(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

wow, so many updates here and the forum doesnt send me notification emails anymore >.<

really nice job guys

so many progress, and those new addons seems really great, yeah, of course I want to go in too ^^

those wireless menus seems interesting, and as for the ME firmware source code, it also looks definitly great

as many of you know, my main goal is add functionality and more options to the firmware like you all do, specially if focused to performance boost / overclocking.

I noticed you are messing with the alienware r3 firmware, is it posible to "port" some modules?

I compared the famous advanced menu module with the alienware's one and the alienware's is bigger, and have more options, I tried to replace it directly, but it caused the advanced menu to entirely disappear, so like I suposed it isnt that easy as just replace a module.

let me know how I can help

edit: I am unable to open the intel sources reference link.

do I need specific software to handle that link or something?

[Brabbelbla]

A BitTorrent client?

And the M17x R3 has Insyde firmware, not Phoenix, guess that creates some problems. Furthermore, I guess the Advanced module contains primarily the visual part of the settings. If I am correct, the contents of the variable stores in NVRAM control the actual functionality. So I guess adding options is not as simple as porting a module, you have to know which bytes of which variable store control which function. Which you can't, other than by trying and looking at clues in the module. Of course, porting a module from the same UEFI and system vendor highly increases chances of 'it' working without edits. Don't take my opinion for truth, though, those are just my thoughts.

Anyway, what settings did you see we don't have?

[kasar]

haha ok ^^

working now properly with utorrent, dont know why it didnt detected it properly as before it did with previous links, upgrading utorrent to newer version fixed it, downloading right now the package, tomorrow I will have the files


oh, thanks for the info, yeah, that makes sense.

well, I miss overclocking options at the bios, bclk control.

I currently do some basic bclk overclocking from xtu thanks to a little ME modding, but that isnt enough for me.

I heard that the crazy OC jkbuha archived with cloverefi could be related with bclk strap option being set to 125 mhz instead 100, that could sightly improve the oc a lot.

but cant find how to implement it, I was also even considering the chance to "hardcode" that option at some bios module, I mean make it to boot at a specific value allways even without having that option in bios (brick chances would be high anyway)

but well , I dont know how to get that.

honestly since almost of the begining of this topic, while we started unlocking stuff, the overclocking strings found while hex viewing my advanced setup module made me crazy, while watching other options being unlocked, but the overclocking options remain hidden locked after all this time.

so, yeah, overclocking options is what I miss at my bios since the begining ^^

[follow_me]

If I am correct, the contents of the variable stores in NVRAM control the actual functionality. So I guess adding options is not as simple as porting a module, you have to know which bytes of which variable store control which function.

Not quite like that, each module can register it's own form , it can store values either in NVRAM or built in directly in file, may be you should take a look at NVRAM section of firmware where you have got RAID driver

NVRAM stores spacial wariable called Setup - this one is responsible for hardware initialisation on PEI stage, but it's hard to find which bytes are responsible for what

Let me finish my work with my loader/shell enabler and I will take a look at Raid driver in disassembler

[Brabbelbla]

Not quite like that, each module can register it's own form , it can store values either in NVRAM or built in directly in file, may be you should take a look at NVRAM section of firmware where you have got RAID driver

So what do you make of kasar's request, then?

may be you should take a look at NVRAM section of firmware where you have got RAID driver

What exactly do you mean? I dumped NVRAM, there were two variables there that were related to the RAID driver: RstSataV and RstSataF. The IFR structure reveals there should be at least another one, RstHiiConfig. Which is not there.

ADDITION: Messing around a bit with the RST menus, setup crashing, entering it again sometimes allows me to for select RAID type etc. on the create volume form, but it definitely does not work. I went back to the old version from the Inspiron and still getting the error. I noticed btw that the RST driver is attached to the protocol DriverEFIVersion, with 'value' 0002000A, which AFAIK means that it was built for UEFI 2.10, while we have UEFI 2.00. That could be where the problem starts. Anyway I hope you find something when you disassemble the module.

---

Probably @kasar, the IFR extract contains quite some information about the variable stores. If you look at what has become the WLAN toggle setting:

Code:

0x30E0C Setting: Wireless (Switch)/(Hotkey), Variable: 0x9 {05 A6 22 00 23 00 09 00 05 00 09 00 00 10 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}

It consists of:

• Opcode, one-of question (05)
  
• Statement size, with scope (A6)
  
• Unicode string ID (22 00)
  
• Unicode string ID (23 00)
  
• Question ID, unique in formset (09 00)
  
• Variable store ID, in this case (05 00), so variable store with ID 0x05. It has to be defined earlier, which it has been, as a linear buffer storage (two other types exist):
  
  Code:

  0x3046C Var Store: 0x5[53] (DellVariable) {24 23 67 3D EE 4F F4 18 17 42 BA 7B BC 53 81 48 38 2A 05 00 35 00 44 65 6C 6C 56 61 72 69 61 62 6C 65 00}
  Which again consists of:
  • Opcode, variable store (24)
    
  • Statement size, no scope (23)
    
  • Variable store GUID (67 3D EE 4F F4 18 17 42 BA 7B BC 53 81 48 38 2A)
    
  • Variable store ID, unique in formset (05 00)
    
  • Store size (35), 53 in decimal
    
  • Human-readable name, just DellVariable in ANSI, terminated by null (44 65 6C 6C 56 61 72 69 61 62 6C 65 00)
    
• Offset in the variable store (09 00)
  
• Question header flags, none here (00)
  
• One-of option flags, here EFI_IFR_DISPLAY_UINT_DEC (10)
  
• Minimum value (00)
  
• Maximum value (07)
  
• Step size. (00) isn't really valid, so = default = 1?
  
