[Request] Need help to modify CbsSetupDxe aka AMD CBS

gupsterg · June 17, 2019, 5:47pm

When Threadripper 2xxx launched a new menu appeared in AMD CBS, PMU Training aka IMC Training.

This menu functions even on 1xxx Threadripper as I have one. I also have a 2700X on AM4 motherboard, I would like to modify CbsSetupDxe to have this menu within AMD CBS.

My crude edits by hand do not work, IFR Extractor will not recognise the edited sct as UEFI and a parse will result in empty txt. So mod will fail.

If I replace CbsSetupDxe using UEFITool, on ASUS Crosshair VII Hero WiFi UEFI with one from ASUS Zenith Extreme Alpha. I gain the menu, I can change and save setting, but it does not apply. All settings seem “orphaned”.

Reading a post here seems I need SW tool which would export IFR data from sct to XML and import edited XML back to sct file, then use UEFITool to replace the sct.

Lost_N_BIOS · June 17, 2019, 8:13pm

@gupsterg - Show me one example here in text format, of an entire setting from start to end that you edit, before and after, and I will tell you what’s wrong or better/other way to do it instead since your current edit is failing.
The “SW” Tool you mention is simply universal IFR extractor, which you already mentioned you are currently using. And that, is what I want an example from before/after edit posted here.
Ohh, I see what you mean, I misunderstood what he said at first. Anyway, that tool is unreleased and not needed, you can maybe PM him or @tag him here and see if he replies.

I understand you cannot show me actual outcome of IFR, since your edit is breaking something, so show me textually how you edit, like example I’ll give below.
Please note, this is random example, since you didn’t even mention a board model so I can’t use your BIOS as source

Here is fake edit to change - whatever, to be visible. This is only meant to serve as an example of what I want you to show me you are doing.

Before -
Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 18 00 00 00 00}
One Of Option: Auto, Value (8 bit): 0x1 (default) {09 07 10 00 10 00 01}
End One Of {29 02}
End If {29 02} << Edit will move this (Cut/paste, or delete/add)

After
Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
End If {29 02} << Moved to here
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 18 00 00 00 00}
One Of Option: Auto, Value (8 bit): 0x1 (default) {09 07 10 00 10 00 01}
End One Of {29 02}

OR, another example, both may work, or only one way may work in your BIOS, many ways to skin a cat (And I like cats!

)
Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00} << FF that 01
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 18 00 00 00 00}
One Of Option: Auto, Value (8 bit): 0x1 (default) {09 07 10 00 10 00 01}
End One Of {29 02}
End If {29 02}

Secondary edit of same setting, to change value instead of unsuppress

Before-
Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 18 00 00 00 00} << We want this to be new default
One Of Option: Auto, Value (8 bit): 0x1 (default) {09 07 10 00 10 00 01} << Move this 10 to above instead
End One Of {29 02}
End If {29 02}

After mod
Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 18 00 10 00 00} << Now this is new default
One Of Option: Auto, Value (8 bit): 0x1 {09 07 10 00 00 00 01}
End One Of {29 02}
End If {29 02}

OR

Suppress If {0A 82}
64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
One Of: Core Performance Boost, VarStoreInfo (VarOffset/VarName): 0x24, VarStore: 0x5000, QuestionId: 0xA, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 00 1A 00 0A 00 00 50 24 00 10 10 00 01 00}
One Of Option: Auto, Value (8 bit): 0x1 {09 07 18 00 00 00 01} << swap variables, so Disabled will now be the stock default
One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 10 00 10 00 00} << Now, new default, due to swapped variable and 10 still in same position
End One Of {29 02}
End If {29 02}

If you still can’t figure it all out. Give me your CBS file, and a test list of the exact settings you want changed, and what you want them changed to, and a list of any settings you need unsuppressed (and left as-is)

gupsterg · June 17, 2019, 10:52pm

I need to add a menu option within AMD CBS.

The motherboard which has PMU menu is ASUS ROG Zenith Extreme Alpha, X399 board.

The motherboard which I would like to have PMU menu in is ASUS ROG Crosshair VII Hero WiFi, X470 board.

I take the ZEA UEFI 0405, I open in UEFITool, search for F639D37E- , I extract as is the PE32 image, run through IFR.

