[Guide] Increasing NVME and eGPU OPI Link Speed to 4 GT/s on Dell laptops

Preamble

A good range of Dell laptops (such as XPSs 9360/9350/9343 and likely a few other Dell ranges too) have their OPI link limited to 2 GT/s, unlike some newer ones such the XPS 9370/9380/7390/9300 and a few Inspirons where full OPI link speed is enabled (4 GT/s) - resulting in double the throughput for SSDs and eGPU interfaces.

These issues are well-known and have been raised elsewhere in the past, such as here, here and here.

After some experimentation, I’ve found a method to unlock full HDD and eGPU speed on the limited machines starting with the XPS 9360 but the process should be similar for all models. The trade-off in power and heat consumption is truly minimal, so it’s definitely worth exploring in earlier models. However the process is long, convoluted, risky and involves a lot of fiddling, particularly in cases such as the XPS 9360 where the BIOS is fitted with a WSON chip instead of the usual SOIC package.


1. Obtaining a full dump of the Winbond BIOS chip

The safest and surest way to dump is to use FPT (dos or windows), but in order to do that the full chip needs to be visible for read-access.

The most reliable way to do this in laptops such as the Dell XPS 9360 is to use CodeRush’s IFR dump to find the UEFI variable (Local ME FW re-flash), which in the 9360’s case is 0x67A.

There are quite a few ways to boot into a UEFI shell though my favourite is CLOVER EFI with a special terminal that enables setup_var which you can download from here

Once you drop into a UEFI shell, type the following:

1
 
setup_var 0x67a 01
 


reboot into Dos/Windows immediately to dump the full flash as follows

1
 
FPT.exe -D FULLDUMP.BIN
 


Make a few dumps and MD5 them just to be safe (you’ll need them, trust me). Next reboot will disable read access of the full chip.

2. Unlocking the flash descriptor on the BIOS dump

The most reliable way of unlocking the FD is using coreboot’s ifdtool. You can compile this manually by cloning the repo here or download a binary for your OS.

Unlocking is simple as follows:

1
 
ifdtool -u FULLDUMP.BIN
 


A new file FULLDUMP.BIN.new is created

3. Flashing the full dump back to the chip

This is the hardest and riskiest part, and it is likely you will need to make a few copies of the FULLDUMP.BIN before you get this right.

The only way for a full flash on this machine (without flash descriptor r/w) is via a hardware programmer. The Raspberry Pi 2/3/4 can do this but check that you have a stable 3v3 line coming out of the device. You will also need a very good quality test clip - either the Pomona 5250, or (as in my case) if it doesn’t read the chip, a specialised WSON test probe clip from AliExpress

There are many ways to set up the RasPI with flashrom and described elsewhere on this forum. My preferred method is using Arch Linux, which can be built and deployed using the method outlined here

The wiring and pin layouts for the XPS 9360’s Winbond chip is identical to the other Winbond chips, as follows:

1
2
3
4
5
6
7
8
9
 
Flash IC Pin	PIN	Raspberry Pi GPIO Pin	PIN
Vcc 8 3.3v 17
GND 4 Ground 25
/CS 1 SPI0_CE0_N 24
CLK 6 SPI_CLK 23
DO 2 SPI_MISO 21
DI 5 SPI_MOSI 19
/WP (IO2) 3 GPIO_GEN4 16
/HOLD (IO3) 7 GPIO_GEN5 18
 


Assuming you’ve got flashrom compiled and ready, test connectivity using this method:

1
 
# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=24000
 


I’ve found that a clock speed of 24MHz is the fastest supported for the W25Q256.V, but you can flash using lower speeds. Be prepared for longer wait times though, which can become an issue if you’re physically holding the clip to the board.

If the clip is properly aligned with the pins, you should see the following:

1
2
3
 
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q256.V” (32768 kB, SPI) on linux_spi.
No operations were specified.
 


It is highly unlikely you will see this on the first attempt, given how finicky the actual connections are. Be patient and try again. Once you get a persistent connection, try the following:

1
 
# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=24000 -r backup_rom1.bin && flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=24000 -r backup_rom2.bin && flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=24000 -r backup_rom3.bin
 


If all the three dumps above are identical (using cmp or diff), then now’s the time to flash back the modified rom from above

1
 
# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=24000 -w FULLDUMP.BIN.new
 


Assuming the flash and verify steps are successful, you will then need to unplug and replug both batteries on the board.

If for whatever reason the flashing operation above is unsuccessful, or the laptop POSTS with an error (usually two amber, two white flashes) then the chip needs to be refreshed. Do not despair - I’ve bricked the machine many times and always brought it back to life with this method, it just requires time and patience.

4. Changing the OPI link speed

Assuming the above is completed successfully, the rest is now easy. You’ll need to boot into Windows, and first verify that the flash descriptor is unlocked using FPTW64.exe -i

You’ll then need the latest copy of Intel’s Flash Image Tool, which can be downloaded from the system tools here

Unrar and unzip, and run the Flash Image Utility. Try and load the FULLDUMP.BIN.new file now.

If you encounter any errors, you will first need to prepare the utility to work with a clean ME image, as is described here

Assuming all works well, you will then need to modify the OPI Link speed. Go to PCH Straps -> OPI Link Speed and change it from 2 GT/s to 4 GT/s. Save the image and create a new flash. Do *not* flash the whole image back.

