IBM Thinkpad 600E bios mod for processor update

Don't ask how to hack password. (BIOS Passwords)
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Digging at Intel design documents... Can't find anymore PIII-mmc2 spec. Intel only have Pentium-M specs online.

I have copy of PII-mmc2 spec though. Anyone still have Intel PIII-mmc2 spec? Especially I need the state-machine part with DeepSleep state.
swsnyder
New visitors - please read the rules.
Posts: 13
Joined: Wed Mar 16, 2005 4:29 am

OK, I'm in the process of upgrading the CPU on my 600E. I'm concerned, though, that I have the wrong value in my BIOS at offset 0x20.

I'm using the latest BIOS fo my 600E-57U, version IHET47WW, available at http://www-3.ibm.com/pc/support/site.ws ... sdih47.exe.

I previously disabled the onboard RAM. The BIOS had the correct initial value at offset 0x2B and changing it gave the desired results. Now I want to disable the L2 cache.

I see now that offset 0x20 does not have the value of 0x02 as expected from the earlier comments in this thread. Instead it has a value of 0x20. In the immediate vicinity I have a 0x02 value at offsets 0x16 and 0x2A. That's it.

Note that I have not yet replaced my old P2 with the new P3 module. Maybe the expected value won't show up until the new CPU is in place? That doesn't seem likely.

What's my next move as far as disabling the L2 cache?

Thanks.
Sebi
BIOS Newbie
Posts: 22
Joined: Fri Mar 11, 2005 12:46 am

brokencase wrote:You are correct. The same cache enabling code would appear in both the 600e and 600x bios's. The issue is only that the early 600e bios does not know how to identify the PIII. It can't proceed to enable the cache if it cannot id the cpu.

So what needs to be changed is how the bios id's the CPU. OR modify the code to always run the cache init.
Right you are. Problem: I can´t find the distinction btw. PII and othr processors. At 0x470d (file offset) the cpuid string (GenuineIntel) and cpu family (6, same for PII/III) is checked. If family==6, carry is cleared. This routine is called two times (from 0x43df and 0x44ba). At 0x43d2 there is a conditional jump:

43dc mov sp, 43e2 ; return address
43df jmp 470d ; call cpuid routine
43e2 in al, 43h ; ????
43e4 jb 44ad ; if below, skip cache init

This ist the only part of the routine different from 600x bios:

461c mov sp, 4622 ; return address
461f jmp 494d ; call cpuid routine
4622 and al, 46h ; compare model/stepping
4624 jb 46ed ; if below, skip cache init

Well, thought I found it.... Flashed the new bios but ended up with a dead thinkpad. Will get it back on monday with a replaced bios chip... :-( But maybe it wasn´t this byte that I changed but the last one in the file - I took it for the checksum. I´m a bit scared now doing further tests...
brokencase wrote: IMHO, since a cache enabler is availible for both Linux and Windows, and that there is a workaround for the 127 error, time would be better spent in comming up with an easy way to turn on SpeedStep. This requires a hardware solution.
Are you sure about this? The MMC-2 module contains chipset (part of) and processor. So the speedstep signals from chipset to processor should be wired. Did any of you tried the SpeedStep applett?

As for the cache: it has to be reenabled after every resume from standby or hibernate. So far I found no solution to execute a program in Windows upon resume. That´s the main resaon for me to look for a bios solution.

Sebi
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

swsnyder,

Dunno.

I am using bios verson INET36WW. Maybe IHET47 is different?

Another explanation could be if the byte has been swapped, then A0 should disable L2, can you try?

If something strange happens when you try, you can always initialize CMOS settings by taking CMOS battery out for 1 min.
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Sebi,

Bad luck.

How did you pack the modded bios?
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Sebi,

SpeedStep aplett does not work in my 600E, I have tried it.
Sebi
BIOS Newbie
Posts: 22
Joined: Fri Mar 11, 2005 12:46 am

Sharedoc wrote:Sebi,

Bad luck.

How did you pack the modded bios?
Didn´t pack it at all as the files on the BIOS update diskette aren´t packed. The disk contains a file called $0044000.fl1, which is exactly 524.288 bytes in size - 512kb. This is the file I also took for the disassembly. I don´t know why the bios didn´t start, the change was very small and I didn´t modify any stacks or things like that. My bet is the last byte in the file was a address and not the checksum as I guessed...

Sebi
brokencase
BIOS Newbie
Posts: 30
Joined: Mon Feb 07, 2005 12:34 am
Location: PA
Contact:

Sharedoc,

The only good description regarding PIII speedstep hardware is in the the PIII MMC-2 pdf. I found the document at www.datasheetarchive.com Search for PIII and be sure to click on the "by description" checkbox.

They describe the four SpeedStep signals and how they interact with the motherboard chipset. Some of the signals are to be gated with the standard PII signals.

Does'nt look easy.
swsnyder
New visitors - please read the rules.
Posts: 13
Joined: Wed Mar 16, 2005 4:29 am

I've got the new P3/500 installed in my 600E-57U and, as expected, I'm getting the 127 cache errors on start up.

