Overclock.net - An Overclocking Community - View Single Post - Hawaii Bios Editing ( 290 / 290X / 295X2 / 390 / 390X )

View Single Post
post #1 of (permalink) Old 06-21-2015, 09:51 AM - Thread Starter
Meddling user
gupsterg's Avatar
Join Date: Jan 2015
Location: Lurking over a keyboard
Posts: 6,801
Rep: 730 (Unique: 342)
*** Under Construction Last update: 22/02/17 ***

Updated 22/02/17:-

1. Heading Adding VDDC Offset to ROM done.

Updated 04/07/16:-

1. Heading How to edit PowerLimit information updated.

Updated on 04/06/16:-

1. Heading Editing Subsystem device & Vendor ID (info shared by @Mihastar) added to UEFI section.

2. GOPupd tool link added in UEFI section.

Updated on 31/03/16:-

1. Heading AtomBiosReader for Windows by @kizwan added with info.

Note:- Any modified ROM even with a UEFI/GOP module within it is technically Non-UEFI. There is a bios signature within legacy ROM section which is a hash of the hashes of protected tables within ROM. As the mods we do are within the protected tables and we can't update the signature in legacy ROM to reflect the changes it will fail UEFI checks, thus you need CSM support enabled on motherboard bios to use a modded ROM.

I had been searching for information how some bios editing can be done.

Reading and participating in a thread about the leaked 390X bios on Guru3D I came across a post by sTOrM41 showing how GPU/RAM clocks editing is done (later we discovered more bios edits).

Google translated thread worked for me! thumb.gif .

I used all the programs linked in sTOrM41's German thread and successfully edited my Vapor X 290X STD edition bios to what I wanted.

Flashing was done using method and files in the OCN 290 -> 290X Unlock thread , view under heading R9 290 Unlock guide in post 1 and use steps 1-7 skipping step 3.

Before clicking spoilers below, read and follow below rules.

Make backup of original bios on video card, for each switch position.

Edit copies of your original bios, so you always have original unedited bios to use if things go bad.

Do not flash both bios positions as then at least you'll have option to boot from other if something goes wrong.

When you have modified a bios make a copy of it and once checksum is fixed on one of them using HawaiReader or HD7xxx Series UEFI Patch Tool BETA. Compare the 2 copies using compare function in Hex editor to know only the checksum changed before flashing.

Warning: Using this guide to edit your bios will void your warranty (if card has one). This guide is provided assuming a user knows implications of what they are doing. I accept no responsibility for damage from using this information. All efforts are being made to double check information but there maybe errors.

Further Credits: Netkas for setting the ball rolling that signature check not being done, OneB1t helping me with AtomDis, DDSZ for speeding up marking of code, asder000 for supply of data, Lard for showing how to do memory timings mod and The Stilt for creating his set of mining roms with varying voltage and MLU Roms.

What I've achieved as a performance boost via bios mods
Warning: Spoiler! (Click to show)
Below is a link comparing:-

My stock factory ROM set to ref 290X clocks (1000/1250)
My stock factory ROM set to factory clocks (1030/1325)
My stock factory ROM set to 1100/1525
My stock factory ROM set to 1030/1325 with Stilts timings in appropriate strap to boost RAM
My stock factory ROM set to 1100/1525 with stock 1250Mhz RAM timings in appropriate strap to boost RAM performance

Link:- http://www.3dmark.com/compare/fs/6484784/fs/6484610/fs/6485151/fs/6485990/fs/6468814

What I've achieved manually setting VID per DPM state vs EVV
Warning: Spoiler! (Click to show)

Things to explain:-

i) VID is what voltage GPU being set to, VDDC is what it's getting.

ii) Even when VID is manually set differing apps/loads mean a different reported VDDC in monitoring apps, this can not be avoided due to how "PowerTune" / tech works.

iii) If you don't set DPM7 voltage manually and adjust GPU clock in ROM, VID under EVV setting will decrease as GPU clock rise. So if your applying a global GPU voltage offset in ROM it will end up higher than what you may use when apply offset in OC app with stock ROM.

Next the thing to note about my particular compare is, my ROM does not have a global GPU voltage offset but the voltage chip on PCB does (IR3567B).

On right is stock rom (1), then stock rom with OC clocks (2) but only DPM7 manually set, next is 1090/1475 rom (3) and 1100/1525 rom (4) set manually for all DPM.

Now 1 vs 2, DPM 2-6 ends up lower under EVV, so potential for card to perhaps artifact when say hitting those GPU DPM frequencies (range). The lowering is occurring due to increased GPU frequency across the whole DPM range.

Comparing 2 vs 3 we can see DPM 5 & 6 need higher VID than what EVV was setting for no artifact at those GPU DPM frequencies (range) in testing. DPM 4 & 2 ended up lower and DPM 3 no change, I set DPM 1 lower and so far no adverse effect.

Comparing 3 vs 4 we see rise across the board but GPU DPM frequencies have increased as well as RAM.

My main purpose of this test was to log VDDC in stock rom (1) and see when OC'ing (setting higher GPU freq.per DPM) was I adding more voltage. If we compare 1 vs 3, DPM 7 is equal, DPM6 rose (but higher GPU Freq.), DPM5 is pretty much same (but higher GPU Freq.), DPM 4, 3, 2, 0 all end up lower plus 1 is lower even if not testable in rom 3.

How I see it is stock rom (1) vs 1090/1475 (3) I've ended up with higher clocks across the DPMs for pretty much same/lower voltage as stock rom under EVV. Even 1 vs 4 seems better as each DPM is higher than stock for really not much voltage variance.

My HML log files, HMLGPU-Z.zip 33k .zip file

Note: When doing test above I was using GPU-Z Render Test as graphical load to log drooped VDDC from VID, this gives a more linear monitored VDDC value compared with other apps. I used MSI AB for monitoring as like the HML log file plus set DPM frequency to be tested using it. My card is sensitive to 3dMark FS graphics test 1 so artifact testing was done with that looped plus a run of Heaven and then Valley.