Close FIT, and re-open it. Load the newly generated image file (outimage.bin) and go to its new dump folder. You should find a 4k DESC file which contains the modded OPI link speed. Flash this back to the descriptor using the command:

1
 
FPTW64.exe -DESC -F DescImage.bin
 


Shutdown, and reboot. Your OPI link is now running at full speed :)

The two screenshots show the performance of my Sabrent 2TB NVMe drive before and after the modification. As can be seen, the new OPI mod lets the drive work to the limits of its manufactured throughput.

GT2.png

GT4.png




Special thanks to the following:

1. Plutomaniac for the excellent guide how to build a new BIOS image and clean it.
2. Espionage724 for proving that the XPS 9360 can be flashed using a Raspberry Pi

Thanks for your tutorial ,this is a useful guide!

After a week of trials and fails I finally managed to get the full potential out of my drive. Now I have a modified ch341a programmer, knowledge how to flash the right fw on my laptop and a spare winbond bios chip for future experiments)



Thanks @jkbuha

I @jkbuha Can i try it with my laptop dell Latitude E5470 (i7 6820HQ)?. Current support E5470 with H processor supports 2X NOT 4X :(. But E5570 with H processor supports 4X. they are the same CPU

@jkbuha can u help me to ifdtool -u dumped_bios.bin? 9360 i7-8550u

I just download someone prebuild ifdtool on MacOS. but I flash bin back ,xps not wake up.

so I flashed the dumped_bios.bin again. xps reboot normal.

I just can confirmed that my dumped_bios is ok.

github.com/P013onEr/XPS9350-macOS/blob/master/dumped_bios.zip



In theory you should be able to - but you need to check whether it’s possible to enable 4 GT/s. Dump the full chip first with whatever method, then open the image up in Flash Image Tools. If you see an option under PCH Straps -> OPI Link Speed, then you can. But you need to modify the process above to work with your dell latitude.



Responded to you via pm a few days ago :slight_smile: Let me know how it goes!



@jkbuha
Please show to me detail document how to Dump the full chip first?. I have tried dump my bios but can not open with Flash Image Tools.
Thanks

There are a few ways to do it, but easiest (for Dell-based laptops) is to set Local ME FW Flash UEFI variable to 0x01, reboot and dump with FPT.exe or FPTW64.exe -D ALL.bin


i am a new member and do not know how to start it, please can you help me make a video or a clear docuemnt to me start do it:)
Thanks



Has anyone been able to get this to work on XPS 13 9343? It doesn’t seem to work for me (I get error 26 regardless). I just posted a separate thread in this forum (but I’m not allowed to link to it).

Also, for my machine I need to resort to a different NV editor (RU.EFI) because the setup_var patched GRUB picks the wrong Setup variable (!) - if it shows size 0x12 and displays a warning you should not proceed. Use RU.EFI instead.

Before

before.jpg


After

after.jpg



Finally successful unlock the Speed limit. Just use Realteck pinmod to unlock fd. thanks for your guide.

Thanks for proving that the Realtek pinmod works. I thought it wasn’t possible because the audio chip was located on the underside. It’s a much safer way of modding the chip as you can unlock the FD without having to flash the entire eeprom.

Could you share some photos of the exact pins to short? I’ll add your feedback to the original post and credit you with the discovery :slight_smile:

Hi, would you be able to give me some instructions? I have an xps 9360 and also have a CH341A programmer

Hello P013onEr
I am so excited to see the way you could double the speed of your laptop. I have the same laptop as yours, xps 9350 with limited speed. I am using bpx pro 2 TB nvme drive. Would you mind help me to get my laptop access the speed like you, I am not an expert, I am searching in the internet and it leaded here. Very much appreciate if you could help.

Thank you for welcoming me. I am so excited to see the way P013onEr could double the speed of his/her laptop. I have the same laptop as his/hers, xps 9350 with limited speed. I am using bpx pro 2 TB nvme drive. Would you mind help me to get my laptop access the speed like him/her, I am not an expert, I am searching in the internet and it leaded here. Very much appreciate if you could help.

check the details here.

This is my first post here, so hello all :slight_smile:

I have an XPS-13 9360 DE (i7-7560U Kaby Lake, Sunrise Point-LP) and I wanted to increase my OPI link speed as described in this guide. I think I may have completed successfully points 1 and 2 and now I have the following doubts and questions:

  1. I was able to obtain a full dump of my chip and as advised I dumped the data several times: 2 times using CSME tools v11 r46 from this thread and also just in case 2 times using r30 from this github repo. All 4 dumps had the same md5, however when I repeated the whole procedure just in case (ie rebooted again to UEFI shell, used setup_var, then rebooted to freeDos and used FPT (both revisions 2 times each again) to obtain a new dump), the new set of dumps had a different md5 than the first one (still all 4 dumps within this new set were identical to each other). I’ve repeated the procedure few times and it’s always like that: within the same boot all dumps are always identical, but dumps from separate boots are always different: is this normal?
  2. Does anyone happen to know in which part of 9360’s motherboard is the bios WSON chip located? Is it clearly visible after opening the case or is it hidden for example under the SSD or elsewhere? Does it have any specific markings that could help me identifying it?

I’m a total n00b in terms of bios programming and flashing chips, so please bare with me in case my questions seem stupid… Thanks! :slight_smile: