Hello,
First of all, I'm quite amazed at how the community has grown over the past year or-so. I'm surprised that I wasn't the only one to find this amazing motherboard!
Second, I have been asked by quite a few people to post an update to the original post on my website made over a year ago over at http://obnauticus.com/2014/09/fixing-my-z800/ (http://obnauticus.com/2014/09/fixing-my-z800/).
I finally have gotten around to trying the experiment that I discussed and I have some exciting results to share! The following is a list of my work. Hopefully this will answer some questions.
Question:
Is changing the BootBlock possible on a Z800 motherboard and will changing the bootblock make my motherboard support the Westmere μArchitecture?
Process:
Swap the SPI Flash Chip (board designator U19) on a z800 Motherboard with one which has a bootblock verified to work with the Westmere μArchitecture.
Results:
Motherboard A is a -003 revision motherboard which supports the westmere microarchitecture. Motherboard B is a -002 revision motherboard which was unable to boot using my westmere processors (i.e., black screen, fans spinning, no beeps).
I desoldered the SPI Flash chip from motherboard A and soldred it motherboard B. Next, I tried booting with westmere processors and found that the system was stable and booting successfully. I looked in the bios and confirmed that the bootblock date had changed and the new processors were being detected successfully!
This is great news! This means that I can start distributing the SPI Flash chips with the bootblocks to help people modify their motherboards to support the new microarchitecture.
I am wondering how many people here would be willing to test this? I'm willing to buy a hand full of chips and burn my new bootblock image to them so people can test them. This would require some soldering skills since I cannot do that for you :P. I am able to post videos of how to do it, it's pretty straight forward if you have the right equipment.
Obnauticus.
This is excellent news. I didn't have the guts to take a soldering iron to my only working 003 board. While you had the IC out did you hook it up to an MCU to read out the content?
I'll do a dump sometime later this week or next week and diff it against your -003 dump.
I wonder if there are any differences between a flashrom dump and a dump read by an MCU over SPI.
Do you have any ideas as to which sectors the bootblock is stored on this flash device? I think it might be bad to assume that the locked sectors are exclusively for bootblock information. I am guessing that if I hook a logic analyzer up to it, it should be one of the first things read; however, there may be a standard offset that BIOS will typically read from ref: https://en.wikipedia.org/wiki/Boot_sector (https://en.wikipedia.org/wiki/Boot_sector).
Also, I'm on IRC -- so if you or anyone else wants to stop by and say hi/ask any questions you can stop by my channel:
server: irc.freenode.net 6667 / 6697 (TLS/SSL)
channel: ##embedded
Did you make any progress on this? I'm up for making the mod to my old v2 board.
Really great news.
I also interested in progress on this.
I found this page. The guy modified a lenovo laptop with a "bus pirate" it had white listed wifi cards, part of the bios was write protected too.
http://www.danand.de/index.php/electronics/bios-e130-write-protected/
Bus pirate here..
http://www.amazon.com/SparkFun-Bus-Pirate/dp/B004G2F6H0
Good Luck!
(I dont own a z800)
If anyone has a z800 v3 motherboard and spare time, please dump the SPI and post it here because 56xx xeons are so much better than 55xx ones but the premium on v3 motherboards is just not worth it :-X
In reference to a earlier post by Andy i believe i must be one of the lucky ones with 6 core processors. i bought a revision 001 board but luckily
for me the previous owner had updated the bios to V 3.54 and the Boot Block date was set to 11/10/09. I initially put two Xeon X5570's in to
test everything was working ok. I now have 2 x Xeon X5660's running with no problems at all. just thought i would share this with you all.
Quote from: john wright on January 29, 2016, 04:39:39 am
In reference to a earlier post by Andy i believe i must be one of the lucky ones with 6 core processors. i bought a revision 001 board but luckily
for me the previous owner had updated the bios to V 3.54 and the Boot Block date was set to 11/10/09. I initially put two Xeon X5570's in to
test everything was working ok. I now have 2 x Xeon X5660's running with no problems at all. just thought i would share this with you all.
