Contribute
Register

<< Solved >> AMD WX4170 dGPU on ZBook G5 17 Laptop

Status
Not open for further replies.
Ohh... I tired of this))):banghead:
Me2
All ways of success are related to VRAM Timings (look at timings are reported in roms):
I also saw that possible link, But I guess it would be possible to use the new Aomorhid Rom that has 3 sets of timings and use the space from Micron and Hynix to make a complete Samsung set without changing the Rom size? It is a big edit that could take a lot of time to do, and may not even be the real problem.

I also suspect it could be related to PMRD, or it may just be a symptom.
It shows up in my test logs and clearly there's a difference in the stalled boot, and PMRD is one of the different things, but it could be just that because the drivers aren't loading, then PMRD changes, so it may be nothing.
How do you unbricking vbios rom without programmer?
I've been lucky and just reboot into windows and since the IGPU is primary, I can recover easily.
 
Me2

I also saw that possible link, But I guess it would be possible to use the new Aomorhid Rom that has 3 sets of timings and use the space from Micron and Hynix to make a complete Samsung set without changing the Rom size? It is a big edit that could take a lot of time to do, and may not even be the real problem.

I also suspect it could be related to PMRD, or it may just be a symptom.
It shows up in my test logs and clearly there's a difference in the stalled boot, and PMRD is one of the different things, but it could be just that because the drivers aren't loading, then PMRD changes, so it may be nothing.

I've been lucky and just reboot into windows and since the IGPU is primary, I can recover easily.
So your laptop is better for patching vbios. Because I already resolder flash more than ten times and heated it by heatgun to temperature 420-450 Celsius.... soon tracks will popcorn... I will try mxm oem pegatron with eDP patch will pay attention while test to power play, and timings. High Sierra only. Actually this values can be discovered inside ioregistry in a real-time.
 
So your laptop is better for patching vbios. Because I already resolder flash more than ten times and heated it by heatgun to temperature 420-450 Celsius.... soon tracks will popcorn... I will try mxm oem pegatron with eDP patch will pay attention while test to power play, and timings. High Sierra only. Actually this values can be discovered inside ioregistry in a real-time.
Yeah I don't mind testing the vbios, seems pretty safe to recover from bad flash/rom
 
Yeah I don't mind testing the vbios, seems pretty safe to recover from bad flash/rom
I start to working on vram timings.
Screen Shot 2021-05-20 at 21.07.23.pngScreen Shot 2021-05-20 at 21.12.01.png


Tried clover inject, not injecting vbios.

So i decided to dump vbios from clover, and that dump some useless bytes file c0000.bin
 

Attachments

  • hp pegatrom.txt
    2 KB · Views: 33
  • hp vagum.txt
    954 bytes · Views: 40
  • c0000.bin.zip
    64.4 KB · Views: 35
The only catch is that the memory table size (may) will need to be changed, and that will change all the following offsets.
 
Last edited:
The only catch is that the memory table size will need to be changed, and that will change all the following offsets.
Are you sure? I mean if main bios is consist of images, maybe video bios has image name and data?

Upd1
Find some info about reverse engineering
 
Last edited:
If you see the VRAM info table is declared with offset and lenght, and so are all tables:

Screen Shot 2021-05-20 at 4.50.25 PM.png


So if you change/add any length to any table, then you would have to cascade the following offsets and most likely the total length, wherever that is declared.

Screen Shot 2021-05-20 at 4.51.33 PM.png



edit

I may be wrong, but I'm trying to stay away from this sort of rom editing because I believe it will be incredibly difficult if at all possible. It's usually not the same thing to change some info than it is to add info.
 

Attachments

  • Pegatron_Catalina.xml.zip
    8.5 KB · Views: 26
If you see the VRAM info table is declared with offset and lenght, and so are all tables:

View attachment 519205

So if you change/add any length to any table, then you would have to cascade the following offsets and most likely the total length, wherever that is declared.

View attachment 519207


edit

I may be wrong, but I'm trying to stay away from this sort of rom editing because I believe it will be incredibly difficult if at all possible. It's usually not the same thing to change some info than it is to add info.

check this links: before editing timings and after


EDIT1:
As you see, the only value is mismatch by offset is power related. So possibly the only thing which protect video bios from inserts is power configs. So protection just will not power on gpu. So if we find out where jump to power table is located, we can change it and we will be able to get rom working!

EDIT2.
Interesting article about reading vrom


EDIT3.
I have a feeling that I found jump to offset. So now need to find string in and out to compare it with other vbioses. Possibly the rom tables are easy build as they are initialize on early stage and gpu chipset uses no force to decompile or execute.


EDIT4.
finaly found reverse offsets to power tables and patched it

Xml report here:


Not tested yet.

Adding two Files:

Before timings insert and reverse offset jumps.zip
After timings insert and reverse offset jumps.zip

Only reasonable problem :(
before
<VoltageObjectInfo>49580 = 0xC1AC = 0b1100000110101100</VoltageObjectInfo>

after
<VoltageObjectInfo>50412 = 0xC4EC = 0b1100010011101100</VoltageObjectInfo>


EDIT5.

I compare this line with 3 versions of vbios

Original MXM (Timings extracted)
<VoltageObjectInfo>43640 = 0xAA78 = 0b1010101001111000</VoltageObjectInfo>

HP vbios from G4 bios
<VoltageObjectInfo>49580 = 0xC1AC = 0b1100000110101100</VoltageObjectInfo>

HP vbios from G4 bios (Timings inserted)
<VoltageObjectInfo>50412 = 0xC4EC = 0b1100010011101100</VoltageObjectInfo>


EDIT6.
Also done some offset test for polaris bios editor, by forcing adding FFFFFFFFF empty space after every efi image, starting from the end of the file, deleted GOP, as i don`t need garbage for patching. So if you compare files in Vaughn_emptyspaces_and_original.zip, you will see, that the last strokes before insert of empty space are related to voltages. I randomly (in another file) added any values after stroke, and Polaris bios editor even not recognize any changes in XML, so possibly this line ending the main gpu bios (base components and hardware control).
28 00 03 01 01 07 0C 00 12 00 00 00 00 00 00 00 02 00 18 00 00 02 00 00 00 00 00 40 00 00 00 00 46 05 00 00 00 40 DC 05 28 00 03 01 FF FF FF 00 7D 00 B8 0B 01 00 00 00 FF FF FF 00 C8 00 4E 0C 02 00 00 00


EDIT7.
P.S. VIDEO OUTPUTS
Are located before Vram sections


EDIT8.
I read Polaris opencode and didnt find any important relationship "VoltageObjectInfo" to BIOS values

AND I FOUND SOME IMPORTANT INFO ON POLARIS BIOS GITHUB PROJECT

IMPORTANT:
You need to disable SecureBoot / Activate CSM in your
Motherboard UEFI because the modification will make
the cryptographic signature invalid.


EDIT9.

@theroadw

And about memory trainings, you was interested in:

1621609021689.png

 

Attachments

  • After timings insert and reverse offset jumps.zip
    107 KB · Views: 46
  • Before timings insert and reverse offset jumps.zip
    106.5 KB · Views: 26
  • Vaughn_emptyspaces_and_original.zip
    87.8 KB · Views: 23
Last edited:
Not following this thread, so maybe you already know about this. I saw a WEG commit to be released in WEG 1.5.0 that might be relevant.
 
Status
Not open for further replies.
Back
Top