[Various] Overclocker discovers Xeon E5 V3 Errata, Engineers exploit to unlock Turbo

[dingmel]

followed the instructions from the pack. got stuck at V3.efi loading. I think i'm not getting the right message cos the microcode is still present, meaning my bios mod failed.
delving deeper into the topic, i just found out that a lot of X99 boards have Aptio V Bioses, that are not compatible with
I guess that's the reason v3.efi isn't loading properly.
I'm not really that good with hex editing bioses manually, trying to figure out how to get the microcode out of the latest bios for the RvE (3501)

[StyM]

what value did you put for broadwell-e ?
got mine to work on a x99-a asus motherboard.

[dingmel]

I used the latest, 1F iirc. will try with another. thx for pointing that out, @StyM

[StyM]

[Saren]

here's mine, 2683 V3 on supermicro motherboard.
still have a bit of tinkering to do as 1 cpu is running slower than the other.
using 2.7ghz offset for now, will try 3.0ghz later.



56 threads @ 3.0ghz ???...

Hi there. I just registered and subscribed to this forum just to ask some questions.
I am also using a supermicro board which is X10DAL-I and the CPUs are dual 2683 v3.

Which model you are using? Which bios version?

Also, what steps have you performed to achieve the exploit?
I am currently using a uefi linux system. The v3.efi file is placed inside /boot/efi/EFI/Apricity and added to driver entry.
The output of efibootmgr is as follows:

[saren@Saren-Workstation /boot/efi/EFI ]% efibootmgr -r -v
DriverOrder: 0000
Driver0000* XeonV3FullTurbo HD(1,GPT,c65d6862-edd5-40f2-aca2-b17d9a4f8a9f,0x1001,0x96001)/File(\EFI\APRICITY\V3.EFI)

[saren@Saren-Workstation /boot/efi/EFI ]% efibootmgr -v
BootCurrent: 0000
Timeout: 1 seconds
BootOrder: 0000,0003,0009,000A,0008,0001,000B,000C,000D
Boot0000* apricity HD(1,GPT,c65d6862-edd5-40f2-aca2-b17d9a4f8a9f,0x1001,0x96001)/File(\EFI\APRICITY\GRUBX64.EFI)
....

I have also tried to remove intel-ucode and regenerated grub config which further disables microcode patch, but I can't seem to be getting the exploit to work.

Did you get into UEFI shell, and performed something like
1. load v3.efi
2. copy file to some folder
3. bcfg add driver, referencing that v3.efi file
or are there extra steps to do?

Thanks.

[StyM]

i'm not using that file, i believe that file is for single CPU only.
there are two files for use on 2P system, you may look for v3x2.efi (3.0ghz) or v3x2_mc39.efi (2.7ghz) , i'm currently using v3x2.efi for full turbo.
went into the efi shell and loaded the v3x2.efi file, copied it to the efi\boot folder.
unfortunately supermicro efi shell doesn't have bcfg, so not sure how to make the efi driver stick permanently.
so for now, everytime i reboot i have to load manually the driver...

[Saren]

i'm not using that file, i believe that file is for single CPU only.
there are two files for use on 2P system, you may look for v3x2.efi (3.0ghz) or v3x2_mc39.efi (2.7ghz) , i'm currently using v3x2.efi for full turbo.
went into the efi shell and loaded the v3x2.efi file, copied it to the efi\boot folder.
unfortunately supermicro efi shell doesn't have bcfg, so not sure how to make the efi driver stick permanently.

Thanks for reply! I am now looking for that file from that pile of meat.
I guess linux's efibootmgr could do the same thing. I believe that it also modifies UEFI files just like bcfg. Once I found that file I will give that a try.

[StyM]

good luck.

[Saren]

good luck.

I am back. efibootcfg didn't seem to work, getting into UEFI shell, loaded that v3x2.efi then exit to bootloader->OS neither.
I guess it's my OS's problem.
What OS you are using? Are there extra steps needed in OS? Thanks.

[StyM]

i'm using windows 10 in UEFI mode.

[Saren]

i'm using windows 10 in UEFI mode.

Hi, what motherboard and bios version you are using?
I still can't get it to work even I booted windows...

Here's my steps:
1. Reset BIOS setup to optimized settings, corrected boot entry
2. Somehow put the v3x2.efi into \EFI\{?}\v3x2.efi
3. > load \EFI\{?}\v3x2.efi
4. > exit
5. Boot Windows Boot Manager and get into windows
6. Use CPU-Z to view stress CPU and to view CPU frequencies, not working

[StyM]

after installing v3x2.efi i removed the intel.dll and install the vmware dll .
i'm using supermicro x10dal-i , with r2.0b bios.

[Saren]

after installing v3x2.efi i removed the intel.dll and install the vmware dll .
i'm using supermicro x10dal-i , with r2.0b bios.

Thanks!
Perhaps I should update my bios first, then manipulate the intel-ucode image, changing that into the exploit.

[StyM]

oh after loading the modified bios, you must disable C-state to prevent windows from locking.

[Saren]

oh after loading the modified bios, you must disable C-state to prevent windows from locking.

Hi, did you striped the microcode out of bios and flashed it?

[Saren]

Hi, I am happy to report that it was very successful!
The reason I am stuck is because I believed that I don't need to strip microcode out of bios and flash it, and later I proved it wrong.