I take the C7H UEFI 2304, I open in UEFITool, search for A5E369C8- , I extract as is the PE32 image, run through IFR.

I have these 4 files then.

I search through ZEA_0405_CBS IFR.txt I find Phy Configuration (on ZEA within this is PMU Training menu):-

1
2
3
4
5
6
7
8
9
10
11
12
13

0xD816 	Form: DDR4 Common Options, FormId: 0x7036 {01 86 36 70 E3 00}
0xD81C 		Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 E3 00 00 00 00}
0xD823 		End {29 02}
0xD825 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xD82C 		End {29 02}
0xD82E 		Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x46, FormId: 0x703A {0F 0F E7 00 E7 00 46 00 00 00 FF FF 00 3A 70}
0xD83D 		Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x47, FormId: 0x703B {0F 0F E8 00 E8 00 47 00 00 00 FF FF 00 3B 70}
0xD84C 		Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x48, FormId: 0x703C {0F 0F E9 00 E9 00 48 00 00 00 FF FF 00 3C 70}
0xD85B 		Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x49, FormId: 0x703D {0F 0F EA 00 EA 00 49 00 00 00 FF FF 00 3D 70}
0xD86A 		Ref: Phy Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4A, FormId: 0x703E {0F 0F EB 00 EB 00 4A 00 00 00 FF FF 00 3E 70}
0xD879 		Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4B, FormId: 0x703F {0F 0F EC 00 EC 00 4B 00 00 00 FF FF 00 3F 70}
0xD888 		Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4C, FormId: 0x7040 {0F 0F ED 00 ED 00 4C 00 00 00 FF FF 00 40 70}
0xD897 	End Form {29 02}

Now the C7H does not have this, so I must make an extra entry.

1
2
3
4
5
6
7
8
9
10
11
12

0xC4A8 	Form: DDR4 Common Options, FormId: 0x7035 {01 86 35 70 DC 00}
0xC4AE 		Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 DC 00 00 00 00}
0xC4B5 		End {29 02}
0xC4B7 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xC4BE 		End {29 02}
0xC4C0 		Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x46, FormId: 0x7039 {0F 0F E0 00 E0 00 46 00 00 00 FF FF 00 39 70}
0xC4CF 		Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x47, FormId: 0x703A {0F 0F E1 00 E1 00 47 00 00 00 FF FF 00 3A 70}
0xC4DE 		Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x48, FormId: 0x703B {0F 0F E2 00 E2 00 48 00 00 00 FF FF 00 3B 70}
0xC4ED 		Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x49, FormId: 0x703C {0F 0F E3 00 E3 00 49 00 00 00 FF FF 00 3C 70}
0xC4FC 		Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4A, FormId: 0x703D {0F 0F E4 00 E4 00 4A 00 00 00 FF FF 00 3D 70}
0xC50B 		Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4B, FormId: 0x703E {0F 0F E5 00 E5 00 4B 00 00 00 FF FF 00 3E 70}
0xC51A 	End Form {29 02}

I do so by injecting 0F 0F E6 00 E6 00 4C 00 00 00 FF FF 00 3F 70 in appropriate area in copy of C7H_2304_CBS.sct, using HxD.

Next I find PMU menu in ZEA_0405_CBS IFR.txt.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

