(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[jkbuha]

yay! nice work kasar!

so, two important steps now:

1) Still unsure why nothing appears in the BIOS. In theory the menu should appear. Maybe you can play about with the settings through FITC.
2) In theory you should now also be able to modify clock (and also undervolt) via command line in windows, through ICC. Would be good to give this a go!

Well done again!

[kasar]

the new clocks range appear at intel XTU ^^

but for some reason I cant seems to apply the clocks and read correct values with other software (before when I lowered it to 95 with stock ME it changed ...)

I think I will try flashing another modded ME just with the modded rangs, everything else default

what do you mean OC by commands?

oh, I think I noticed why it doenst change anything.


look at this

before

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

[0x00] CSS -> LOCKED
[0x01] SSS -> LOCKED
[0x02] FCSS -> LOCKED
[0x03] PLLRCS -> LOCKED
[0x04] --- -> LOCKED
[0x05] --- -> LOCKED
[0x06] --- -> LOCKED
[0x07] --- -> LOCKED
[0x08] --- -> LOCKED
[0x09] --- -> LOCKED
[0x0a] --- -> LOCKED
[0x0b] --- -> LOCKED
[0x0c] PLLEN -> LOCKED
[0x0d] --- -> LOCKED
[0x0e] OCKEN -> LOCKED
[0x0f] IBEN -> LOCKED
[0x10] DIVEN -> LOCKED
[0x11] --- -> LOCKED
[0x12] PM1 -> LOCKED
[0x13] PM2 -> LOCKED
[0x14] --- -> LOCKED
[0x15] --- -> LOCKED
[0x16] --- -> LOCKED
[0x17] --- -> LOCKED
[0x18] --- -> LOCKED
[0x19] --- -> LOCKED
[0x1a] --- -> LOCKED
[0x1b] --- -> LOCKED
[0x1c] SEBP1 -> LOCKED
[0x1d] SEBP2 -> LOCKED
[0x1e] --- -> LOCKED
[0x1f] --- -> LOCKED
[0x20] DIVSET -> UNLOCKED
[0x21] --- -> UNLOCKED
[0x22] --- -> LOCKED
[0x23] --- -> LOCKED
[0x24] SSCCTL -> UNLOCKED
[0x25] --- -> LOCKED
[0x26] --- -> LOCKED
[0x27] --- -> LOCKED
[0x28] --- -> LOCKED
[0x29] PI12BiasParms -> LOCKED
[0x2a] --- -> LOCKED
[0x2b] --- -> LOCKED
[0x2c] --- -> LOCKED
[0x2d] --- -> LOCKED
[0x2e] --- -> LOCKED
[0x2f] --- -> LOCKED
[0x30] SSC1PARMS -> UNLOCKED
[0x31] SSC2PARMS -> UNLOCKED
[0x32] SSC3PARMS -> UNLOCKED
[0x33] SSC4PARMS -> UNLOCKED
[0x34] --- -> LOCKED
[0x35] --- -> LOCKED
[0x36] --- -> LOCKED
[0x37] --- -> LOCKED
[0x38] --- -> UNLOCKED
[0x39] SSC2OCPARMS -> UNLOCKED
[0x3a] --- -> UNLOCKED
[0x3b] --- -> UNLOCKED
[0x3c] --- -> LOCKED
[0x3d] --- -> LOCKED
[0x3e] --- -> LOCKED
[0x3f] --- -> LOCKED
[0x40] --- -> LOCKED
[0x41] --- -> LOCKED
[0x42] --- -> LOCKED
[0x43] --- -> LOCKED
[0x44] --- -> LOCKED
[0x45] --- -> LOCKED
[0x46] --- -> LOCKED
[0x47] --- -> LOCKED
[0x48] PMSRCCLK1 -> LOCKED
[0x49] PMSRCCLK2 -> LOCKED
[0x4a] --- -> LOCKED
[0x4b] --- -> LOCKED
[0x4c] --- -> LOCKED
[0x4d] --- -> LOCKED
[0x4e] --- -> LOCKED
[0x4f] --- -> LOCKED
[0x50] --- -> LOCKED
[0x51] --- -> LOCKED
[0x52] --- -> LOCKED

