What controls Turbo Core in Xeons?

[Dufus]

@fromax Sometimes it's enough to just modify the microcode header so it isn't usable. For instance we can change the CPUID of 0306F2 to 0506F2 AND 0106F2. The reason for changing by both +2 and -2 is to keep the simple checksum the same. Seems there are two microcode locations in BIOS E7885IMS.1D0. We could try changing the following offsets

F0C69E 03 -> 05
F0C6E6 03 -> 01

F1C29E 03 -> 05
F1C2E6 03 -> 01

Of course if the MSI BIOS has been written to halt on no microcode or uses more than just the usual simple checksum or uses a function that needs a microcode fix then it will not work.


@GTZ Your welcome and for the record it was hinted there might be some extra performance to be had almost 2 years ago but for whatever reason not much seemed to come of it.
http://hwbot.org/submission/2830783_0.0_cpu_frequency_core_i7_4700mq_4550_mhz

It would be nice to know how many HSW chips are affected but without people such as yourself willing and capable of testing it then it's hard to say. Perhaps it got fixed in the refresh, maybe not. idk.

That's strange with fast boot, must have a look at it when time permits. Thanks for the feedback.


@C-Power/Tw0tch UEFI can make it easier for this sort of thing with direct access to the hardware and a flat memory system. A lot of thanks should go to The Stilt otherwise the thread would have probably died like others before it and thanks to all the posters that have contributed, including of course the OP for making the thread.

 

[fromax]

@Dufus Yep, two locations. Will try to sort it out, thanks for reply

 

[mr.hat]

UEFI can make it easier for this sort of thing with direct access to the hardware and a flat memory system. A lot of thanks should go to The Stilt otherwise the thread would have probably died like others before it and thanks to all the posters that have contributed, including of course the OP for making the thread.

no, thread will be alive
video guide will be soon, russian community of xeonholders just found it recently
thanks a lot guys

 

[GTZ]

@GTZ Your welcome and for the record it was hinted there might be some extra performance to be had almost 2 years ago but for whatever reason not much seemed to come of it.
http://hwbot.org/submission/2830783_0.0_cpu_frequency_core_i7_4700mq_4550_mhz


That's strange with fast boot, must have a look at it when time permits. Thanks for the feedback.

In the the HWBOT link how was the 4700MQ able to clock so high? I was under the impression that a non K SKU could only go up 4 turbo bins. Also all of the was achieved on a non Z board (notebook motherboard at that). Was all that accomplished thru UEFI scripts?

I mean if it worked for him what is stopping myself or others from attempting to overclock non K Haswell 1150 and a H81, B85, or H87 (similarly H97) motherboard.

I have so many questions, I am truly mind blown.

 

[vadimkara]

is there any possibility unlock all cores turbo on 306F1 es samples of haswell-e?

 

[katlen]

is there any possibility unlock all cores turbo on 306F1 es samples of haswell-e?

From what i've read , all haswell 2011v3 suffer from this bug and it might be possible to do it.
306F1 is stepping 1 (ES) , 306F2 is stepping 2 (QS/Retail) . If you have the cpu you can give it a try.

 

[vadimkara]

I am in community where many people have es samples stepping 1 of haswell-e and i also have one, but with instruction from this topic it works only on qs and retail pieces

 

[The Stilt]

I am in community where many people have es samples stepping 1 of haswell-e and i also have one, but with instruction from this topic it works only on qs and retail pieces

Since the bug which makes the exploit possible still exists in a newer stepping it, it is almost certain that it also exists in the older 0x0306F1 stepping (ES). The same exact workflow should work with these CPUs too, however obviously you need to load a different microcode in the later stages. The issue is that these earlier CPUs generally seem to have quite a low maximum turbo frequency, or in some cases no turbo at all.

 

[vadimkara]

Since the bug which makes the exploit possible still exists in a newer stepping it, it is almost certain that it also exists in the older 0x0306F1 stepping (ES). The same exact workflow should work with these CPUs too, however obviously you need to load a different microcode in the later stages. The issue is that these earlier CPUs generally seem to have quite a low maximum turbo frequency, or in some cases no turbo at all.

ma sample has turbo boost at 2.6,and it's still a performance boost.

 

[Jann]

Hi, new user here
I have an Asrock X99 WS board with 3.30 bios, and E5-2686 V3 QS cpu (306F2 from what I gather).
Has someone made any progress on this cpu and/or motherboard maybe?

If I understand correctly, this "mod" is performed either on hardware level in bios(uefi) or in windows?
I'd like the more permanent option with no bclk overclocking. Maybe someone can guide me through it?

Also, those who did get their 2683 V3 to 3GHz on all cores, how did your temperatures change?

