[SOLVED] How to unlock MSR 0x194 for 2nd/3rd Gen CPU overclocking

AMIBCP is available now, but opening the BIOS in it isn’t due to some string in the BIOS is messed up so I can’t open it in there properly

@Lost_N_BIOS , @Blossomcrown : Thank you very much for the modded bios and the efi vars. I have finally found some time to test the modded bios and sucessfully set the turbo multi for 1-Core to 4,0GHz and 3,8GHz for the others.

Now it is time for some test :wink:

@pseudodeed - you’re welcome, and thank you for the report back, good luck in your testing!

Dear @Lost_N_BIOS ,i’ve finally understand what you meant “a TPM module”.
On my Precision M6700 there is a specific 1/2 mini card slot with Mini PCI-E interface that is reserved for a so called “Dell encryption module”.I’ll try to get one,see if it can activate TPM function and then report back.

-update-
i opened up the other tpm-enabled machine and didnt see any module on that 1/2 slot, meanwhile i cant find any mini pci-e encryption card on neither ebay nor aliexpress, so im pretty confused now.
hmmmm, maybe still a bios related problem?

@Blossoncrown - yes, that sounds similar, but not exact same thing I mentioned. It doesn’t go into a 1/2 card slot (Whatever you mean by that, Mini PCIE I suppose?)
Normal TPM I’ve always seen on any board, the device plugs into a header similar to COM port or a USB onboard header, but it has it’s own pinout and larger size than those. I gave links on page 5 post 62 to device I mean, there you can see how it connects, like a USB block header

Hey @Blossomcrown ,

I own the same laptop , and am curious about how far you can push the 3940xm on stock volts.

My laptop is currently equipped with the 3740qm and K4000m (heavily overclocked on a custom bios). I want to try to squeeze more power out of it by upgrading to a 3920xm/3940xm and replace the GPU with a 980m . Should cost about 400 bucks in all for the parts.

Can you hit over 4.0Ghz? It seems like fairly meager gains compared to the stock 3.9 turbo maximum. I’m trying to decide if it is worth it to sink more money into this laptop, or sell it and get something newer.

Thanks!

Hi there,
Full core @ 4.1GHz work for me,and before you hit 81.25W power limit you should already encountered TJMax.
For daily use i just maintain full core @ 4.0GHz,getting about 10% more performance than stock full core @3.7GHz.
Personally i want to use this machine for one or two more years , then replace it with upcoming 10nm processors or Ryzen counterparts.
From what I know,suggest you just pull up 4x multiplier for your 3740QM (which means 4.1GHz for single freq and 3.9GHz full core) .I think that’s good enough , no need to buy an expensive 39x0XM. Meanwhile,GTX980M or M5000M is the best graphics card you can get for PremierColor version of M6700 so i think it’s good.
Remember,replace whole thing or not still up to your need,that’s your call.

Hi from here too Blossomcrown.

Ihave M6700 with i7-3720qm and want little power on it. I have thinking to buy xm prosessor, but
what you say abaut it? I have now GTX980m and very happy abaut it. Can you make custom bios
so i can push little bit more power to my 3720qm??

Hey there! I just signed up for this Forum because i screwed myself over…

After flashing the modbios from @Lost_N_BIOS and setting the NVRAM variables i rebooted and wanted to re-set some settings in the bios.
I noticed that all the options were grayed out and that an Admin password is suddenly set.

Do you maybe know some way to get out of this and get the admin PW unset?
I do have a SPI Flasher as well.

Thanks a lot in advance,
Nevoness

Edit:
I forgot to mention: I cant even use the grub setup_var anymore, since im stuck in UEFI - Secureboot ON mode and cant change that without the "admin password"
Windows still boots though

Edit2: Figured out thaz the bios in Post #17 has a bios PW set. Managed to reflash my bios using SuperUEFIinsecureBoot and fpt.

@Lost_N_Bios, could you please mod my backup? Would be awesome to have the MSR 0x194 unlocked.

BACKUP.zip (5.84 MB)

@neovness - Great to see you found a way to get back your original BIOS!!
Please confirm, what all do you need edited in above file, just the MSR 0x194 edit, or anything else too?
Also, please dump both chips and upload somewhere for me, I can’t edit just the one chip, this BIOS is split in the middle across both chips.