What is "ASIC Quality"?
Warning: Spoiler! (Click to show)
ASIC Quality is LeakageID of GPU. (Click to show)
The Lkg value is the fused LeakageID of the GPU. Convert it to decimal and divide by 1023, you´ll have the GPU-Z ASIC "quality". Higher LeakageID (or ASIC "quality") means higher leakage, which is bad unless you´re running on custom water cooling or LN2.

Quote from link.
More info on LeakageID. (Click to show)
If you use over 1.3V for the GPU (which certainly isn´t recommended), do yourself a favor and DO NOT run Furmark.

The VRM can provide around 360A of current without burning, and a GPU running at >1.3V might just exceed it in Furmark (depending on leakage). The higher your "ASIC Quality" (GPU-Z) is the higher your leakage level is and vice versa. Higher leakage means the GPU will require less voltage to operate, however it´s maximum safe voltage level is lower at the same time. Lower leakage parts require higher voltages, however their break down voltage is slightly greater too.

Note that the VRM current capability is completely temperature dependant, so don´t expect it to survive at high temperatures.It can provide 360A at 25°C, but it can still burn with <150A load at 110°C.

High ASIC "Quality" (Leakage) = Lower operating voltage, larger current draw, hotter, less energy efficient (due higher losses)

Low ASIC "Quality" = Higher operating voltage, lower current draw, cooler, more energy efficient

Unless you are using LN2 you definitely want the leakage to be as low as possible. Even under LN2 the high leakage characteristics are only desired because the difference in voltage scaling. All ASICs despite the leakage have some sort of design specific absolute voltage limit. The low leakage ASIC might run into this limit prior reaching the maximum clocks.

You can use this software the check the default, leakage dependent voltage of your CPU specimen: http://1drv.ms/1Hln01F

The software must be run at default settings (as it came from the factory; clocks, voltages), otherwise the results will be invalid.

Unless your default voltage is greater than 1.250V you should never exceed 1.300V.

Also never trust the VDDC voltage reading displayed GPU-Z or Afterburner. Even at stock the voltage reads around 56mV too low and the discrepancy only increases with the increased current draw (higher clocks and voltage).

Quote from link.
Effect of LeakageID on LL and current draw (Click to show)
Eventhou you can tell if the GPU has high or low leakage properties based on the "ASIC Quality", there is no way to tell how much you can reduce the VDDC from stock. It needs to be tested on each and every card as even the GPUs with identical LeakageID ("ASIC Quality") are never fully identical in terms of other properties. Once there is enough of ACCURATE test data it is possible to roughly estimate the usable VDDC levels (i.e. is the minimum VDDC closer to 1.2V or 1.05V for example).

Also it must be noted that GPUs with low and high leakage properties have different voltage under load eventhou the voltage would be set to the same level. A low leakage GPU might draw 150A of current in load while a high leakage part can draw 170A or even higher. Since the load-line resistance (RLL) is fixed instead of being dynamic based on the leakage current, the high leakage GPU will have a greater load-line effect (voltage drop).


Low Leakage GPU: VDDC = 1.20000V, IDDMax = 150.0A, RLL 0.64mOhm

Idle (~ 5A IDD) = 1.20000 - (((1/10000)*6.4) * 5) == 1.1968V
Load (~ 150A IDD) = 1.20000 - (((1/10000)*6.4) * 150) == 1.104V

High Leakage GPU: VDDC = 1.20000V, IDDMax = 170.0A, RLL 0.64mOhm

Idle (~ 5A IDD) = 1.20000 - (((1/10000)*6.4) * 5) == 1.1968V
Load (~ 170A IDD) = 1.20000 - (((1/10000)*6.4) * 170) == 1.0912V

Quote from link.

HawaiiReader bios modification utility
Warning: Spoiler! (Click to show)
Originally Posted by OneB1t View Post

Here is Hawaii bios reader

if you dont have VS for compile then there is .exe

HawaiiReader now creates checksum when a loaded rom is saved.

Any functional issues post in thread so others are aware and perhaps OneB1t can rectify program.

Use the bios reader with caution as some values it reads wrong, this is due to the varying lengths of tables within differing types of ROMs.

In above image the blue boxed area is CCC Overdrive limits and read data is wrong for that bios.

Warning: Spoiler! (Click to show)
AtomBios info

Atom is basically a byte code scripting language used to write little scripts to handle basic card initialization tasks (asic init, setting engine/memory clocks, modesetting).

There are two sets of tables in ATOM: command tables (basically scripts that execute certain functionality) and data tables (structs that store board/system specific information (type and number of connectors/encoders used on the board, power states, ddc lines, panel info, etc.).

The command tables are versioned and there are specific structs defined for the inputs to the command tables. These are all defined in atombios.h and ObjectID.h. Command tables can also call other command tables and look up data in data tables.

Extract from , another useful page to view.

AtomDis installation and usage in Ubuntu
Warning: Spoiler! (Click to show)
1. Used this guide to install VM of Ubuntu , I used Ubuntu 32bit version.

2. Click Files icon in launcher bar , you will now be in your user home directory. Right click a empty section and select Open Terminal
Screenshot for referencing (Click to show)

*** Commands in terminal window are case sensitive ***

3. Install git , type command sudo apt-get install git
Screenshot for referencing (Click to show)

4. Clone the AtomDis files , type command git clone git://people.freedesktop.org/~mhopf/AtomDis
Screenshot for referencing (Click to show)

5. Now compile the downloaded AtomDis files, type command make
Screenshot for referencing (Click to show)

6. To see supported commands for atomdis type command ./atomdis
Screenshot for referencing (Click to show)

7. You can make atomdis output data to txt by adding >filename.txt , for example gaining tables of a bios.

./atomdis yourbiosfilename l >bios_tables.txt

Another method I use is selecting and copying created tables list in terminal window and the pasting it into PasteBIN. I can then share this paste or view it in windows whilst Ubuntu running in VM, I also use googledrive as I quick method of transferring files between windows & Ubuntu VM.

