Acer Travelmate 5530G CPU upgrade to Turion Ultra ZM-87 - thermal throttling

[Blasku]

VICTORY!!!!
F3xDC register's 10th to 8th bits stand for the P-state maximum value. Which means the p-state with the largest value ID number is: P2 (600 MHz). Upon setting this value to P0 (2.4 GHz) the little rascal was unable to downthrottle! I could even block the vent and it went straight up till 85 °C and k10stat didn't show the slightest flinch in the p-state, it remained rock-steady at 2.4 GHz.
What's even better in this work-around is when I'm done playing/watching HD movies/whatever I re-set this value to 010b from 000b and all is back to normal . No need to reboot, anything.
I don't even know how to thank you kizwan for all your help , of course that doesn't mean that I'll just leave this thread as this isn't exactly a final solution, but it can be used as fallback.

EDIT: I almost got a stroke when this stopped working, until I realized that I put the lappie into sleep just before that. So going into standby resets the register (obviously).

[kizwan]

Good job Blasku! Actually that is the same idea I want to do but in SSDT table instead.

On Intel chipset, PCI registers can be configured using CONFIG_ADDRESS (Configuration Address Register). For example Intel 945 Express Chipset:-

Code:

Bit: 31 30 - 24 23 - 16 15 - 11 10 - 8 7 - 0 Value: 1 Reserved Bus Device Function Offset * Bit 31: When this bit is set to 1, accesses to PCI configuration space are enabled. If this bit is reset to 0, accesses to PCI configuration space are disabled.

If there is similar function use to configure F3xDC register, we can figure out how the register set in BIOS. However, if we mod this in BIOS, the CPU will always running at highest P-State. I think the RW-Everything method is most suitable solution at the moment.

[Blasku]

What I've found in my decompiled DSDT are the

OperationRegion(NBRV, PCI_Config, 0x8, 0x1)

type commands, according to this nice presentation's 14th page, this might be the way to set ACPI registers, including the F3xDC. What just this command does is point to an address which can then be manipulated by the commands that follow it.
So I also looked this up in the ACPI 4.0 specification, and in section 20.5.89 it is explained in more detail.
BTW, according to the BKDG for family 11h AMD processors, section 2.4.2.3: the OS uses the MSRC001_0062 (P-State Control Register) for switching between p-states. I have no idea if this helps in identifying all parts of the BIOS code which touch the p-states. I guess the DSDT might not contain the section that's causing the problem, otherwise this would've been solved by your correcting my DSDT already.

EDIT: Here's a very promising thread about looking for sections of the BIOS code that modify a certain MSR register: http://www.wimsbios.com/forum/topic9326.html
I'm able to decompile the BIOSCOD00.ROM type modules with ndisasm, it'll be interesting to see how many rdmsr and wrmsr commands I'll find.

---

I've attached all the BIOSCOD modules decompiled. I've found a total of 82 occurrences of wrmsr in 4 of these files: 01, 02, 05 and 06. It won't be an easy read...

[kizwan]

(^^Sorry, I didn't look in the disassembled file yet. Got problem with my internet connection. I can access & write this post after several retry.)

I found an alternative to the MSR register. F3xDC register is configured using IO-Space Configuration Address Register (BKDG - page #95).

Bits description:-

• Bit 31
  • ConfigEn: configuration space enable. Read-write. 1=IO read and write accesses to IOCFC are translated into configuration cycles at the configuration address specified by this register. 0=IO read and write accesses to IOCFC are passed to the appropriate IO link and no configuration access is generated.
    
• Bits 30:28
  • Reserved.
    
• Bits 27:24
  • ExtRegNo: extended register number. Read-write. ExtRegNo provides bits[11:8] and RegNo provides bits[7:2] of the byte address of the configuration register. ExtRegNo is reserved unless it is enabled by MSRC001_001F[EnableCf8ExtCfg].
    
• Bits 23:16
  • BusNo: bus number. Read-write. Specifies the bus number of the configuration cycle.
    
• Bits 15:11
  • Device: bus number. Read-write. Specifies the device number of the configuration cycle.
    
• Bits 10:8
  • Function. Read-write. Specifies the function number of the configuration cycle.
    
• Bits 7:2
  • RegNo: register address. Read-write. See IOCF8[ExtRegNo].
    
• Bits 1:0
  • Reserved.
    

F3xDC - Bus 0 : Device 18 : Function 3 : Register DC = 80001BDC

So, we should look for "mov ecx,0x80001BDC" opcode then.