* Edit - Ohh, so the above is FPT Full BIOS dump, not programmer. Can you flash back full BIOS with FPT? If yes, OK, I can edit like this and send back to you

I can flash it with FPT without issues.
Thankfully SuperUEFIinsecureBoot allows you to execute any .efi file including the modified grub and the EFI shell for FPT, even with secureboot on

Since im now back on my Original bios i have no issues at all flashing with FPT.

Would be awesome if you could edit it for me.

@neovness - OK, well then here you go - http://s000.tinyupload.com/index.php?fil…814985046473661

Your BIOS works perfectly!
Thanks a ton that you could mod mine.

I do have another question tho:
Would it be possible to mod the CPU Power Limits?
Since i have liquid metaled my CPU, it usually stays quite cool even under full load, sustaining 3.6ghz+ allcore would be amazing, since right now i hit a brick wall at 3.7GHz with the cpu drawing 55W

@neovness - You’re welcome, and thanks for the report back!! Good to here you were able to sort out the rest of the stuff in OS that makes this work
I see TC1/TC2/TSP values (currently set to 1/5/10) that you can change that may affect this. This is ACPI Passive Cooling Formula values

I also see Active/Passive thermal trip points (71C/79C) for MCH and PCH (same for both)

Ohh! Maybe found it, but looks to be set to zero…
Long Duration Power Limit
Long Duration Maintained
Short Duration Power Limit

I believe those ^^ are what is often PL1/PL2 in other BIOS

You can change this via grub / setup_var possibly, if not, then use RU - For both, use the (VarOffset/VarName) value, and the VarStore Value tells you what area of NVRAM to edit (if using RU, if VarStore not “Setup” then you can use setup_var)


Configurable TDP, VarStoreInfo (VarOffset/VarName): 0xB3E, VarStore: 0x2
0x45CFC One Of Option: TDP NOMINAL, Value (8 bit): 0x0 {09 0E 4D 0A 00 00 00 00 00 00 00 00 00 00}
0x45D0A One Of Option: TDP DOWN, Value (8 bit): 0x1 {09 0E 4F 0A 00 00 01 00 00 00 00 00 00 00}
0x45D18 One Of Option: TDP UP, Value (8 bit): 0x2 (default) {09 0E 4E 0A 30 00 02 00 00 00 00 00 00 00}
0x45D26 One Of Option: Disabled, Value (8 bit): 0xFF {09 0E 55 0A 00 00 FF 00 00 00 00 00 00 00}

Numeric: Long duration power limit, VarStoreInfo (VarOffset/VarName): 0xB39, VarStore: 0x2

Numeric: Long duration maintained, VarStoreInfo (VarOffset/VarName): 0xB3B, VarStore: 0x2

Numeric: Short duration power limit, VarStoreInfo (VarOffset/VarName): 0xB3A, VarStore: 0x2