 

[katlen]

I just got my taichi mobo today, 2686v3 reporting in.
Instead of 2.3ghz on all cores i get 2.9ghz, but sometimes when CPU is idle all cores are at 3.5ghz, in bios i don't have an option to set cpu clock (idk why probably because i use ECC memory) i can only change only BCLK, when i put it at 105 but in windows it fluctuates 101-103. (windows server 2016)

http://valid.x86.fr/anazw9
15% single core / 30% multicore increase in CPU-Z

Cinebench r15 score: 2025 before, 2537 after.

I will do some power measurements and some other tests.

 

[GTZ]

Hi, new user here
I have an Asrock X99 WS board with 3.30 bios, and E5-2686 V3 QS cpu (306F2 from what I gather).
Has someone made any progress on this cpu and/or motherboard maybe?

If I understand correctly, this "mod" is performed either on hardware level in bios(uefi) or in windows?
I'd like the more permanent option with no bclk overclocking. Maybe someone can guide me through it?

Also, those who did get their 2683 V3 to 3GHz on all cores, how did your temperatures change?

It is a permanent option, just follow the step by step guide someEEguy posted on page 3 of this thread. You might however get the same results as Stilt. All core turbo of 3.0 instead of 3.5.

My 2683 temp went up 4 degrees, really no change since these Xeons run cool. During a R15 run, CPU socket max is 46 Celsius and the hottest cores too out in the low 40s. I have a simple tower cooler.

 

[fromax]

@fromax Sometimes it's enough to just modify the microcode header so it isn't usable. For instance we can change the CPUID of 0306F2 to 0506F2 AND 0106F2. The reason for changing by both +2 and -2 is to keep the simple checksum the same. Seems there are two microcode locations in BIOS E7885IMS.1D0. We could try changing the following offsets

F0C69E 03 -> 05
F0C6E6 03 -> 01

F1C29E 03 -> 05
F1C2E6 03 -> 01

Of course if the MSI BIOS has been written to halt on no microcode or uses more than just the usual simple checksum or uses a function that needs a microcode fix then it will not work.

Dufus, is it any chance you make this offset mod and share this bios. I can`t find much info about this.

 

[mr.hat]

Need guide for asus mobos

 

[GTZ]

Need guide for asus mobos

Should be the same as AsRock, remove the microcode from BIOS and later inject microcode thru Windows. The EFI driver Dufus made should work for all Haswell Xeons. Just follow the step by step guide someEEguy posted on page 3 of this thread.

 

[fromax]

Should be the same as AsRock, remove the microcode from BIOS and later inject microcode thru Windows. The EFI driver Dufus made should work for all Haswell Xeons. Just follow the step by step guide someEEguy posted on page 3 of this thread.

Well, it could be tricky since UBU doesn`t fully support Asus bios :
2) "Error in Replacing File- to update the microcode on X99 Asus, MSI, Gigabyte. The Volume, where the microcode, fixed by changing the size.
http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html

 

[Jann]

It is a permanent option, just follow the step by step guide someEEguy posted on page 3 of this thread. You might however get the same results as Stilt. All core turbo of 3.0 instead of 3.5.

My 2683 temp went up 4 degrees, really no change since these Xeons run cool. During a R15 run, CPU socket max is 46 Celsius and the hottest cores too out in the low 40s. I have a simple tower cooler.

Kind of stuck on step 4.
There are two .efi file steps with booting. So should I boot once from the github shell.efi, and then from the V3.efi in order, or just pick one of them?
And which one of the microcodes should I use (or how to determine which would be better?)

 

[GTZ]

Well, it could be tricky since UBU doesn`t fully support Asus bios :
2) "Error in Replacing File- to update the microcode on X99 Asus, MSI, Gigabyte. The Volume, where the microcode, fixed by changing the size.
http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html

Fix on how to mod a modded BIOS below.

"
By the way, good news. The USB BIOS Flashback method on the ASUS X99 boards to flash a modded BIOS dose work.

I just thought I would give the USB BIOS Flashback method one last try and I discovered that on the Asus Rampage V Extreme X99, once
you've flashed the board with a certain BIOS version, it won`t re flash fully again the same BIOS version you have already applied.

To flash the modded BIOS successfully onto my board BIOS using the USB BIOS Flashback method, I had to downgrade my BIOS
to an earlier one first before flashing the modded one so it could preform a full BIOS flash.

This info will come in handy for those that have a Asus X99 board that has the USB BIOS Flashback feature
and want to be able to flash their modded BIOS.

Thanks again to you SoniX for the help you gave me with the finding the BIOS OROM modules on my
board and letting me know the correct way to replace them.

