Y510p Ultrabay Graphics card

[MWichni]

On 28.01.2018 at 8:28 AM, High_Voltage said:

Hi, Everyone!

 

I've just discovered this thread and the whole Y510p adapter thing and needless to say I'm quite fascinated with what you've accomplished so far.

 

While 5 years have passed since this laptop's release and it might be almost considered too old to get any useful performance from, I believe that the i7-4700MQ together with external GPU would be just enough to make this machine VR-capable, which is what I'm interested in. It is a shame, however, that NVIDIA GPUs are not supported.

 

I had some free time this weekend to disassemble and fiddle with Y510p's BIOS to make NVIDIA GPUs work and would like to ask if any of you were interested in testing some BIOS dumps on their machines, since I'm kind of too broke to afford the adapter, let alone the GPU which might not even work.

 

It looks like the BIOS code specifically checks whether a PCI Vendor ID is NVIDIA upon initialization, and if so, runs a test to check whether the Device ID is equal to that of the built-in GPU. This is a bit like whitelist, but is instead meant for people not accidentally plugging a GT755M ultrabay unit into their GT750M machines and vice versa and then complaining that SLI doesn't work, I believe. I have now removed this conditional check, which threw the "Unauthorized VGA card" exception and ran some extra code, but there are still places in the binary, which cause questions to me. If this attempt fails, there are at least two more approaches I have in mind to be tested.

 

So, if anyone is up for this, please let me know. Please, note that you will need an SPI Flash programmer to do this. Also, always back up your original flash dumps!!! They will not only be useful if(when) my modded dumps render your machine unbootable, but will also contain your Windows license code, which can be later integrated into modded dumps if they're successful.

 

Also, I'd appreciate any links or advice on modding the Lenovo bios update exes to allow flashing of the patched image (haven't looked into this yet). Other than that, does anyone have a working download link for V2.07 bios installer? Found it.

Hi, I am interested in modding bios so I can use nvidia cards,

Can you tell me what programs do you use to look into bios files?

 

Thanks in advance.

[High_Voltage]

On 11.02.2018 at 2:01 PM, MWichni said:

Can you tell me what programs do you use to look into bios files?

Sure!

 

First of all, I find the Universal BIOS Backup Toolkit 2.0 to be extremely useful for dumping the UEFI image under Windows without the need for bootable DOS flash drive. Fptw64 which was recommended by Svl7 does not work for me for some reason (got it to work right now, the backup file it returns is identical).

 

The Y510p holds its BIOS in two flash chips, 2MB and 4MB one in configuration 2+4. In this case the 2MB one contains about 1.5MB of Intel ME region and the rest is possibly EC firmware. To be precise, EC firmware is contained on the EC chip itself, however I suspect that it includes a bootloader which allows firmware to rewrite itself from data stored on BIOS chip during update. There should be some trigger bit in BIOS flash that the EC checks to decide whether to trigger self-flash or not. But the EC is not important to us. The 4MB chip holds the UEFI image, which is what we're looking for.

 

Once executed under administrator privileges, the Universal BIOS Backup Toolkit 2.0 will spit out a file of approximately 4.5MB. This consists of 0.5MB of rubbish header in the beginning and remaining 4MB are the contents of the 4MB flash chip (the one of two, that actually holds the UEFI image.). The offset is 0x80000 and mine starts from signature 38 00 00 00 00 00 00 00 FF. Yours might have a different first byte, I suspect. The 0.5MB header has to be deleted. (Also, if you don't have a hex editor, I recommend HxD).

 

Once you have dumped your 4MB UEFI image, it can be decompressed by using either PhoenixTool (despite the name, actually works perfectly with InsydeH2O) or UEFItool. This will separate it into individual UEFI PE files (UEFI modules). The one responsible for GPU initialisation appears to be the A6F691AC-31C8-4444-854C-E2C1A6950F92_284. It can be found by using the UEFItool to search for the unicode text phrase "Unauthorized Slave VGA".

 

The A6F691AC-31C8-4444-854C-E2C1A6950F92_284 can then be disassembled using IDA Freeware v7.0, where searching for the same text phrase will point you at the subroutine that determines whether the adapter is valid and either does nothing or outputs this error and runs some sort of infinite loop (which possibly makes the PC freeze at the error screen) and some additional subroutines.

 

I can't be 100% certain, but having looked around the cross references to this subroutine and that variable it checks, you can find such interesting things as explicit declaration of variable with value 0x10DE, which is Nvidia's Vendor ID. Or that the variable which determines whether the error occurs is written by a code that compares return values from two similar routines accessing some (similar) hardcoded addresses. All of this suggests that the thing might be checking whether the Ultrabay is Nvidia GPU, and if it is, whether it is the same as the built-in one. This could explain why AMD cards work perfectly fine.

