"/$romVendorID.$romDeviceID.from_ACPI_$acpiTableToFind.rom
echo "$romImage" | xxd -r -p > "$filename"

# Check if file was successfully written
if [ -f "$filename" ]; then
WriteToLog "${gLogIndent}Extracted VBIOS ROM from ACPI $tbl_name"
else
WriteToLog "${gLogIndent}Failed to write $filename to file"
fi
else
echo "No Signature found"
fi
fi

Yeah, mine vbios from mxm also is in VCTF acpi table as hex. And that’s a poof that vbios is load correct, even if that is not in system bios. So definitely the problem of errors is smbus data of mxm. As smbus signaling of data lanes is 2.1v for One and 0.8v for zeros, it’s easy to check if smbus is working, using red led, as it operates with 2.1-2.4v. If I will get blinks, then the smbus signals are working. And initializing problem is problem of EC firmware. And it’s only for mine scenario of unsupported gpu by system.

Anyway my unsupported gpu opening curtain to deeper research.

Clover also can dump that acpi. But clover inject pci spi to ioregistry that’s is maybe not an issue, but developers concept. Anyway the clover or OpenCore could add option to read vbios from shadow ram, or from acpi tables or from pci spi. That’s doesn’t matter why they done that, but vctf table could be patched for Windows usage for testing of discrete without flashing the rom.

//////////////////////////////////////////////////////////////
I compared POSTED (ACPI) vbios of AOMORHID with System bios, end here is what i get:

AOMORHID POSTED VBIOS VS THE ROM ITSELF
	POSTED VBIOS	ROM
FirmwareInfo
USHORT FirmwarePosted:1	0x0001 (1)	0x0000 (0)
UCHAR ucMemoryModule_ID	0x01	0x00
VRAM_UsageByFirmware
ULONG ulStartAddrUsedByFirmware	0x003fffe0 (4194272)	0x00000000 (0)
USHORT usFirmwareUseInKb	0x0020 (32)	0x0000 (0)
LVDS_INFO
usPixClk	0x3bb4 (15284)	0x0000 (0)
usHActive	0x0780 (1920)	0x0000 (0)
usHBlanking_Time	0x014a (330)	0x0000 (0)
usVActive	0x0438 (1080)	0x0000 (0)
usVBlanking_Time	0x0034 (52)	0x0000 (0)
usHSyncOffset	0x0030 (48)	0x0000 (0)
usHSyncWidth	0x0020 (32)	0x0000 (0)
usVSyncOffset	0x0003 (3)	0x0000 (0)
usVSyncWidth	0x0005 (5)	0x0000 (0)
usImageHSize	0x017d (381)	0x0000 (0)
usImageVSize	0x00d6 (214)	0x0000 (0)
(union) ATOM_MODE_MISC_INFO sbfAccess
=> USHORT HSyncPolarity:1	0x0000 (0)	0x0001 (1)
=> USHORT RGB888:1	0x0001 (1)	0x0000 (0)
(union) USHORT usAccess	0x0204 (516)	0x0000 (0)
ucRefreshRate	0x3c (60)	0x0000 (0)
ucLCDPanel_SpecialHandlingCap	0x01 (1)	0x0000 (0)

So EFI runtime modifying vbios on thy fly to make it more fitted to hardware.

 

[bigguygeo]

MUX ICs. Better look. Trying to map track GPIO GPU_SEL

For some reason the motherboard does not have any dp to hdmi port converting IC, so possibly hdmi is connected to thunderbolt controller And it converts signals. I tried to beeping with multimeter but can’t get any results. But DP to VGA IC is beeping fine from mxm to mux, from mux to converter and from converter to d-sub connector.

The next stage is to find GPIO of mux mossfet at EC IC

The smd K72 datasheet


I spend some time on mapping traces of muxes, but the scheme of connections are really strange: those two transistors which switch to mux ways are connected together. The source are grounded, the gate are connected together too. So if the gate will open, then it will be open simultaneously for eDP to mxm and other ports to mxm. But mode bios graphics: hybrid is making all ports connected to mxm, but eDP to eDP, which is impossible with the way of provided electrical design. Weird...

