(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[TimeWalker]

@jkbuha
We are still missing:

Code:

* Express Charge
Express Charge  = a Dell fast charging technology
Standard Charge = batteries charged over a longer period of time
Note:  ExpressCharge may not be available for all batteries

* Wireless Configuration
    * Wireless (Switch)/(Hotkey)
    This setting determines which wireless devices will be controlled by the wireless
        - None = The wireless switch is ignored
        - WLAN = The wireless switch only controls the WLAN device
        - BT = The wireless switch only controls the Bluetooth device
        - WLAN & BT = The wireless switch controls the Bluetooth and WLAN devices
        - WWAN = The wireless switch only controls the WWAN devices
        - WWAN & WLAN  = The wireless switch controls the WWAN and WLAN devices
        - WWAN & BT = The wireless switch controls the WWAN and Bluetooth devices
        - All= The wireless switch controls all wireless devices
        The factory default setting is All
    
    * Internal Bluetooth
    This option lets you enable or disable the internal Bluetooth device
        - Disabled  = The internal Bluetooth device is off and is not visibleto the operating system
        - Enabled   = The internal Bluetooth device is enabled
        The factory default setting is Enabled

    * Internal WLAN
    This option lets you enable or disable the internal WLAN device
        - Disabled = The internal Wi-Fi device is off and is not visibleto the operating system
        - Enabled = The internal Wi-Fi device is enabled
        The factory default setting is Enabled
        
    * Internal WWANThis option lets you enable or disable the internal WWAN device
    - Disabled = The internal Wi-Fi device is off and is not visibleto the operating system
    - Enabled      = The internal Wi-Fi device is enabled
    The factory default setting is Enabled
    
* Boot Configuration:
        * Boot Priority
        Select proirity of boot option between UEFI and Legacy
            - UEFI First
            - Legacy First
                
* ME Configuration

        * Intel AMT
        Enable/Disable Intel (R) Active Management Technology BIOS Extension
        Note : iAMT H/W is always enabled
        This option just controls the BIOS extension execution
        If enabled this requires additional firmware in the SPI device
        
        * Intel AMT Hot Key
        Enable/Disable Intel AMT Hot-Key during POST to enter MEBX setup
        
        * Intel AMT Setup Prompt
        Enable/Disable Intel AMT Setup Prompt to wait for hot-key to enter setup
        
        * Intel AMT SPI Protected
        Enable/Disable Intel AMT SPI write protect
        

* OverClocking Feature:
    
    * Performance Menu for Processor and Memory
        
        *Processor Bus Ratio Override and Bus Speed Override
            *CPU Flex Ratio Settings:
            This value must be between Max Efficiency Ratio (LFM) and Maximum non-turbo ratio set by Hardware (HFM)  
            
            *Flex Vid Override:
            Vid Override Paramters. Value varies from 8-48 (08h-30h),which relates to volts 14000v to 09000v. Each step equates to 00125v
            
            Bus Speed Support:
            Enable/Disable CPU Speed Override Support  
            
            Bus Speed Override:
            Value entered will be taken as overclocking percentage (%)of current clock frequency. Value varies from 0%-49%(0h%-31h%)

        * Memory Overclocking Menu
            * Memory Voltage Override Support:
            Enable/Disable option for Memory Voltage Support  
            
            * Memory Voltage:
            Memory Voltage Override
                1.50 Volts
                1.55 Volts
                1.60 Volts
                1.65 Volts
        
        * GT Overclocking Menu
            * GT OverClocking Support
            Enable/Disable GT OverClocking Support
            
            * GT OverClocking Frequency
            Overclocked RP0 Frequency (MLC Clk) in multiples of 50 MHz
            
            * GT OverClocking Voltage
            Extra voltage needed above the original RP0 voltage - The unit is 1/256 volt
        
    * ICC Configuration
        * Use Watchdog Timer for ICC
        Enable Watchdog Timer operation for ICCIf enabled,Watchdog Timer will be started after ICC related changed
        This timer detects platform instability caused by wrong clock settingsTurn off unused PCI/PCIe clocks
            - Disabled:all clocks turned on
            - Enabled:clocks for empty PCI/PCIe slots will be turned off to save power Platform must be powered off for changes to take effect
                
        * Lock ICC registers
            All registers: all ICC registers will be locked
            Static only - only static ICC registers will be locked

I've looked at 17R SE BIOS (SCT 2.1) and it appears that hidden menus are suppressed by questions in there.
Maybe it's the case with our missing options as well, or are you dead positive there are no *links* between menus and unicode strings in the module?