EDIT: 80001BDC is wrong. Please see post #58

[Blasku]

F3xDC - Bus 0 : Device 18 : Function 3 : Register DC = 80001BDC

So, we should look for "mov ecx,0x80001BDC" opcode then.

ExtRegNo provides bits[11:8] and RegNo provides bits[7:2] of the byte address of the configuration register. ExtRegNo is reserved unless it is enabled by MSRC001_001F[EnableCf8ExtCfg].

It took me a little while to understand how the register address is given . Now I see why you don't need address bits [1:0], those will always be 00b anyway. And since 0xDC = 11011100b => 110111b is all you needed to put into RegNo and you didn't even need ExtRegNo so you could leave it all zeros.
But there's one part I still don't get:
I came up with 0x800093DC because the device number is a little different for me?
1000 0000 0000 0000 1001 0011 1101 1100
The bold part is the device number in my case, because 10010b is 18d.
For you it is:
1000 0000 0000 0000 0001 1011 1101 1100
device no. 3?

Anway, I'll try to search for both addresses in the BIOS code.

[kizwan]

Device no. in RW-Everything already in hexadecimal, not decimal. Please observed my RW-Everything:-


I'm wrong too. 0x80001BDC is not correct. So, I look again:-

Code:

F3xDC - Bus 0x0 : Device 0x18 : Function 0x3 : Register 0xDC Bits 31 30 - 28 27 - 24 23 - 16 15 - 11 10 - 8 7 - 2 1 - 0 Description ConfigEn Reserved ExtRegNo BusNo Device Function RegNo Reserved Value (HEX) 1 - - 0 18 3 DC - Value (BIN) 1 000 0000 0000 0000 1 1000 011 1101 11 00 10000000000000001100001111011100b = 8000C3DCh

[Blasku]

Oh bugger, I always mistake hex numbers when there are no larger digits than 9 involved . My only excuse is that I didn't have any device IDs that has an alphabetical digit in them.
The other problem is that my BIOS code is probably obscured because I don't find a mention of any of these addresses there, so the addresses must be loaded into ECX with some trickery.
I've also searched through BIOSCOD01 and ..02 and found some MSR register addresses that I have no idea what they might be: 0x1f, 0x1a, 0x102a. I can't find them in the BKDG. I've still got ..05 and ..06 to browse through.

[kizwan]

My assembly/disassembly skill still at beginner level but I believe I unable to find it too because I don't know the start location of the CODE section is. I found out that we need to load it in IDA & adjusted it to get the correct offsets. To get the actual offsets will require forcing the memory locations when loading in IDA. How to do that (I mean how to find the correct offset)? NASM/NDISASM is great tool but they not always accurate because they can't differentiate between CODE & DATA section (I read this in some forum. Is this correct?).

[Blasku]

My assembly/disassembly skill still at beginner level but I believe I unable to find it too because I don't know the start location of the CODE section is. I found out that we need to load it in IDA & adjusted it to get the correct offsets. To get the actual offsets will require forcing the memory locations when loading in IDA. How to do that (I mean how to find the correct offset)? NASM/NDISASM is great tool but they not always accurate because they can't differentiate between CODE & DATA section (I read this in some forum. Is this correct?).

Yes, you're right... That makes decompilation really tedious (I'm not yet used to IDA), plus how do I differentiate a data section from a code section? If I force IDA to analyze it, it will come up with some code even if it doesn't make sense (a la ndisasm). BTW, what options do you recommend for IDA? I've always selected the processor to be Athlon, but I'm not sure that's a good idea.

[kizwan]

I found several Function register but F3xDC is not found.

Code:

F000:BF5E ; --------------------------------------------------------------------------- F000:BF5E mov eax, 8000C3E8h F000:BF64 mov dx, 0CF8h F000:BF67 out dx, eax F000:BF69 add dx, 4 F000:BF6C in eax, dx F000:BF6E shr ax, 0Ch F000:BF71 and ax, 3 F000:BF74 jz short loc_1FBF85 F000:BF76 mov ecx, 0C001001Fh F000:BF7C rdmsr F000:BF7E bts edx, 16h F000:BF83 wrmsr F000:BF85 F000:BF85 loc_1FBF85: ; CODE XREF: F000:BF74j F000:BF85 mov ecx, 1Bh F000:BF8B rdmsr F000:BF8D bts eax, 0Bh F000:BF92 wrmsr F000:BF94 mov ecx, 1Bh F000:BF9A rdmsr F000:BF9C bt ax, 8 F000:BFA0 jb short loc_1FBFAB F000:BFA2 mov bx, 0D373h F000:BFA5 sub bx, 8 F000:BFA8 jmp loc_1FC4C4 F000:BFAB ; --------------------------------------------------------------------------- F000:BFAB F000:BFAB loc_1FBFAB: ; CODE XREF: F000:BFA0j F000:BFAB mov bx, 0BFB1h F000:BFAE jmp loc_1FC03E F000:BFB1 ; --------------------------------------------------------------------------- F000:BFB1 mov bx, 0BFB7h F000:BFB4 jmp loc_1FC9E3 F000:BFB7 ; --------------------------------------------------------------------------- F000:BFB7 mov bx, 0BFBDh F000:BFBA jmp loc_1FCB4B F000:BFBD ; --------------------------------------------------------------------------- F000:BFBD mov bx, 0BFC3h F000:BFC0 jmp loc_1FC0AA F000:BFC3 ; --------------------------------------------------------------------------- F000:BFC3 mov dx, 0CF8h F000:BFC6 mov eax, 8000A36Ch F000:BFCC out dx, eax F000:BFCE mov dx, 0CFCh F000:BFD1 mov al, 0E0h ; 'a' F000:BFD3 out dx, al F000:BFD4 jmp loc_1FC44C F000:BFD7 ; --------------------------------------------------------------------------- F000:BFD7 F000:BFD7 loc_1FBFD7: ; CODE XREF: F000:loc_1FCFE1j F000:BFD7 mov ecx, 26Ch F000:BFDD mov eax, 4040404h F000:BFE3 mov edx, eax F000:BFE6 wrmsr F000:BFE8 inc cl F000:BFEA wrmsr F000:BFEC inc cl F000:BFEE wrmsr F000:BFF0 inc cl F000:BFF2 wrmsr F000:BFF4 mov eax, 0C00h F000:BFFA mov ecx, 2FFh F000:C000 xor edx, edx F000:C003 wrmsr F000:C005 mov ecx, 0C0010010h F000:C00B rdmsr F000:C00D bts eax, 12h F000:C012 wrmsr F000:C014 wbinvd F000:C016 mov eax, cr3 F000:C019 mov cr3, eax F000:C01C mov eax, cr0 F000:C01F and eax, 9FFFFFFFh F000:C025 mov cr0, eax F000:C028 wbinvd F000:C02A jmp loc_1FCFE4 F000:C02D ; --------------------------------------------------------------------------- F000:C02D mov fs, bx F000:C02F assume fs:nothing F000:C02F mov al, 2 F000:C031 out 92h, al F000:C033 mov bx, 0C039h F000:C036 jmp loc_1FCF10 F000:C039 ; --------------------------------------------------------------------------- F000:C039 mov bx, fs F000:C03B jmp loc_1FC4BF F000:C03E ; --------------------------------------------------------------------------- F000:C03E F000:C03E loc_1FC03E: ; CODE XREF: F000:BFAEj F000:C03E mov fs, bx F000:C040 mov dx, 0CF8h F000:C043 mov eax, 80000060h F000:C049 out dx, eax F000:C04B mov dx, 0CFCh F000:C04E mov al, 0B8h ; '+' F000:C050 out dx, al F000:C051 mov dx, 0CF8h F000:C054 mov eax, 80000064h F000:C05A out dx, eax F000:C05C mov dx, 0CFCh F000:C05F in eax, dx F000:C061 or eax, 4000000h F000:C067 out dx, eax F000:C069 mov dx, 0CF8h F000:C06C mov eax, 8000A080h F000:C072 out dx, eax F000:C074 mov dx, 0CFCh F000:C077 in eax, dx F000:C079 and eax, 0FFEEFFFFh F000:C07F or eax, 10000000h F000:C085 out dx, eax F000:C087 mov cx, 3E8h F000:C08A F000:C08A loc_1FC08A: ; CODE XREF: F000:C08Cj F000:C08A out 0EDh, al F000:C08C loop loc_1FC08A F000:C08E mov dx, 0CF8h F000:C091 mov eax, 8000A080h F000:C097 out dx, eax F000:C099 mov dx, 0CFCh F000:C09C in eax, dx F000:C09E