An 001 board with a new bootblock has not been heard of before. You are very lucky to have one. Next time you have the case open would you mind having a close look at the BIOS IC to see if there are any signs of rework? It would be interesting to know if it's been physically upgraded.
I have a question along the lines of BIOS, I currently have my z800 MB running and the current version of the BIOS is 03.19 The latest version is 03.57, is there any reason not to upgrade? Current setup is two Xeon X5680 3.33 gig hex core processors and 48 gig of DDR3 1333 ECC memory.
Quote from: mbppg on March 02, 2016, 06:50:28 am
I have a question along the lines of BIOS, I currently have my z800 MB running and the current version of the BIOS is 03.19 The latest version is 03.57, is there any reason not to upgrade? Current setup is two Xeon X5680 3.33 gig hex core processors and 48 gig of DDR3 1333 ECC memory.
i'm running almost the same config of X5675's and 48GB, newest bios with issues whatsoever.
I also have a V3 MoBo, so if you guys need a flash dump, just let me know how to do it, i'll do my best to help.
Hi all, new to the forum. Picked up a Z800 from a surplus auction at work. Motherboard is v 1.02 updated to latest however in my excitement to use the 2 CPU's I purchased 2 56XX Xeons. As a result I have intermittent boots. Works like a gem when it gets up though. How would I get my hands on a v1.03 flashed chip? I'm quite competent with soldering, just less so with programming chips.
Thanks
Hi all
I'm about to begin my Z800 build. It is somewhat "affordable" now. ( Technology in Brazil is EXPENSIVE ).
I've just ordered the board, but I'm not sure about the hardware revision.
After reading through your Z800 page and the forum, I'm wondering if a CH341 programmer would work to perform the BootBlock upgrade using a clip such as this:
(http://i.imgur.com/2IuEyJC.jpg?2)
I'm not sure if this will fit, but I guess the answer is yes.
I've already brought 2 dead motherboards back to life using this programmer and clip, programming using the clip, without taking the chip out, flash were both MX25L8005.
It is a bit tricky to get the clip perfectly in place, but it works.
My kit also included this socket:
(http://i.imgur.com/oUIgM1b.jpg?3)
http://www.ebay.com/itm/SOIC8-SOP8-to-DIP8-EZ-Programmer-Adapter-Socket-Converter-Module-150mil-/140938311821 (http://www.ebay.com/itm/SOIC8-SOP8-to-DIP8-EZ-Programmer-Adapter-Socket-Converter-Module-150mil-/140938311821)
so I think, hacking gadgets wise, I'm good to go 8)
I'm going to use it as a NAS/VM Server, simple nvidia card (VMware console only ) ( run FreeNAS into VMware, passthrough PCIex SAS2008 HBA ), so I think my current Corsair HX750 PSU might be enough ( I hope! ).
[ a few hours of research later, and the rest of this post is: ]
After reading the Z800 manual, and reading the SST25VF016B datasheet, I've come to conclusion that it is doable somehow.
Both the bios update and the bios.bin posted by Andy start at the same offset: 0x4000, but Andy's includes a few bytes mostly with hex 0x20 before the actual bios begins at hex offset 0x4079.
I guess I'll have to do some hacking :) ( I like it! )
I've been delaying to get/learn arduino, and now it might be the right timing :o
https://github.com/nullboundary/SST25VF/blob/master/SST25VF.cpp (https://github.com/nullboundary/SST25VF/blob/master/SST25VF.cpp) looks capable of disabling the wp areas.
I'll dig deeper later to find out how to do it.
Anyone kind enough to dump V1 and V2 board bioses? :-*
I've found a source for a BIOS v3.19 ( the same version as Andy's Dump )
http://avid.force.com/pkb/articles/en_US/Compatibility/Legacy-HP-Bios-Information (http://avid.force.com/pkb/articles/en_US/Compatibility/Legacy-HP-Bios-Information)
I'm cutting the files in 1/32 parts to check differences.
Andy's Dump and the original v3.19 bios don't differ at the last 64kb ( probable protected area ), the same results when comparing v3.57 and v3.60 .
When comparing the last 128k there's a lot of diff.