Also got heads up from @CodeRush:

1. ME v8 is required for Ivy Bridge support, without it there's no way 22nm CPU will work on 67-chipset
2. Regions are usually the same size on all platforms, the entry (start) points differ for different flashing software though. In UEFI BIOSes ME starts right after the Flash Descriptor (so 0x1000h in our case)
3. After FD lock has been set by OEM there's no software way to remove it, even the OEM flasher won't eliminate the lock. The only way to get rid of it is to flash 12 bytes 00 00 FF FF 00 00 FF FF 18 01 FF FF at 0x60h, that is correct for all the platforms.
4. If you try to flash the .cap from OEM onto the chip all the info in NVRAM storage will be wiped, so all the motherboard propriatory details will be lost foerever. Having an entire hw-based chip backup is a must!
5. The header 0x1000h - 0x37FFFh is common for both v7 and v8 ME firmware. If there's is old UEFI on the board it is unable to utilize 22nm CPUs and even ME v8 won't help here, because UEFI 2.0 has no support for it. If Dell does not release a single BIOS with ME v8 for your particular machine - there no way to have ME v8 and 22nm CPU support. Even if you had SDK/sources at hand we would still be helpless here, because as far as i know even ASUS had to ask Intell for support in regards to implementing the ME v8 into their BIOS. And still they failed miserably at it.
To conclude: Ivy Bridge and v8 ME support without the manufacturer's support is a dead end.

[jkbuha]

@TimeWalker - all the menus have been unlocked. What remaining options will be shown depends on the status of the hardware registers, which in our 15 series case means either WWAN/BT/Cell hardware toggles (which we don't have) or the ME configuration. For instance when I reboot from BIOS recovery mode I get the iRST menus as well, which I dont get in normal boot.

Re: ME v8 - I don't think we should play around with v8 for now. I think we should try to unlock v7 with the FITC tool (just like I proposed before) to see if the Clock + Voltage menus show up in the CPU sub-menu. That is something we should easily be able do now that the descriptor region is unlocked.

CodeRush sounds like he knows a thing or two about our BIOSes - which forum(s) is he on, and can he pop over here as well to help us?
EDIT - no worries I've found his posts.

Sent from my HTC One X

[kasar]

ok, going to try flash the file you gave me Tw

FPTw64.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-Y] [-P] [-LIST] [-I]
[-F] [-ERASE] [-VERIFY] [-D] [-DESC] [-BIOS] [-ME] [-GBE]
[-PDR] [-SAVEMAC] [-SAVESXID] [-C] [-B] [-E] [-REWRITE]
[-ADDRESS|A] [-LENGTH|L] [-FOVS] [-CFGGEN] [-U] [-O] [-IN] [-N] [-ID]

[-V] [-LOCK] [-DUMPLOCK] [-PSKFILE] [-CLOSEMNF] [-GRESET]
[-PAGE] [-SPIBAR] [-R] [-VARS] [-COMMIT] [-COMPARE] [-HASHED]

-H|? Displays help screen.
-VER Displays version information.
-EXP Displays example usage of this tool.
-VERBOSE<file> Display the debug information of the tool.
-Y Do NOT prompt when a warning occurs.
-P<file> Specifies a flash part definition file to use.
-LIST List all SPI devices supported.
-I Displays information about the flash image.
-F<f>[NoVerify] Load binary file into flash. "NoVerify" skips verify.
-ERASE Erase the contents of flash.
-VERIFY<file> Compare binary file to flash.
-D<file> Dump flash contents to file or "STDOUT".
-DESC Load/verify/dump Descriptor region.
-BIOS Load/verify/dump BIOS region.
-ME Load/verify/dump ME region.
-GBE Load/verify/dump GbE region.
- Press any key to continue -
-PDR Load/verify/dump PDR region.
-SAVEMAC Saves the GbE MAC when GbE is being reflashed.
-SAVESXID Saves the GbE SSID and SVID when GbE is being reflashed.
-C Erase entire flash part.
-B Check to see if the flash part is erased.
-E Do NOT erase area before writing to flash.
-REWRITE Rewrite the SPI with file data even if flash is identical.
-ADDRESS|A<address> Flash address to load/verify/dump file.
-LENGTH|L<length> Number of bytes to load/verify/dump.
-FOVS Displays list of FOVs supported.
-CFGGEN Generates an FOV Input File.
-U Update Variable.
-O<file> Sets an output file name.
-IN<file> Input param file.
-N<name> Name of variable.
-ID<id> Id of the FOV to be updated.
-V<value> Value for variable.
-LOCK[PDR] Sets SPI flash region access to Intel recommended values
-DUMPLOCK Dumps the current lock settings to screen.
-PSKFILE<file> PSK key file name.
-CLOSEMNF[NO] [PDR] End of Manufacturing. Details on NO & PDR use -exp option
-GRESET[NO] Global reset drives GPIO30 low unless "NO" is provided.
-PAGE Pauses the screen when a page of text is reached.
-SPIBAR Display the SPI BAR.
- Press any key to continue -
-R<name> Read a variable.
-VARS Display supported variables.
-COMMIT Commit updates to FOVs requiring a FW reset.
-COMPARE<file> Compare variable with expected value filled in a text file
-HASHED Display a variable (from read command) in hashed format.

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.


Error 200: Invalid parameter value specified by user. Use -? option to see help.


