dual-mode IDA bios mod for 8-13% more CPU performance
Consider a dual-IDA bios mod to gain more CPU performance as explained here
. Intel's Intel® 64 and IA-32 Architectures Software Developer’s Manual explains the relevant MSR 0x1a0 bit 20:
Enhanced Intel SpeedStep Technology
Select Lock. (R/WO)
When set, this bit causes the following become read-only:
• Enhanced Intel SpeedStep Technology Select Lock (this bit),
• Enhanced Intel SpeedStep Technology Enable bit.
The bit must be set before an Enhanced SpeedStep Technology transition
This bit is cleared on reset.
Meaning then a Core 2 CPU with IDA support would see anywhere from 8-15% more performance depending on what the highest multiplier is when using unclewebb's Throttlestop software if MSR 0x1a0 bit 20 is unlocked. Moreso if the system has setfsb PLL overclocking support.
from thinkpads.com helped figure out how to do this mod by analysing the uncompressed 2510P bios looking for lines that the lock bit finding it in two places as quoted below.
I found 2 places where bit 20 is set:
Code: Select all
000031BA 66B9A0010000 mov ecx,0x1a0
000031C0 0F32 rdmsr
000031C2 660D00001000 or eax,0x100000
000031C8 0F30 wrmsr
00003F7F 66B9A0010000 mov ecx,0x1a0
00003F85 0F32 rdmsr
00003F87 660D00001000 or eax,0x100000
00003F8D 0F30 wrmsr
All you need to do is replace the OR instruction with NOPs (0x90) and redisassemble to check it was done correctly. You'd better have a BIOS recovery method before you attempt to flash, obviously.
Here's how I found it:
1. disassemble all files: "ndisasm -a -b 16 $f > $f.dis" (done in Bash program)
2. find all occurrences of register 0x1a0: "grep -i "mov ecx,0x1a0" *.dis" (ECX is register index for rdmsr/wrmsr, but looking for this instruction isn't necessary - I just noticed most rdmsr/wrmsr instructions use a hard coded value)
3. Inspect each occurrence and look for an OR instruction which sets bit 20
The exact binary sequence appears in the uncompressed 13_SMM2_000A000_68MSP_F0F-2510P.dec file but I'm stuck trying to use ADDCCV3 to change the single byte in the compressed file. I'm just trying to set the OR to use 0x0 instead of 0x100000 which is effectively cancelling out setting bit 20 to 1.
Code: Select all
FROM -> 000031C2 660D00001000 or eax,0x100000
TO -> 000031C2 660D00000000 or eax,0x000000
FROM -> 00003F87 660D00001000 or eax,0x100000
TO -> 00003F87 660D00000000 or eax,0x000000
EDIT: I found the above code in 68MSP_FOF_2510P.BIN (decompressed) 13_SMM2_000A000_68MSP_F0F-2510P.dec. I proceeded to change 10 to 0 until my decompressed code matched my desired eax, 0x0. One compressed byte did nullify both lines of code above. Another byte was needed for checksum correct. So it was a 2 byte modification. Nice and easy
EDIT: Turns out the checksum correction bit wasn't needed. The only requirement was changing the single compress 0x10 to 0x00. So it was a 1-byte mod!!