HECI CMD Status = 0x00000000 (SUCCESS)

now

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gl

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

[0x00] CSS -> LOCKED
[0x01] SSS -> LOCKED
[0x02] FCSS -> LOCKED
[0x03] PLLRCS -> LOCKED
[0x04] --- -> LOCKED
[0x05] --- -> LOCKED
[0x06] --- -> LOCKED
[0x07] --- -> LOCKED
[0x08] --- -> LOCKED
[0x09] --- -> LOCKED
[0x0a] --- -> LOCKED
[0x0b] --- -> LOCKED
[0x0c] PLLEN -> LOCKED
[0x0d] --- -> LOCKED
[0x0e] OCKEN -> LOCKED
[0x0f] IBEN -> LOCKED
[0x10] DIVEN -> LOCKED
[0x11] --- -> LOCKED
[0x12] PM1 -> LOCKED
[0x13] PM2 -> LOCKED
[0x14] --- -> LOCKED
[0x15] --- -> LOCKED
[0x16] --- -> LOCKED
[0x17] --- -> LOCKED
[0x18] --- -> LOCKED
[0x19] --- -> LOCKED
[0x1a] --- -> LOCKED
[0x1b] --- -> LOCKED
[0x1c] SEBP1 -> LOCKED
[0x1d] SEBP2 -> LOCKED
[0x1e] --- -> LOCKED
[0x1f] --- -> LOCKED
[0x20] DIVSET -> LOCKED
[0x21] --- -> LOCKED
[0x22] --- -> LOCKED
[0x23] --- -> LOCKED
[0x24] SSCCTL -> LOCKED
[0x25] --- -> LOCKED
[0x26] --- -> LOCKED
[0x27] --- -> LOCKED
[0x28] --- -> LOCKED
[0x29] PI12BiasParms -> LOCKED
[0x2a] --- -> LOCKED
[0x2b] --- -> LOCKED
[0x2c] --- -> LOCKED
[0x2d] --- -> LOCKED
[0x2e] --- -> LOCKED
[0x2f] --- -> LOCKED
[0x30] SSC1PARMS -> LOCKED
[0x31] SSC2PARMS -> LOCKED
[0x32] SSC3PARMS -> LOCKED
[0x33] SSC4PARMS -> LOCKED
[0x34] --- -> LOCKED
[0x35] --- -> LOCKED
[0x36] --- -> LOCKED
[0x37] --- -> LOCKED
[0x38] --- -> LOCKED
[0x39] SSC2OCPARMS -> LOCKED
[0x3a] --- -> LOCKED
[0x3b] --- -> LOCKED
[0x3c] --- -> LOCKED
[0x3d] --- -> LOCKED
[0x3e] --- -> LOCKED
[0x3f] --- -> LOCKED
[0x40] --- -> LOCKED
[0x41] --- -> LOCKED
[0x42] --- -> LOCKED
[0x43] --- -> LOCKED
[0x44] --- -> LOCKED
[0x45] --- -> LOCKED
[0x46] --- -> LOCKED
[0x47] --- -> LOCKED
[0x48] PMSRCCLK1 -> LOCKED
[0x49] PMSRCCLK2 -> LOCKED
[0x4a] --- -> LOCKED
[0x4b] --- -> LOCKED
[0x4c] --- -> LOCKED
[0x4d] --- -> LOCKED
[0x4e] --- -> LOCKED
[0x4f] --- -> LOCKED
[0x50] --- -> LOCKED
[0x51] --- -> LOCKED
[0x52] --- -> LOCKED

HECI CMD Status = 0x00000000 (SUCCESS)

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>

I know many of those stuff was already locked before, but now ..... everything is locked

well,I supose this is like the menus, to unhide them, we had to hide them before xD


but I'm almost sure I am on the right way

[kasar]

AWESOME NEWS GUYS!!!!!!!