0xEF6B 	Form: Phy Configuration, FormId: 0x703E {01 86 3E 70 EB 00}
0xEF71 		Subtitle: Statement.Prompt: Phy Configuration, Flags: 0x0 {02 87 EB 00 00 00 00}
0xEF78 		End {29 02}
0xEF7A 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xEF81 		End {29 02}
0xEF83 		Ref: PMU Training, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x8A, FormId: 0x7044 {0F 0F F8 01 F8 01 8A 00 00 00 FF FF 00 44 70}
0xEF92 	End Form {29 02}
0xEF94 	Form: PMU Training, FormId: 0x7044 {01 86 44 70 F8 01}
0xEF9A 		Subtitle: Statement.Prompt: PMU Training, Flags: 0x0 {02 87 F8 01 00 00 00}
0xEFA1 		End {29 02}
0xEFA3 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xEFAA 		End {29 02}
0xEFAC 		One Of: DFE Read Training, VarStoreInfo (VarOffset/VarName): 0xCF, VarStore: 0x5000, QuestionId: 0x8B, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 F9 01 FA 01 8B 00 00 50 CF 00 10 10 00 FF 00}
0xEFBD 			One Of Option: Disable, Value (8 bit): 0x0 {09 07 9D 00 00 00 00}
0xEFC4 			One Of Option: Enable, Value (8 bit): 0x1 {09 07 A8 00 00 00 01}
0xEFCB 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xEFD2 		End One Of {29 02}
0xEFD4 		One Of: FFE Write Training, VarStoreInfo (VarOffset/VarName): 0xD0, VarStore: 0x5000, QuestionId: 0x8C, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 FB 01 FC 01 8C 00 00 50 D0 00 10 10 00 FF 00}
0xEFE5 			One Of Option: Disable, Value (8 bit): 0x0 {09 07 9D 00 00 00 00}
0xEFEC 			One Of Option: Enable, Value (8 bit): 0x1 {09 07 A8 00 00 00 01}
0xEFF3 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xEFFA 		End One Of {29 02}
0xEFFC 		One Of: PMU Pattern Bits Control, VarStoreInfo (VarOffset/VarName): 0xD1, VarStore: 0x5000, QuestionId: 0x8D, Size: 1, Min: 0x1, Max 0xFF, Step: 0x0 {05 91 FD 01 FE 01 8D 00 00 50 D1 00 10 10 01 FF 00}
0xF00D 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xF014 			One Of Option: Manual, Value (8 bit): 0x1 {09 07 62 01 00 00 01}
0xF01B 		End One Of {29 02}
0xF01D 		Suppress If {0A 82}
0xF01F 			QuestionId: 0x8D equals value 0x1 {12 86 8D 00 01 00}
0xF025 				Not {17 02}
0xF027 			End {29 02}
0xF029 			Numeric: PMU Pattern Bits, VarStoreInfo (VarOffset/VarName): 0xD2, VarStore: 0x5000, QuestionId: 0x8E, Size: 1, Min: 0x0, Max 0xA, Step: 0x0 {07 91 FF 01 00 02 8E 00 00 50 D2 00 10 20 00 0A 00}
0xF03A 				Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0xF040 			End {29 02}
0xF042 		End If {29 02}
0xF044 	End Form {29 02}

I find the hex within ZEA_0405_CBS.sct . I then edit this to become entry 4 (ie E4 plus change FormId), link.

I add within copy of C7H_2304_CBS.sct, I bump the entry hex / form id of Common RAS / Security menu hex in sct, trying to mod the PMU menu exact location, I then also add the text strings located near the end, I change length of sct at top of it to account for all these additions. I do believe I am missing some other edits to sct to make it right.

Lost_N_BIOS · June 18, 2019, 9:19pm

Thanks for all the info @gupsterg - I am sorry, but as of yet, I have never seen anyone successfully add a single byte to a file like this and then be able to create a properly formed IFR post-edit.
@ket and I both spent a LOT of time trying to do this various ways, no matter what we did it = 1kb IFR
Very sorry I can’t help on this one, if you ever figure out how to do that please post here to let us know for future reference.

Now, if you can make the same edits, possibly removing something else exactly same size byte-wise, then it may be possible. I believe we tried that too and it failed, but I can’t remember for sure.

Feluchi @ BIOS-mods may be able to help, he got me IFR from file that wouldn’t give me proper IFR, so I think he knows some IFR secrets. Maybe you can send him PM and get help?

gupsterg · June 20, 2019, 10:28am

Thank you for swift reply , I delayed mine as was experimenting .

So as stated in 1st post I can gain PMU Menu by simply adding CbsSetupDxe as is from ZEA UEFI to C7H UEFI, link. As menus appeared, changes could be done and saved, but did not apply I have believed menus have not hooked into other elements correctly to function. I could be wrong, I have no idea .

Another mod I tried was adding CbsBaseDxe and CbsSetupDxe from ZEA UEFI to C7H UEFI, the board would cycle through Q-Codes and not POST. As the ASUS UEFIs have the text stripped it can be handy to reference other vendor UEFIs in UEFITool, for example ket’s fave Gigabyte.

Another mod I tried was applying CbsSetupDxe from ZEA UEFI to C7H UEFI AGESA PiniaclePI-AM4 1.0.0.6 instead of Combo-AM4 0.0.7.2a. This too failed.