 

[bigguygeo]

Okay. Now let’s focus on thermal data. The gpu has three ways to monitor thermal data: with drivers via pci device; smbus with direct signals to EC bus, with ACPI.


The smbus Polaris 11 address is 0x40,41,42,43. The switch between different addresses is made with two resistors pads. And four variations. As I don’t have access to mxm pcb, I cannot confirm that. And to find this hex address with reverse of EC firmware is also little bit insane idea, so will better look inside g3, g4 acpi to find the table responsible for control EC acpi method.

12.9. SMBus Host Controller Interface via Embedded Controller — ACPI Specification 6.4 documentation

As I understand, the EC controller has the address mapping with ram and can have access to data of ports through preallocated memory for this operations.

 

[bigguygeo]

Vbios data for research of unknown data in the header:

Screen Shot 2021-08-01 at 01.45.38.png
Click to expand...

The 6770 the last GPU vbios with that short data which located starting from offset to BIOS boot up message to BIOS boot up message itself, the next 7770 gpu has extended data. Maybe because the most systems became the uEFI, so efi driver was need more information to work with gpu.

i think that this data is for PCI host, that contain Pci dev id, ssid, vendorid, addresses, pci expansion revision, etc. Maybe that is something related to execution of firmware.


included files:

That`s possibly SSID coded (3Bytes)

040B (0B04) vs D580 (80D5)

I think that its almost enough data to rebuild header of vbios for new, hope the most stable and final build

////////////
Option Rom Header links:

AArch64 option ROMs for AMD GPUs – Work Of Ard

https://www.programmersought.com/article/74293671592/

https://www.rom.by/forum/UEFI_BIOS_i_Option_ROM

edk2/BaseTools/Source/C/EfiRom/EfiRom.c at master · tianocore/edk2

EDK II. Contribute to tianocore/edk2 development by creating an account on GitHub.

github.com

PCI Expasion ROM(Option ROM) | DXR165の備忘録

Also this:

 

[bigguygeo]

Header research. Next Part.
With the brilliant idea @galkinvv, to switch to binary and to work there, brings to the new page of header research

The researching data is selected on image.

HEX:
0015000000D00100AA0121E102807E00220F4402120000000000003C400E02073C011A0004000000EEA0FF06000830400E010000000000001403000000000000BE7E1100B9071AD6502C000000000000000000000C404143000000001000000042000000807E06002000200012000E00

REVERSED HEX (its important to get similar binary code without formulas):
000E00120020002000067E800000004200000010000000004341400C000000000000000000002C50D61A07B900117EBE0000000000000314000000000000010E4030080006FFA0EE00000004001A013C07020E403C0000000000001202440F22007E8002E12101AA0001D00000001500

SSID - 80D5 = 1000000011010101
SUBVEN 103C = 1000000111100
DEVID 67E8 = 110011111101000

THE BINARY CODE:
11100000000000010010000000000010000000000000001000000000000000000
110011111101000 - DEVICEID
000000000000000000000000000001000010000000000000000000000000000100000000000000000000000000000000000001000011010000010100000000001100000000000000000000000000000000000000000000000000000000000000000000000000000000000010110001010000110101100001101000000111101110010000000000010001011111101011111000000000000000000000000000000000000000000000000000000011000101000000000000000000000000000000000000000000000000000000000100001110010000000011000000001000000000000000011011111111101000001110111000000000000000000000000000000100000000000001101000000001001111000000011100000010000011100100000000111100000000000000000000000000000000000000000000000000000100100000001001000
1000000111100 - SUBVENDOR
10001000000000011111101000000000000010111000010010000
1000000011010101 ----- SSID
00000000000000001110100000000000000000000000000000001010100000000

@hugodlc, @nikey22 have an idea how to find the principle where to cut data to get full access to data hidden there?