AtomBiosReader for Windows by @kizwan
Warning: Spoiler! (Click to show)
Creates tables for a ROM like AtomDis in Linux, in the created tables lists you will find "Command Tables" and "Data Tables". Pretty much all edits we will be doing will be in "Data Tables".

Extract from created tables list for a ROM:-
000f:   a0da  Len 02b4  Rev 07:01  (PowerPlayInfo)

Each table gets a hexadecimal number in the list, in above example PowerPlay is 000f.

After that we see the offset location for PowerPlay in the ROM = a0da , if we pick "Search" then select "Goto" from menu bar in HxD (hex editor) and type that offset location the cursor will go there.

After that we see length in hexadecimal of the PowerPlay table in the ROM, 02B4 . If we pick "Edit" then "Select block" from menu bar in HxD and enter the offset location a0da and the length 02B4 the whole PowerPlay will be selected out of ROM.

ATOMBIOSReader.zip 74k .zip file

Editing GPU/RAM Clock
Warning: Spoiler! (Click to show)
The section in your bios file where you need to edit GPU core clock will be where also the RAM clock is (PowerPlay Table).

Here is an image of my default GPU/RAM clock in bios, use this to ref with instructions below. Be aware values will not be in the same place but like said earlier you make the edit where GPU/RAM clock are together.

So what I did using a backup copy of the factory bios for my card:-

1) Took my default GPU/RAM clocks and did the conversion.

2) Using search in hex editor found the section where both were together.

3) Did the conversion for my OC clocks.

4) Made changes and saved changes.

5) Used the HD7xxx Series UEFI Patch Tool BETA to Fix Checksum on edited bios file (HawaiiReader also calculates checksum when rom edited/saved).

6) Placed the bios onto my bootable USB and flashed to one of the bios positions on my card.

Do not flash both bios positions as then at least you'll have option to boot from that if something goes wrong.

My card boot as normal after flash and CCC / GPU-Z detected the new default clocks.

Quick check running 3dMark with GPU-Z / MSI AB monitoring stats reported similar readings for temps / volts after the edits applied.

Making OC bios like factory pre OC'd card/ROM
Warning: Spoiler! (Click to show)
Compare of Vapor X 290X STD & OC edition roms (Click to show)

What is called GPU Freq. Table and RAM Freq. Table in HawaiiReader differ as clock rates go up between rom. Why this is done is so OC bios holds more performance per DPM state.

In below image is table showing DPM State and GPU Freq. Table compare between stock AMD and Vapor-X 290X roms.
Warning: Spoiler! (Click to show)

When DPM7 is raised the lower GPU Freq. states are calculated as a % of DPM7.

Here is an image showing what DPM states for GPU & RAM Freq. Table would be for a 1100MHz / 1525MHz preset OC in rom.
Warning: Spoiler! (Click to show)

Note 1: The % of DPM7 clock in each image was calculated from comparing 290X roms, this may well differ for 290 / 295X2 / 390 / 390X .

Note 2: I have noted there is another edit that is done for when RAM frequency rise in a rom, see heading Memory Interface voltage (VDDCI) and RAM frequency editing. Currently this mod can only be done using HEX editor and not with HawaiiReader.

Fan control modes
Warning: Spoiler! (Click to show)
Firstly there are 2 sets of fan control mode.
Standard fan control mode(LUT) (Click to show)

Note:- Manual Fan control is not enabled by default and no Target GPU Temperature (Max ASIC Temperature) in CCC Overdrive page. This mode is denoted in rom by the 00 in hex editor, see blue boxed hex. Standard mode uses 4 temps and 3 rpm% for setting it's profiling plus a temperature hysteresis.
Advanced fan control mode (Fuzzy Logic) (Click to show)

Note:- Manual Fan control is enabled by default and can not be unchecked, Target GPU Temperature (Max ASIC Temperature) is shown in CCC Overdrive page. This mode is denoted in rom by the 01 in hex editor, see blue boxed hex, 295X2 roms have 02 . AFAIK the 4 temp and 3 rpm% are then not used for fan profile but a pre determined profile based on target GPU temp and maximum fan speed is used.

How to edit Standard Fan Control mode (LUT)
Warning: Spoiler! (Click to show)
Note:- The Fan profile edit in this section works with 00 as fan mode (Standard Fan Control or Look Up Table), ref first image in this section box boxed hex. If in CCC Overdrive section you see "Target GPU Temperature" then your card is using Advanced Fan control, see that heading for info and Maximum fan speed.

In image below you can see 2 windows of Hex-Editor MX open, top shows stock bios settings, bottom shows edits done. The notepad window shows information concerning conversion of HEX to values.

1) Run a search in bios for 7C15. The right place to do edits is where 0306 proceeds 7C15 and you find 00 or 01 after counting 7 pairs of HEX between 0306 and 00 or 01. I found the Vapor-X 290 bios did not conform to this rule but instead 7 pairs of HEX were between 0706 and 00, view spoiler below.

So do count pairs and convert HEX and view values. The 03 or 07 is revision for the fan control scheme.
Comparative of differing roms fan profile settings (Click to show)
Sapphire R9 290 bioses orange underlines. Sapphire R9 290X purple bioses.

Asus DCUII R9 290X STD edition Quiet & Uber bioses

In each image notepad shows unedited values for HEX data

2) Take your 7 pairs of HEX and switch each pair around. ie 7C15 becomes 157C

3) Convert switched HEX pairs to DECIMAL (Read Note 1 below), knock off 00 on end and this gives you value.

4) Do the reverse to calculate HEX for new value, ie if new value to be set is 55 add 00 to end, convert 5500 from DECIMAL to HEX = 157C , switch pairs around 157C becomes 7C15 . (Read Note 2 below)

5) Enter new values in corresponding location, save your new bios.

6) Use the HD7xxx Series UEFI Patch Tool BETA to fix Checksum and save on edited bios file or open rom in HawaiiReader and save.

7) Place the bios onto bootable USB and flash to one of the bios positions on card.

Note 1:

When entering HEX value into calculator where first character is 0 it will not be displayed. For example HEX pair 07D0 will be shown as 7D0.