So I was back at looking at editing the CbsSetupDxe.

I now can do some mods with file still being recognised as UEFI and parsed by Universal IFR Extractor.

In this ZIP is CbsSetupDxe from C7H UEFI 2304, but I added strings package from CbsSetupDxe of ZEA UEFI 0405, corrected size. When you compare this modded files IFR with stock 2304 you’ll see the text labels have changed. When this modded file is placed in UEFI the complete AMD CBS menu is missing, so some kind of check it is failing IMO.

In this ZIP is CbsSetupDxe from C7H UEFI 2304, but I added an entry hex to DDR4 Common Options, due to this additional hex I changed also form sets size hex, besides size for whole module. Now when you compare the parsed IFR between this mod and stock you’ll see how I’ve duplicated formid 0x703F. When this modded file is placed in UEFI the complete AMD CBS menu is missing, so some kind of check it is failing IMO.

Will bare in mind Feluchi @ BIOS-mods, just wanna try some more things today and see where I get.

Lost_N_BIOS · June 20, 2019, 8:40pm

How about MSI or specifically Tiachi transplants? I think those are the ones ket uses when he does transplanting or experiments like this.

So you’ve modified two IFR’s and kept same size, both output proper IFR, that’s good! I can’t follow along without actual BIOS from each board, because AMITSE may be involved too.
Plus it’s too confusing looking at only the setup files and short names you have above (I have no clue what these files are based on the names you are using above ).

Please package both complete stock BIOS, and your modified setup modules, then I can best see what’s going on and maybe figure out why it’s failing.
Don’t include the duplicated menu mod, that would always cause hangs

This doesn’t make sense to me >> CbsSetupDxe from ZEA UEFI to C7H UEFI AGESA PiniaclePI-AM4, one is CBS Menu other is AGESA module, so unsure what you were trying there but sounds like something impossible on unrelated files?

gupsterg · June 21, 2019, 11:34am

I shall take a look at other vendor UEFIs and transplant modules at some point , I shall firstly just concentrate on modding ASUS module.

I have modified 2 or more IFRs, due to addition of code they are ever so slightly bigger, these do output IFR.

Here is package for you/others that maybe following/viewing the thread .

Just like you have stated a module name (ie AMITSE) I have done the same . I was try to keep post shorter, I’ll try another approach.

ASUS ROG Zenith Extreme Alpha UEFI 0405
Module Name: CbsSetupDxe
GUID: F639D37E-02A1-4BA8-AD17-5C6C6E5E9322

ASUS ROG Crosshair VII Hero WiFI UEFI 2304
Module Name: CbsSetupDxe
GUID: A5E369C8-ABF9-4B43-B212-FF1BFD35666D

I think as one is sTR4 AGESA and other AM4 the GUID differs, dunno.

Each IFR it does also state "Form Set: AMD CBS" and CBS menu settings are found in them.

I know the GUID: F639D37E-02A1-4BA8-AD17-5C6C6E5E9322 also take that same module name as Gigabyte X399 Aorus Extreme UEFI has that label.

I think you may have got the wrong end of the stick when you say "Don’t include the duplicated menu mod, that would always cause hangs". I think it is from below quote:-

The UEFI does not hang, the complete AMD CBS menu is not there. I must share this file as to know what a possible solution is.

I will explain below in detail.

To create the menu I must expand code.

Below is original IFR from:-

ASUS ROG Crosshair Hero VII Wifi UEFI 2304
Module: CbsSetupDxe
GUID: A5E369C8-ABF9-4B43-B212-FF1BFD35666D

1
2
3
4
5
6
7
8
9
10
11
12

0xC4A8 	Form: DDR4 Common Options, FormId: 0x7035 {01 86 35 70 DC 00}
0xC4AE 		Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 DC 00 00 00 00}
0xC4B5 		End {29 02}
0xC4B7 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xC4BE 		End {29 02}
0xC4C0 		Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x46, FormId: 0x7039 {0F 0F E0 00 E0 00 46 00 00 00 FF FF 00 39 70}
0xC4CF 		Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x47, FormId: 0x703A {0F 0F E1 00 E1 00 47 00 00 00 FF FF 00 3A 70}
0xC4DE 		Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x48, FormId: 0x703B {0F 0F E2 00 E2 00 48 00 00 00 FF FF 00 3B 70}
0xC4ED 		Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x49, FormId: 0x703C {0F 0F E3 00 E3 00 49 00 00 00 FF FF 00 3C 70}
0xC4FC 		Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4A, FormId: 0x703D {0F 0F E4 00 E4 00 4A 00 00 00 FF FF 00 3D 70}
0xC50B 		Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4B, FormId: 0x703E {0F 0F E5 00 E5 00 4B 00 00 00 FF FF 00 3E 70}
0xC51A 	End Form {29 02}