The best correctly binary converter:

Binary to Hexadecimal Converter

Binary to hexadecimal converter tool, convert up to 63 binary characters with this bin to hex conversion calculator with number samples table.

www.binaryhexconverter.com

I would like to recommend add FFh byte if the Hex starts from 00, otherwise this zero will be lost, look at demo:

The One and half bytes are lost

IF FF Is Used:

Good news!
Finally hack unknown part of header, decode it and patch, then code it back. The method explained in my 4150 for Zbook G3 theme at techpowerup.

So, I done the fully new build that is based on 560x header with patching and vgafirmware but with vortex vbios and parser + connectors patch + Apple memory training. And build is working fine with discrete mode. Stunning stable then ever before on such extreme hybrid vbios. But this means that with this method is possible to build 4170 vbios that will be almost fully vanilla and will work on discrete mode!!!



Also I recorded extended tutorial on how this was done! I will edit it next week. Two hours of work on new build!

This means that soon I will finish vbios builds project. So the last part is to solve thermal readings for fan control.





//////////// ///////////// //////////// //////////// //////////// //////////// //////////// //////////// //////////// ////////////

ACPI VBIOS LOCATION​

0x000000003DEAF068 RAM ADDRESS TO ACPI VBIOS IN VFCT Table.
The table itself start at 0x000000003DEAF000

 

[bigguygeo]

Vbios can be loaded by pci amd driver from:

 

[bigguygeo]

HP ZBook 15 G3 Mobile Workstation
Thunderbolt firmware + Thunderbolt SPI DUMP
For some reason the firmware duplicates 2 times in spi image

 

[bigguygeo]

Okay, let's see what the bios looks like there!

The EC dump after update and Main bios dump
(Sorry I am not providing platform bios sharing)

That means, that when update process was successful, then update volumes shares between those two spi ICs.
Comparison is simple: to compare update bios with content of flash dumps.

01-Padding_Non-empty_Padding0_EC_dump
Contain JFIF image and RSA signature.

01-Padding_Non-empty_Padding0_EC_dump AND 01-Padding_Non-empty_Padding_Update AND 01-Padding_Non-empty_Padding_BiosDump - contain same RSA signature
That mean that those GRAY VOLUMES ARE NOT SIGNATURE PROTECTED!!! PROTECTION HAS ONLY GREEN AND YELLOW VOLUMES. ME region also is not protected!


So EC firmware are editable!

 

[bigguygeo]

I suppose that gop rom is efi compressed gop driver. How to find out how efi compressed image mask look like?

Example: if Apple gop driver is compressed inside of vbios second rom, then it’s possible to decompress it and even build gop rom that is enabling boot screen for any gpu (amd) !?

Finally I got the key to GOP! I was right! It’s a compressed driver! Now I can create a GOP to any amd gpu and of course for Apple style gop with boot screen!


I have successfully get supported GPUS by Apple:

CARRIZO 9874

MULLINS

MULLINS(985F)

MULLINS(985E)

MULLINS(985D)

MULLINS(985C)

MULLINS(985B)

MULLINS(985A)

MULLINS(9859)

MULLINS(9858)

AMD Radeon XX-2200M with R2

AMD Radeon R2 Graphics

AMD Radeon R3 Graphics

AMD Radeon LEXA Graphics

AMD Radeon BAFFIN Graphics

AMD Radeon ELLESMERE Graphics

AMD Radeon FIJI Graphics

TONGA

AMD RADEON R9 200

AMD FirePro W7100

AMD FirePro S7150

AMD Radeon R9 M295X

AMD Radeon R9 M395X

TOPAZ

AMD Radeon R5 M255

AMD Radeon R7 M255KINGSTON

THEBE-P

THEBE(9920)

HAWAIIHAWAII LE

HAWAII GL Gemini

HAWAII GL40HAWAII XTGLBONAIRE

BONAIRE (6651)

BONAIRE (6065)

AMD FirePro W5100

AMD Radeon R9 M270X

AMD Radeon R9 M280XSATURN (6641)