• Lots of zeroes. Last three things are allowed to be UINT8, UINT16, UINT32 or UINT64, so space is reserved for the last case.
  

[follow_me]

What exactly do you mean? I dumped NVRAM, there were two variables there that were related to the RAID driver: RstSataV and RstSataF. The IFR structure reveals there should be at least another one, RstHiiConfig. Which is not there.

I mean you should open NVRAM dump from image from which RAID driver was

AFAIK bios capsule contains firmware image and NVRAM default state dump , for example we have volume with id FFF12B8D-7696-4C8B-A985-2747075B4F50 which contains parts of VNRAM

[Brabbelbla]

Aaahhh, I have always been wondering where those defaults were kept. So here they are...

[follow_me]

here is my Internal Shell Enabler
I will convert it into dxe driver , but for testing I've built it as App

[jkbuha]

Hey all

Been a while since I last posted here. Long story short; my 15z laptop was stolen and it took me a while to find a quality replacement as Dell doesn't make them anymore, which is a pity as they are a great aesthetic and performing family. Finally I've managed to get my hands on an excellent xps 15z with the faster i7 processor (i7-2640m - I didn't even realise they are soldered to the l511z m/b so you cannot upgrade to a better processor) and I've restored the hw config to how it was running before (mods, hacks, vbios edits etc).

For any of you with a 15z trying to do the pin mod for the descriptor unlock; well good luck - it's on the daughter audio board which needs to be dismantled, before the battery is removed as well from the motherboard. After a lot of trouble, finally managed to short pins 1 & 5 on ALC269, and bingo - descriptor unlocked. Apply mods to the relevant sections in fitc and hey presto - overclockable m/b in windows.

Now here's the interesting part. Whereas previously I could (and still can) get >125MHz FSB over clocking using Clover (only for OSX, as this is the only kernel Clover can pass parameters to at boot up) - I cannot o/c reliably more than 1Mhz with XTC. Not 5, or 4, or 3 but 1MHz. Initially I thought it was the spread spectrum enabling, but even with disabling it, the laptop just powers off when I select Apply in XTC. I may need to do some more reading on all the ME config parameters in case I'm missing something, but if anyone can post all their optimal ME settings from either the 15z (assuming anyone has been brave enough to do so) or the xps15 I can compare equivalent o/c performance on different settings.

Other than that, it's really great to see what developments have happened in the last few months. Great news for the IFR menu insertion/changes; this was something that I had been looking into last year but never managed to crack. Also great work on the internal shell enabler! This will open up a new chapter of in-bios mods that we can add, without mentioning of course the ability to properly test without having to re-flash! But lastly kudos to the RAID work! This is absolutely genius and a big shame I cannot use it in the L511z due to lack of ports (and physical space).

Re: the additional bios security settings unlock; it seems kind of strange that a menu item called "Flash Security Descriptor" with default On does not have any effect when turned off. Maybe it's an issue with the form itself, that it hasn't been properly set (it's quite easy to mess up the form if you change all the conditions into nulls or force jumps) - but in any case it should be worth another go. In theory there should now also be the clock and voltage options as well in the processor configuration; my suspicion is that it could be related to the ME parameter tweaking with fitc; but I'd need to check.

Just for my benefit; to summarise what has been achieved most recently - can anyone add/change to this list?

1) UEFI IFR Form software - enables unlocking of more options, but so far only from Raid/Security menus?
2) IFR Menu changes - enables inserting/changing/removing of bios functionality
3) Pinmod descriptor unlocking - enables ME/DESC changes without the need to flash thru an external programmer
4) Internal Shell enabler - self explanatory

Ideally what we should do is create a bios diff patch list for a number of different bios families (this is how I patched my ME region - thanks @Florin9doi) to fully capture all the possible changes; that way others can experiment with their own different bioses to see if the same patches work. Would also help people like me who haven't been on these forums in a while to get up to speed as well as it is quite lengthy to digest all the good work that has been done in the last few months!

Great work again to all - it's good to back on the forum

[kasar]

welcome mate

srry to hear that about your old 15z, anyway you was lucky to get another one.

nice job with the 15z pinmod descriptor unlocking!

you should be able now to dump the whole chip image, usefull for modding and also will be required to have a backup in case something goes wrong (a external programmer would also be needed, but well) ^^

XTC?

U mean XTU?

mmm its weird you can only do 1 mhz, I can do up to 4 mhz and a little more, but it start crashing near the 5 mhz bclk OC.

that clover "magic" really get me upset it manages somehow to OC that high without the need of ME modding or anything, but it does not work on my windows 7 OS.

like I said, I think there may be interesting to check clover source code if it is avalible or ask de devs how they manage to get those clocks and what settings they use for the motherboard settings.

then we may be able to replicate those changes writting or modifing our current bioses.

yeah, as far I know those were our progress, I also managed to get a custom logo working


you can download my modded ME firmware from my L502X bios topic and compare my settings with yours using FITC, you may archive higher BCLK with my settings.

guys, does the email notifications work for you?

I dont recive them anymore,and it make the reply delays higher as I dont notice when you guys write >.<