(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

mmm

still reporting me 7



will try the version 8 tools

then I will reboot


edit: same stuff with me 8 tools

will reboot now, if you dont have news from me in some time, then my laptop died ^^

---

well I have some good news and some bad news.

the bad news is that it screwed up the ME

the good news is that the laptop still alive, and I made a backup of the me before ^^

---

[TimeWalker]

Err .. I guess a transient v7.1 to v8.0 firmware has to be flashed first, only then upgraded to v8.1
I have seen such a firmware on MSI (67 chipet as well btw) .. http://www.msi.com/product/mb/P67A-GD65.html#/?div=BIOS
But I can't seem to extract it ...

Flash your backup back and report how it goes.

[kasar]

backup worked fine, restored the 7 version I had before.

what about trying to flash a modified me7 firmware with OC features?

[TimeWalker]

By the way it was supposed to start flashing at 1000h but started at 2000h instead .. might be the cause of this "bad flash".
I guess the utility was coded to update just the part after the ME header (1000h-2000h) .. which essentially was missing or wasn't adequate for v8 firmware since it was still coded for v7. This is why a full upgrade was needed possibly ..

---

I've just read that flashing can sometimes require 2 consequent flashes for a proper upgrade.
Also instead of restarting the laptop just shut it down. Also try flashing the image that proposed the truncation message and see what it does.

If this still ends up messing up the ME we have @CodeRush's FTK
http://www.mediafire.com/?gr8515lx83s91wd
merefl.bat is meant for upgrading the ME region .. but his tool is coded for Asus as well.
as bios.bin (which you have to put in the folder alongside all the utilities) take the ME-infused dump I've uploaded earlier.

[kasar]

mmm, what file do I have to put as bios.bin?

ME image? or entire bios image to extract it from there?

I think I am falling as sleep lol, has been awake the whole night :o

[TimeWalker]

here is a transient 8.0.3.1427 from a Sony Vaio laptop:
http://www.mediafire.com/?qr2g4brno469lrr

as bios.bin you take the v8-infused-backup.rom I have posted.

[jkbuha]

@kasar - might be a good idea to try out the FITC-based hack I prescribed a couple of pages back to enable overclocking to see if this works?

[TimeWalker]

@jkbuha
We are still missing:

Code:

* Express Charge Express Charge = a Dell fast charging technology Standard Charge = batteries charged over a longer period of time Note: ExpressCharge may not be available for all batteries * Wireless Configuration * Wireless (Switch)/(Hotkey) This setting determines which wireless devices will be controlled by the wireless - None = The wireless switch is ignored - WLAN = The wireless switch only controls the WLAN device - BT = The wireless switch only controls the Bluetooth device - WLAN & BT = The wireless switch controls the Bluetooth and WLAN devices - WWAN = The wireless switch only controls the WWAN devices - WWAN & WLAN = The wireless switch controls the WWAN and WLAN devices - WWAN & BT = The wireless switch controls the WWAN and Bluetooth devices - All= The wireless switch controls all wireless devices The factory default setting is All * Internal Bluetooth This option lets you enable or disable the internal Bluetooth device - Disabled = The internal Bluetooth device is off and is not visibleto the operating system - Enabled = The internal Bluetooth device is enabled The factory default setting is Enabled * Internal WLAN This option lets you enable or disable the internal WLAN device - Disabled = The internal Wi-Fi device is off and is not visibleto the operating system - Enabled = The internal Wi-Fi device is enabled The factory default setting is Enabled * Internal WWANThis option lets you enable or disable the internal WWAN device - Disabled = The internal Wi-Fi device is off and is not visibleto the operating system - Enabled = The internal Wi-Fi device is enabled The factory default setting is Enabled * Boot Configuration: * Boot Priority Select proirity of boot option between UEFI and Legacy - UEFI First - Legacy First * ME Configuration * Intel AMT Enable/Disable Intel (R) Active Management Technology BIOS Extension Note : iAMT H/W is always enabled This option just controls the BIOS extension execution If enabled this requires additional firmware in the SPI device * Intel AMT Hot Key Enable/Disable Intel AMT Hot-Key during POST to enter MEBX setup * Intel AMT Setup Prompt Enable/Disable Intel AMT Setup Prompt to wait for hot-key to enter setup * Intel AMT SPI Protected Enable/Disable Intel AMT SPI write protect * OverClocking Feature: * Performance Menu for Processor and Memory *Processor Bus Ratio Override and Bus Speed Override *CPU Flex Ratio Settings: This value must be between Max Efficiency Ratio (LFM) and Maximum non-turbo ratio set by Hardware (HFM) *Flex Vid Override: Vid Override Paramters. Value varies from 8-48 (08h-30h),which relates to volts 14000v to 09000v. Each step equates to 00125v Bus Speed Support: Enable/Disable CPU Speed Override Support Bus Speed Override: Value entered will be taken as overclocking percentage (%)of current clock frequency. Value varies from 0%-49%(0h%-31h%) * Memory Overclocking Menu * Memory Voltage Override Support: Enable/Disable option for Memory Voltage Support * Memory Voltage: Memory Voltage Override 1.50 Volts 1.55 Volts 1.60 Volts 1.65 Volts * GT Overclocking Menu * GT OverClocking Support Enable/Disable GT OverClocking Support * GT OverClocking Frequency Overclocked RP0 Frequency (MLC Clk) in multiples of 50 MHz * GT OverClocking Voltage Extra voltage needed above the original RP0 voltage - The unit is 1/256 volt * ICC Configuration * Use Watchdog Timer for ICC Enable Watchdog Timer operation for ICCIf enabled,Watchdog Timer will be started after ICC related changed This timer detects platform instability caused by wrong clock settingsTurn off unused PCI/PCIe clocks - Disabled:all clocks turned on - Enabled:clocks for empty PCI/PCIe slots will be turned off to save power Platform must be powered off for changes to take effect * Lock ICC registers All registers: all ICC registers will be locked Static only - only static ICC registers will be locked

