<< Solved >> AMD WX4170 dGPU on ZBook G5 17 Laptop

[EdwardGeo]

I highly suspect a whitelist in the management engine, based on symptoms.
2 approved cards (4150,4170) only 2 roms post in discrete and both are present as part of the bios. And get shadowed from bios, not the card in discrete mode.
That means the source for the management engine's shadow rom has to be in the bios itself. This explains why Crane works in hybrid, but can't be shadowed and device-id or something else mismatches to what is allowed by management engine or simply management engine looks for rom in bios, can't find it and bricks on post.

One way to test this theory would be to change the id of a known working rom Aomorhid to match Crane and see it if posts.

Same but reverse would be to edit Crane's id to match Aomorhid, and see if it posts.
I suspect if done right the laptop will post but the management engine will use the bios version, completely ignoring the rom in the card.

Because the Bios itself has so many security redundancies, I don't think editing the bios would be a good solution, so we have to find a way to inject our rom from the card to acpi.

There is no white list (only for secure Boot!!!!!!)

I dumped rom from VFCT table, but it was late night, so i cant remember how i did this.

The next step is to find where the image is located and to which one GFX0/*X* this one connected. I think, that if you change only one byte at this header (the number of spare, or subid device, then bios will no longer recognize gpu and will work only through MXM spi)

But!!! Only @nikey22 have suggestions about how to decode this data. Anyway the SMBus is connected to EC, and your firmware support any addresses of system management data, etc, so your system wont post about dead GPU as in my case. Why I am so sure?

That is really interesting why board have additional holes after SMD resistors, maybe this one connected else where, for example to chipset? And if i desolder those two resistors, maybe i will solve post issue problem? Hmm or somewhere else connected another device?

The other way, i started to test, but cant afford more time now to this way of efishell64 research. But recommend for reading: https://forums.macrumors.com/threads/2011-imac-graphics-card-upgrade.1596614/post-30132232

By @joevt from macrummors

early results:

 

[theroadw]

Ok not whitelist, but the same result. if Firmware Management Engine only shadows a rom that is already present in the bios image, it is a "whitelist" per se.
Now if the first GPU is IGPU, then it's all allowed, so no whitelist, but for discrete, the first GPU is MXM, and if the only way to make it work is to shadow the rom, and only an already present rom can be shadowed... = "whitelist by another name"

 

[EdwardGeo]

Ok not whitelist, but the same result. if Firmware Management Engine only shadows a rom that is already present in the bios image, it is a "whitelist" per se.
Now if the first GPU is IGPU, then it's all allowed, so no whitelist, but for discrete, the first GPU is MXM, and if the only way to make it work is to shadow the rom, and only an already present rom can be shadowed... = "whitelist by another name"

Okay, I get your vision of white list. You’re talking about SSID - subsystem id. And this part of atombios config, but this ssid is coded in he part of the rom which are comes with the mxm spare part. And we can easy to identify that coded ssid with comparing the Apple 13.3, 14.3 mbp vbios roms. As the header should be same, but coded ssid are different. That is good theory but it cannot pretend to be perfect as there is the gpu with no spi. So in this case efi program compares the device I’d with preloaded images. But this can be easy test with OEM vbios with two bytes patch of ascii code for example. If change ssid to non present, then system will load mxm vbios!

 

[theroadw]

Or stall/brick

 

[EdwardGeo]

Or stall/brick

It bricks if:
Checksum is wrong, and vrom won’t be loaded.

Subid or other data not corresponding to mxm itself, then cpu simply won’t find the gpu in address mapping. That’s data we need to decode to understand what’s wrong could be there.

One of modules causes infinite loop of procedure that freezes system.

Some registers are missing or not corresponding to expected and gpu is waiting for something

Wrong initialization sequence is executed

 

[EdwardGeo]

Good news!
Finally hack unknown part of header, decode it and patch, then code it back. The method explained in my 4150 for Zbook G3 theme at techpowerup.

So, I done the fully new build that is based on 560x header with patching and vgafirmware but with vortex vbios and parser + connectors patch + Apple memory training. And build is working fine with discrete mode. Stunning stable then ever before on such extreme hybrid vbios. But this means that with this method is possible to build 4170 vbios that will be almost fully vanilla and will work on discrete mode!!!



Also I recorded extended tutorial on how this was done! I will edit it next week. Two hours of work on new build!

 

[EdwardGeo]

Also I found who is loading vbios from mxm. And this is not a MacOS, that is clover/ OpenCore. Because that bootloader emulating parts of Apple ram mapping! The clover or whatevergreen loads there a video driver. So that’s why the whatevergreen has an option of injection for acpi and ioregistry vbioses!

 

[ganthore]

I am really impressed with the amount of work you've put into this. Makes me wonder how hard it would be to hack the rom of a similar device (the W4190M on a G4).

 

[EdwardGeo]

I am really impressed with the amount of work you've put into this. Makes me wonder how hard it would be to hack the rom of a similar device (the W4190M on a G4).

Thanks! But what is the problem and that gpu suppouse to be old now?

 

[EdwardGeo]

WX 4170
Final vBios build for Zbook G5 17
And WX 4170 for iMac 2011 (patched by @nikey22)

for additional info visit (project page):

AMD Radeon Pro WX 4150/4170 Mobile - custom VBIOS FOR HP ZBook

AMD Radeon Pro WX 4150 (Zbook 15 G3, G4) / 4170 (Zbook 17 G5) Mobile (...UPDATING...) Finnished new stable builds, will write post later. Old post can be seen at spoiler. At that moment - two vbioses are for hp cards, one for green dell _0_MyFinBuilds ===>...

www.techpowerup.com

​