IBM Thinkpad 600E bios mod for processor update

Don't ask how to hack password. (BIOS Passwords)
Sebi
BIOS Newbie
Posts: 22
Joined: Fri Mar 11, 2005 12:46 am

Sharedoc wrote:I got a new idea how to get a 28F004 wired in parallel to the original 600E bios-EEPROM: hacksaw a ~50*100mm part containing bios-EEPROM and BX Southport out of a broken 600/600E/600X-motherboard, and wiring it parallel to the 600E motherboard.

Now I regret that I destroyed my existing 600X motherboard by removing the 28F004 by force. Stupid me!

Have to look eBay for a broken 600/600E/600X motherboard.
Don´t think this will work. The unused and unpowered chips will distort the signals. Hf signals won´t take this (even ISA bus works at 8MHz).

Before hacksawing, buy some 0.5mm wire and try my desoldering tip with the old board. Once it works, you can desolder almost every chip without destroying the bord nor the chip. I also desoldered ram chips from a 600e board and many other chips using this technique.

Btw, could you post the location of the signals on the southbridge chip?

I haven´t found the checksum code so far. Seems strange to me, as I´d have thought it´s one of the first routines being executed. Found some checks and the routine where (parts of) the bios is being copied to RAM - but no checksum code so far...

Sebi
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Found out that local electronics shop has 29F040 in their catalogue, so I'll go that direction

I have already cut a 32-pin bios-EEPROM socket from an old motherboard and a 12 cm connecting cable cut from a UDMA66-IDE Cable. Need to do the soldering later this evening.

I'll post a connection list of the signal locations between BX Southport and 29F040 later.
wmarcusm
BIOS Newbie
Posts: 24
Joined: Tue May 31, 2005 8:17 pm
Location: Western US

[quote="Sharedoc"]Brokencase,

You are right. I admire your logical deduction capability.

Let's try to find solution to SpeedStep. Now this what I have found out sofar.

Intel has a specific chip that controls SpeedStep. It propably works in a way of a special I/O device containing internal registers and it can interrupt the PIII CPU. Chip output control signal goes to VCore regulator (select Vcore = 1,35 or 1,60V) and to CPU multiplier input selection GHI#. (SpeedStep mod described in earlier messages is basically meaning: cut GHI# signal path and insert a pull-up resistor forcing GHI# = 1 always). According Intel spec "CPU latches this signal when BCLK restarts in DeepSleep state". Try figure this out, hehe.

So, with the mod, we have GHI# always 1, so we only need "BCLK restart in DeepSLeep state". It seems that CPU multiplier change does not trigger by changing GHI# alone, but it needs to be triggered somehow else (causes BCLK restart) at the right moment (CPU in DeepSleep). Propably by an interrupt generated by the SpeedStep controller?

Now what needs to be done is somehow to find out how to trigger the SpeedStep controller to generate the interrupt.

From the fact that the SpeedStep mod I detected is based on battery booting, we can deduce that power supply conditions (AC/Battery) has something to do with the Speed Step triggering conditions (DeepSleep?)

We know that all communication between 600E motherboard and SpeedStep chip go via the MMC2 connector. So there may be a signal in the connector that somehow controls/triggers the DeepSleep?

Need to go search and eyeball Intel specs.

Compare the MMC2 signals in non-SpeedStep vsSpeedStep PIII's.

I have also available both 600E and 600X motherboards to study...[/
quote]

Assuming you have not added the additional lines from the MMC-2
connector to the TP600e MB - the G_LOHI#, VRCHGNG# and G_CPU_STP# lines need to be connected to the PIIX4 southbridge
to complete the Speedstep circuit. I have an alternate solution using
your mod.

The simplest solution is to use your mod and a software patch to put
the PIII into deepsleep at every boot (or on demand) - much like the L2 cache patch. I wrote a small piece of code that runs under win2k/xp that uses the pIIX4 to put the PIII into deepsleep at each boot. Provided the
processor GHI# line is tied low (as in your mod), the processor will
exit in the fast clock state after a trip to deepsleep. The same technique
will also work under Linux. It is not really Speedstep - but it does allow
one to use the PIII at the fast clock on demand. I can post the code if you want to give it a try.

-Marcus
wmarcusm
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Wmarcusm,

Wow, thanks for bringing eventually light to the SpeedStep issue!

Software initiated DeepSleep: What a great idea! Newer came to think of that before. I always assumed that the state transitions were driven by platform hardware signals.

Is there any danger of left hanging there in DeepSleep? What causes the processor leave DeepSleep? Real-Time clock, Fn-key/keyboard, mouse?