Config TDP LOCK, VarStoreInfo (VarOffset/VarName): 0xB3F, VarStore: 0x2

Active Thermal Trip Point MCH, VarStoreInfo (VarOffset/VarName): 0x14D, VarStore: 0x2, QuestionId: 0x117, Size: 1, Min: 0x0, Max 0x0, Step: 0x0 {05 A6 4F 02 50 02 17 01 02 00 4D 01 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3FA6E One Of Option: Disabled, Value (8 bit): 0x7F {09 0E C1 02 00 00 7F 00 00 00 00 00 00 00}
0x3FA7C One Of Option: 15 C, Value (8 bit): 0xF {09 0E 6F 02 00 00 0F 00 00 00 00 00 00 00}
0x3FA8A One Of Option: 23 C, Value (8 bit): 0x17 {09 0E 70 02 00 00 17 00 00 00 00 00 00 00}
0x3FA98 One Of Option: 31 C, Value (8 bit): 0x1F {09 0E 71 02 00 00 1F 00 00 00 00 00 00 00}
0x3FAA6 One Of Option: 39 C, Value (8 bit): 0x27 {09 0E 72 02 00 00 27 00 00 00 00 00 00 00}
0x3FAB4 One Of Option: 47 C, Value (8 bit): 0x2F {09 0E 73 02 00 00 2F 00 00 00 00 00 00 00}
0x3FAC2 One Of Option: 55 C, Value (8 bit): 0x37 {09 0E 74 02 00 00 37 00 00 00 00 00 00 00}
0x3FAD0 One Of Option: 63 C, Value (8 bit): 0x3F {09 0E 75 02 00 00 3F 00 00 00 00 00 00 00}
0x3FADE One Of Option: 71 C, Value (8 bit): 0x47 (default) {09 0E 76 02 30 00 47 00 00 00 00 00 00 00}
0x3FAEC One Of Option: 79 C, Value (8 bit): 0x4F {09 0E 77 02 00 00 4F 00 00 00 00 00 00 00}
0x3FAFA One Of Option: 87 C, Value (8 bit): 0x57 {09 0E 78 02 00 00 57 00 00 00 00 00 00 00}
0x3FB08 One Of Option: 95 C, Value (8 bit): 0x5F {09 0E 79 02 00 00 5F 00 00 00 00 00 00 00}
0x3FB16 One Of Option: 103 C, Value (8 bit): 0x67 {09 0E 7A 02 00 00 67 00 00 00 00 00 00 00}
0x3FB24 One Of Option: 111 C, Value (8 bit): 0x6F {09 0E 7B 02 00 00 6F 00 00 00 00 00 00 00}
0x3FB32 One Of Option: 119 C, Value (8 bit): 0x77 {09 0E 7C 02 00 00 77 00 00 00 00 00 00 00}

0x3FB42 One Of: Passive Thermal Trip Point MCH, VarStoreInfo (VarOffset/VarName): 0x14E, VarStore: 0x2, QuestionId: 0x118, Size: 1, Min: 0x0, Max 0x0, Step: 0x0 {05 A6 51 02 52 02 18 01 02 00 4E 01 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3FB68 One Of Option: Disabled, Value (8 bit): 0x7F {09 0E C1 02 00 00 7F 00 00 00 00 00 00 00}
0x3FB76 One Of Option: 15 C, Value (8 bit): 0xF {09 0E 6F 02 00 00 0F 00 00 00 00 00 00 00}
0x3FB84 One Of Option: 23 C, Value (8 bit): 0x17 {09 0E 70 02 00 00 17 00 00 00 00 00 00 00}
0x3FB92 One Of Option: 31 C, Value (8 bit): 0x1F {09 0E 71 02 00 00 1F 00 00 00 00 00 00 00}
0x3FBA0 One Of Option: 39 C, Value (8 bit): 0x27 {09 0E 72 02 00 00 27 00 00 00 00 00 00 00}
0x3FBAE One Of Option: 47 C, Value (8 bit): 0x2F {09 0E 73 02 00 00 2F 00 00 00 00 00 00 00}
0x3FBBC One Of Option: 55 C, Value (8 bit): 0x37 {09 0E 74 02 00 00 37 00 00 00 00 00 00 00}
0x3FBCA One Of Option: 63 C, Value (8 bit): 0x3F {09 0E 75 02 00 00 3F 00 00 00 00 00 00 00}
0x3FBD8 One Of Option: 71 C, Value (8 bit): 0x47 {09 0E 76 02 00 00 47 00 00 00 00 00 00 00}
0x3FBE6 One Of Option: 79 C, Value (8 bit): 0x4F (default) {09 0E 77 02 30 00 4F 00 00 00 00 00 00 00}
0x3FBF4 One Of Option: 87 C, Value (8 bit): 0x57 {09 0E 78 02 00 00 57 00 00 00 00 00 00 00}
0x3FC02 One Of Option: 95 C, Value (8 bit): 0x5F {09 0E 79 02 00 00 5F 00 00 00 00 00 00 00}
0x3FC10 One Of Option: 103 C, Value (8 bit): 0x67 {09 0E 7A 02 00 00 67 00 00 00 00 00 00 00}
0x3FC1E One Of Option: 111 C, Value (8 bit): 0x6F {09 0E 7B 02 00 00 6F 00 00 00 00 00 00 00}
0x3FC2C One Of Option: 119 C, Value (8 bit): 0x77 {09 0E 7C 02 00 00 77 00 00 00 00 00 00 00}
0x3FC3A End One Of {29 02}

