Thursday, January 2, 2014

Location of the ATI ATOMBIOS!

After having a chat with some guys developing the open source radeon driver on freenode, and with the reverse engineering of GPU-Z I found where the ATI ATOMBIOS is located.

Pretty simple actually, you take the BAR2(Base Address Register #2) and XOR it with 0x80000 afterwards you AND the result with 0xFFFE0000.

In practical terms

atombiosaddress = (BAR2 ^ 0x80000) & 0xFFFE0000.

Also, the VBIOS of the primary card can also be located at physical address 0xc0000 like radentool has specified.

EDIT: I did a binary comparison of my dump of my card vs the one from GPU-Z and mine seems to contain different data at certain locations. So not quite there yet.
Something interesting I discovered is that the location of the ATOMBIOS on the primary card is not always available at the address using the formula above, the address is valid, however the GPU-Z driver does something to make the card map the BIOS to that location, after it's done the address is valid, just doesn't contain anything. It works on non-primary cards though.


  1. Hello,
    Your work is interesting, I was just looking at how GPU-Z works
    because I want to modify what link speed the graphics card reports.
    If AMD Catalyst reads the value the same way, I might trick it to
    enable Crossfire on lower speed link.
    Do how does GPU-Z specificity reads the number of PCI-E lanes used, link speed and
    such? (like where it says: 16x 2.0 @ x1 2.0). I would like to modify by intercepting it
    so it would read (16x 2.0 @ 16x 2.0)

  2. Hi,

    Unfortunately, I do not know. But GPU-Z states that GPUs come with power saving features that reduce the link speed when the GPU is not stressed/idle.

    However if you want to enable Crossfire between a slot at x16 speed and a slot below x8 I don't recommend it. I've tried it with my 5850 and 5870, one was running in a slot at speed x16, the other at speed x4, horrible microstutter. I had to enable VSync to fix the microstutter, but then I had huge input lag, in the end I threw the idea of crossfire out.