Looking at the hex the logical step would be to add 0F 0F E6 00 E6 00 4B 00 00 00 FF FF 00 3F 70. The 4C denoting another QuestionId, 3F 70 denoting another form set and I believe E6 denoting another entry.

You can see this logic in original IFR from:-

ASUS Zenith Extreme Alpha UEFI 0405
Module: CbsSetup
GUID: F639D37E-02A1-4BA8-AD17-5C6C6E5E9322.

1
2
3
4
5
6
7
8
9
10
11
12
13

0xD816 	Form: DDR4 Common Options, FormId: 0x7036 {01 86 36 70 E3 00}
0xD81C 		Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 E3 00 00 00 00}
0xD823 		End {29 02}
0xD825 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xD82C 		End {29 02}
0xD82E 		Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x46, FormId: 0x703A {0F 0F E7 00 E7 00 46 00 00 00 FF FF 00 3A 70}
0xD83D 		Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x47, FormId: 0x703B {0F 0F E8 00 E8 00 47 00 00 00 FF FF 00 3B 70}
0xD84C 		Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x48, FormId: 0x703C {0F 0F E9 00 E9 00 48 00 00 00 FF FF 00 3C 70}
0xD85B 		Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x49, FormId: 0x703D {0F 0F EA 00 EA 00 49 00 00 00 FF FF 00 3D 70}
0xD86A 		Ref: Phy Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4A, FormId: 0x703E {0F 0F EB 00 EB 00 4A 00 00 00 FF FF 00 3E 70}
0xD879 		Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4B, FormId: 0x703F {0F 0F EC 00 EC 00 4B 00 00 00 FF FF 00 3F 70}
0xD888 		Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4C, FormId: 0x7040 {0F 0F ED 00 ED 00 4C 00 00 00 FF FF 00 40 70}
0xD897 	End Form {29 02}

Once I add the extra hex I have highlighted within stock C7H UEFI 2304 CbsSetupDxe, the IFR has this:-

1
2
3
4
5
6
7
8
9
10
11
12
13

0xC4A8 	Form: DDR4 Common Options, FormId: 0x7035 {01 86 35 70 DC 00}
0xC4AE 		Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 DC 00 00 00 00}
0xC4B5 		End {29 02}
0xC4B7 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xC4BE 		End {29 02}
0xC4C0 		Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x46, FormId: 0x7039 {0F 0F E0 00 E0 00 46 00 00 00 FF FF 00 39 70}
0xC4CF 		Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x47, FormId: 0x703A {0F 0F E1 00 E1 00 47 00 00 00 FF FF 00 3A 70}
0xC4DE 		Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x48, FormId: 0x703B {0F 0F E2 00 E2 00 48 00 00 00 FF FF 00 3B 70}
0xC4ED 		Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x49, FormId: 0x703C {0F 0F E3 00 E3 00 49 00 00 00 FF FF 00 3C 70}
0xC4FC 		Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4A, FormId: 0x703D {0F 0F E4 00 E4 00 4A 00 00 00 FF FF 00 3D 70}
0xC50B 		Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4B, FormId: 0x703E {0F 0F E5 00 E5 00 4B 00 00 00 FF FF 00 3E 70}
0xC51A 		Ref: WARNING - DAMAGE CAUSED BY USE OF YOUR AMD PROCESSOR OUTSIDE OF SPECIFICATION OR IN EXCESS OF FACTORY SETTINGS ARE NOT COVERED UNDER YOUR AMD PRODUCT WARRANTY AND MAY NOT BE COVERED BY YOUR SYSTEM MANUFACTURER'S WARRANTY., VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4C, FormId: 0x703F {0F 0F E6 00 E6 00 4C 00 00 00 FF FF 00 3F 70}
0xC529 	End Form {29 02}

