(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[CodeRush]

Congratulations. Descriptor unlock is easy as shorting pin 1 and pin 5 on HDA chip. Well done.

[kasar]

thanks CR

well, as for the HDA chip, I was unable to find it on my sandy bridge laptop.

I also preffer the hardware programmer mod since it allow you to recover the laptop in case it doesnt boot anymore, it also let you create a whole backup of the chip wich is allways a good thing.

those features saved my 4ss several times while working on this mod, else my laptop would have died forever like 5 + times

[CodeRush]

Now we need to figure out ME message format to be able to unlock ME by software and write an autopatching utility for enabling OC.

[kasar]

well, as for the ME

I know two ways of writting it (well, three if we add the hardware programmer)

one is fptw64.exe, wich require unlocked descriptor (the one I used to archive this mod)

the other way is FWUpdLcl.exe, wich it seems like a way of updating the firmware safetly. it works with aparently generic bins and it doesnt require descriptor unlock, all users can use it.

thats how I made the update package to update the me for the latest version at the L502X unlocked bios topic ^^

however, not sure if we can do anything from FWUpdLcl.exe, it have a lot of checks to ensure the firmware its valid and legit, also those generic updates cant be opened with FITC when I tried to.

[TimeWalker]

Wow, gongrats, kasar!
I'm not attempting the hda trick until I have a reason to disassemble the unit, that is when I'm installing an sad later this months. An M4 is sitting at my desk while I wait for the optibay to arrive.

[kasar]

thx TW
well, I think I cant reach High OCs with this method but every extra Mhz we gain free its awesome ^^

I was months or even a year after this, being able to OC the machine was the thing wich got me to get into all this BIOS headache, hehe

anyway It would be nice if we can enable the OC menus directly in BIOS and also test another ME features.

I noticed some fields at FITC wich talked about ME emergency modes, MACs ,IPs, servers and many other interesting options.

you guys have to get ride of the descriptor or doing the HDA trick like CR said, so we all keep going deeper into the ME FW hacks

---

ok, this is how my "cctwin.exe gl" command looks now ^^

I would say more stuff is unlocked now, hehe

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gl

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

[0x00] CSS -> LOCKED
[0x01] SSS -> LOCKED
[0x02] FCSS -> LOCKED
[0x03] PLLRCS -> LOCKED
[0x04] --- -> LOCKED
[0x05] --- -> LOCKED
[0x06] --- -> LOCKED
[0x07] --- -> LOCKED
[0x08] --- -> LOCKED
[0x09] --- -> LOCKED
[0x0a] --- -> LOCKED
[0x0b] --- -> LOCKED
[0x0c] PLLEN -> LOCKED
[0x0d] --- -> LOCKED
[0x0e] OCKEN -> LOCKED
[0x0f] IBEN -> LOCKED
[0x10] DIVEN -> LOCKED
[0x11] --- -> LOCKED
[0x12] PM1 -> LOCKED
[0x13] PM2 -> LOCKED
[0x14] --- -> LOCKED
[0x15] --- -> LOCKED
[0x16] --- -> LOCKED
[0x17] --- -> LOCKED
[0x18] --- -> LOCKED
[0x19] --- -> LOCKED
[0x1a] --- -> LOCKED
[0x1b] --- -> LOCKED
[0x1c] SEBP1 -> LOCKED
[0x1d] SEBP2 -> LOCKED
[0x1e] --- -> LOCKED
[0x1f] --- -> LOCKED
[0x20] DIVSET -> UNLOCKED
[0x21] --- -> UNLOCKED
[0x22] --- -> LOCKED
[0x23] --- -> LOCKED
[0x24] SSCCTL -> UNLOCKED
[0x25] --- -> LOCKED
[0x26] --- -> LOCKED
[0x27] --- -> LOCKED
[0x28] --- -> LOCKED
[0x29] PI12BiasParms -> LOCKED
[0x2a] --- -> LOCKED
[0x2b] --- -> LOCKED
[0x2c] --- -> LOCKED
[0x2d] --- -> LOCKED
[0x2e] --- -> LOCKED
[0x2f] --- -> LOCKED
[0x30] SSC1PARMS -> UNLOCKED
[0x31] SSC2PARMS -> UNLOCKED
[0x32] SSC3PARMS -> UNLOCKED
[0x33] SSC4PARMS -> UNLOCKED
[0x34] --- -> LOCKED
[0x35] --- -> LOCKED
[0x36] --- -> LOCKED
[0x37] --- -> LOCKED
[0x38] --- -> UNLOCKED
[0x39] SSC2OCPARMS -> UNLOCKED
[0x3a] --- -> UNLOCKED
[0x3b] --- -> UNLOCKED
[0x3c] --- -> LOCKED
[0x3d] --- -> LOCKED
[0x3e] --- -> LOCKED
[0x3f] --- -> LOCKED
[0x40] --- -> LOCKED
[0x41] --- -> LOCKED
[0x42] --- -> LOCKED
[0x43] --- -> LOCKED
[0x44] --- -> LOCKED
[0x45] --- -> LOCKED
[0x46] --- -> LOCKED
[0x47] --- -> LOCKED
[0x48] PMSRCCLK1 -> LOCKED
[0x49] PMSRCCLK2 -> LOCKED
[0x4a] --- -> LOCKED
[0x4b] --- -> LOCKED
[0x4c] --- -> LOCKED
[0x4d] --- -> LOCKED
[0x4e] --- -> LOCKED
[0x4f] --- -> LOCKED
[0x50] --- -> LOCKED
[0x51] --- -> LOCKED
[0x52] --- -> LOCKED