I've looked at 17R SE BIOS (SCT 2.1) and it appears that hidden menus are suppressed by questions in there.
Maybe it's the case with our missing options as well, or are you dead positive there are no *links* between menus and unicode strings in the module?

Also got heads up from @CodeRush:

1. ME v8 is required for Ivy Bridge support, without it there's no way 22nm CPU will work on 67-chipset
2. Regions are usually the same size on all platforms, the entry (start) points differ for different flashing software though. In UEFI BIOSes ME starts right after the Flash Descriptor (so 0x1000h in our case)
3. After FD lock has been set by OEM there's no software way to remove it, even the OEM flasher won't eliminate the lock. The only way to get rid of it is to flash 12 bytes 00 00 FF FF 00 00 FF FF 18 01 FF FF at 0x60h, that is correct for all the platforms.
4. If you try to flash the .cap from OEM onto the chip all the info in NVRAM storage will be wiped, so all the motherboard propriatory details will be lost foerever. Having an entire hw-based chip backup is a must!
5. The header 0x1000h - 0x37FFFh is common for both v7 and v8 ME firmware. If there's is old UEFI on the board it is unable to utilize 22nm CPUs and even ME v8 won't help here, because UEFI 2.0 has no support for it. If Dell does not release a single BIOS with ME v8 for your particular machine - there no way to have ME v8 and 22nm CPU support. Even if you had SDK/sources at hand we would still be helpless here, because as far as i know even ASUS had to ask Intell for support in regards to implementing the ME v8 into their BIOS. And still they failed miserably at it.
To conclude: Ivy Bridge and v8 ME support without the manufacturer's support is a dead end.

[jkbuha]

@TimeWalker - all the menus have been unlocked. What remaining options will be shown depends on the status of the hardware registers, which in our 15 series case means either WWAN/BT/Cell hardware toggles (which we don't have) or the ME configuration. For instance when I reboot from BIOS recovery mode I get the iRST menus as well, which I dont get in normal boot.

Re: ME v8 - I don't think we should play around with v8 for now. I think we should try to unlock v7 with the FITC tool (just like I proposed before) to see if the Clock + Voltage menus show up in the CPU sub-menu. That is something we should easily be able do now that the descriptor region is unlocked.

CodeRush sounds like he knows a thing or two about our BIOSes - which forum(s) is he on, and can he pop over here as well to help us?
EDIT - no worries I've found his posts.

