It actually worked. Here’s how to enable XMP.
“setup_var_cv SaSetup 0x18D 0x1 0x2” Enables XMP profile 1
“setup_var_cv SaSetup 0x18D 0x1 0x3” Enables profile 2
“setup_var_cv SaSetup 0x18D 0x1 0x4” Enables profile 3
1 Like
Hi thanks for your help.
I enabled XMP profile 2 and now my PC won’t boot (many beeps at power on), in which way can i reset the option?
Try to pull out cmos battery and power cycle 2-3 times.
Thanks now it works again!
I have now some questions, could you please help me again? 
-
XMP profile 1 works and XMP profile 2 doesn’t, is it worth to try XMP profile 3?
-
Below there are Windows and CPU-Z info without and with XMP profile 1 enabled:
NO XMP
WITH XMP profile 1
As you can see with XMP enabled the DRAM Frequency is 1729 MHz (Windows double it, so 3467 MHz), is it normal that Mem. Controller Freq. indicated by CPU-Z is lower with XMP activated than without it?
-
What was your approach to find the right VarStore, VarOffset and Value? I mean which approaches and tools did you use? SaSetup is far away by xmp string
I’m a developer and I would like to learn the method in order to help someone here on the forum in the future -
Do you think that with you approach is it possible to enable Advance menu directly in the BIOS?
Finally I want to thank you again, if you have a forum, webpage, project where I can contribute with a donation I will do
For the people that want to try this hack in the future, as soon as you write the command you may receive this error on unmatched GUID:
On my system all is fine so don’t worry about this!
I think it’s not normal. If it remained 1064, you’d get beautiful 3600 MHz of ram speed.
Maybe ram sticks are not good enough to work at 3600. Try profile 2 with only one stick installed.
Is this topic clear?
Not with this approach.
I don’t accept donations.
Blockquote 1. 4. Do you think that with you approach is it possible to enable Advance menu directly in the BIOS?
Maybe, if GRUB/RU would let you write it.
The original adv has been used in the current adv, but has been suppressed. We only need to use GRUB/RU to change its conditions to make it appear in the BIOS. Just like some Asus computers.
They are 2 Corsair Vengeance LPX 3600 modules, I thought it is a good RAM. With XMP profile 2 it didn’t work, was the problem the amount of modules? I’ll try.
I imagine that if with profile 2 there was a problem the profile 3 is “forbidden”, isn’t it?
Yes (more or less) but I didn’t find any info on why XMP is related to SaSetup variable. Could you please add some info?
Will it be possible with SREP and the help of @AARCH64_EL3?
Thanks again
Could please point me to the right direction? Any example?
It’s a good ram. I was curious about if modules are mixed.
First, check CPUZ SPD tab if there are that many profiles.
The XMP setting refers to VarStoreId 5. VarStore which has ID = 5 is SaSetup.
To be honest, I don’t know. I tried different ways on my PC with no result.
On the motherboard there are only 2 slots of 4, alternate, the missing ones are not soldered
I’m following the guide you linked but I can’t find FPT Tool v11, my Intel ME version is 16.0. In which way we can dump a BIOS with this ME version? I previously used Universal BIOS Backup ToolKit 2.0.exe but this tool is not mentioned anywhere (this is why initially I can’t dump my BIOS)
Ok I followed the guide present at this link on GitHub because the guide present at the link you posted is confusionary (for me), some tools are missing and it is not clear if it is a full guide or if some parts excluded some others.
By the way I report here the process and at the end I have a question.
With ifrextractor.exe I got 2 files (“0” and “1”), the “0” file seems totally unuseful (full of Invalid) while “1” is good. I attach here the “1” extracted with ifrextractor.exe and the one “elaborated” with “IFR-Formatter.js”.
In the first one there is this piece of “code” related to XMP:
0xACBB7: OneOf Prompt: "Memory profile", Help: "Select DIMM timing profile. The below values start with the currently running values and don't auto populate.", QuestionFlags: 0x14, QuestionId: 0x276C, VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x6, Step: 0x0 { 05 91 54 08 55 08 6C 27 05 00 8D 01 14 10 00 06 00 }
0xACBC8: OneOfOption Option: "Default SPD Profile" Value: 0, Default, MfgDefault { 09 07 56 08 30 00 00 }
0xACBCF: OneOfOption Option: "Custom Profile" Value: 1 { 09 07 5A 08 00 00 01 }
0xACBD6: SuppressIf { 0A 82 }
0xACBD8: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACBDF: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACBE9: BitwiseAnd { 35 02 }
0xACBEB: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACBF5: Equal { 2F 02 }
0xACBF7: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC01: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC0B: Conditional { 50 02 }
0xACC0D: End { 29 02 }
0xACC0F: OneOfOption Option: "XMP Profile 1" Value: 2 { 09 07 57 08 00 00 02 }
0xACC16: End { 29 02 }
0xACC18: SuppressIf { 0A 82 }
0xACC1A: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACC21: Uint64 Value: 0x2 { 45 0A 02 00 00 00 00 00 00 00 }
0xACC2B: BitwiseAnd { 35 02 }
0xACC2D: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC37: Equal { 2F 02 }