I finally got it

after bricked and unbricked my laptop several times and partially damaged 1 of the sockets I installed due excesive ussage

I hacked ME firmware and got finally a compatible OC firmware

proof ^_^



in order to do this I had to start from a fresh (non already modded) me backup from my firmware, then I checked the intel PDF docs and tweakes all the options related with OC, the new menus arent avalible at the BIOS with the machine can be OCed now finally with intel XTU

here is the patch

(will probably just work for the L502X users)

http://www.mediafire.com/?tgv2qpll3patc2j

the bad news is that it require unlocked descriptor to be installed, so unless you patch the descriptor via hardware programer like I did or you bypass the descriptor settings by some kind of pinmod, you have no chances of getting this I think :/

[CodeRush]

Congratulations. Descriptor unlock is easy as shorting pin 1 and pin 5 on HDA chip. Well done.

[kasar]

thanks CR

well, as for the HDA chip, I was unable to find it on my sandy bridge laptop.

I also preffer the hardware programmer mod since it allow you to recover the laptop in case it doesnt boot anymore, it also let you create a whole backup of the chip wich is allways a good thing.

those features saved my 4ss several times while working on this mod, else my laptop would have died forever like 5 + times

[CodeRush]

Now we need to figure out ME message format to be able to unlock ME by software and write an autopatching utility for enabling OC.

[kasar]

well, as for the ME

I know two ways of writting it (well, three if we add the hardware programmer)

one is fptw64.exe, wich require unlocked descriptor (the one I used to archive this mod)

the other way is FWUpdLcl.exe, wich it seems like a way of updating the firmware safetly. it works with aparently generic bins and it doesnt require descriptor unlock, all users can use it.

thats how I made the update package to update the me for the latest version at the L502X unlocked bios topic ^^

however, not sure if we can do anything from FWUpdLcl.exe, it have a lot of checks to ensure the firmware its valid and legit, also those generic updates cant be opened with FITC when I tried to.

[TimeWalker]

Wow, gongrats, kasar!
I'm not attempting the hda trick until I have a reason to disassemble the unit, that is when I'm installing an sad later this months. An M4 is sitting at my desk while I wait for the optibay to arrive.

[kasar]

thx TW
well, I think I cant reach High OCs with this method but every extra Mhz we gain free its awesome ^^

I was months or even a year after this, being able to OC the machine was the thing wich got me to get into all this BIOS headache, hehe

anyway It would be nice if we can enable the OC menus directly in BIOS and also test another ME features.

I noticed some fields at FITC wich talked about ME emergency modes, MACs ,IPs, servers and many other interesting options.

you guys have to get ride of the descriptor or doing the HDA trick like CR said, so we all keep going deeper into the ME FW hacks