So basically what I did:
1. striped microcode out of bios
2. flashed it
3. load v3x2_mc39.efi using UEFI shell before each boot
4. remove OS microcode update, in my case (archlinux), removed intel-ucode and regenerated grub config

Here is X10DAL-I 2.0b modded BIOS. Use at own risk!

http://drop.wtako.net/file/d1bb0c82f...a54e1aafc5.zip
sha1sum
d1bb0c82f7ebe84521179d08b91075a54e1aafc5 X10DAL6.zip

[Ace123]

It is clear to me, I'll also be making a video in the near future.

[Ace123]

Very good work saren. Feel free to share some screen shots and benchmarks

[StyM]

nice one, both are running 3.0ghz ?
any idea how to add the efi driver permanently ? sucks to keep on loading them everytime i reboot...

[Saren]

Hi there, I am currently still experimenting despite 4am now and 10:30am to school. I just can't withstand the hype I got.

I am trying to get the efi auto load on boot. After that I will do a geekbench4 against my unexploited config.

____

The modded old efi never worked for me, only the modded efi from 0x39 worked. The efibootmgr way added a uefi driver section (driver option priorities) in bios setup, but autoload still not working.

[Saren]

Geekbench 4 comparison: https://browser.geekbench.com/v4/cpu...seline=2074945
I started to regret not buying 2686 v3 at first although I have never considered buying that. However, I am lucky that I sold my pair of 2675 v3 and bought a pair of 2683 v3.

For CB15, it was done inside windows 10. I was getting 3120 average. After the patch, I got 3530 average.

[VietOZ]

So from what I understand after reading is

1. Download a latest bios of your board
2. Use tool to remove microcode from the bios just downloaded.
(what/which tool? I don't know .. need help on this)
3. Flash the modded bios
4. Create a usb f:\EFI\BOOT\BOOTx64.EFI
5. Copy v3x2_mc39.efi to f:\
6. Use boot manager to load Shell (the usb with bootx64.EFI)
7. Load v3x2_mc39.efi
8. Exit => load to OS to see if it works
9. If we're happy with the result .. then I guess restart the machine and back to shell
10. Copy v3x2_mc39.efi to OS system boot folder
Command: cp fs0:\v3x2_mc39.efi fs1:\EFI\Boot (this is for windows .. linux probablly different?)
11. Add v3x2_mc39.efi to the OS for auto load
Command: bcfg driver add 0 fs1:\EFI\Boot\v3x2_mc39.efi "V3 Full Turbo"
12. Type reset to restart the PC
13. Remove driver from Bios
List the drivers to get its sequence number : bcfg driver dump
Remove with command: bcfg driver rm 0 (change 0 to according number you get with list)


Please let me know if I'm missing anything. I'd like to give it a try sometime this week

[StyM]

this is what i did.
1. download the latest bios
2. extract the zip file posted by Ace
3. extract the latest bios
4. copy the "X10DAL6_910\UEFI\X10DAL6.910" bios file to the "UBU\UEFI BIOS Updater" folder
5. right click on the UBU.bat , run as administrator
* you should see the command window display your motherboard and bios file correctly.
6. follow the instructions on how to remove the microcode and save the modded bios
7. copy the contents of X10DAL6_910\UEFI to a FAT32 usb drive.
8. rename the original unmodified bios to different name.
9. copy the modded bios to the FAT32 usb drive.
10. rename the modified bios to the original bios name.
11. goto your bios, execute uefi shell manager
12. press any key when prompted
13. from the message locate which drive your usb is mounted, mine is fs1
14. type "fs1:" from the command line
15. use supermicro flash utility, "flash X10DAL6.910" to flash the modded bios
16. after finish, restart with a power cycle.
17. goto to bios cpu info, your microcode should now show N/A
18. disable C-state, goto to your bios cpu power management
19. open up uefi shell manager again
20. type "fs0:" , fs0 is my boot drive
21. copy the "v3x2_mc39.efi" or "v3x2.efi" to fs0:\efi\boot\ , type the following command "copy fs1:\v3x2.efi fs0:\efi\boot\" or "copy fs1:\v3x2_mc39.efi fs0:\efi\boot\"
* this is to make a permanent copy of your efi driver, just in case you remove your usb.
* this is where we should add the efi driver to the boot sequence but supermicro shell doesn't have bcfg
22. goto to the "efi\boot" folder and type "load v3x2_mc39.efi" or "load v3x2.efi"
23. you should see a message indicating your cpu set to full turbo or 2.7ghz
24. exit back into the bios by typing "exit" , and load uefi: windows boot manager
25. after windows has started , goto windows\system32\ look for the file "mcupdate_GenuineIntel.dll" , rename this file or delete file
26. restart, and do step 19, 20, 22, 24
26. goto "00_OC ANANDTECH\05 MICROCODE\0x306F2_27-39" copy "0x39.dat" to "00_OC ANANDTECH\06 VMWARE MICROCODE UPDATER\cpumcupdate2.1"
27. rename "0x39.dat" to "microcode.dat"
28. right on "install.bat" run as administrator
29. your cpu should now be able to run at full speed.

[VietOZ]

Thank you Stym!

[zanzabar]

i'm not getting that message. Somehow i think its because of my bios. being a rampage v extreme bios, it may not be compatible with UBU. any idea how else i can remove the microcode?

you have launch the uefi shell (the elf file.)