or eax, 10000h F000:C0A4 out dx, eax F000:C0A6 mov bx, fs F000:C0A8 jmp bx F000:C0AA ; --------------------------------------------------------------------------- F000:C0AA F000:C0AA loc_1FC0AA: ; CODE XREF: F000:BFC0j F000:C0AA mov fs, bx F000:C0AC mov dx, 0CF8h F000:C0AF mov eax, 8000C06Ch F000:C0B5 out dx, eax F000:C0B7 mov dx, 0CFCh F000:C0BA in al, dx F000:C0BB test al, 10h F000:C0BD jz short loc_1FC111 F000:C0BF mov dx, 70h ; 'p' F000:C0C2 mov al, 0Eh F000:C0C4 out dx, al ; CMOS Memory: F000:C0C4 ; POST diagnostics status byte F000:C0C5 inc dx F000:C0C6 in al, dx ; CMOS Memory F000:C0C7 and al, 40h F000:C0C9 mov ah, al F000:C0CB mov dx, 70h ; 'p' F000:C0CE mov al, 27h ; ''' F000:C0D0 out dx, al ; CMOS Memory: F000:C0D0 ; F000:C0D1 inc dx F000:C0D2 in al, dx ; CMOS Memory F000:C0D3 shr al, 1 F000:C0D5 and al, 1 F000:C0D7 or al, al F000:C0D9 jnz short loc_1FC111 F000:C0DB or ah, ah F000:C0DD jnz short loc_1FC111 F000:C0DF mov ecx, 401h F000:C0E5 rdmsr F000:C0E7 wrmsr F000:C0E9 mov ecx, 405h F000:C0EF rdmsr F000:C0F1 wrmsr F000:C0F3 mov ecx, 409h F000:C0F9 rdmsr F000:C0FB wrmsr F000:C0FD mov ecx, 40Dh F000:C103 rdmsr F000:C105 wrmsr F000:C107 mov ecx, 411h F000:C10D rdmsr F000:C10F wrmsr F000:C111 F000:C111 loc_1FC111: ; CODE XREF: F000:C0BDj F000:C111 ; F000:C0D9j ... F000:C111 mov bx, fs F000:C113 jmp bx F000:C115 ; --------------------------------------------------------------------------- F000:C115 F000:C115 loc_1FC115: ; CODE XREF: F000:BF5Bj F000:C115 mov fs, bx F000:C117 mov ecx, 0C001001Fh F000:C11D rdmsr F000:C11F mov ebx, edx F000:C122 or edx, 4000h F000:C129 wrmsr F000:C12B mov dx, 0CF8h F000:C12E mov eax, 8100C3E4h F000:C134 out dx, eax F000:C136 mov dl, 0FCh ; 'n' F000:C138 in al, dx F000:C139 or al, 10h F000:C13B out dx, al F000:C13C rdmsr F000:C13E mov edx, ebx F000:C141 wrmsr F000:C143 mov bx, fs F000:C145 jmp bx F000:C147 ; --------------------------------------------------------------------------- F000:C147 F000:C147 loc_1FC147: ; CODE XREF: F000:BF4Fj F000:C147 ; F000:CC2Fj F000:C147 mov dx, 0CF8h F000:C14A mov eax, 8000A348h F000:C150 out dx, eax F000:C152 add dl, 6 F000:C155 in al, dx F000:C156 or al, 20h F000:C158 out dx, al F000:C159 jmp bx F000:C15B F000:C15B ; =============== S U B R O U T I N E ======================================= F000:C15B F000:C15B F000:C15B sub_1FC15B proc near ; CODE XREF: F000:loc_1FE11Bp F000:C15B mov dword ptr ss:[esi], 0F0000h F000:C164 mov dword ptr ss:[esi+4], 10000h F000:C16E mov dword ptr ss:[esi+8], 0FFF40000h F000:C178 mov dword ptr ss:[esi+0Ch], 10000h F000:C182 mov dword ptr ss:[esi+10h], 0FFF50000h F000:C18C mov dword ptr ss:[esi+14h], 10000h F000:C196 retn F000:C196 sub_1FC15B endp F000:C196

It make sense F3xDC register is not found. This is because F3xDC register is for setting maximum P-State & VID which the value are not the same for different processor. P-States & VID package are defined in SSDT table (ACPI) which I believe derived from Microcode.

In IDA, I set to Intel (metapc). Since you mentioned that you use Athlon, I start thinking why I didn't use it. LOL. BTW, regarding disassembled BIOS using IDA, I got help from aascut@mydigitallife. The part we need to disassembled is the last 64kB of the ROM.
(EDIT->SEGMENTs->Create segment->)
For 512kbit .rom: last 64 kB->address is from 00070000 to 0007FFFF; base is 70000/10 =7000
or for 1 Mbit .rom: last 64 kB is from 000F0000-000FFFFF; base is F0000/10=F000
or for 2 Mbit .rom: last 64 kB is from 001F0000-001FFFFF: base is 1F0000/10=1F000