The chip is protected in powers of 2 : 1/32, 1/16, 1/8, 1/4 and 1/2 ( 2^5, 2^4, 2^3, 2^2, 2^1 )
A few more testing about the last 64k ( 1/32 ):
v3.07, v3.13, v3.15, v3.19, v3.20, v3.21 and andy's 3.19 dump are equal
About the last 128k ( 1/16 ):
v3.57 and v3.60 have a few diff:
000071E0 D9 0C
0000E02B 33 36
0000E079 33 36
0000FFF6 37 32
0000FFF8 31 32
0000FFF9 35 34
0000FFFC 33 36
0000FFFF 1B E4
The other diff combinations all differ a lot.
I repeat: I'd love to get my hands on V1 and V2 boards dumps to compare.
Andy, would you mind dumping your latest bios, please ? :)
I was unable to jump to any conclusion yet, not without other samples.
But, my *guess* is that the last 1/32th is the BootBlock that needs update.
This latest 32k block always have ths string "IFXTPMDRV-MA-BRSEG16 v0.96 Copyright 2006, Infineon Technologies" at offset 0x1F00E0
That's all ( I think ) I know the moment.
The *BIG* question is: are there any other hardware changes from V1->V2 and V2->V3 ? I don't think so, because making big changes in a not so "mass production" item would cost too much. I don't think HP sells as many units as a consumer grade motherboard from Asus, Gigabyte, etc.
I think this is enough research before I get my hands on the Motherboard!
I just can't help myself.... I'm anxious
I've just found out confirmation that the 64k final block of the chip is indeed the Bios Boot Block.
All Z series include a crisis recovery jumper, when closed, it forces this bootblock to run to recovery from bad bios flashes.
"HP Workstations include 64 KB of write-protected boot block ROM that provides a way to recover from a failed update of the system BIOS ROM, for instance in the event of a power loss. Fail-safe BootBlock Recovery Mode will detect that the BIOS is unusable and boot the workstation in a recovery mode and search the root folder of any FAT/FAT32 file system on any USB media source (hard drive, flash drive, etc.) for a compatible binary image. The binary (.bin) file in the DOS Flash folder should be copied to the root of the desired storage device, and the system powered on. Once the binary image is located, the BIOS recovery process will be attempted. The automatic recovery will continue until the BIOS is successfully updated or restored."
Source: https://h30434.www3.hp.com/t5/Desktop-Boot-and-Lockup/Z820-Bricked-Bios-after-Firmware-update/td-p/5718307 (https://h30434.www3.hp.com/t5/Desktop-Boot-and-Lockup/Z820-Bricked-Bios-after-Firmware-update/td-p/5718307)
Long story short:
Aren't we all "jumping the gun" ?
I mean, isn't the boot issues related to PSU ( excessive draw ), thus leading some users having success using Westmere ( those without power graphics etc ) ?
Any story about people with V1/V2, and the whole workstation with 850W or 1100W PSU? I read somewhere an absolute requirement for the 1.110W PSU when using 130W TDP CPUs ( eg: x5690 ).
There's no need to use Andy's dumped flash to get the new bootblock. All we need is the v3.60 and find a way to disable write protect. The updated bootblock is included in every release, it's simply not written because it is write protected.
My bet is that using my ch341 programmer kit I've mentioned will be enough :)
Having a good server to learn stuff is a difficult task when you're in Brazil, good hardware is EXTREMELY EXPENSIVE for an independent consultant to have at home office.
The board I mentioned had some bent cpu pins in it, thus making it a bargain, so I'm taking the risk and I'll try to get the bent pins fixed.
I've already done this before when I once messed up 2 pins in a customer's PowerEdge.
Looking again at the absent SPI flash header.... there's a 2 pin header ( a jumper probably ) right beside the SPI header markings.... maybe that's the Write Unprotect jumper!?
I hope this is my last post before I get my hands on the board!
According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 (http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7) , there's hope:
"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."
here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487 (https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487)
and here
http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0112039 (http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0112039)
Here's a picture of the "crisis recovery jumper"
(http://i.imgur.com/gCqpW02.jpg)
Fingers crossed!