I infer from previous comments that it is possible to get past this error with a few keystrokes. I'm willing to put up with this inconvenience while determining the real fix.

So... how does one get past this error?

Thanks.
swsnyder
New visitors - please read the rules.
Posts: 13
Joined: Wed Mar 16, 2005 4:29 am

swsnyder wrote: I infer from previous comments that it is possible to get past this error with a few keystrokes. I'm willing to put up with this inconvenience while determining the real fix.

So... how does one get past this error?

Thanks.
Never mind. Found it.
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

I have a new hunch how the SpeedStep mod I described actually works and how it could be still improved. The hunch is based on my recent observation, that the hotter the processor is during the boot, the more propable it enters SpeedStep higher speed during the battery operated boot.

Observations:
(1) When I used very high Vcore values of 1.75V, then booted every time with higher SpeedStep speed.
(2) When using high Vcore (from standard Vcore 1.60 ... 1.75) processor starts to throttle at high loads due to excess core temperature. Throttling means that temporarily motherboard (BX chipset?) turns the FSB bus to lower speed (half or 1/4 speed). You can see this taking place with WCPUID programme
(3) It does not matter if the laptop is AC powered in the beginning of the boot, it only matters that the laptop is battery powered during the final stages of Windows desktop loading.

My hunch is that it is the PIII throttling that somehow enters the state transition from DeepSleep that caused theSpeedStep mod to work.

If my hunch is right, then we can reach better propability to activate SpeedStep simply by taking care that the processor runs hot and throttles during late stages of boot.

We can make this happen by
(A) blocking the cooler air output temporarily (not sure if this is enough if you cold-start the laptop)
(B) Increase Vcore during boot to heat up the CPU.

I will try combinations of A and B and try to figure out a scheme where Vcore can be brought down after the boot automatically. I have already developed a way to increase Vcore with a resistor hack to Vcore regulator reference voltage input. Now what needs to be done is to develop a simple one-shot logical pulse to elevate the Vcore for duration of boot. Or make a simple switch/button for "core heater"
beatoem
Chip off the ol' block
Posts: 120
Joined: Sun Jan 16, 2005 11:38 am
Location: sydney,australia

Sharedoc wrote:Digging at Intel design documents... Can't find anymore PIII-mmc2 spec. Intel only have Pentium-M specs online.

I have copy of PII-mmc2 spec though. Anyone still have Intel PIII-mmc2 spec? Especially I need the state-machine part with DeepSleep state.

8O GOT BOTH INCLUDING THE LATEST UPDATED ONE WITH CPU STRING IDS,IF YOU HAD NO LUCK WITH THE FILES.
:? IT SEEMS THE CPU SWITCHES TO FAST SPEED AS SOON AS IT BOOTS IN WINDOWS,LIKE ASIF WINDOWS P3 DRIVER ACTIVATES DESKTOP CPU MODE,CONVERSELY NOT THE CASE WITH HP 4150 THOUGH,BUT TP600E,390X EA TIME IN WINDOWS. :?
beatoem
Chip off the ol' block
Posts: 120
Joined: Sun Jan 16, 2005 11:38 am
Location: sydney,australia

Sebi wrote:
Sharedoc wrote:Sebi,

Bad luck.

How did you pack the modded bios?
Didn´t pack it at all as the files on the BIOS update diskette aren´t packed. The disk contains a file called $0044000.fl1, which is exactly 524.288 bytes in size - 512kb. This is the file I also took for the disassembly. I don´t know why the bios didn´t start, the change was very small and I didn´t modify any stacks or things like that. My bet is the last byte in the file was a address and not the checksum as I guessed...

Sebi

SORRY TO HEAR ABOUT THE LOSS,THERE WAS A BIOS GURU IN THE THREAD WHOM OFFERED SOME HELP WITH FILE MODIFICATIONS,HE SAID THAT HE NEEDED BOTH FULLY EXPANDED BIOSES TO EVALUATE
THE CPU ID STRINGS.
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Looks like my hunch was right. I made a Vcore-booster modification to the 750-PIII-MMC2 module that ups the Vcore to 1.65V for about 100 seconds after power-on. With this new Vcore-booster mod, and previously described SpeedStep mod, and booting from battery, and keeping closed the ventilation holes at the left side of the 600E, the processor seems to boot almost every time at 810MHz (=higher SpeedStep speed).


-- deleted the Vcore-boost mod description because it caused instability --
Last edited by Sharedoc on Mon Mar 28, 2005 2:41 pm, edited 1 time in total.
brokencase
BIOS Newbie
Posts: 30
Joined: Mon Feb 07, 2005 12:34 am
Location: PA
Contact:

Sharedoc, Regarding your mod...
I guess what I am not clear on is at what point is the SpeedStep kicking in at during boot? Is is because of something that the Windows power management is trying to do or is it all in the hardware?

I might even be something that the ibm power management utility is doing (or trying to do?)
Post Reply