AMD Radeon HD 8950KALINDI

AMD Radeon HD 8250

AMD Radeon HD 8180

AMD Radeon HD 82400/R3

AMD Radeon HD 8280E

AMD Radeon HD 8200/R3

AMD Radeon HD 8210E

AMD Radeon HD 8210

AMD Radeon HD 8330E

AMD Radeon HD 8330

AMD Radeon HD 8400E

AMD Radeon HD 8400/R3

KAVERI

KV SPOOKY MOBILE 35W

AMD Radeon R5 Series

AMD Radeon R7 Series

KV SPOOKY DESKTOP 95W

KV SPECTRE WORKSTATION 95W

KV SPECTRE WORKSTATION 65W

AMD Radeon R5 Graphics

AMD Radeon R4 Graphics

AMD Radeon R6 Graphics

AMD Radeon R7 Graphics

KV SPECTRE SL DESKTOP 95W

KV SPECTRE SL MOBILE 35W

KV SPECTRE DESKTOP 95W

KV SPECTRE MOBILE 35W



SUN/JET

AMD Radeon R5 M200

AMD Radeon HD 8500M

AMD Radeon HD 8600M



OLAND/Mars

MARS(6623)

MARS(6621)

MARS(6620)

AMD FirePro W2100

AMD Radeon R5 M240

AMD Radeon HD 8790M

AMD Radeon R7 M260

AMD Radeon R7 M265

MARS(6603)

MARS(6602)

AMD Radeon HD 8500M/8700M

AMD Radeon HD 8600/8700M

OLAND

AMD Radeon R7 200

VENUS PRO MCM

AMD Radeon E8860

AMD Radeon HD 8800M

AMD Radeon HD 7700

AMD Radeon R7/HD 9000

AMD Radeon HD 7700M

AMD Radeon HD 7800M

AMD FirePro W4100

AMD Radeon HD 8970M

AMD Radeon HD 7970M

AMD Radeon R9 200

AMD FirePro V(FireGL V)

NEPTUNE

AMD Radeon HD 7800

AMD Radeon HD 7900

Caicos/Seymour

AMD Radeon HD 6430M

AMD Radeon HD 7400M

AMD RADEON HD 6450

AMD Radeon HD 7000

AMD Radeon HD 7400A

AMD Radeon HD 8490

AMD Radeon HD 6400

AMD Radeon HD6460



Lombok/Thames



AMD Radeon HD 7000M

AMD Radeon HD 7500M/7600M

AMD Radeon HD 7600M

AMD Radeon HD 7400



Turks/Whistler/Onega

AMD Radeon HD 7670M

AMD Mobility Radeon HD 6000

AMD Radeon E6760

AMD Radeon HD 7500/7600

AMD Radeon 6600M and 6700M

AMD Radeon HD 6700M

AMD Radeon HD 7500

AMD Radeon HD 7600

AMD Radeon HD 6600

AMD Radeon HD 7600A

AMD Radeon HD 6500Barts/Blackcomb/Victoria

Mobility Radeon HD 6000

AMD Radeon HD 6900MCayman/Antilles

AMD Radeon HD 6900

AMD FirePro V (FireGL V)

AMD Radeon HD 7660

AMD Radeon HD 8550D

AMD Radeon HD 8650D

AMD Radeon HD 8310G

AMD Radeon HD 8410G

AMD Radeon HD 8510G

AMD Radeon HD 8370D

AMD Radeon HD 7400G

AMD Radeon HD 7480D

AMD Radeon HD 7420G

AMD Radeon HD 7540D

AMD Radeon HD 7520G

AMD Radeon HD 8610G

AMD Radeon HD 8570D

AMD Radeon HD 8550G

AMD Radeon HD 8670D

AMD Radeon HD 8650G

AMD Radeon HD 7500G

AMD Radeon HD 7600G

AMD Radeon HD 7620G

AMD FirePro A300 Series(FireGL V)

