<< Solved >> AMD WX4170 dGPU on ZBook G5 17 Laptop

theroadw said:

GitHub - galkinvv/PolarisBiosEditor-xml: PolarisBiosEditor 1.7xml: fork with dumping additional data as XML in console.

PolarisBiosEditor 1.7xml: fork with dumping additional data as XML in console. - galkinvv/PolarisBiosEditor-xml

github.com

It may be different on G3, but on G5 Bios, whenever a hardware change is detected (more RAM, change in nvme or mxm) the Bios does this weird setup where the fans spin up to max and it cycles OFF/ON a couple of times.
I have a theory that it may be decrypting the Bios and storing a working Bios with the new config in the flash ROM or something.

Then also when you change the graphics config, it does a similar, but less extensive config, so I believe that the Bios could be setting the controllers in a particular state that can't be changed on the fly. (maybe writing to their respective ROMS)

I find this Bios is very glitchy, and sometimes you have to reset to defaults, or reset the EC controller, or take out an NVME drive and then go through a reboot, then put it back so it does it's thing, then everything works as expected.

It is definitely a complicated box, and has many unknown variables and trying to understand what is happening based on limited information is guesswork at best.

I like the fact that I now have 2 working Catalina ROMS for the WX-4170, and 4 Mojave ROMS, so hopefully using that xml polaris editor I can get enough info to compare , and maybe edit a ROM or patch the driver, whichever is easier.

Click to expand...

it may be corrupted, but i got it opened


Here is atom bioses)


i extract it))))


Try and replay how its


Also added DXE section into "Entire corrupted section 372B56DF-CC9F-4817-AB97-0A10A92CEAA5.bin.zip"


This articles help to reconstruct efi volume:

UEFI notes

Collection of my projects and hacks.

trmm.net

GitBook

GitBook

edk2-docs.gitbook.io

LongSoft/UEFITool

UEFI firmware image viewer and editor. Contribute to LongSoft/UEFITool development by creating an account on GitHub.

github.com

Click to expand...

EdwardGeo said:

Here is atom bioses)
i extract it))))

Click to expand...

Where did you get this from?
The Bios updates I've got don't show this information

Unfortunately it is the wrong size, so something is off.

I've attached the xml dumps so we can try and make sense of the information.

theroadw said:

Where did you get this from?
The Bios updates I've got don't show this information

Unfortunately it is the wrong size, so something is off.

I've attached the xml dumps so we can try and make sense of the information.

Click to expand...

theroadw said:

I have a theory that it may be decrypting the Bios and storing a working Bios with the new config in the flash ROM or something.

Click to expand...

Actually its native vbioses used by Hp Zbook G5. I reconstruct efi volume partition as. That’s why UEFITOOL didn’t get access to volume. After reconstruct, volume is almost correct. They should work, only need to add GOP and Gop enable bytes, recover checksum

It was bios update, but first revision. So now extracted vbioses from latest update

Do you mind sharing how you reconstructed the efi volume partition?

I'm testing the new ROM and so far so good, it's performance is a bit better:





So between 2-5% better. I did check and the Memory Straps were different, so HP must have tweaked them a bit.
Thank you!

Still no Catalina with this new ROM though. Same problem as AFFLECK.

theroadw said:

Do you mind sharing how you reconstructed the efi volume partition?

I'm testing the new ROM and so far so good, it's performance is a bit better:

View attachment 518821View attachment 518823

View attachment 518824View attachment 518825

So between 2-5% better. I did check and the Memory Straps were different, so HP must have tweaked them a bit.
Thank you!

Still no Catalina with this new ROM though. Same problem as AFFLECK.

Click to expand...

I will write short manual in two days.


I think the problem is in framebuffer or driver. You wrote about it earlier. If native rom won’t work then non native is faulty and because of this part of driver won’t work as expected and you don’t have your issue

theroadw said:
I'm testing the new ROM and so far so good, it's performance is a bit better:

Click to expand...

Its quite nice. Do G5 have wx4150 support? maybe i will rebuild my spi rom)))



UPD1.
Added all ATOMBIOSES from first revision of bios and the latest.
G5 WX4170+WX4150 +++ G4 WX4150.zip





UPD2
Made G5 WX4150 bios update based on GOP from MXM OEM card, UEFI patched, Cheksum patched
ID67E8 - G5 - WX4150 + GOP - HP Vortex C98501 BaffinM GLPro A0 GDDR5 4GB 214e_300m_SecondRevision.zip

Wx4150 thread here:

AMD Radeon Pro WX 4150 Mobile - moded VBIOS FOR HP ZBook 15 G3

AMD Radeon Pro WX 4150 Mobile - moded VBIOS FOR HP ZBook 15 G3 This bios enables almost full support of GPU in Zbook G3 is based on Zbook G4 video bios with UEFI added GOP and UEFI (HEX) enabled. Checksum also patched. All ports working well. Even the displayport to VGA connector, which sounds...

www.techpowerup.com

UPD3
Something wrong with Anoraks ATOMBIOSReader.exe, I mean it reading wrong values, or wrong offsets.