0xACC39: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC43: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC4D: Conditional { 50 02 }
0xACC4F: End { 29 02 }
0xACC51: OneOfOption Option: "XMP Profile 2" Value: 3 { 09 07 58 08 00 00 03 }
0xACC58: End { 29 02 }
0xACC5A: SuppressIf { 0A 82 }
0xACC5C: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACC63: Uint64 Value: 0x4 { 45 0A 04 00 00 00 00 00 00 00 }
0xACC6D: BitwiseAnd { 35 02 }
0xACC6F: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC79: Equal { 2F 02 }
0xACC7B: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC85: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC8F: Conditional { 50 02 }
0xACC91: End { 29 02 }
0xACC93: OneOfOption Option: "XMP Profile 3" Value: 4 { 09 07 59 08 00 00 04 }
0xACC9A: End { 29 02 }
0xACC9C: SuppressIf { 0A 82 }
0xACC9E: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACCA5: Uint64 Value: 0x8 { 45 0A 08 00 00 00 00 00 00 00 }
0xACCAF: BitwiseAnd { 35 02 }
0xACCB1: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCBB: Equal { 2F 02 }
0xACCBD: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCC7: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACCD1: Conditional { 50 02 }
0xACCD3: End { 29 02 }
0xACCD5: OneOfOption Option: "XMP User Profile 4" Value: 5 { 09 07 5B 08 00 00 05 }
0xACCDC: End { 29 02 }
0xACCDE: SuppressIf { 0A 82 }
0xACCE0: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACCE7: Uint64 Value: 0x10 { 45 0A 10 00 00 00 00 00 00 00 }
0xACCF1: BitwiseAnd { 35 02 }
0xACCF3: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCFD: Equal { 2F 02 }
0xACCFF: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACD09: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACD13: Conditional { 50 02 }
0xACD15: End { 29 02 }
0xACD17: OneOfOption Option: "XMP User Profile 5" Value: 6 { 09 07 5C 08 00 00 06 }
0xACD1E: End { 29 02 }
0xACD20: End { 29 02 }
0xACD22: GrayOutIf { 19 82 }
0xACD24: EqIdValList QuestionId: 0x276C, Values: [0, 1, 5, 6] { 14 8E 6C 27 04 00 00 00 01 00 05 00 06 00 }
0xACD32: EqIdVal QuestionId: 0xC3, Value: 0x1 { 12 06 C3 00 01 00 }
0xACD38: Or { 16 02 }
0xACD3A: End { 29 02 }
The first line is this:
0xACBB7: OneOf Prompt: "Memory profile", Help: "Select DIMM timing profile. The below values start with the currently running values and don't auto populate.", QuestionFlags: 0x14, QuestionId: 0x276C, VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x6, Step: 0x0 { 05 91 54 08 55 08 6C 27 05 00 8D 01 14 10 00 06 00 }
where I see this info:
VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8
I suppose that Size is expressed in bit but we pass it in byte with the command setup_var_cv.
Now if I search for VarStoreId: 0x5 I find this line:
0xA8FC6: VarStore Guid: 72C5E28C-7783-43A1-8767-FAD73FCCAFA4, VarStoreId: 0x5, Size: 0x4A7, Name: "SaSetup" { 24 1E 8C E2 C5 72 83 77 A1 43 87 67 FA D7 3F CC AF A4 05 00 A7 04 53 61 53 65 74 75 70 00 }
so SaSetup is declared here but its Size is 0x4A7. It may be confusing because if I understood well it is the total size.
For a newbie like me it is better to use “IFR-Formatter.js” and search for “VarStore: SaSetup | VarOffset: 0x18D” (with values from the previous output data) where the output is this one:
Memory Overclocking Menu
Memory profile | VarStore: SaSetup | VarOffset: 0x18D | Size: 0x1
Default SPD Profile: 0x0
Custom Profile: 0x1
XMP Profile 1: 0x2
XMP Profile 2: 0x3
XMP Profile 3: 0x4
XMP User Profile 4: 0x5
XMP User Profile 5: 0x6
I hope that this will be useful for someone.
So my question now is:
with this approach I can change some other features without corrupt motherboard? If I understand better the use of setup_var_cv command changes only the current values that are maintained by the battery, it’s almost impossible to damage the motherboard or corrput the BIOS itself, isn’t it?
Indeed.
You can change other features, but very little of CPU features since it’s alder lake platform.
Not a 100% agreed. This is your backup. Those stores are part of the NVRAM- “NV” here meaning NonVolatile- which is part of the bios region of your firmware (=“bios”) and stored in the SPI Chip, same place as firmware with its bios code:
There are examples of both behaviours:
- Resetteable via removing the battery (“CMOS- reset”)
- Salvageable only via programmer
So you can’t corrupt the bios code, but you might put in values in the area where the bios (ans OS) stores its values which may put the machine (temporarily) in a bricked state.
Good point but if we avoid to change values in NVRAM area we are safe, aren’t we?
In order to avoid an accidentally update can I disable System Firmware? I read this on GitHub but I don’t understand if this is only a point of access for OS or if it is necessary
Set a supervisor password for the bios/ firmware and check this option to avoid windows update from flashing a newer bios:
(But NVRAM normally don’t get overwritten / reset)
1 Like
I would like to enable Resizable BAR (I have an NVIDIA GPU), I found this, is it safe to try?
setup_var_cv SaSetup 0x42B 0x1 0x1
@lfb6 scared me!
XMP-3596
What dose it means 3596? Can I use XMP profile 3? A few minutes ago I got a BSOD using Flight Simulator, maybe I have to change other parameters?