(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[gabiz_ro]

3 means to move bios image to end of flash chip.
Ex. In 4MB flash chip last 2MB are real BIOS first 2 are GB ME region etc.
In bigger flash chip,let's say 16MB that real BIOS,last 2MB from previous example must also be placed in last 2MB area of new chip.

4 I'm not sure but is something like.
Inside BIOS area exist some modules uncompressed,these are executed in early stage of initialization.Since these modules are now at different address must be modified to be able to run properly.
I think is same structure as PE files and all is need is to modify entrypoint with new value.

[mbunal]

once upon a time, i tried this bios. and then i back to official dell bios. and now i want to flash again. buti didnt. there is a error message:

Code:

Part Table Signature not found in the Interface.
Error code: -161

i read about 100 pages about this error from google. i tried lots of suggestion. but always i have same error. anyway, how can i flash this bios again?

[follow_me]

once upon a time, i tried this bios. and then i back to official dell bios. and now i want to flash again. buti didnt. there is a error message:

Code:

Part Table Signature not found in the Interface.
Error code: -161

What do you use to flash bios ?
Did you tried pflash from uefi shell with /sa switch (suppress all errors) ?

[thorbsd]

Really quiet around here these days...

How did you guys make out with the larger bios chips?

[kasar]

well, after some tests, I gave up.

the electronics part was easy, remove old chip, program new, and place the bigger chip on the socket.

however, the firmware/bios part, was tricky, it had to be on specific parts of the chip.

many head ache to just remove the ability of flash future flashes from the normal flashing methods.


so I finally desisted, I have the bigger chip and programmer arround here, but I keep using the machine with the standard 4 mbit chips.

[follow_me]

Hi - I moving slowly in that direction
spent some hours on soft part , and found out (from intel sourcess, disassemblling , etc) that there is 3 places that should be edited to have it working with larger chips

1 - there should be offset defined, in startup PEI code, from the begginig of the chip where bios region is located. if the bios region is expanded and placed in the same place where it was before, there is no need to change this offset because it will be the same, and the only difference will be stretched address space

2 - The PEI code should be able to read the chip - this means that it must have built in device descriptors (vendor/model id)
This part is should be done by manualy editing firmware and correcting the descrptors

3 - bios image should have a flash driver for corresponding firmware to be able to flash by a standard way. Here is two options. First one is to modify existing driver adjusting descriptors and lenght. The second one is to obtain driver from any other image (e.g try to look in some AlienWare images)

now I'm working on soft realisation of part 1 and 2 (disasembling bios image, adjusting space and descriptors and rebuilding it back)

When I'll have working app - I'll share with you guys. But there is one warning - thi bigger chip should be from the same vendor and same serie , because different wendors may have slightly different r/w protocol and it is difficult to change it in binary image

[jkbuha]

I guess we all have been out of reach for the last few months, catching up on life (and summer, where relevant). Now that we're back in school schedule there are a couple of interesting ongoing projects that will definitely be of interest to all the Dell (and modding) community...

1) ME firmware updating - this is something that both @kasar & @follow_me have boldly taken on, and seems like it is making progress, albeit in slow steps. The good thing is that we now have the ability to hot-swap ICs for those (like myself) that have soldered on a removable SOIC socket. Question on this - I'm assuming we are all using Winbond chips, are there any other relevant vendors (in which case we need to modify the BIOS structure?)

2) Multiplier modding - in theory possible though need to add/patch new .efi modules into the flash. I have not been involved in this to date but I do have some spare time I can devote to this. Would be good to get up to speed on any developments that have not yet been posted to this topic.

3) UEFI - some great progress has been made elsewhere by @Timewalker and others on booting UEFI without the NVRAM emulator, so directly supporting SCT2.0 chipsets. Separately I've also managed to get clover to boot natively in UEFI and then handover to Windows in legacy mode using Legacy=LegacyBIOSDefault & LegacyBiosDefaultEntry=1 in Clover config.plist and Clover installed in Partition 1 (no other way, that's SCT2.0 for you, but hey - it works). It's then possible to chain-boot UEFI->Clover->Legacy->Chameleon without rebooting.

So - fingers crossed - we have some more interesting things in the pipeline

[kasar]

yay! finally some activity over there

also nice to hear I am not anymore the only one with SOIC sockets

that should definitly speed up things.

about multiplier modding, I may be wrong, but, I think that only may be posible with extreme edition CPUs (the ones with multiplier unlocked)
it could be posible also to boot up the system on certain turbo speeds, but not sure how we can go over the max turbo limit per proccesor, I were able to get 100 mhz over the max turbo speed by doing bclk OC , however that isnt too much.

I think that the most interesting project (and also one of the hardest ones) is bring ivy support to our machines.