AMD Radeon HD 7560D

AMD Radeon HD 7640G

AMD Radeon HD 7660D

AMD Radeon HD 7660G

AMD Radeon HD 6300

AMD Radeon HD 7290

AMD Radeon HD 7310

AMD Radeon HD 7340

AMD Radeon HD 6290

AMD Radeon HD 6320

AMD Radeon HD 6250

AMD Radeon HD 6310

AMD Radeon HD 6550

SUMO 964F

SUMO 964E

AMD Radeon HD 6530D

AMD Radeon(TM) HD 6480G

AMD Radeon(TM) HD 6520G

AMD Radeon HD 6410D

AMD Radeon(TM) HD 6380G

AMD Radeon HD 6370D

AMD Radeon(TM) HD 6620G

AMD Radeon HD 6550D

AMD Radeon HD 6300M

AMD Radeon HD 7300

AMD Radeon HD 5450

AMD FirePro 2270

AMD FirePro (FireGL)

EG CEDAR

AMD Mobility Radeon HD 5000

AMD Mobility Radeon HD 5570EG REDWOOD

AMD Radeon HD 5500

AMD Radeon HD 5570

AMD Radeon HD 5670

AMD FirePro 3800 (FireGL)

AMD FirePro V4800 (FireGL)

AMD Mobility Radeon HD 6800

AMD Mobility Radeon HD 5800

AMD Radeon HD 6700

AMD Radeon HD 5600/5700

AMD Radeon HD 5700

AMD FirePro V5800 (FireGL)EG LEXINGTON

AMD Radeon HD 5900

AMD Radeon HD 6800

AMD Radeon HD 5800

AMD FireStream 9350

AMD FireStream 9370

AMD FirePro V9800 (FireGL)

AMD FirePro V7800 (FireGL)

AMD FirePro V8800 (FireGL)

 

[bigguygeo]

Working on BaffinM Support For iMac 2011

Thats why I always saying: begin from supported stuff to make working unsupported!​

Here Is Apple GOP for native GPU. As newer iMacs are not MXM, the same code is located at bios!
Solution: Create GOP with knowledge of HD6XXX GOP and based on new official release or from any laptop that support your GPU ;-)

Also i have found iMac GOP Framebuffer For Baffin, later will try to build fully working Rom!
The problem here is simple: 560X rom which was used for building vbios is not supported by drivers i have. So i need to redesign vbios again with Radeon Pro 560


BaffinM Gop driver

 

[bigguygeo]

Back to i2c patching

VAUGHN 4150

1E01 - SIZE
0103 - _ATOM_OBJECT_HEADER_V3
8A02 - usDeviceSupport
3E00 - usConnectorObjectTableOffset = 04 00 00 00 14 31 62 00 68
0000 - usRouterObjectTableOffset
CE00 - usEncoderObjectTableOffset = 04 00 00 00 20 21 F2 00
0000 - usProtectionObjectTableOffset
1200 - usDisplayPathTableOffset = 04 01 00 00 02 00 0A 00 14 31 00
0000 - usMiscObjectTableOffset

DisplayPathTableOffset
04 - ucNumOfDispPath
01 - ucVersion
00 - ucPadding2
00 - asDispPath

ATOM_DISPLAY_OBJECT_PATH

0200 - usDeviceTag; //supported device
0A00 - usSize; //the size of ATOM_DISPLAY_OBJECT_PATH
1431 - usConnObjectId; //Connector Object ID
0011 - usGPUObjectId; //GPU ID
2021 - usGraphicObjIds[1]; //1st Encoder Obj source from GPU to last Graphic Obj destinate to connector.

ATOM_DISPLAY_OBJECT_PATH


ATOM_DISPLAY_OBJECT_PATH

0800 - usDeviceTag; //supported device
0A00 - usSize; //the size of ATOM_DISPLAY_OBJECT_PATH
1331 - usConnObjectId; //Connector Object ID
0011 - usGPUObjectId; //GPU ID
2022 - usGraphicObjIds[1]; //1st Encoder Obj source from GPU to last Graphic Obj destinate to connector.