C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>fptw64.exe -ME -F 1427_8.0.BIN

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "1427_8.0.BIN"
File Length: 1560576
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x17E000] 1524KB of 1524KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x005000] - 100% complete.
- Programming Flash [0x005000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x00A000] - 100% complete.
- Programming Flash [0x00A000] 8KB of 8KB - 100% complete.
- Erasing Flash Block [0x00D000] - 100% complete.
- Programming Flash [0x00D000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x011000] - 100% complete.
- Programming Flash [0x011000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x01D000] - 100% complete.
- Programming Flash [0x01D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x025000] - 100% complete.
- Programming Flash [0x025000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x02D000] - 100% complete.
- Programming Flash [0x02D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x033000] - 100% complete.
- Programming Flash [0x033000] 12KB of 12KB - 100% complete.
- Erasing Flash Block [0x035000] - 100% complete.
- Programming Flash [0x035000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x092000] - 100% complete.
- Programming Flash [0x092000] 360KB of 360KB - 100% complete.
- Erasing Flash Block [0x107000] - 100% complete.
- Programming Flash [0x107000] 460KB of 460KB - 100% complete.
- Erasing Flash Block [0x159000] - 100% complete.
- Programming Flash [0x159000] 320KB of 320KB - 100% complete.
- Verifying Flash [0x17E000] 1524KB of 1524KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>

@jkbuha

wich one?

we hard to find anything at this topic at the moment

[jkbuha]

@kasar - try this:

1) Dump your Desc table via fptw.exe -DESC -D DESC.BIN
2) Open FITC and load up DESC.BIN
3) Go to Master Access Section, and select Manageability Engine.
4) Change Read/Write Access to Enable
5) Go to CPU section & change bitmap as per post on rag.asus
6) Save DESC_MODIFIED.BIN (in compact mode to get it to 4kb)
7) fptw.exe -DESC -F DESC_MODIFIED.BIN

Sent from my HTC One X

[TimeWalker]

@jkbuha
I see... that's what I assumed at first, SMBIOS firmware capabilities define what's shown and whats not.
But looking at 17R SE has kind of lead me into thinking the opposite ..

His main thread is over at overclockers.ru (hence the reason I do my "rough translations" of the said quotes), but he's also somewhat active on hardforum.com
I've asked about FITC as well, he said that virtually nothing can be unlocked with this tool .. even on desktop boards it doesn't do any justice ..

Sure you can try, but I will be highly surprised if it works. At least I wasn't able to unlock anything using this tool. There surely is some other algo used to control these features.

Well, won't disturb you any longer .. enjoy the wedding

[jkbuha]

thanks mate

good luck kasar as well - will get back to some more helpful advice once i'm back from the wedding (and reduced alcohol consumption )

Sent from my HTC One X

[TimeWalker]

I'm also looking for:
"Phoenix Technologies SecureCore Tiano Technical Reference Manual -Vol 2"
So far I've stumbled upon only the first chapter of it: http://notebook.tmx.hu/bulletinek/Phonix_Bios.pdf
Why you may ask?
There's this person supposedly taking some training to become a Phoenix agent.. (http://www.phoenix.com/pages/training) he makes notes to himself on some wordpress blog: http://kunyichen.wordpress.com/
And even though the snippets are somewhat useless we can at least see that there's an SDK somewhere in the wild available to certain people as well as some sort of documentation to accompany it.

[kasar]

@kasar - try this:

1) Dump your Desc table via fptw.exe -DESC -D DESC.BIN
2) Open FITC and load up DESC.BIN
3) Go to Master Access Section, and select Manageability Engine.
4) Change Read/Write Access to Enable
5) Go to CPU section & change bitmap as per post on rag.asus
6) Save DESC_MODIFIED.BIN (in compact mode to get it to 4kb)
7) fptw.exe -DESC -F DESC_MODIFIED.BIN

Sent from my HTC One X

ok, trying those atm

fptw.exe -DESC -D DESC_BACKUP.ROM
fptw.exe -ME -D ME_BACKUP.ROM

here are the backups
http://www.mediafire.com/?cxx5j8ir71f631t



at the step 3)

wasnt that what I made by desoldering , flashing from lpt directly to chip, and resoltering back to the mobo in order to unlock that stuff?



also didnt got step 4, what bitmap option I have to change?

[jkbuha]

Sorry kasar difficult to type everything when u have a few drinks too many

I meant the following (copying and paste from my previous post a few weeks back)

1) Dump ME using fptw.exe -ME -D ME.BIN. If correctly unlocked you should be able to dump this file.
2) Load up FITC and load ME.BIN
3) Under ME Region goto Configuration/ICC Data/ICC Profile 0/FCIM/BTM specific ICC registers
4) If Clock Source Select is 0x00011A33, then the Dells use the PLL built into the PCH, so we can change it to 0x00011A34 to enable overclocking. If this value is something else then we cannot enable overclocking like this
5) If successful save ME_MODIFIED.BIN in compact form
6) fptw.exe -ME -F ME_MODIFIED.BIN

Good luck!

Sent from my HTC One X

[kasar]

thanks



yeah, my me_backup shows 0x00011A33



anyway, when I go to build, i get this error :o





arrgg, I can feel how close I am from enable OC!