Active Thermal Trip Point PCH, VarStoreInfo (VarOffset/VarName): 0x151, VarStore: 0x2, QuestionId: 0x11B, Size: 1, Min: 0x0, Max 0x0, Step: 0x0 {05 A6 57 02 58 02 1B 01 02 00 51 01 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3FE56 One Of Option: Disabled, Value (8 bit): 0x7F {09 0E C1 02 00 00 7F 00 00 00 00 00 00 00}
0x3FE64 One Of Option: 15 C, Value (8 bit): 0xF {09 0E 6F 02 00 00 0F 00 00 00 00 00 00 00}
0x3FE72 One Of Option: 23 C, Value (8 bit): 0x17 {09 0E 70 02 00 00 17 00 00 00 00 00 00 00}
0x3FE80 One Of Option: 31 C, Value (8 bit): 0x1F {09 0E 71 02 00 00 1F 00 00 00 00 00 00 00}
0x3FE8E One Of Option: 39 C, Value (8 bit): 0x27 {09 0E 72 02 00 00 27 00 00 00 00 00 00 00}
0x3FE9C One Of Option: 47 C, Value (8 bit): 0x2F {09 0E 73 02 00 00 2F 00 00 00 00 00 00 00}
0x3FEAA One Of Option: 55 C, Value (8 bit): 0x37 {09 0E 74 02 00 00 37 00 00 00 00 00 00 00}
0x3FEB8 One Of Option: 63 C, Value (8 bit): 0x3F {09 0E 75 02 00 00 3F 00 00 00 00 00 00 00}
0x3FEC6 One Of Option: 71 C, Value (8 bit): 0x47 (default) {09 0E 76 02 30 00 47 00 00 00 00 00 00 00}
0x3FED4 One Of Option: 79 C, Value (8 bit): 0x4F {09 0E 77 02 00 00 4F 00 00 00 00 00 00 00}
0x3FEE2 One Of Option: 87 C, Value (8 bit): 0x57 {09 0E 78 02 00 00 57 00 00 00 00 00 00 00}
0x3FEF0 One Of Option: 95 C, Value (8 bit): 0x5F {09 0E 79 02 00 00 5F 00 00 00 00 00 00 00}
0x3FEFE One Of Option: 103 C, Value (8 bit): 0x67 {09 0E 7A 02 00 00 67 00 00 00 00 00 00 00}
0x3FF0C One Of Option: 111 C, Value (8 bit): 0x6F {09 0E 7B 02 00 00 6F 00 00 00 00 00 00 00}
0x3FF1A One Of Option: 119 C, Value (8 bit): 0x77 {09 0E 7C 02 00 00 77 00 00 00 00 00 00 00}

0x3FF2A One Of: Passive Thermal Trip Point PCH, VarStoreInfo (VarOffset/VarName): 0x152, VarStore: 0x2, QuestionId: 0x11C, Size: 1, Min: 0x0, Max 0x0, Step: 0x0 {05 A6 59 02 5A 02 1C 01 02 00 52 01 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3FF50 One Of Option: Disabled, Value (8 bit): 0x7F {09 0E C1 02 00 00 7F 00 00 00 00 00 00 00}
0x3FF5E One Of Option: 15 C, Value (8 bit): 0xF {09 0E 6F 02 00 00 0F 00 00 00 00 00 00 00}
0x3FF6C One Of Option: 23 C, Value (8 bit): 0x17 {09 0E 70 02 00 00 17 00 00 00 00 00 00 00}
0x3FF7A One Of Option: 31 C, Value (8 bit): 0x1F {09 0E 71 02 00 00 1F 00 00 00 00 00 00 00}
0x3FF88 One Of Option: 39 C, Value (8 bit): 0x27 {09 0E 72 02 00 00 27 00 00 00 00 00 00 00}
0x3FF96 One Of Option: 47 C, Value (8 bit): 0x2F {09 0E 73 02 00 00 2F 00 00 00 00 00 00 00}
0x3FFA4 One Of Option: 55 C, Value (8 bit): 0x37 {09 0E 74 02 00 00 37 00 00 00 00 00 00 00}
0x3FFB2 One Of Option: 63 C, Value (8 bit): 0x3F {09 0E 75 02 00 00 3F 00 00 00 00 00 00 00}
0x3FFC0 One Of Option: 71 C, Value (8 bit): 0x47 {09 0E 76 02 00 00 47 00 00 00 00 00 00 00}
0x3FFCE One Of Option: 79 C, Value (8 bit): 0x4F (default) {09 0E 77 02 30 00 4F 00 00 00 00 00 00 00}
0x3FFDC One Of Option: 87 C, Value (8 bit): 0x57 {09 0E 78 02 00 00 57 00 00 00 00 00 00 00}
0x3FFEA One Of Option: 95 C, Value (8 bit): 0x5F {09 0E 79 02 00 00 5F 00 00 00 00 00 00 00}
0x3FFF8 One Of Option: 103 C, Value (8 bit): 0x67 {09 0E 7A 02 00 00 67 00 00 00 00 00 00 00}
0x40006 One Of Option: 111 C, Value (8 bit): 0x6F {09 0E 7B 02 00 00 6F 00 00 00 00 00 00 00}
0x40014 One Of Option: 119 C, Value (8 bit): 0x77 {09 0E 7C 02 00 00 77 00 00 00 00 00 00 00}