---

ok, this is how my "cctwin.exe gl" command looks now ^^

I would say more stuff is unlocked now, hehe

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gl

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

[0x00] CSS -> LOCKED
[0x01] SSS -> LOCKED
[0x02] FCSS -> LOCKED
[0x03] PLLRCS -> LOCKED
[0x04] --- -> LOCKED
[0x05] --- -> LOCKED
[0x06] --- -> LOCKED
[0x07] --- -> LOCKED
[0x08] --- -> LOCKED
[0x09] --- -> LOCKED
[0x0a] --- -> LOCKED
[0x0b] --- -> LOCKED
[0x0c] PLLEN -> LOCKED
[0x0d] --- -> LOCKED
[0x0e] OCKEN -> LOCKED
[0x0f] IBEN -> LOCKED
[0x10] DIVEN -> LOCKED
[0x11] --- -> LOCKED
[0x12] PM1 -> LOCKED
[0x13] PM2 -> LOCKED
[0x14] --- -> LOCKED
[0x15] --- -> LOCKED
[0x16] --- -> LOCKED
[0x17] --- -> LOCKED
[0x18] --- -> LOCKED
[0x19] --- -> LOCKED
[0x1a] --- -> LOCKED
[0x1b] --- -> LOCKED
[0x1c] SEBP1 -> LOCKED
[0x1d] SEBP2 -> LOCKED
[0x1e] --- -> LOCKED
[0x1f] --- -> LOCKED
[0x20] DIVSET -> UNLOCKED
[0x21] --- -> UNLOCKED
[0x22] --- -> LOCKED
[0x23] --- -> LOCKED
[0x24] SSCCTL -> UNLOCKED
[0x25] --- -> LOCKED
[0x26] --- -> LOCKED
[0x27] --- -> LOCKED
[0x28] --- -> LOCKED
[0x29] PI12BiasParms -> LOCKED
[0x2a] --- -> LOCKED
[0x2b] --- -> LOCKED
[0x2c] --- -> LOCKED
[0x2d] --- -> LOCKED
[0x2e] --- -> LOCKED
[0x2f] --- -> LOCKED
[0x30] SSC1PARMS -> UNLOCKED
[0x31] SSC2PARMS -> UNLOCKED
[0x32] SSC3PARMS -> UNLOCKED
[0x33] SSC4PARMS -> UNLOCKED
[0x34] --- -> LOCKED
[0x35] --- -> LOCKED
[0x36] --- -> LOCKED
[0x37] --- -> LOCKED
[0x38] --- -> UNLOCKED
[0x39] SSC2OCPARMS -> UNLOCKED
[0x3a] --- -> UNLOCKED
[0x3b] --- -> UNLOCKED
[0x3c] --- -> LOCKED
[0x3d] --- -> LOCKED
[0x3e] --- -> LOCKED
[0x3f] --- -> LOCKED
[0x40] --- -> LOCKED
[0x41] --- -> LOCKED
[0x42] --- -> LOCKED
[0x43] --- -> LOCKED
[0x44] --- -> LOCKED
[0x45] --- -> LOCKED
[0x46] --- -> LOCKED
[0x47] --- -> LOCKED
[0x48] PMSRCCLK1 -> LOCKED
[0x49] PMSRCCLK2 -> LOCKED
[0x4a] --- -> LOCKED
[0x4b] --- -> LOCKED
[0x4c] --- -> LOCKED
[0x4d] --- -> LOCKED
[0x4e] --- -> LOCKED
[0x4f] --- -> LOCKED
[0x50] --- -> LOCKED
[0x51] --- -> LOCKED
[0x52] --- -> LOCKED

HECI CMD Status = 0x00000000 (SUCCESS)

this is also how GCDR command looks now

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gcdr

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.


clock_id = 1 [DIV1-S]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 2 [DIV2-S]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 80.0000 MHz
frequency_max = 300.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 3 [DIV3]

clock_usage = {PCIe, PCI33, SATA, USB3}
frequency_min = 99.5463 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 4 [DIV4]

clock_usage = {Display_Bending}
frequency_min = 119.3473 MHz
frequency_max = 120.6599 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 1
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 2.50 %

clock_id = 5 [DIV1-NS]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %

clock_id = 6 [DIV2-NS]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 100.0000 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %


HECI CMD Status = 0x00000000 (SUCCESS)
C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>

I didnt oced new laptops until now, but I heard high BCLKs can damage components like usbs, sata and other stuff since it is linked too.

well relating to previous command, I am playing now with div2-s instead div3

so aparently the whole OC goes to BCLK,DMI and PEG, its relative save to fo up for for example 2.4 or 2.5 ghz? (stock speed is 2.1)

its just that when I did OC testing to 2.2 and 2.3 I was playing some music at the laptop and it started to sound weird, some times faster and rare stuff, I also heard there was some kind of command in windows to fix the timmer while messing with OC, not sure if that is what I need now

edit: found the fix for my issue here ^^

http://forum.notebookreview.com/gaming-s...fixed.html

[jkbuha]

Great work kasar

I'm of the same mindset as CodeRush - there has to be some way of unlocking ME via software, ie: a MESET utility but for Dell...

That said, I'm not even sure what the HDA chip looks like - or even if I'll be able to short pins 1 & 5 on boot because of the fixed battery on the 15z.

One other thing - I'm still keen to see if we can enable the undervolting of Sandy Bridge as well - I don't play much games so it's actually more of a motivation from my perspective. Also - would be good to see what all those other parameters do that are currently LOCKED as well..

Anyways, great discovery mate - slowly but surely all the investment that has been done since you first bricked your laptop has now been ultimately worth it