I have gained another menu entry within IFR, but the FormId 0x703F is already taken, text label is as that form. Besides the string package of:-

ASUS ROG Crosshair Hero VII Wifi UEFI 2304
Module: CbsSetupDxe
GUID: A5E369C8-ABF9-4B43-B212-FF1BFD35666D

Does not have the Phy Configuration menu text strings, nor the PMU Training menu hex, below is the hex from Zenith Extreme Alpha.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

0xEF6B 	Form: Phy Configuration, FormId: 0x703E {01 86 3E 70 EB 00}
0xEF71 		Subtitle: Statement.Prompt: Phy Configuration, Flags: 0x0 {02 87 EB 00 00 00 00}
0xEF78 		End {29 02}
0xEF7A 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xEF81 		End {29 02}
0xEF83 		Ref: PMU Training, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x8A, FormId: 0x7044 {0F 0F F8 01 F8 01 8A 00 00 00 FF FF 00 44 70}
0xEF92 	End Form {29 02}
0xEF94 	Form: PMU Training, FormId: 0x7044 {01 86 44 70 F8 01}
0xEF9A 		Subtitle: Statement.Prompt: PMU Training, Flags: 0x0 {02 87 F8 01 00 00 00}
0xEFA1 		End {29 02}
0xEFA3 		Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0xEFAA 		End {29 02}
0xEFAC 		One Of: DFE Read Training, VarStoreInfo (VarOffset/VarName): 0xCF, VarStore: 0x5000, QuestionId: 0x8B, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 F9 01 FA 01 8B 00 00 50 CF 00 10 10 00 FF 00}
0xEFBD 			One Of Option: Disable, Value (8 bit): 0x0 {09 07 9D 00 00 00 00}
0xEFC4 			One Of Option: Enable, Value (8 bit): 0x1 {09 07 A8 00 00 00 01}
0xEFCB 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xEFD2 		End One Of {29 02}
0xEFD4 		One Of: FFE Write Training, VarStoreInfo (VarOffset/VarName): 0xD0, VarStore: 0x5000, QuestionId: 0x8C, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 FB 01 FC 01 8C 00 00 50 D0 00 10 10 00 FF 00}
0xEFE5 			One Of Option: Disable, Value (8 bit): 0x0 {09 07 9D 00 00 00 00}
0xEFEC 			One Of Option: Enable, Value (8 bit): 0x1 {09 07 A8 00 00 00 01}
0xEFF3 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xEFFA 		End One Of {29 02}
0xEFFC 		One Of: PMU Pattern Bits Control, VarStoreInfo (VarOffset/VarName): 0xD1, VarStore: 0x5000, QuestionId: 0x8D, Size: 1, Min: 0x1, Max 0xFF, Step: 0x0 {05 91 FD 01 FE 01 8D 00 00 50 D1 00 10 10 01 FF 00}
0xF00D 			One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 19 00 10 00 FF}
0xF014 			One Of Option: Manual, Value (8 bit): 0x1 {09 07 62 01 00 00 01}
0xF01B 		End One Of {29 02}
0xF01D 		Suppress If {0A 82}
0xF01F 			QuestionId: 0x8D equals value 0x1 {12 86 8D 00 01 00}
0xF025 				Not {17 02}
0xF027 			End {29 02}
0xF029 			Numeric: PMU Pattern Bits, VarStoreInfo (VarOffset/VarName): 0xD2, VarStore: 0x5000, QuestionId: 0x8E, Size: 1, Min: 0x0, Max 0xA, Step: 0x0 {07 91 FF 01 00 02 8E 00 00 50 D2 00 10 20 00 0A 00}
0xF03A 				Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0xF040 			End {29 02}
0xF042 		End If {29 02}
0xF044 	End Form {29 02}

I am currently just aiming to create a modded module which gets me an extra menu with correct labels within:-

AMD CBS > UMC Common Options > DDR4 Common Options > Phy Configuration

Next stage would be to gain:-

AMD CBS > UMC Common Options > DDR4 Common Options > Phy Configuration > PMU Training

So then I thought to get rid of this FormId duplication I must bump FormId of the other entries. This has been successful, but another issue has been highlighted.