Anyone willing to give it a try?
Quote from: msilveira on April 14, 2017, 10:35:51 pm
I hope this is my last post before I get my hands on the board!
According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 (http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7) , there's hope:
"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."
here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487 (https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487)
I am the author of the post you quoted. Bear in mind that that discussion was pertaining to the Zx20. I have very little knowledge of the Zx00 platform, however do recall that the board itself underwent some revision during its lifetime (4 RAM slots and then 6 RAM slots) + supposedly some chipset changes so I can not comment whether just the changing the boot block will suffice in terms or running the newer processors.
As for the Zx20 and perhpas also the Zx00 there is a method of unlocking the descriptor - you need to connect / short pins 1 and 5 on the sound chip with a 1k ohm resistor during POST. THe board will be in debug mode until reset allowing you to fully dump your bios and to write to the descriptor and with the various jumpers (boot block, me) in place to the rest of the bios. Just bear in mind that it is VERY EASY to end up with a brick if this does not go according to plan. There may also be other security features / locks in place on the actual bios chip which despite the appearance that you are able to write to the bios from the chipset side will result in an error halfway through your write and render the board inoperable. ALso, since you will be able to write to the entire bios, it may be the case that a failed write will corrupt your boot block to the extent that you will be unable to recover using the boot block recovery feature. You have been warned.
Check my response to the Z420 bios thread on this forum, I outlined the steps needed to safely update the bios boot block in that thread - basically installing a socket and programming a new bios chip with an external programmer. An external programmer with a chip clip is perhaps also an option, however these can be hit and miss hence I would not recommend using one without being mentally prepared that it may be necessary to desolder the original bios if things do not go according to plan.
PS. re the picture you inserted - crisis recovery jumper is for restoring the bios using boot block recovery. It will not grant you write access to the boot block area (FF0000-FFFFFF on the Zx20). On the Zx20 boards there is a separate jumper for that.
Quote from: mtothaj on April 26, 2017, 07:23:40 am
Quote from: msilveira on April 14, 2017, 10:35:51 pm
I hope this is my last post before I get my hands on the board!
According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 (http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7) , there's hope:
"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."
here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487 (https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487)
I am the author of the post you quoted. Bear in mind that that discussion was pertaining to the Zx20. I have very little knowledge of the Zx00 platform, however do recall that the board itself underwent some revision during its lifetime (4 RAM slots and then 6 RAM slots) + supposedly some chipset changes so I can not comment whether just the changing the boot block will suffice in terms or running the newer processors.
As for the Zx20 and perhpas also the Zx00 there is a method of unlocking the descriptor - you need to connect / short pins 1 and 5 on the sound chip with a 1k ohm resistor during POST. THe board will be in debug mode until reset allowing you to fully dump your bios and to write to the descriptor and with the various jumpers (boot block, me) in place to the rest of the bios. Just bear in mind that it is VERY EASY to end up with a brick if this does not go according to plan. There may also be other security features / locks in place on the actual bios chip which despite the appearance that you are able to write to the bios from the chipset side will result in an error halfway through your write and render the board inoperable. ALso, since you will be able to write to the entire bios, it may be the case that a failed write will corrupt your boot block to the extent that you will be unable to recover using the boot block recovery feature. You have been warned.
Check my response to the Z420 bios thread on this forum, I outlined the steps needed to safely update the bios boot block in that thread - basically installing a socket and programming a new bios chip with an external programmer. An external programmer with a chip clip is perhaps also an option, however these can be hit and miss hence I would not recommend using one without being mentally prepared that it may be necessary to desolder the original bios if things do not go according to plan.
PS. re the picture you inserted - crisis recovery jumper is for restoring the bios using boot block recovery. It will not grant you write access to the boot block area (FF0000-FFFFFF on the Zx20). On the Zx20 boards there is a separate jumper for that.
Hi mtohaj!
I spent some more time thinking about this and I think you're right.
About board revisions, of course it will impact in the chances of success of the bootblock upgrade.