EdwardGeo said:

I think the problem is in framebuffer or driver. You wrote about it earlier. If native rom won’t work then non native is faulty and because of this part of driver won’t work as expected and you don’t have your issue

Click to expand...

It could also be because Apple in all their wisdom decided to change the drivers and restrict certain cards and only if the magic "card+secret-sauce" is met, then the drivers load.
Since these Polaris cards exist in many flavors, I guess there are a couple that "fit" the wx-4170 and that have the secret-sauce.
So not because non-native is faulty, but because apple restricts to a special combo that this card+Rom doesn't have.
The biggest difference in the Roms is the memory straps/timing, mine has 2, all the working ones have 5 or more.
But I think the problem is the device-id. There's no faking it, not with a SSDT, changes in config, booting with a modified DSDT, editing the ROM, enabling CSR boot, etc... no matter what I do, if the ROM belongs to the real 4170 family, then the device id is always 67E0.
If I use one of the other working Roms, then the device-id changes and Catalina Boots.

Just did a full pass on all my tests, and the new ROM is great, overall a bit better than the one I had, both in temperature and performance.

So back to square 1, find what they changed in drivers and how to patch it.

edit:
Yes the Vortex is for the 4150

theroadw said:

It could also be because Apple in all their wisdom decided to change the drivers and restrict certain cards and only if the magic "card+secret-sauce" is met, then the drivers load.
Since these Polaris cards exist in many flavors, I guess there are a couple that "fit" the wx-4170 and that have the secret-sauce.
So not because non-native is faulty, but because apple restricts to a special combo that this card+Rom doesn't have.
The biggest difference in the Roms is the memory straps/timing, mine has 2, all the working ones have 5 or more.
But I think the problem is the device-id. There's no faking it, not with a SSDT, changes in config, booting with a modified DSDT, editing the ROM, enabling CSR boot, etc... no matter what I do, if the ROM belongs to the real 4170 family, then the device id is always 67E0.
If I use one of the other working Roms, then the device-id changes and Catalina Boots.

Just did a full pass on all my tests, and the new ROM is great, overall a bit better than the one I had, both in temperature and performance.

So back to square 1, find what they changed in drivers and how to patch it.

edit:
Yes the Vortex is for the 4150

Click to expand...

Did you try booting without whatevergreen and patch kext framebuffers Baladi, Berbice, Palena and one which have same layout with zeros?

I am 100% sure that vbios is so simple and couldn't have some verification codes. Did you try to disassemble working and non working vbioses?

So back to square 1, find what they changed in drivers and how to patch it.

Click to expand...

Possibly this is second way of solution is better. Or possibly problem in hack. I am interesting if you will insert this gpu to iMac running Catalina, what would happen then? Some users was trying to use wx4170 on imac. Maybe those users are now on Catalina and are able to share their experience?


UPD1
Could you make whole picture from geekbench? You can find your GPU by its Original name in search browser of Geekbench 4 and 5. Its possibly to find one who succeded with WX4170 on Catalina on real mac or hack. I suppose everyone after gpu upgrade is making some of this tests

UPD2
They are talking about something, they call it "kickstart", but on Catalina and so on supposed to work without this "Kickstart"

Please read this articles (Posts):

UPD3
Backward to bios discuss
UEFI BOOT PROCESS

link:

Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware - SentinelLabs

Learn how to emulate, trace, debug, and Reverse Engineer UEFI modules in part 2 of our new blog series on Firmware Security

labs.sentinelone.com

Click to expand...

EdwardGeo said:

Did you try booting without whatevergreen and patch kext framebuffers Baladi, Berbice, Palena and one which have same layout with zeros?

Click to expand...

It's not a framebuffer issue, I tried injecting different framebuffers without Whatevergreen and nothing

EdwardGeo said:

I am 100% sure that vbios is so simple and couldn't have some verification codes. Did you try to disassemble working and non working vbioses?

Click to expand...

Not a verification code, but a particular string that the drivers want to see, for example: 'device-id=67E8 && "BaffinM XT"' in boot message.

Different cards have different particular specs, and apple probably narrows down how the drivers interact with the card based on this "yet-unknown" part of the ROM.

I just did a test based on the RX480 -> RX580 ROM conversion and changed these bytes:


Now the card is recognized as device-id 67E8 but the drivers in Windows refuse to load, and in MacOS it's a hard crash on boot on any OS version.
So if the drivers think this is a E8 (4150) they treat it differently than a E0 (4170) and not just based on what is in the ROM, but something else that is coded in the driver itself.

The other ROM for the G5-4150 (VORTEX+) has device ID E8 but no Samsung Memory, so it will not work with my card, and even if I change the memory to Samsung and adjust the straps, the GPU clock is still set to 1GHZ (instead of 1.2GHZ) and the shaders, voltages and temps are also for the 4150, so I would expect the same performance issue as before with my other 2 "working" Catalina ROMS.