If it works, you might consider to prepare a download site for it. Would be interesting to test your DeepSleep utility.

Do you know if your DeepSleep utility's XP version works in Windows98? (I am still using original Windows98 installation in my TP600E)

---

I have newer come even to think that wiring some additional BX Southport signals could solve the SpeedStep propblem! Thanks for your insight.

I have to check if BX Southport versions are the same on 600E and 600X, and if the BX SouthPort version on 600E supports those signals. I can measure wiring differences between 600E and 600X.
wmarcusm
BIOS Newbie
Posts: 24
Joined: Tue May 31, 2005 8:17 pm
Location: Western US

Sharedoc wrote:Wmarcusm,

Wow, thanks for bringing eventually light to the SpeedStep issue!

Software initiated DeepSleep: What a great idea! Newer came to think of that before. I always assumed that the state transitions were driven by platform hardware signals.

Is there any danger of left hanging there in DeepSleep? What causes the processor leave DeepSleep? Real-Time clock, Fn-key/keyboard, mouse?

If it works, you might consider to prepare a download site for it. Would be interesting to test your DeepSleep utility.

Do you know if your DeepSleep utility's XP version works in Windows98? (I am still using original Windows98 installation in my TP600E)

---

I have newer come even to think that wiring some additional BX Southport signals could solve the SpeedStep propblem! Thanks for your insight.

I have to check if BX Southport versions are the same on 600E and 600X, and if the BX SouthPort version on 600E supports those signals. I can measure wiring differences between 600E and 600X.
Sharedoc,

Based on my reading of the original Intel Patent application for SpeedStep, the first generation SpeedStep is a combination of H/W and software (mostly BIOS routines). It looks like they were attempting to keep the external H/W changes to a minimum - and isolated most of those to an ASIC. They use some of the GPIO lines on the southbridge for interrupt processing and to signal the PIIX4 southbridge to bring the processor out of deepsleep. The basic transaction is:

- BIOS sets up appropriate Power Management (PM-APIC) interrupt vector for power events (ac - plugin/battery, lid open/close, etc.)

- The Speedstep lines on the MMC-2 are connected to GPIO lines on the southbridge. Once a PM event is triggered the BIOS programs the Sourthbridge to pull the G_LOHI# signal low and programs a Stop Break event on the triggering of a GPIO interrupt line (this interrupt is raised by the SpeedStep ASIC via the VRCHGNG# signal and is called a System Controller Interupt).

- This causes the Speedstep ASIC to transitions the PIII from the running state to DeepSleep by asserting the STPCLK# signal followed by the DPSLP# signal (and then stops the local bus clock BCLK).

- The ASIC basically toggles the processor between two multiplier states, fast and slow. by transistioning the power controller to output the higher/lower core voltage and asserts/deasserts the GHI# processor signal (this is what your mod hardwires to the larger multipler state). After this it asserts the VRCHGNG# signal to the southbridge. The VRCHCNG# line is also used to gate the CPU_STP signal from the southbridge to the MMC-2 connector (the gated signal becomes G_CPU_STP).

- The southbridge receives the ASCI interrupt and executes a Stop Break cycle to bring the processor out of DeepSleep. As the processor transitions from DeepSleep it senses the level on the GHI# line (if low, it uses the larger core multiplier, and the smaller value otherwise).

I would say it would only be worth wiring the MMC-2 and southbridge lines - if the TP600e BIOS actually includes the SpeedStep routines (which I doubt, unless IBM has economized and uses the same core BIOS for all the 600 series). If the TP600e BIOS does not contain those routines, then their function would need to be supported in software (or added to the BIOS - not too easy as you already know).

Turns out you can have the southbridge transition the processor through DeepSleep without the ASIC because you can program the PIIX4 to execute a Stop Break cycle based on either the Fast or Slow Bust internal timers. This is what the utility that I wrote does. I program the PIIX4 to transition the processor into DeepSleep. Before executing the DeepSleep command (via a read to the PLVL3 register), I program the Fast Burst timer to fire a Stop Break transition after 1 ms. This is all documented fairly well in the Intel 82371AB (PIIXA) datasheet.

The version I wrote is a Win32 app, so that would likely run on Win98SE,
but... the way I access the southbridge registers from user space is via a 32 bit protected mode device driver, and I think this would not work under Win98SE. You would probably need a "Real Mode" device driver. I'm certain of this for Win98 First Edition, but not sure about SE. In any event it would be very easy to write such a driver for any of the Windows platforms if it would be useful.
wmarcusm
ProtoColD
New visitors - please read the rules.
Posts: 3
Joined: Sun May 29, 2005 12:19 pm

wmarcusm,

Could you share the piece of code you wrote?? That would help this TP600e community a lot.