Note 2:

When a DECIMAL is converted to HEX and your result is 3 characters a 0 will be needed to be added to beginning. For example setting 20 as a value becomes 2000 after adding 00 to end, then convert DEC to HEX, then a result of 7D0 on calculator will be shown. Add the 0 at beginning gives you 07D0.

How to edit Temperature Hysteresis for Standard Fan Mode (LUT) Warning: Spoiler! (Click to show)

In this image we have:-

TMP1 = 60C
TMP2 = 83C
TMP3 = 92C
TMP4 = 95C

Temperature hysteresis defined as 6C (06 HEX to DEC=6).

Temperature hysteresis prevents fluctuation of fan RPM(PWM) at defined temp points (ie TMP1, etc) within a range of the set hysteresis.

For example temp hits 83C which uses PWM2 = 40% fan will stay at 40% until temp decreases to 77C. So the range for PWM2 (40%) = 83C - 77C

Note: Hysteresis is applied to decreasing temperatures only, not to both directions.

How to enable/disable Advanced Fan Mode (Fuzzy Logic)
Warning: Spoiler! (Click to show)
This is the difference between "Uber" & "Quiet" bios on AMD R9 290X which have these bios per switch position.

"Uber" = Standard fan mode (Look Up Table)
"Quiet" = Advanced fan mode (Fuzzy Logic)

Bios set as 00

Bios set as 01

Above example images is my Sapphire Vapor-X bios edited which doesn't come with target temperature & maximum fan speed limit enabled by default on any of the bios switch positions, it only comes with UEFI & NON UEFI. Reason why GPU-Z state Asus R9 290X is I was using some Asus branded drivers from their support site.

How to edit Sensitivity/Granularity of fan speed adjustment in Advanced fan mode (Fuzzy Logic)
Warning: Spoiler! (Click to show)
Bigger number means more aggressive adjustment (vs. temperature). At default the sensitivity is set to 4836. You will find E4 12 in Fantable of PowerPlay in hex editor.

E4 12 switched is 12 E4, hex to dec = 4836

How to edit default Maximum Fan Speed
Warning: Spoiler! (Click to show)
The HEX straight after the 01 sets % for maximum fan speed, originally bios has 28 (HEX) converted to DECIMAL is 40.

I wanted value of 55, convert decimal 55 to HEX is 37, below is video.

Note:- Once you boot into windows with this edit driver needs to be defaulted on overdrive page. I had already done this before capturing screen video. Near the end of video is also shown how to restore complete CCC to factory defaults.

How to edit Target GPU Temperature (Maximum ASIC Temp)
Warning: Spoiler! (Click to show)
In the PowerPlay table (ref the atomdis tables produced for the rom your editing) you will find a 5F located in it near the end of it.

5F convert to decimal= 95C , if we wish to set 75C we convert to hex = 4B and overwrite default value.

This will impact the thermal policy used and throttling due to temperature.

Note: Above image is my stock bios PowerPlay selected, the rom you will be editing may have powerplay table located at different offset in bios and length so ref the AtomDis tables for your rom.

Editing Maximum GPU/RAM Overdrive Limits
Warning: Spoiler! (Click to show)
In the PowerPlay table /section of bios you will find HEX code F0 49 02 , to calculate value switch position of first pair and end pair of code. So F04902 becomes 0249F0 , convert to decimal = 150000 , knock off the 00 on end makes it 1500MHz, this is the GPU CCC Limit.

RAM CCC limit is 40 0D 03 , to calculate value switch position of first pair and end pair of code. So 400D03 becomes 030D40 , convert to decimal = 200000 , knock off the 00 on end makes it 2000MHz, this is the RAM CCC Limit.

Now if you wish to set a limit of 3000MHz we calculate this by adding 00 to the end. Take 300000 and convert to HEX 0493E0 , then switch position of first pair and end pair of code. So 0493E0 becomes E09304 now replace GPU or RAM or both if you like with new value (ref image above for default HEX code of GPU / RAM CCC limits.

GPU Voltage adjustment
Warning: Spoiler! (Click to show)
Warning: Using this guide to edit your bios will void your warranty (if card has one). This guide is provided assuming a user knows implications of what they are doing. I accept no responsibility for damage from using this information. All efforts are being made to double check information but there maybe errors.

Explanation Warning: Spoiler! (Click to show)
Part 1 - Dynamic Power Management (DPM) (Click to show)
First we have to understand Dynamic Power Management (DPM) has 8 states (0-7).

The rule is a lower number state has less voltage and lower frequency associated to it.

Therefore we should not edit a bios to have higher number DPM state to more voltage / frequency than a lower number state, this will cause issues.
Part 2 - The 6 tables (Click to show)
Then we have six sections in bios.

Using the terms in the HawaiiReader :-

GPU Freq. Table = voltage depending on GPU clock separated into DPM0 -DPM7

MEM Freq. Table = voltage depending on RAM clock separated into DPM0 -DPM7

StartVCELimitTable = VCE (Video Coding Engine) mode voltage separated into DPM0 -DPM7

StartUVDLimitTable = UVD (Unified Video Decoder) mode voltage separated into DPM0 -DPM7

StartSAMULimitTable = SAMU (security asset management unit) mode voltage depending on GPU clock separated into DPM0 -DPM7

StartACPLimitTable = ACP (Average Consumed Power) voltage depending on GPU clock separated into DPM0 -DPM7

All six sections must have the same voltage edits, as down below you will read the interconnectivity of these sections.

VCE & UVD sections in bios do not have a GPU/RAM frequency hex value by them in rom. Therefore they must use the frequencies set in GPU / RAM Freq. table.

SAMU & ACP have GPU frequency but not RAM, therefore they must use RAM Freq. Table for that information.

Now hopefully above has explained why the voltages in each six sections must be the same.

For any other purpose we may use the card for GPU / RAM Freq. Tables are used.
Part 3 - ROMs with VDDC offset only (Click to show)
Next we have ROMs which have a preset GPU core voltage offset, this offset is added to all DPM states (ie 0-7).