 

After you decided to do something to the code (for example, in my first patch attempt, I have changed conditional jump (JZ) (or was it a JNZ, I don't remember) that decides whether to throw an error to an unconditional JMP that jumps to No Error no matter what. This is done by highlighting the instruction and looking up its location in the HEX view. You can then manually replace it in your hex file with an op code of the instruction you want there instead.

 

When you have modified the desired PE UEFI module, you can reassemble your UEFI image using the same utility you used to decompress it.

 

That's it! The resulting 4MB file can be flashed. And that's where it stops, because I have no idea how to reliably flash this file by software means, and therefore can't provide any installer solution for everyone to test. When I have more free time, I'll have a look at the method Slv7 used to flash his mod, however I'd appreciate if anyone explained it to me (especially the reason for v2.07 bios rollback being necessary for the installation).

 

Speaking of my own machine, I just had an so8 ic clip arrive from e-bay and immediately flashed my modded image. Raspberry pi zero w with flashrom, accessed via SSH was used as a programmer and also to power the memory chips. Anyone with extra 15 bucks, a soldering iron and a screwdriver could probably just hardware-flash. My machine is still working fine with modded BIOS, however I have no way of checking whether the fix actually worked or not.

 

If you or anyone else is interested in doing a hardware flash, I could provide you with test ROMs or mod your own backup dump, thus retaining your Windows license key.

Edited February 12, 2018 by High_Voltage
Clarified IDA version

[MWichni]

Hi, thanks for the reply.

I will try to work with the bios files during this weekend. 

[High_Voltage]

Good news, everyone!

 

Having studied Svl7's BIOS modding method, I've been able to create my own installer for the nvidia patch discussed in previous posts.

It works in a similar fashion and installation instructions are pretty much the same (although applications I recommend for backup and DOS drive creation are IMHO easier to use). Also, note that this mod is applied to Version 3.08 of BIOS whereas original Svl7's mod is applied over V3.05!

 

You will find detailed installation guide in the Readme file.

 

Download link:

https://mega.nz/#!yd41hBJK!E76XI_NbCG-3q1VDbF9XMePwImkOyiGwjFZAg-wJzNQ

 

DISCLAIMER: Follow the instructions carefully and thoroughly when applying the patch! Although I have successfully tested it on my own machine, I provide ABSOLUTELY NO WARRANTY that it will not damage yours. ALL THE ACTIONS YOU PERFORM DURING INSTALLATION PROCESS ARE DONE AT YOUR OWN RISK ONLY!!!

 

Now, it would be interesting to see whether it actually works for anyone. If it doesn't, we will continue our search through BIOS's disassembled code. Also, if anyone is interested, I can tell you more about this installation procedure and the reason the BIOS rollback is necessary. I can also explain how to extract EC image from factory BIOS installer, and list my interesting findings about the general structure of official updater's .bin files.

 

Also, if anyone wants the patcher's source code, I'll be happy to provide that too.

 

Yours Faithfully,

High_Voltage.

Edited February 18, 2018 by High_Voltage
Can't type

[Bos Maior]

@High_VoltageThat's very cool!

 

I am afraid I won't be able to help as I've already invested in an AMD Vega card and don't want to risk bricking my system, but hope that you will succeed as it'll give Y510p users even more choice.

 

Best of luck!

[High_Voltage]

@Bos Maior Thanks a lot for support!

 

Even though the flashing procedure is not really that dangerous (except for the EC flash, but we flash stock FW so it's OK), I'd discourage anyone who is happy with their AMD-based rig from flashing the mod (unless one wants to do it just out of curiosity, of course).

[MWichni]

Hi las weekend was a bit busy. But this weekend I definitely try your mod. I have an old gtx275 so I'll test it out. 

 

Thanks for your work!

 

Regards,

Mariusz.

Edited February 23, 2018 by MWichni

[High_Voltage]

@MWichni Awesome! Can't wait to find out whether it works well!

[fleshyweeb]

Nvidia has better deals currently. I'll be trading my AMD card if you find a solution

[MWichni]

Hi, I followed the guide though one thing didn't work as should. When I executed ec to flash the soft DOS gave me something like this: DOS memory buffer 2 allocate failed.

Edited February 24, 2018 by MWichni

[High_Voltage]

@MWichni No idea why this happened... Worked perfectly on my machine. Have you tried running the EC command several times?