I think it would be best if Fernando updated that topic about flashing modded BIOS so that people will know
that the USB BIOS Flashback method does work on the newer X99 platform from ASUS to flash modded BIOS. "

Taken from the win raid forums. Post # 57
http://www.win-raid.com/t761f16-New-AMI-Aptio-UEFI-MMTool-v-now-available-3.html#msg13289

 

[C-Power/Tw0tch]

Kind of stuck on step 4.
There are two .efi file steps with booting. So should I boot once from the github shell.efi, and then from the V3.efi in order, or just pick one of them?
And which one of the microcodes should I use (or how to determine which would be better?)

You boot into the shell, then load the V3.efi (driver) within the shell, you can't "boot" into V3.efi, but you can make it load at startup before the OS (which is the entire point of V3.efi).

@Dufus has written a nice little guide a page or 2 back including screen shots and step by step what you should be typing in the shell (can vary depending on what number your startup drive is).

Technically it should work for any V3 Xeon.

Edit:
This is the post from Dufus:
What controls Turbo Core in Xeons?

 

[vadimkara]

After adding V3.EFI driver to my bios at bios boot it writes me 'V3 Wrong CPU" i have e5-2658 v3 es sample.

 

[Dufus]

@fromax Here's a portable hex editor that can be used. https://mh-nexus.de/downloads/HxDen.zip

Run HxD then use ctrl+o to open the BIOS file E7885IMS.1D0

Use ctrl+g and type in the first offset F0C69E, hit OK then type 05 to overwrite 03. Use ctrl+g again and type in the next offset F0C6E6, hit OK then type 01 to overwrite 03. Complete the last two offsets then save the file with a suitable name. Attempt to flash and see if it works. If not you could try contacting user svl7 (IIRC) on the MSI forum. Good luck.

@GTZ the full unlock only seems to work with the Haswell processors that support ratio overclocking with limited bins. The 4700MQ can normally use up to an extra 2 bins allowing a top ratio of 36 (~3.6GHz). Before a microcode update higher than ver 1 or 2 is applied it supports ratios up to 82x due to some errata.

@vadimkara please try this file instead. https://www.sendspace.com/file/qt0bjs V3_1.zip (716bytes)

@Aidar never having had a board other than uni-processor ones, I would think only one processor would be set but idk. It's also my first Xeon so I'm still pretty much a noob when it comes to these CPU's.

 

[katlen]

Hi Dufus,
Could you share the source code for v3.efi driver?
What does it exactly do? overwrite the MSR registers?
Thank you.

 

[vadimkara]

@fromax Here's a portable hex editor that can be used. https://mh-nexus.de/downloads/HxDen.zip

Run HxD then use ctrl+o to open the BIOS file E7885IMS.1D0

Use ctrl+g and type in the first offset F0C69E, hit OK then type 05 to overwrite 03. Use ctrl+g again and type in the next offset F0C6E6, hit OK then type 01 to overwrite 03. Complete the last two offsets then save the file with a suitable name. Attempt to flash and see if it works. If not you could try contacting user svl7 (IIRC) on the MSI forum. Good luck.

@GTZ the full unlock only seems to work with the Haswell processors that support ratio overclocking with limited bins. The 4700MQ can normally use up to an extra 2 bins allowing a top ratio of 36 (~3.6GHz). Before a microcode update higher than ver 1 or 2 is applied it supports ratios up to 82x due to some errata.

@vadimkara please try this file instead. https://www.sendspace.com/file/qt0bjs V3_1.zip (716bytes)

@Aidar never having had a board other than uni-processor ones, I would think only one processor would be set but idk. It's also my first Xeon so I'm still pretty much a noob when it comes to these CPU's.

Can you explain what you driver is doing? And can i modify bios manually without driver. What tools should i use, to programm MSR registers(maybe in small manual).

 

[GTZ]

@ katlen and vadimkara

The V3.EFI driver basically sets all turbo's to max core ratio, cache min/max ratio's to max cache ratio and core and cache voltage with -20mV offset then locks the OC'ing register so the settings other than cache min/max don't get affected by other software. Those settings seem to work well and help a little with the AVX2 offset which appears dependent on core and cache voltage, cache ratio and number of active cores rather than power dependent. Would be nice to get rid of that and reduce the AVX voltage if possible.

 

[GTZ]

@GTZ the full unlock only seems to work with the Haswell processors that support ratio overclocking with limited bins. The 4700MQ can normally use up to an extra 2 bins allowing a top ratio of 36 (~3.6GHz). Before a microcode update higher than ver 1 or 2 is applied it supports ratios up to 82x due to some errata.

I built a budget gaming fig for my nephew a few years back with a i5 4460 and a ASRock Z87 board (I believe). If I delete the microcode from the BIOS there is there a strong possibility the multiplier will be unlicked? And if it works and apply an updated microcode thru the OS will the setting stick like they do for the Xeon exploit?

To bad he lives an hour away or I would experiment with his PC.

Again thanks for all the info.