HECI CMD Status = 0x00000000 (SUCCESS)

this is also how GCDR command looks now

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gcdr

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.


clock_id = 1 [DIV1-S]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 2 [DIV2-S]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 80.0000 MHz
frequency_max = 300.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 3 [DIV3]

clock_usage = {PCIe, PCI33, SATA, USB3}
frequency_min = 99.5463 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 4 [DIV4]

clock_usage = {Display_Bending}
frequency_min = 119.3473 MHz
frequency_max = 120.6599 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 1
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 2.50 %

clock_id = 5 [DIV1-NS]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %

clock_id = 6 [DIV2-NS]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 100.0000 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %


HECI CMD Status = 0x00000000 (SUCCESS)
C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>

I didnt oced new laptops until now, but I heard high BCLKs can damage components like usbs, sata and other stuff since it is linked too.

well relating to previous command, I am playing now with div2-s instead div3

so aparently the whole OC goes to BCLK,DMI and PEG, its relative save to fo up for for example 2.4 or 2.5 ghz? (stock speed is 2.1)

its just that when I did OC testing to 2.2 and 2.3 I was playing some music at the laptop and it started to sound weird, some times faster and rare stuff, I also heard there was some kind of command in windows to fix the timmer while messing with OC, not sure if that is what I need now

edit: found the fix for my issue here ^^

http://forum.notebookreview.com/gaming-s...fixed.html

[jkbuha]

Great work kasar

I'm of the same mindset as CodeRush - there has to be some way of unlocking ME via software, ie: a MESET utility but for Dell...

That said, I'm not even sure what the HDA chip looks like - or even if I'll be able to short pins 1 & 5 on boot because of the fixed battery on the 15z.

One other thing - I'm still keen to see if we can enable the undervolting of Sandy Bridge as well - I don't play much games so it's actually more of a motivation from my perspective. Also - would be good to see what all those other parameters do that are currently LOCKED as well..

Anyways, great discovery mate - slowly but surely all the investment that has been done since you first bricked your laptop has now been ultimately worth it

[kasar]

ty

well, I am not sure of the soft mod for this.

because they hardlocked those setings on porpose, and like we discused, it was annoying as h3ll to unlock this even doing a lot of efforts doing all those hardware mods.

well, I am also interested about how the HDA chip looks, probably many people will preffer just bridge 1 pin instead desoldering chips, and soldering sockets.

well, as for the moment I didnt got undervolt the CPU, I enabled all the options related to OC at the FITC (you guys have to give a look to the intel PDF, it explains well each option, it was relatively easy to mod it with all those docs.)

[TimeWalker]

Compared your me firmware to a stock 7.1.52.1176 binary which comes bundled with FWUpdLcl, zero changes what so ever. The common header (1000h to 37FFFh) is totally different now though, so there's no way this could be updated by means of software without breaking the chain of trust on the ME region... also this won't neccesarily suit other machines even with same chipset.

[kasar]

so, acording with what TW said HW mods are the only way to get it :o

well, I has been playing with my OC unlock

it seems I can only change BCLK.

if I go more than 105.34 mhz with clock reference, the machine crash.

so that seems the limits ^^

I gained following

stock

cpu 2.10 ghz
ram 1333 mhz
HD graphics 3000 (base profile) 650 mhz


OC

cpu 2.212 ghz
ram 1405 mhz
HD graphics 3000 (base profile) 685 mhz


as you can see , the OC is minimal, since I already did all the stuff, I will use it.

also the windows timer for games music and any other thing based on time got screwed.

to fix it I had to do:

* bcdedit /set useplatformclock true
* reboot
* run WinTimerTester.exe for 2 , 3 mins to adjust the time everytime I do the OC at winows startup (edit, not needed to run at the startup anymore, the value is saved any I set XTU to OC on startup )

so , as for you guys, the performance gain isnt probably enough to take your lappys appart and pick the soldering iron.

in my case I love any extra MHZ I can get, but it your case I am not sure, so your choice guys ^^



OC