 

More importantly, does your PC still boot? (I don't see any reason why it wouldn't) And if it does, Does the NVidia card work?

 

One more question: Did you have anything installed in your ultrabay while flashing?

 

Edit: Yeah, this could possibly be due to different graphical configuration. On my machine I was flashing while original secondary GPU was inserted into Ultrabay, meaning Intel graphics and thus Optimus were disabled. EC flasher part of flashit uses some sort of pseudo-graphical interface, so that could have been what has failed. Alternatively, you should maybe try different version of FreeDOS.

Edited February 24, 2018 by High_Voltage

[MWichni]

I had nothing installed in the slot, I will try with second gt750m attached and see what happens. PC boots without any problem so far.

[High_Voltage]

Glad to hear that! Also, would be interesting to see whether it allows you to flash the EC without rolling back to V2.07. If not, just roll back and follow the steps from 7) onwards. Also, if it flashes successfully on V3.08, don't forget to change boot mode to UEFI and UEFI first when done, otherwise windows won't boot.

Edited February 24, 2018 by High_Voltage

[MWichni]

Just tried to flash BIOS and EC with second vga but still no luck so far. Still EC gives the same error. What would you suggest about freedos?

 

Both cards work, and other parts of the PC works as well.

 

Thanks in advance.

Edited February 24, 2018 by MWichni

[High_Voltage]

@MWichni Something might really be wrong with the DOS version then. Were you using the latest Rufus to prepare the flash? And if so, was it a portable version of rufus or the one that has to be installed? I've been using portable version.

 

Just trying to follow my steps through once again to see what might be different.

 

Can you confirm, that apart from bios files and autorun files, the only content of the flash drive is the LOCALE folder? if so, can you take a SHA-256 of it? (this should be available on right click menu, then CRC SHA, then SHA-256, if you have 7zip installed). Comparing our checksums will tell whether we're using the same version of FreeDOS.

 

Also, what is the label of your flash drive (the one displayed next to the drive letter in My Computer)? This shouldn't really matter, but try changing that to something below 8 characters long, like "FLASH" for example.

Edited February 24, 2018 by High_Voltage

[MWichni]

I've done whole procedure using portable rufus. I attached the SHA-256 of the locale, beside you can see that I have only what is needed. 

Maybe the problem is that modded bios was made when the second vga was removed. I will retry the whole procedure with second vga attached and then we will see what happens.

 

Thanks!

[High_Voltage]

@MWichni Right, this is to confirm our DOS versions are identical. Also, I've just reflashed my EC once again from modded V3.08 bios.

 

Whether the BIOS has been installed with Ultrabay GPU or without, should not make any difference. Better not touch it once it's installed successfully.

 

Have you checked the flash drive label? Could you maybe try another flash drive?

Edited February 24, 2018 by High_Voltage

[MWichni]

The label is just simple 8GB. I just tried whole procedure with second vga and it still make the same error message.

[High_Voltage]

@MWichni I see. This appears to be some FreeDOS error. Maybe it just doesn't like your flash drive. I can see two options to try:

 

1) Try different flash drive.

2) Try different DOS. (For example, you could follow Svl7's original procedure of creating DOS drive)

 

OH ALSO, I think I know what the issue is. You should try smaller flash drive. I've been using a 2gig one. This could be because DOS can't allocate as much memory as 8 gig.

Edited February 24, 2018 by High_Voltage

[MWichni]

Ok, I am creating freeDOS on my 4GB pendrive. Will test it out.

 

Tried it even with 1GB one, still doesn't work.

Edited February 24, 2018 by MWichni

[High_Voltage]

27 minutes ago, MWichni said:

still doesn't work.

I see. Could you please try Svl7's DOS flash then?

[MWichni]

Unfortunattely I don't know why but this hp program tells me that my pendrive is write protected...

 

I'm on win 10.

[High_Voltage]

Yeah, it's the same for me. That's why I went with freedos in the first place.

 

p.s. I've replied in PM

[High_Voltage]

Right, an update:

 

We've spent some time with @MWichni trying to get this to work. The mod doesn't help at all with getting Nvidia card to work. The EC flashing issue seems to be unrelated to the mod or its performance though. Such issue has also occurred several times in Svl7's thread, but nobody knows the exact reason why it happens.

 

@MWichni and I will now test several other varieties of the mod (over the course of undefined amount of time) to see if anything works at all.

 

-High_Voltage.

[AllanDavidson]

Im just waiting for the NVIDIA support so I can buy a 1080 Ti to play on my 4k TV.

 

Maybe it could help if we look for help on this matter outside this forums. I will spread the word around, maybe someone can help.