I will let you view this posted information and supplied files, then in another post I share this new modded file.

I did try transplanting AMITSE (B1DA0ADF-4F77-4070-A88E-BFFE1C60529A) from ASUS ROG Zenith Extreme Alpha and ASUS ROG Crosshair VII Hero WiFi with also CbsSetupDxe (GUID: F639D37E-02A1-4BA8-AD17-5C6C6E5E9322 in ASUS ROG Zenith Extreme Alpha, GUID: A5E369C8-ABF9-4B43-B212-FF1BFD35666D in ASUS ROG Crosshair VII Hero WiFi). Board flips through Q-Codes IIRC.

I did also quickly compare AMITSE between them for the section where TOM_RUS had highlighted in his post that can hide menus, I couldn't tell if this module needs tinkering yet.

Thank you for your time

, it's greatly appreciated

.

*** edit ***

I think I have found a FormId to use which is not in use, so may not need to bump other FormId.

*** edit 2 ***

I also need unique VarStoreInfo (VarOffset/VarName). As I am way out of my depth I think this is beyond my means to do. There must be a variables store, etc, which then I would think does not have the necessary data.

Lost_N_BIOS · June 25, 2019, 7:01am

Yes, I think for your goal to work as you explained, like your final thoughts you need source module with the info already in it, otherwise you have no varstore info to point at.
Transplant is best option here, why was that not working for you, I’m not sure we are discussing same things? You can’t transplant AMITSE (PE32 and 000000 module too) from one BIOS to another, unless you also swap Setup module, AMITSE/SetupData etc. This however would change entire BIOS layout (ie not the goal)
My main mention of transplant was transplanting the CBS Modules only. You do not need to transplant AMITSE (Any of it) or Setup for this, just the CBS modules PE32 body.

What is the actual target board here? I will check it’s AMITSE module and show you what menus are hidden by it and where, normally this has nothing to do with what you’re editing here but rather main BIOS menus, but I will check (and inspect what TOM_RUS mentioned too) and let you know

gupsterg · July 2, 2019, 10:06am

@Lost_N_BIOS

Thank you for your post and thoughts .

Yes I have tried transplanting only CbsSetupDxe PE32. GUID: F639D37E-02A1-4BA8-AD17-5C6C6E5E9322 from Zenith Extreme Alpha UEFI 0405 and replacing it in Crosshair VII Hero WiFi as is (GUID: A5E369C8-ABF9-4B43-B212-FF1BFD35666D). I gain the PMU Training menu in AMD CBS. See 1st link within post 5, left image is ZEA UEFI (note orange box has 4 RAM channels voltage), right is C7H. The whole of AMD CBS menu does not function, it is just dummy text, I can make a change, save and it does not apply. For example I tried disabling C-State control and it did not function. So functions (variables) that are already part of AMD CBS for unmodified C7H UEFI, stop working with the modded C7H UEFI. All I have is dummy menus.

I wish the C7H to have PMU Training menu, that is the target board.

I did take a look at TOM_RUS shared ZIP where it has XML data converted from SCT, which is a “as is” extraction of PE32 body. It seems to me the PE32 body contains various data which would need differing methods of viewing it and editing. For example the Form Sets, String Package, Variables Store. Then also it seems from where I transplanted only CBS from one board to another, the module must be “hooking” into another, as the menus were all there, but none of the options worked, as if they were “orphaned”.

Lost_N_BIOS · July 3, 2019, 8:40am

You need to transplant both parts of that module as I mentioned, maybe it’s failing because you are only transplanting the PE32, and not the 00000 module too.
That is a split file, so both need switched out. I think this is why you are getting the orphaned experience If you do not know what I mean about both files, let me know and I will show you with image.

gupsterg · July 3, 2019, 3:04pm

Cheers, I would appreciate image showing 00000 module .

Lost_N_BIOS · August 1, 2019, 5:52am

@gupsterg - sorry I missed this!

Here is an image (Random example, not the BIOS you are working on) showing the GUID-00000 I am referring to, sorry for any confusion, I just checked your BIOS and this is not used in your CBS/PBS or setup modules.
I am not sure why I said that above, I must have been looking at wrong BIOS

gupsterg · August 3, 2019, 1:51pm

No worries .