Sent from my HTC One X

[kasar]

ok, going to try flash the file you gave me Tw

FPTw64.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-Y] [-P] [-LIST] [-I]
[-F] [-ERASE] [-VERIFY] [-D] [-DESC] [-BIOS] [-ME] [-GBE]
[-PDR] [-SAVEMAC] [-SAVESXID] [-C] [-B] [-E] [-REWRITE]
[-ADDRESS|A] [-LENGTH|L] [-FOVS] [-CFGGEN] [-U] [-O] [-IN] [-N] [-ID]

[-V] [-LOCK] [-DUMPLOCK] [-PSKFILE] [-CLOSEMNF] [-GRESET]
[-PAGE] [-SPIBAR] [-R] [-VARS] [-COMMIT] [-COMPARE] [-HASHED]

-H|? Displays help screen.
-VER Displays version information.
-EXP Displays example usage of this tool.
-VERBOSE<file> Display the debug information of the tool.
-Y Do NOT prompt when a warning occurs.
-P<file> Specifies a flash part definition file to use.
-LIST List all SPI devices supported.
-I Displays information about the flash image.
-F<f>[NoVerify] Load binary file into flash. "NoVerify" skips verify.
-ERASE Erase the contents of flash.
-VERIFY<file> Compare binary file to flash.
-D<file> Dump flash contents to file or "STDOUT".
-DESC Load/verify/dump Descriptor region.
-BIOS Load/verify/dump BIOS region.
-ME Load/verify/dump ME region.
-GBE Load/verify/dump GbE region.
- Press any key to continue -
-PDR Load/verify/dump PDR region.
-SAVEMAC Saves the GbE MAC when GbE is being reflashed.
-SAVESXID Saves the GbE SSID and SVID when GbE is being reflashed.
-C Erase entire flash part.
-B Check to see if the flash part is erased.
-E Do NOT erase area before writing to flash.
-REWRITE Rewrite the SPI with file data even if flash is identical.
-ADDRESS|A<address> Flash address to load/verify/dump file.
-LENGTH|L<length> Number of bytes to load/verify/dump.
-FOVS Displays list of FOVs supported.
-CFGGEN Generates an FOV Input File.
-U Update Variable.
-O<file> Sets an output file name.
-IN<file> Input param file.
-N<name> Name of variable.
-ID<id> Id of the FOV to be updated.
-V<value> Value for variable.
-LOCK[PDR] Sets SPI flash region access to Intel recommended values
-DUMPLOCK Dumps the current lock settings to screen.
-PSKFILE<file> PSK key file name.
-CLOSEMNF[NO] [PDR] End of Manufacturing. Details on NO & PDR use -exp option
-GRESET[NO] Global reset drives GPIO30 low unless "NO" is provided.
-PAGE Pauses the screen when a page of text is reached.
-SPIBAR Display the SPI BAR.
- Press any key to continue -
-R<name> Read a variable.
-VARS Display supported variables.
-COMMIT Commit updates to FOVs requiring a FW reset.
-COMPARE<file> Compare variable with expected value filled in a text file
-HASHED Display a variable (from read command) in hashed format.

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.


Error 200: Invalid parameter value specified by user. Use -? option to see help.


C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>fptw64.exe -ME -F 1427_8.0.BIN

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "1427_8.0.BIN"
File Length: 1560576
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x17E000] 1524KB of 1524KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x005000] - 100% complete.
- Programming Flash [0x005000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x00A000] - 100% complete.
- Programming Flash [0x00A000] 8KB of 8KB - 100% complete.
- Erasing Flash Block [0x00D000] - 100% complete.
- Programming Flash [0x00D000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x011000] - 100% complete.
- Programming Flash [0x011000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x01D000] - 100% complete.
- Programming Flash [0x01D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x025000] - 100% complete.
- Programming Flash [0x025000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x02D000] - 100% complete.
- Programming Flash [0x02D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x033000] - 100% complete.
- Programming Flash [0x033000] 12KB of 12KB - 100% complete.
- Erasing Flash Block [0x035000] - 100% complete.
- Programming Flash [0x035000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x092000] - 100% complete.
- Programming Flash [0x092000] 360KB of 360KB - 100% complete.
- Erasing Flash Block [0x107000] - 100% complete.
- Programming Flash [0x107000] 460KB of 460KB - 100% complete.
- Erasing Flash Block [0x159000] - 100% complete.
- Programming Flash [0x159000] 320KB of 320KB - 100% complete.
- Verifying Flash [0x17E000] 1524KB of 1524KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>

@jkbuha

wich one?

we hard to find anything at this topic at the moment