I think most of us have HM67 chipsets, wich are theorically compatible with ivy, the bad thing is the lack of firmware support.

but if we manage to upgreade intel me 7 to intel me 8, and we make also some bios tweaks, we may be able to unleash the hidden power of our machine and take advantage of the ivy proccesors on this motherboard.

I think I remember that, in previous tests, I was able to flash a me8 firmware on the machine and it booted, or partially did, however, the bios reported version 0.0.0.0 on me version, also the system did not past POST screen and remain stuck there.

I made that long time ago, and switched back to me7 to keep using the machine and being able to test other stuff.

let me know about your priority in our future unlocks and features

[jkbuha]

Yes I'm now the proud owner of three motherboards with varying mods (and bricks) applied to them. The only setback so far is that on the L511z the CPU is soldered to the mainboard, so I need to find someone who can desolder them and soak the socket up in resin for a future 35-45W CPU replacement

I've also made a few mods on the heatsink for better heat conduction at no fan spin; it's amazing what crap Dell fits into its 'premium' range. Otherwise thanks to OSX and a few careful OS tweaks (Nvidia off, C6/C7s modes set, no turbo on battery) I can now get 5:30h of constant use out of a 4400mAh battery (again thanks to the BIOS modding we can enable C7s besides C7, which allows us to put more devices into low-power mode. Net consumption under UEFI mode in OSX ~700mAh.

In terms of priorities, this is where I'd focus:

1) ME modding - this is by far the most important IMO as not only will we get Ivy-bridge support but also OC and UV.
2) Multiplier - I think this is the easiest for me to work on as I know (in theory) what to look for; it is a case of patching & inserting efi modules and possibly tampering (again) with the EFI_FORM instructions. Happy days...

Couple of questions whilst we're all on the line:

- I'm about to hot-swap the DVD with an SSD to make some experiments on UEFI booting. Has anyone managed to crisis boot from a USB (or appropriately formatted HDD/SSD)?

- @Timewalker - did you manage to successfully patch the i8k utility to work on our laptops?

- Has anyone managed to force-boot UEFI Windows on our Dell using MBR (not GPT/MBR hybrid) under Clover?

[follow_me]

Hi , glad to hear you, guys, again

The only setback so far is that on the L511z the CPU is soldered to the mainboard, so I need to find someone who can desolder them and soak the socket up in resin for a future 35-45W CPU replacement

Don't even try - it will kill mb in 95% cases

1) ME modding - this is by far the most important IMO as not only will we get Ivy-bridge support but also OC and UV.

To achive this we need a stable way to reassemble firmware with custom modules. Because ME upgrade requires PEI modules update

2) Multiplier - I think this is the easiest for me to work on as I know (in theory) what to look for; it is a case of patching & inserting efi modules and possibly tampering (again) with the EFI_FORM instructions. Happy days...

It is easy (in case if you want to do it "factory-like") - you need to unlock ICC profiles and overclocking in ME, load ICCOverclock.efi and comuncate with the driver , or just write your own, which will send requests to ME and change multyplier, clocks etc ... You can refer leaked bios sourcess (016s/Board/EM/MeWrapper/Icc/IccPlatform). And firget about hussling with byte-patching, it is no so hard to setup EFI build env and write some real code

Couple of questions whilst we're all on the line:

- I'm about to hot-swap the DVD with an SSD to make some experiments on UEFI booting. Has anyone managed to crisis boot from a USB (or appropriately formatted HDD/SSD)?

I'am now have Linux installed to CD-bay SSD with UEFI boot , it works fine
all you nees is to add custom boot record

I'm was able to boot from crysis usb flash. Now, with EFI shell supported in any mode, it is easy to recover using bios image with pflash


@jkbuha - what exactly do we need from 2.3.1 to support new ME firmware ? (what features ?)
@Timewalker - can you, please, point me where I can read about current status of built in ACPI tables modification ability ? (I mean possible/not possible/how to do it if possible)

BTW , about hw "flash socket mod" - I figured out a little different approach to this problem - I've made a so8 -> FFC/FPC 8 (0.5 mm pitch) adapter , which can be soldered to mb instead of flash chip and using flat cable (ffc) connected to FFC/FPC 8 -> so8 adapter
Advantages of this approach - minimum used space, clean, no wire mess, easy to change flash chips (soldered to adapters). Disadaventages - each chip is soldered to adapter, so , to connect in to HW programmer FFC/FPC -> dip adapter is required. Now I'm on a manafacturing stage (sent files to china maker), and will have all adapters in ~three weeks. I will make some photos of my mod then. If anyone want to do same way - fill free to PM me , and I'll send the files requred for adapters manufacturing