You will know if you have a ROM of this type if on MSI AB Core Voltage slider you see a preset + xx mV value when you didn't set one.

Also you know if your ROM has this is to check ROM for what is default VDDC for DPM 0 (ie idle) via HawaiiReader and then compare in a monitoring program if you are getting that.

We have 2 ways of dealing with these roms for editing voltages purpose.

1. Change the offset in the VoltageObjectInfo table.

2. Take into account the offset when doing voltage changes in powerplay table.

Then we have roms which have no preset GPU core voltage offset but the CHiL or IR controllers have factory programmed offset. To deal with this you take into account the offset when doing voltage changes in PowerPlay table.

Now also there must be roms without an offset and CHiL or IR controllers have no factory programmed offset. Therefore you just edit voltages as you require.
Part 4 - ROMS with VDDC & VDDCI offset (Click to show)
There are also ROMs which have a GPU voltage (VDDC) and Aux voltage (VDDCI) offset in them. The GPU core voltage (VDDC) is added to all DPM states (ie 0-7).

These type of ROMs will not show a preset value in MSI AB Core Voltage slider or Aux Voltage slider. Therfore easiest way to know if your ROM has this is to check ROM for what is default VDDC for DPM 0 (ie idle) and Aux voltage via HawaiiReader and then compare in a monitoring program if you are getting that.

*** screenshot to be added ***

Finding GPU core voltage offset in a rom
Warning: Spoiler! (Click to show)

Note 1: You can search for the GPU core voltage offset in a rom by using the find command in a hex editor but I highly recommend creating tables for a rom to do this edit so you know you are in the right area of rom.

Note 2: If your rom does not have a GPU core voltage offset but MSI AB / OC apps shows an offset the voltage control chip has a factory programmed offset. If you flash a rom with an offset in it then this becomes the used offset and the one in the voltage control chip is ignored.

Note 3: Adding the hex values 8D 00 xx 00 (xx denoting offset) to a rom's VoltageObjectInfo is not recommended currently. Reasons being:-

a) we have no idea what the other values in table mean but a few at beginning.
b) from roms I've viewed it's location within the VoltageObjectInfo table can differ.
c) adding these values also requires further edits to rom. Firstly an increase of the 7th hex value of this table, secondly all beginning offset locations of data / command tables after VoltageObjectInfo table shift with this additional data. The area of rom that must be then edited is what I call the "Directory of tables". Thirdly padding area after the command tables must be reduced to keep rom size the same, view image below comparing a factory Vapor-X 290X STD edition rom with OC edition.
Rom compare (Click to show)

Note 4: Proof these hex values are what they are has been a) collated from viewing several roms b) flashing / testing some of these roms.

Note 5: When a rom has been edited to a differing offset you will require an uninstall of MSI AB / OC apps which note defaults for a card. The uninstall must include removal without keeping saved settings, also verify directories of such apps are empty or deleted after uninstall and before reinstalling, otherwise anomalies will occur.

Setting/editing GPU core voltages in the 6 tables
Warning: Spoiler! (Click to show)

You will find 2 tables in the Powerplay tab (note blue box left image) and 4 tables in the Limit Tables tab (note blue box right image), as explained earlier per DPM (green box) per table must have same voltage setting (red box).

For example DPM 0 is idle state voltage, stock on 290X is 968 (0.968V) , if setting it to 1.000v each tables DPM 0 must be set to 1000 .

The numbers 625282 , 625283 , 625284 , 625285 , 625286 , 625287 , 625288 represent EVV voltage. This is determined by the leakage ID of your GPU (ASIC Quality) . Link:- expanded info here
Image of stock and modified ROM for voltages (Click to show)

Stilts VID app (linked end of this post) gives you DPM 7 EVV voltage only (AiDA64 can be used to gain others). How this can be used is, say for an OC of 1100MHz you set +44mv in MSI AB, you would first determine your DPM 7 VID @ stock settings. Then add 44mv (43.75mv due to how SVI2 voltages are) to this and plus do GPU clock edits in rom.

Stilt app shows 1.25v, 1.25 + 0.04375v = 1.29375v , if using hawaiireader as explained in heading SVI 2 Compliant Voltages you enter 1293 for DPM7 per 6 tables.

AiDA64 can also be used to get voltages for each DPM state, view video. Credit to DDSZ for sharing this information.

Note: To get correct readings for voltages via Stilts VID app or AiDA64 video card should running at default settings.

SVI 2 Compliant Voltages
Warning: Spoiler! (Click to show)
Example stock Hawaii XT:

DPM0 = 300MHz - 0.96875V
DPM1 = 516MHz - 1.01875V
DPM2 = 727MHz - 1.05000V
DPM3 = 840MHz - 1.07500V
DPM4 = 890MHz - 1.10000V
DPM5 = 936MHz - 1.12500V
DPM6 = 977MHz - 1.18750V
DPM7 = 1000MHz - 1.21250V

Warning: Some voltages are shown in image below which are way to high, so please ref above stock values as to what you should use.
SVI 2 Voltages Table (Click to show)

To use all you do is drop the decimal point and trim last 2 digits and enter into HawaiiReader.

For example:- 0.70000v would be 700 for entry into HawaiiReader, 1.28750v would be 1287 for entry into HawaiiReader.

If using HEX editor to do voltage change drop the decimal point and trim last 2 digits and convert from DEC to HEX. If no 0 present in resulting change add one to front of HEX value and then switch pairs around for entering into HEX editor.

For example:- 0.70000v would be 0700, then convert to HEX result 2bc, add 0 to beginning = 02bc , then switch pairs bc02

Adding VDDC offset to ROM
Warning: Spoiler! (Click to show)
Note: I would advise mod not to be done on Asus 290X Matrix and MSI 290X Lightning.

Link to video.

Attached is guide.txt seen in linked video.

guide.txt 3k .txt file

GoogleDoc link to IR3567B registers I'm aware of. The process shown in the video can be used to add registers which may not be in the VoltageObjectInfo of your ROM.