- ProtoColD
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Wmarcusm,

I wonder if CPU overheating related throttling in 600E has been implemented using the same DeepSleep/BX Southport mechanism, since it seems to trigger the higher SS speed as well.

My TP600E uses the original Windows98 installation that came with the laptop. So it is prior to SE.
REPNZ
New visitors - please read the rules.
Posts: 1
Joined: Mon Jun 06, 2005 3:59 pm

Thank you for that huge amount of interesting informations on the TP600 series!
Although it is mostly upon the 600e modell here, perhaps somebody could
give me some hints on upgrading/overclocking my vanilla 600x/500mhz.
I am not sure, if i could use all 600e infos 1to1, so there are my 600x questions:

- my TP 600x/500mhz (2645-8eg) has no speed-step cpu yet.
Could i insert any mmc2 speed-step cpu and will speed-step be supported?
Do i need an bios-update?

- Will the 600e PLL soldering-mod (8% fsb-gain) which is mentioned here also be valid for an 600x;
does anybody have information about the 600x clock-chip? (I have not opened my TP yet)

- Is there a software-solution (like SoftFSB, but working) to reprogram the 600x PLL
and take advantage of a higher FSB?

Thank you all
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

SpeedStep-PIII's should run on 600X. Bios update may be needed.

To my knowledge 8% mod has never been tried on 600X, because the clock generator chip is different fro 600E. Clock gen is of old type which has no SM-bus support, so Soft-FSB propably does not work.
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

Bought two AM29F040B-90PC EEPROMs. 7,50 euro piece.
wmarcusm
BIOS Newbie
Posts: 24
Joined: Tue May 31, 2005 8:17 pm
Location: Western US

Sharedoc wrote:Wmarcusm,

I wonder if CPU overheating related throttling in 600E has been implemented using the same DeepSleep/BX Southport mechanism, since it seems to trigger the higher SS speed as well.

My TP600E uses the original Windows98 installation that came with the laptop. So it is prior to SE.
Sharedoc,

The PIIX4 supports a distict throttle mechanism, that is unrelated to deepsleep, via the throttle enable bit and throttle duty cycle bits (the pcntrl register), and this does not put the processor into deepsleep. There are some utilities on the net that use this approach to implement CPU cooling.
The throttle mechanism basically periodically asserts the STPCLK# signal based on the frequency programmed in the duty cycle bits.

Cleary there is some BIOS/OS routine that is forcing the processor into deepsleep infrequently however, and it "appears" to happen more often when the processor gets hot (this is only my observation - and I may be completly wrong on the temp correlation).

I'll post my win2k/xp deepsleep code today or tomorrow. I need to zip up the files, then upload them to my web site.
wmarcusm
wmarcusm
BIOS Newbie
Posts: 24
Joined: Tue May 31, 2005 8:17 pm
Location: Western US

ProtoColD wrote:wmarcusm,

Could you share the piece of code you wrote?? That would help this TP600e community a lot.

- ProtoColD
ProtoColD, et al,

I've posted the winxp/2k version of the DeepSleep code at:

http://home.pacbell.net/wmarcusm/deepsleep/

If you have winxp or win2k installed on your thinkpad 600e you can give it a try.

I will probably do a second version that displays the cpu frequency after the transition from DeepSleep. I may also add some code to turn on the P3 Level 2 cache so that I don't need to load the powerLeap utility (I only use it to enable the L2 cache). Come to think of it, I could probably install that part of the code in the power managment interrupt handler chain, which would allow the L2 cache to be enabled after every suspend or hibernate operation.
wmarcusm
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

The DeepSleep utility download web site is up and running. I was #00014 visitor.

I will give it a try later today it in my TP600E/Windows98 even if it is not supposed to work in Windows98.

Please report your results if it works for you and report your configuration as well (processor type, os). If you have any problems, please report also TP600E serial no.
Sharedoc
Notebook Genius
Posts: 679
Joined: Mon Aug 18, 2003 8:46 pm
Location: Finland

OK, I tried to install for Win98, but it fails to open \system32\drivers for copying file
jixe
New visitors - please read the rules.
Posts: 1
Joined: Wed Jun 08, 2005 8:48 pm

If anyone wants a broken 600e MB to play with , there's one on ebay (item 6775314771) . A couple of hours to go...
Post Reply