I read somewhere ( not sure if in the topic I mentioned ) about "creating" a bios file, using the last 64k from a new bios release ( that's the boot block ) on top of a dump of the board bios dump.
I think it's the way to go on the "What file should I burn to the bios chip?" matter. Using dd in Linux or BSD is easy to do it ( seek / skip ).
Nice to know about the jumpers and project differences between zx00 an zx20 platforms ( those pretty black boxes ).
Well, I know my stuff and I know my odds. Don't mind me, I'm an old geek and I like getting my hands dirty.
eg: I've never looked into flash memory WP feature, this journey led me to learn about it :D
I have to wait about two more weeks before I get my hands on some CPUs and memory modules ( I'll borrow the cheapest ones from a customer's future leftovers ). As sonn as I get these, I'll check if the board is OK before I mess with it. And then I'll decide about the PSU.
I remember the times when we used to build our 486 system, It worked like a charm on the bench, state of the art VLB IDE controller, S3 video card... then you get it back to your desktop and bang: it didn't boot or just kept beeping.
Wasn't it like that? ;D
Again, thanks for the info !
Quote from: msilveira on April 28, 2017, 08:02:33 pm
Hi mtohaj!
I spent some more time thinking about this and I think you're right.
About board revisions, of course it will impact in the chances of success of the bootblock upgrade.
I read somewhere ( not sure if in the topic I mentioned ) about "creating" a bios file, using the last 64k from a new bios release ( that's the boot block ) on top of a dump of the board bios dump.
I think it's the way to go on the "What file should I burn to the bios chip?" matter. Using dd in Linux or BSD is easy to do it ( seek / skip ).
Nice to know about the jumpers and project differences between zx00 an zx20 platforms ( those pretty black boxes ).
Well, I know my stuff and I know my odds. Don't mind me, I'm an old geek and I like getting my hands dirty.
eg: I've never looked into flash memory WP feature, this journey led me to learn about it :D
I have to wait about two more weeks before I get my hands on some CPUs and memory modules ( I'll borrow the cheapest ones from a customer's future leftovers ). As sonn as I get these, I'll check if the board is OK before I mess with it. And then I'll decide about the PSU.
I remember the times when we used to build our 486 system, It worked like a charm on the bench, state of the art VLB IDE controller, S3 video card... then you get it back to your desktop and bang: it didn't boot or just kept beeping.
Wasn't it like that? ;D
Again, thanks for the info !
For the Z420 / 620, the easiest approach is to simply download the latest bios from HP website (v.3.91 as of now), open it in hex editor and in line offset 00001000 put in your mac address (00 - 05). This will give you latest bios, ME firmware and bootblock, and the bios will have your MAC address hardcoded. Then just flash that to the bios chip.
If one wants an additional refinement you can also add the NVMe support module NvmExpressDxE_2 by following this guide: http://www.win-raid.com/t871f16-Guide-How-to-get-full-NVMe-support-for-all-Systems-with-an-AMI-UEFI-BIOS.html
Or to make things easy just use this bios file (already includes the NVMe module) and edit the MAC address before flashing: https://uploadfiles.io/y0zyf
For the Z800 things are somewhat more complicated since it is not a UEFI bios so you cannot use e.g. UEFI Tool. However, I would do as follows:
- dump your original bios from the chip, using your chip clip and programmer
- using a hex editor find the location / hex address of your MAC address in the file you dumped
- then follow the above procedure - download the latest bios from HP, add your MAC address in the location you found above and flash it to the chip. This is IMHO the easiest way to get a consistent / coherent latest bios.
You probably already know this, but when flashing with the chip clip disconnect all power from the board - mother board and CPU connectors and remove the CMOS battery. If you are still having problems it sometimes helps by disconnecting the power / VCC pin from the bios chip, so the programmer is not trying to power the whole board.
Hello.
I'm stuck with programming new SPI with Andy's flash bios.bin from 003 board.
Can You guide me through this.
I placed the chip on CH341, programmm detects it. Then I open Andy's bios, erase the chip, and then I press program/write.
But after 10-15 seconds I get error write timeout.
What could be the problem?
Regards
Gorazd