Note: Use above GoogleDoc information with caution as potential for killing card.

How to edit PowerLimit
Warning: Spoiler! (Click to show)
There are 3 values that can be edited.

TDP: "Change TDP limit based on customer's thermal solution"

Maximum Power Delivery Limit (MPDL): "This power limit is the total chip power that we need to stay within in order to not violate the PCIe rail/connector power delivery"

TDC: "PowerTune limit for maximum thermally sustainable current by VDDC regulator that can be supplied"

Warning: Anyone implementing this mod needs to be aware you will see no upped % for "PowerLimit" in CCC / MSI AB / TriXX / etc. When you increase these 3 values in bios and add 50% "PowerLimit" via an OC app you will be going higher than stock settings.

Note: PowerLimit relates to GPU not total board power usage. So you will see higher readings for A/W in HWiNFO for VRM than what you set in PowerLimit as other circuitry and "electrical elements" are not part of PowerLimit.

MPDL relates to what power can be delivered to card from mobo slot/PCI-E plugs.

So a 8+6 config card 300W MAX , 8+8 = 375W , etc. Just bear in mind warning in red above. Now all information on MPDL is based on PCI-SIG spec, the hardware limits for 6/8 pin plug are higher.

Below is a post by The Stilt, handy to read power split on cards:-
Originally Posted by The Stilt View Post

Hawaii or Fiji based cards don't draw anywhere near the maximum allowed by the specification (i.e 66W) from the PCI-E slot. They draw the power for the GPU VRM from the PCI-E power connectors and the power drawn from the PCI-E bus itself only feeds VDDCI VRM and the display interfaces (on Hawaii) and MVDDC and display interfaces on Fiji.

THG reviews for Hawaii cards have data on PCI-E slot / plugs loading, I would use the averages for reference, also be aware high leakage GPU would be higher power draw, the cards used in THG reviews we have no idea if they are high/average/low leakage GPU.

Next TDC.

Simple explanation regarding VRM

The VRM takes the 12v and steps it down to lower voltage for GPU to use and converts the higher voltage, lower current supply to a low voltage, high current supply.

Knowledge of phases on VRM and spec of components is necessary/handy to know. Best source is hi res PCB images and then google for tech spec pdfs on mosfets.

Ref PCB 290/X have 5+1+1 config (GPU/RAM.interface/RAM) and spec is 40A per phase, thing to note is thermals affect mosfets efficiency/output.

What I noted in unmodified factory ROMs for my Tri-X 290 STD and Vapor-X 290X STD.

So in testing of up to 1175MHz GPU I found no throttling using 238/238/229, my view is only to have PowerLimit in ROM appropriate for an OC set in ROM.

What is VDDCI (aka Aux Voltage)?
Warning: Spoiler! (Click to show)
VDDCI (aka Aux Voltage) is voltage given to Memory Controller.

Some have reported improved:-

a) stability for a RAM clock
b) improved RAM clock headroom
c) stopped blackscreen

for me it hasn't helped in any of those situations.

It's all down to "quality" of MC and "silicon lottery".

From talk's with The Stilt via PM going too heavy hand on upping this is not good idea. So little increase can help and excessive can do the opposite (ie not help). The MC is sensitive to voltage so use caution. It's effects are down to per user experience / card.

How to edit Memory Interface Voltage (VDDCI/AUX Voltage) and associated RAM frequency
Warning: Spoiler! (Click to show)
In powerplay table between SCLK VDDC dependency table (what is called GPU Freq. Table in HawaiiReader) and MCLK VDDC dependency table (what is called RAM Freq. Table in HawaiiReader) are HEX values to set memory interface voltage (VDDCI) and associated frequency for that VDDCI.

Below is cropped image of my factory Vapor-X 290X STD rom and OC edition powerplay, the relevant HEX values are marked in turquoise boxes.


Vapor-X 290X STD rom has a RAM clock 1325, therefore 94 05 02 (switch) = 02 05 94 (convert to dec) = 132500, drop 00 = 1325MHz

Vapor-X 290X OC rom has a RAM clock 1410, therefore C8 26 02 (switch) = 02 26 C8 (convert to dec) = 141000, drop 00 = 1410MHz

SO we can see the frequency associated with VDDCI is the same as highest RAM frequency in a ROM.

E8 03 switched is 03 E8 , convert HEX to DEC 1000 , which is 1.000v . As voltage control chip controls both VDDC (GPU voltage) & VDDCI the values that can be used are SVI2 ones as shown under heading GPU Voltage adjustment > SVI 2 Compliant Voltages.
The quality of the memory controllers vary so some of them might need a slight increase in the supply voltage (VDDCI) even at or slightly below 1500MHz. Usually 20mV increase in the VDDCI is enough to stabilise it. On Hawaii the VDDCI should never be set higher than +50mV (= 1.050V) as the memory PHY / controller is the hottest part of the GPU already.

Link:- quote from

Further info also in post 512 of this thread.

Warning: Setting voltage more than 1.100v is not recommend, the Stilt has confirmed 1.10v is OK for max testing purpose, I've seen stock Sapphire 390/X roms to have 1.050v which shows as 1.047v in GPU-Z.

Note: Currently this complete mod can only be done using HEX editor and not with HawaiiReader. HawaiiReader now supports VDDCI editing only not associated frequency. Do not use offset locations in image above as powerplay table can differ in location. Ref atomdis created tables for a rom, then find appropriate values to edit in powerplay table.

Note: Ref heading GPU Voltage adjustment > SVI 2 Compliant Voltages for compliant voltages. IMO do not enter more than 1100 = 1.100V
Hawaireader screenshot for editing VDDCI (Click to show)

How to add extra states of VDDCI and associated RAM frequency
Warning: Spoiler! (Click to show)
info soon to be added

0.95V rail volt mod Warning: Spoiler! (Click to show)
So far only the Matrix has this rail modifiable via software, an investigation was done if a bios mod could be done so other cards could have this function via software. Unfortunately so far the bios is the same as any other hawaii card and i2cdumps for a Matrix card were revealling extra controllers which maybe allowing the rail to be manipulated.