EdwardGeo said:

Possibly this is second way of solution is better. Or possibly problem in hack. I am interesting if you will insert this gpu to iMac running Catalina, what would happen then? Some users was trying to use wx4170 on imac. Maybe those users are now on Catalina and are able to share their experience?

Click to expand...

I spent days reading all the imac forums where they swapped the MXM for a 4150 or 4170. Out of the 2 the 4170 turned out to be more troublesome, and they solved the issue by using a 4150 ROM on the 4170. They are happy to have a working card for their once-GPU-dead iMac, so I doubt they mind the loss in performance.

One thing I haven't tried is to inject a device-id swap after, just when I inject my PP Tables, maybe since it's after SSDT's and whatevergreen, but before the drivers kick in, I can fool them into thinking it is a E8...
-edit
Didn't work, my guess is that the drivers are talking directly to the MXM card's ROM

This is my current theory:
We think the 67E0 device-id (4170) is in Apple's drivers because we find it in AMD9500Controller, and in AMDRadeonX4000, but it's possible the drivers for Catalina+ removed support for this device-id and they just didn't change the info.plist, so we think 67E0 is supported but in fact it isn't by the new drivers. So the info.plist in the driver reads the device-id, makes the match, tells the driver to load, but since the driver no longer supports the device-id it stalls, and since the WindowServer depends on the driver to return, it never moves ahead.
If I use radvesa, it instructs the drivers not to load, then WindowServer moves ahead and I have a working Catalina...but no DGPU.
If I flash a ROM that has a supported device-id, drivers load, and everything works.
In Mojave the device-id 67E0 is in the drivers, so it works.

This could narrow down the problem to AMDRadeonX4000.kext

theroadw said:

Catalina+ removed support for this device-id and they just didn't change the info.plist, so we think 67E0 is supported but in fact it isn't by the new drivers.

Click to expand...

Impossible. Long time ago I inject by adding pciid of x1200, x1600, hd2400, hd4850 which wasn’t have supported by Apple but almost fine was working on tiger, leopard and snowleopard. I even inject ati9500 agp on tiger with id injection. So info plist are not responsible to this issue. What is actually loading on 70 percent of boot? Is it possible to get desktop over VNC, AnyDesk? As if you see UI, then drivers are working fine. The stage you’re reporting possible related to software problem or what? I remember possibly same issue on mine hd4850, it was only one port working, but after wake screen shows boot logo for few second, it like some sort of framebuffer cache. Did you try boot on DisplayPort only with magnet on power button or closed lid? Possible reason why it’s happening is because of igpu mux and pci tunneling. Because I didn’t find any other way of connectors from dGPU to cpu. Actually I can remove logic board and using multimeter find those port path ways, but it’s to hard to do carefully remove of keyboard ((

I only suggest that your issue is possible igpu graphics buffer issue when it won’t go through it to transcoder and transmitter...

Do you correct checksum after this overrides?

EdwardGeo said:

Impossible. Long time ago I inject by adding pciid of x1200, x1600, hd2400, hd4850 which wasn’t have supported by Apple but almost fine was working on tiger, leopard and snowleopard. I even inject ati9500 agp on tiger with id injection. So info plist are not responsible to this issue.

Click to expand...

Info.plist is not responsible, I explained myself wrong, AMD9500Controller loads and is fine, this in turn loads AMDRadeonX4000 and this one or one of it's dependencies are the ones that stall.
The device ID is in the AMDRadeonX4000 kext info.plist, but maybe support for the actual id is not in the kext itself, or it is but only if ssid matches a certain card model, or something else we don't know.

EdwardGeo said:

What is actually loading on 70 percent of boot?

Click to expand...

Nothing, it goes from verbose to Apple Logo, but bar never moves, GPU fan starts to spin (suggesting drivers are loading) then stall.

EdwardGeo said:

Is it possible to get desktop over VNC, AnyDesk?

Click to expand...

No, the stall happens before there is a desktop available over the network or in any other way. boot logs don't show any error on the stall.

EdwardGeo said:

Did you try boot on DisplayPort only with magnet on power button or closed lid?

Click to expand...

Tried all the possible combinations, lid closed, discrete, hybrid, only display port, only hdmi, only usb-c, always stall

EdwardGeo said:

Possible reason why it’s happening is because of igpu mux and pci tunneling. Because I didn’t find any other way of connectors from dGPU to cpu. Actually I can remove logic board and using multimeter find those port path ways, but it’s to hard to do carefully remove of keyboard ((

Click to expand...

Ok I did think of that before, but why does it work with a different ROM then? and or Mojave?
Not a hardware issue, definitely a driver in Catalina

EdwardGeo said:

Do you correct checksum after this overrides?

Click to expand...

Always


Also forgot...

Reverting to using Affleck ROM since the new Aomorphid crashed the WindowServer when connecting the usb-c display. And in more than a month of heavy daily use (including connects and disconnects, multiple monitors, etc) with Affleck this never happened.
Maybe the ROM is the right one, but my card is the cheap-version and doesn't like the new fancy HP ROM...