Passive TC1 Value, VarStoreInfo (VarOffset/VarName): 0x140, VarStore: 0x2, QuestionId: 0x102, Size: 1, Min: 0x1, Max 0x10, Step: 0x1 {07 A6 83 02 84 02 02 01 02 00 40 01 00 10 01 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3F6CA Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 0D 00 00 00 01 00 00 00 00 00 00 00}

0x3F6D9 Numeric: Passive TC2 Value, VarStoreInfo (VarOffset/VarName): 0x141, VarStore: 0x2, QuestionId: 0x103, Size: 1, Min: 0x1, Max 0x10, Step: 0x1 {07 A6 85 02 86 02 03 01 02 00 41 01 00 10 01 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3F6FF Default: DefaultId: 0x0, Value (8 bit): 0x5 {5B 0D 00 00 00 05 00 00 00 00 00 00 00}

0x3F70E Numeric: Passive TSP Value, VarStoreInfo (VarOffset/VarName): 0x142, VarStore: 0x2, QuestionId: 0x104, Size: 1, Min: 0x2, Max 0x20, Step: 0x2 {07 A6 87 02 88 02 04 01 02 00 42 01 00 10 02 20 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x3F734 Default: DefaultId: 0x0, Value (8 bit): 0xA {5B 0D 00 00 00 0A 00 00 00 00 00 00 00}


All are in VarStore 0x2 >> VarStore: VarStoreId: 0x2 [EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9], Size: 0xC57, Name: Setup
^^ So, setup, meaning setup_var “May” be able to change them all, if not use RU method, see section 2.2 and make bootable USB with RU program, then read 2.3-2.5

Sorry, yes, I checked current applied value for NVRAM for Long Duration Power Limit, Long Duration Maintained, and Short Duration Power Limit, and all are set to 00
So this is either controlled by one of the other settings mentioned above, such as TC1/TC2/TSP, or possibly in the EC FW

我是从51nb来的。能否帮我找下m6700 cfg lock的偏移设置 黑果需要解锁这个设置

Dear @Lost_N_BIOS and @Blossomcrown
Please, help me ! Please ! My M6700 with 3940XM and K5000M.

I’ve been struggling for the past week trying to find a way to unlock MSR 0x194 for my 3940XM. (I am also very happy and grateful to @pseudodeed for his VGA Bios mod for K5000M)

Previously I used Thinkpad T430 with 3840QM, with guidance from a kind person, it reached single core 4.2Ghz and all core 4.0Ghz.

I just changed to M6700 one month ago and am very confused.
Please help me,please ! How can I maximize the power of my 3940XM. Please give me a little time. Extremely grateful. Wish you a thousand good things. :slight_smile:

I tried to download the file in post #17 but all links die :’(
I’m currently looking for a way to back up my current Bios. To post here with earnest hope of help.

Please guide me how to unlock and overclock my Dell M6700 with 3940XM and K5000M.
Extremely grateful.