This mod helps blackscreen when pushing VDDC, discussion about it started at this post.

@rt123 posted info on Lightning 0.95 volt mod in this post

@Enzarch did a mod on a Gigabyte hawaii card, link

Memory Timings Modding
Warning: Spoiler! (Click to show)
Memory Controller Straps/Frequency Range (Click to show)

In VRAM_Info section of ROM you will find RAM straps/timings. You will find the end frequency of each strap and then associated timings for it. Thus a RAM clock equal to and below that end frequency uses those timings and once past that end frequency it uses next strap and so on.

Most 290/X & 295X2 have these straps/frequency range:-

Strap end 400MHz (40 9C 00) , Range = 150-400MHz
Strap end 800MHz (80 38 01) , Range = 401-800MHz
Strap end 900MHz (90 5F 01) , Range = 801-900MHz
Strap end 1000MHz (A0 86 01) , Range = 901-1000MHz
Strap end 1125MHz (74 B7 01) , Range = 1001-1125MHz
Strap end 1250MHz (48 E8 01) , Range = 1126-1250MHz
Strap end 1375MHz (1C 19 02) , Range = 1251-1375MHz
Strap end 1500MHz (F0 49 02) , Range = 1376-1500MHz
Strap end 1625MHz (C4 7A 02) , Range = 1501-1625MHz
Strap end 1750MHZ (98 AB 02) , Range = 1626-1750MHz

Note: HEX values in brackets are as they would be in VRAM_Info timings section without endian conversion, etc.

I have noted some ROMs to have 200MHz / 250MHz / 600MHz strap plus 390/X ROMS have 12 straps, so use above as guide only.

400MHz, 800MHz, 900MHz, 1000MHz, 1125MHz, 1250MHz, 1375MHz, 1731MHz, 1500MHz, 1625MHz, 1750MHz, 2000MHz

Now if I was using a 390/X ROM I'd correct the 1731MHz strap, as ideally you want them in sequence so ranges are created like above shown.

As frequency is stored as 10kHz value you will see 1731MHz as 173100 when you convert the hex values.

2C A4 02, switched = 02 A4 2C , convert to DEC = 173100

You can change the frequency per strap, for example make it:-

400MHz, 800MHz, 900MHz, 1000MHz, 1125MHz, 1250MHz, 1375MHz, 1500MHz, 1625MHz, 1750MHz, 2000MHz, 2125MHz

At present we don't know how to create timings, so you can copy another straps timings to use. See heading Other Timings mods in this section.
What area of ROM to mod? (Click to show)

The green boxed HEX is the upper limit for a strap. ie if we wish to edit timings for 1126-1250MHz we edit hex after 48 e8 01 and between 1c 19 02.

In above image a VRAM Info with "AutoDetect" & 2 RAM IC support is shown. Hence AFR IC has take ID 01 in timings section and BFR 02. Below is an image which shows beginning of VRAM_Info and should explain further about this.

End of this post is also Memory Info tool which will tell you which RAM IC you have.

Note: Do not use offset locations from the image above as the location of VRAM_Info in a rom can vary. You have two options to find correct area i) create tables for rom using atomdis, then look for relevant HEX (best option) ii) search relevant strap HEX values using HEX editor

Also there is this video by @navjack27 as an alternative to the image/text explanation above plus also read his post linked here.
The Stilt Timings for Hynix AFR (Click to show)
77 71 33 20 00 00 00 00 08 39 47 2A 50 55 0C 0B 24 20 45 04 00 46 C4 00 22 BB 1C 00 5C 0B 14 20 4A 89 00 A0 00 00 01 20 12 0C 21 1E 51 19 26 13
The Stilt Timings for Elpida BBBG (Click to show)
77 71 33 20 00 00 00 00 4A BD 47 2A 60 55 0F 0F 23 1D 87 03 00 46 C4 00 22 AA 1C 08 5C 0B 14 20 4A 89 00 A0 00 00 01 20 11 0D 20 23 4A 1D 24 11
Other Timings mods (Click to show)
Besides adding the Stilt's timings we can take lower latency timings of say the 1375 strap and add it to the 1500 strap. So then clocks of 1376-1500MHz will have 1251-1375MHz timings. A ROM containing this mod (supplied by Lard) was tested by me in 3dmark / Heaven / Valley , due to time constraints I did not do more tests or longer period of use.

Some results in this post, Link:- https://www.overclock.net/t/1561372/hawaii-bios-editing-290-290x-295x2-390-390x/130#post_24188996

Plus some more thoughts Link:- https://www.overclock.net/t/1561372/hawaii-bios-editing-290-290x-295x2-390-390x/140#post_24190870

Bare in mind at the time of those 2 posts above we thought the Stilt MLU builds contained differing tightened timings for 1375MHz strap. When I was getting this section of "How to ..." ready discovered The Stilt had identical timings for his 1250MHz & 1375MHz strap. Lard had added 1375MHz stock timings into 1500MHz strap for me, which in turn has created this mod wink.gif.

How to edit supported memory size & density
Warning: Spoiler! (Click to show)
Supported memory size in a rom is located in VRAM_Info table (ref Atomdis tables for a rom for beginning offset location of table). Currently HawaiiReader does not support this edit.

Quick way of getting you to right area is doing a text string search in a HEX editor, you would be searching for the supported IC by rom to get to you that area.

ICs that can be supported (if you find more post in thread so they can be added):-




K4G20325FS (so far only seen in Sapphire R9 290/X New Edition)




A 40 denotes 4GB RAM and 80 denotes 8GB RAM. When 2 IC's are supported you would edit the appropriate one or both if creating a ROM being released for others to use.

RAM density needs to be adjusted when using a 390/X ROM on 290/X.
290X VRAM_info

0022:  UCHAR ucDensity                                     = 0x43       (67)

0028:  UCHAR ucMemorySize                                  = 0x40       (64)

390X VRAM_info

0022:  UCHAR ucDensity                                     = 0x53       (83)

0028:  UCHAR ucMemorySize                                  = 0x80       (128)
Originally Posted by The Stilt View Post

To get around the MEMCLK barrier in Grenada, AMD has latched some of the memory controller related timings (through bios). So for higher than 1375MHz use 390 memory block with corrected memory density and corrected timings.