ATOM_DISPLAY_OBJECT_PATH



ATOM_DISPLAY_OBJECT_PATH

8000 - usDeviceTag; //supported device
0A00 - usSize; //the size of ATOM_DISPLAY_OBJECT_PATH
1332 - usConnObjectId; //Connector Object ID
0011 - usGPUObjectId; //GPU ID
1E22 - usGraphicObjIds[1]; //1st Encoder Obj source from GPU to last Graphic Obj destinate to connector.

ATOM_DISPLAY_OBJECT_PATH



ATOM_DISPLAY_OBJECT_PATH

0002 - usDeviceTag; //supported device
0A00 - usSize; //the size of ATOM_DISPLAY_OBJECT_PATH
1333 - usConnObjectId; //Connector Object ID
0011 - usGPUObjectId; //GPU ID
1E21 - usGraphicObjIds[1]; //1st Encoder Obj source from GPU to last Graphic Obj destinate to connector.

ATOM_DISPLAY_OBJECT_PATH


ConnectorObjectTableOffset


ATOM_OBJECT_TABLE //Above 4 object table offset pointing to a bunch of objects all have this structure
04 - ucNumberOfObjects;
00 - ucPadding[3];
00
00
ATOM_OBJECT asObjects[1];
ATOM_OBJECT_TABLE






_ATOM_OBJECT 01 //each object has this structure
1431 - usObjectID
6200 - usSrcDstTableOffset
6800 - usRecordOffset //this pointing to a bunch of records defined below
0000 - usReserved
ATOM_OBJECT 01

_ATOM_OBJECT 02
1331 - usObjectID
7D00 - usSrcDstTableOffset
8300 - usRecordOffset
0000 - usReserved
ATOM_OBJECT 02

_ATOM_OBJECT 03
1332 - usObjectID
9800 - usSrcDstTableOffset
9E00 - usRecordOffset
0000 - usReserved
ATOM_OBJECT 03

_ATOM_OBJECT 04
1333 - usObjectID
B300 - usSrcDstTableOffset
B900 - usRecordOffset
0000 - usReserved
ATOM_OBJECT 04




_ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT 01 //usSrcDstTableOffset pointing to this structure
01 - ucNumberOfSrc;
2021 - usSrcObjectID[1];
00 - ucNumberOfDst;
0000 - usDstObjectID[1];
ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT; 01


_ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT 02 //usSrcDstTableOffset pointing to this structure
01 - ucNumberOfSrc;
2022 - usSrcObjectID[1];
00 - ucNumberOfDst;
0000 - usDstObjectID[1];
ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT; 02


_ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT 03 //usSrcDstTableOffset pointing to this structure
01 - ucNumberOfSrc;
1E22 - usSrcObjectID[1];
00 - ucNumberOfDst;
0000 - usDstObjectID[1];
ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT; 03


_ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT 04 //usSrcDstTableOffset pointing to this structure
01 - ucNumberOfSrc;
1E21 - usSrcObjectID[1];
00 - ucNumberOfDst;
0000 - usDstObjectID[1];
ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT; 04




040C010010010000020000000104930002040400FF
040C010010020000080000000104920002040300FF
040C010020020000800000000104900002040100FF
040C010030020000000200000104910002040200FF





EncoderObjectTable
04
00
00
00
2021F200F8000000 F200 and F8000 are offsets to (010011011431 and 14040F00FF)
2022FD0003010000
1E2208010E010000
1E21130119010000

01001101143114040F00FF
01001101133114040F00FF
01001101133214040F00FF
01001101133314040F00FF

Back to Fan project:
If disable GPU via ACPI, then GPU not reporting problems or what happens? Fan goes supper quite.

 

[bigguygeo]

Custom GOP for wx4150, recommended for G3. Testing now. If everything will Okay, then will add to the first post

 

[bigguygeo]

MUX ICs. Better look. Trying to map track GPIO GPU_SEL
View attachment 210399

For some reason the motherboard does not have any dp to hdmi port converting IC, so possibly hdmi is connected to thunderbolt controller And it converts signals. I tried to beeping with multimeter but can’t get any results. But DP to VGA IC is beeping fine from mxm to mux, from mux to converter and from converter to d-sub connector.