A 53 in the 390/X VRAM_Info needs to be changed to 43. When 2 IC's are supported you would edit the appropriate one or both if creating a ROM being released for others to use.
Sreenshot for referencing plus extra info (Click to show)

Use yellow underlined HEX values for ref plus ANSI text section in editor with supported RAM type. Right most window shows a 290 rom with 2 supported ICs, each colour of boxed HEX matches the same colour underlined supported IC, density is purple boxed hex values.

Adding 390/X MC Timings (v3.1) to a 290/X & 295X2 ROM
Warning: Spoiler! (Click to show)
Below is a video showing how to apply this mod to a ROM, 295X2 owners will have do master & slave ROMs.

In the video it is shown how I would do the mod but if your stock ROM has a larger VRAM_Info than the files in zip, you can copy and overwrite that section but you must 00 out the remaining values of old VRAM_info table. Then you don't need to edit the ROM directory of data and command tables as shown in the video.

VRAM_Info_390_MC_v3.1.zip 8k .zip file

All straps have stock timings, where a stock ROM did not have higher frequency strap timings for a RAM IC the lower one was copied into higher one.


i) After this mod checksum will require fixing.
ii) If the ROM you are modding is not 128kb in size before modding you will need to add padding to end of ROM to make it 128kb for HD7xxx Series UEFI Patch Tool BETA to open it for checksum fixing.

How to add/remove UEFI/GOP plus match/edit Device ID info
Warning: Spoiler! (Click to show)
UEFI module in ROM begins at offset location 10000, when you add a UEFI to a ROM which does not have UEFI you also need to change a HEX value near beginning of ROM to activate UEFI.

Note: The 3 example screenies below are a Tahiti ROMs, when have time will update images with Hawaii roms.

Activating UEFI HEX values (Click to show)

Location of the HEX value can differ per rom, run search in HEX editor from beginning of rom. Ref the ANSI text in HEX editor screenie only slight variation between shown rom and say a Hawaii one.

Then you must also check Device & Vendor ID (PCIID) match in beginning section of ROM & UEFI / GOP section.

Easy way to find right area for Device & Vendor ID is just search for PCIR using find command of HEX editor (Click to show)

Device & Vendor ID in ROM / UEFI (Click to show)

Checks I did the Subsystem device & Vendor ID in beginning of ROM is not referenced in UEFI section only Device & Vendor ID.

Subsystem device & Vendor ID in ROM (Click to show)
Subsystem ID & Vendor is stored the same switched way as Device & Vendor ID. 4B 17 82 E2 = E2 82 17 4B

Editing Subsystem device & Vendor ID in beginning of ROM (Click to show)
See this post by @Mihastar

Extra info (Click to show)

I can't remember if there is a switch to check a flash file if it has UEFI using ATIFLASH (DOS) but a flashed ROM can be checked by doing command atiflash -ai . This command will also give info like PCIID SSID.

You can use HD7xxx Series UEFI Patch Tool BETA to add a UEFI to a non UEFI rom. It will also activate UEFI in a ROM and do checksum but it will not check to match PCIID AFAIK. To use this tool you do require a ROM with UEFI to use as donor for addition to ROM without UEFI.


1. Click Load vBIOS , select rom in next window which you wish to add UEFI.

2. Click Add UEFI , select rom in next window which has UEFI module.

3. Click Activate UEFI , then Fix Checksum , save new ROM via Save As...

*** GOPupd Tool ***

On Win RAID forum is a great tool, this will update an AMD ROM to latest UEFI/GOP module. The tool will do edits required to ROM to enable UEFI/GOP module and create checksum, read carefully post 1 & 2 of linked thread.

How to edit ROM for data/command table length changes
Warning: Spoiler! (Click to show)
Lard has created a batch file which calculates hex values for pointers in ROM to data & command tables. This has been updated by @kizwan smile.gif .

Table_Calculator.zip 2k .zip file

In ROM there is section which contains pointers to data & command tables. From beginning of ROM search for A6 00 01 01, including those bytes the section has length F0 .

In above image is shown only the directory of data & command tables in a rom. Then notepad windows show link to data / command table names, these tables were reordered by hand in notepad.

Using Lard's Table calculator

- Tables.bat must be run from a command prompt launched as administrator. Right click command prompt icon and pick run as administrator.

- Copy the section in ROM from and including A6 00 01 01 for a length of F0. Paste those hex values in tables.txt, it will already have example values in file, overwrite and save file.

- Run tables.bat from command prompt, enter the hex value of the table that has changed in length (for example a748), next enter the hex value of changed length, next state if it's a + or - difference in length, next state S for switched pairs ie endian conversion.

- After the bat file has run, in the same directory as the tables.bat will be Table_modified.txt this has new calculated table values.

- Open the Table_modified.txt and select all and copy. In the hex editor paste the copied values (use paste write not insert), this will overwrite the appropriate section in rom (ie where you copied the values from (A6 00 01 01 inc those bytes length F0)).

- Save the modified ROM and fix checksum.

Note: This info is provided as is, use at your own risk.

If you modify length of PowerPlay table hawaiireader may not read it correctly for values afterwards.

I had some issues with hawaiireader fixing checksum of modded files so use HD7XXUEFIPatchToolBeta.

Also compare modded unfixed checksum ROM with modded fixed checksum ROM using hex editor to know there is no corruption.

Useful Links

Link:- The Stilt's VID APP (AiDA64 gets all DPMs)
Link:- The Stilt's MLU roms
Link:- HxD Hex editor
Link:- MemoryInfo v1.005 @ TPU, Alternative Link:- Memory Info tool
Link:- HIS iTurbo v1.6.6 (link near end of webpage)
HD7XXUEFIPatchToolBeta.zip 63k .zip file
gupsterg is offline