The next stage is to find GPIO of mux mossfet at EC IC

The smd K72 datasheet
View attachment 210414

I spend some time on mapping traces of muxes, but the scheme of connections are really strange: those two transistors which switch to mux ways are connected together. The source are grounded, the gate are connected together too. So if the gate will open, then it will be open simultaneously for eDP to mxm and other ports to mxm. But mode bios graphics: hybrid is making all ports connected to mxm, but eDP to eDP, which is impossible with the way of provided electrical design. Weird...

Okay, i ve made some testing. And here is results:
On smd mosfet, pin GATE = 3.3V. On SIGNAL Pin = 0v, That means, that GATE is 0v too. So Laptop is Booting default to IGPU.
IGPU is A channel and on SELECT pin of MUX, means that is LOW logic switch.


So if on Signal comes signal, then Discrete graphics (B chanell) will work!

 

[bigguygeo]

After covering SMBus data lane, confirm that SMBus is not responsible to thermal reading.
So thermal readings are made from PECI

 

[eidairaman1]

So has a solution been found

 

[bigguygeo]

So has a solution been found

Hi! What do you mean solution?

On zbook g3 vbioses are working except fan controller, mux controller, initialization of gpu in preboot environment, random hotplug glitches and glitchy brightness control of gpu brightness pwm pin. I think that most of this glitches are acpi related or EC firmware. EC firmware is protected by 1 rsa 256 bytes key. Need to capture the spi boot traffic to find out who is checking the EC signature to unlock the firmware from security check. Then it will be possible to get patching. Hp SureStart is good thing at hp laptops, but is the bad if non stock modding wanted. I’ve done some research of SureStart and the low level of the security chain can be patched, but need better skills for that.

For example muxes for external b channel output can be occupied by external graphics, but outputs not working before gpu will reinitialized...

 

[bigguygeo]

Custom GOP for wx4150, recommended for G3. Testing now. If everything will Okay, then will add to the first post

Confirm, that one is WORKING!!!
Solves some noise on white color at bios ui and efishell64 now working on edp display only.

Based on GOP of zbook G4, anyway still need patch initialization of gpu




///////////////////// ///////////////////// ///////////////////// /////////////////////
///////////////////// ///////////////////// ///////////////////// /////////////////////
///////////////////// ///////////////////// ///////////////////// /////////////////////
///////////////////// ///////////////////// ///////////////////// /////////////////////




Possibly I have found something important that causes powermanagment problems: that is amd enduro!

https://www.amd.com/en/technologies/enduro

AMD Eyefinity Technology is a reason of display glitches


thanks to @m0bil

w5170m controller

http://www.farnell.com/datasheets/2712651.pdf

///////////////////////////////

Confirm that smbus is reporting temperature from gpu, also that is used for powermanagment and that’s the reason why g3 is so glitchy. Maybe it can be solved by Acpi workaround

Pics:

P.s. never do that trick, I almost brick EC controller, was required for extreme reanimation of cmos and EC....

////////////////

Question: how does opensource driver recognize the smbus data from gpu? Maybe all Id bytes are stored there and that will help to analyze acpis?

 

[bigguygeo]

PECI is single wire transfer Chanel

[PATCH v10 03/12] peci: Add support for PECI bus driver core - Jae Hyun Yoo

Datasheet of PECI IC controller.

https://www.onsemi.com/pdf/datasheet/nct7491-d.pdf

////////////////////// //////////////////////

Finally I got a proof that even supported gpu can work with mad fan if disabling smbus data and clk pins



Now we need to find out where this comes from: acpi or EC firmware

 

[bigguygeo]

Interesting info about smbus thermal readings with Pentium 2:

http://datasheets.chipdb.org/Intel/x86/Pentium%20II%20Xeon/24379101.PDF

I think that need more research need to be done with older devices that are using smbus