• Welcome to Andy's Workshop Forums. Please login or sign up.
 

Modifying a Z800 MotherBoard to support the Westmere μArchitecture.

Started by obnauticus, December 04, 2015, 05:40:34 am

Previous topic - Next topic

msilveira

I hope this is my last post before I get my hands on the board!

According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 , there's hope:

"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."

here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487

and here
http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0112039

Here's a picture of the "crisis recovery jumper"


Fingers crossed!

Anyone willing to give it a try?

mtothaj

Quote from: msilveira on April 14, 2017, 10:35:51 pm
I hope this is my last post before I get my hands on the board!

According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 , there's hope:

"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."

here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487


I am the author of the post you quoted. Bear in mind that that discussion was pertaining to the Zx20. I have very little knowledge of the Zx00 platform, however do recall that the board itself underwent some revision during its lifetime (4 RAM slots and then 6 RAM slots) + supposedly some chipset changes so I can not comment whether just the changing the boot block will suffice in terms or running the newer processors.

As for the Zx20 and perhpas also the Zx00 there is a method of unlocking the descriptor - you need to connect / short pins 1 and 5 on the sound chip with a 1k ohm resistor during POST. THe board will be in debug mode until reset allowing you to fully dump your bios and to write to the descriptor and with the various jumpers (boot block, me) in place to the rest of the bios. Just bear in mind that it is VERY EASY to end up with a brick if this does not go according to plan. There may also be other security features / locks in place on the actual bios chip which despite the appearance that you are able to write to the bios from the chipset side will result in an error halfway through your write and render the board inoperable. ALso, since you will be able to write to the entire bios, it may be the case that a failed write will corrupt your boot block to the extent that you will be unable to recover using the boot block recovery feature. You have been warned.

Check my response to the Z420 bios thread on this forum, I outlined the steps needed to safely update the bios boot block in that thread - basically installing a socket and programming a new bios chip with an external programmer. An external programmer with a chip clip is perhaps also an option, however these can be hit and miss hence I would not recommend using one without being mentally prepared that it may be necessary to desolder the original bios if things do not go according to plan.

PS. re the picture you inserted - crisis recovery jumper is for restoring the bios using boot block recovery. It will not grant you write access to the boot block area (FF0000-FFFFFF on the Zx20). On the Zx20 boards there is a separate jumper for that.

msilveira

Quote from: mtothaj on April 26, 2017, 07:23:40 am
Quote from: msilveira on April 14, 2017, 10:35:51 pm
I hope this is my last post before I get my hands on the board!

According to this thread: http://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/z820-e5-2600-v2-ivy-bridge-upgrade/td-p/5086052/page/7 , there's hope:

"I was pretty excited when I was able to dump the Descriptor section from my bios using FPT to a file desc.bin (fpt.exe -desc -d desc.bios). The result is a 4kb file. Then, using Intel Flash Image Tool (FITC) I edited Decriptor Region \ Master Access Section to remove the read / write locks. A problem however arouse on the last hurdle - flashing back the modified descriptor to the bios (fpt -desc -f desc.bin) as FPT reports that 'host CPU does not have write access to the target flash region'. It suggests modifing the descriptor settings (clearly just tried that with no success) to give host access to this region."

here
https://h30434.www3.hp.com/t5/Business-PCs-Workstations-and-Point-of-Sale-Systems/Z440-640-840-is-there-a-boot-block-issue-like-in-the-Zx20/td-p/5895487


I am the author of the post you quoted. Bear in mind that that discussion was pertaining to the Zx20. I have very little knowledge of the Zx00 platform, however do recall that the board itself underwent some revision during its lifetime (4 RAM slots and then 6 RAM slots) + supposedly some chipset changes so I can not comment whether just the changing the boot block will suffice in terms or running the newer processors.

As for the Zx20 and perhpas also the Zx00 there is a method of unlocking the descriptor - you need to connect / short pins 1 and 5 on the sound chip with a 1k ohm resistor during POST. THe board will be in debug mode until reset allowing you to fully dump your bios and to write to the descriptor and with the various jumpers (boot block, me) in place to the rest of the bios. Just bear in mind that it is VERY EASY to end up with a brick if this does not go according to plan. There may also be other security features / locks in place on the actual bios chip which despite the appearance that you are able to write to the bios from the chipset side will result in an error halfway through your write and render the board inoperable. ALso, since you will be able to write to the entire bios, it may be the case that a failed write will corrupt your boot block to the extent that you will be unable to recover using the boot block recovery feature. You have been warned.

Check my response to the Z420 bios thread on this forum, I outlined the steps needed to safely update the bios boot block in that thread - basically installing a socket and programming a new bios chip with an external programmer. An external programmer with a chip clip is perhaps also an option, however these can be hit and miss hence I would not recommend using one without being mentally prepared that it may be necessary to desolder the original bios if things do not go according to plan.

PS. re the picture you inserted - crisis recovery jumper is for restoring the bios using boot block recovery. It will not grant you write access to the boot block area (FF0000-FFFFFF on the Zx20). On the Zx20 boards there is a separate jumper for that.


Hi mtohaj!

I spent some more time thinking about this and I think you're right.
About board revisions, of course it will impact in the chances of success of the bootblock upgrade.
I read somewhere ( not sure if in the topic I mentioned ) about "creating" a bios file, using the last 64k from a new bios release ( that's the boot block ) on top of a dump of the board bios dump.
I think it's the way to go on the "What file should I burn to the bios chip?"  matter. Using dd in Linux or BSD is easy to do it ( seek / skip ).

Nice to know about the jumpers and project differences between zx00 an zx20 platforms ( those pretty black boxes ).

Well, I know my stuff and I know my odds. Don't mind me, I'm an old geek and I like getting my hands dirty.
eg: I've never looked into flash memory WP feature, this journey led me to learn about it  :D

I have to wait about two more weeks before I get my hands on some CPUs and memory modules ( I'll borrow the cheapest ones from a customer's future leftovers ). As sonn as I get these, I'll check if the board is OK before I mess with it. And then I'll decide about the PSU.

I remember the times when we used to build our 486 system, It worked like a charm on the bench, state of the art VLB IDE controller, S3 video card... then you get it back to your desktop and bang: it didn't boot or just kept beeping.
Wasn't it like that?  ;D

Again, thanks for the info !

mtothaj

Quote from: msilveira on April 28, 2017, 08:02:33 pm
Hi mtohaj!
I spent some more time thinking about this and I think you're right.
About board revisions, of course it will impact in the chances of success of the bootblock upgrade.
I read somewhere ( not sure if in the topic I mentioned ) about "creating" a bios file, using the last 64k from a new bios release ( that's the boot block ) on top of a dump of the board bios dump.
I think it's the way to go on the "What file should I burn to the bios chip?"  matter. Using dd in Linux or BSD is easy to do it ( seek / skip ).

Nice to know about the jumpers and project differences between zx00 an zx20 platforms ( those pretty black boxes ).

Well, I know my stuff and I know my odds. Don't mind me, I'm an old geek and I like getting my hands dirty.
eg: I've never looked into flash memory WP feature, this journey led me to learn about it  :D

I have to wait about two more weeks before I get my hands on some CPUs and memory modules ( I'll borrow the cheapest ones from a customer's future leftovers ). As sonn as I get these, I'll check if the board is OK before I mess with it. And then I'll decide about the PSU.

I remember the times when we used to build our 486 system, It worked like a charm on the bench, state of the art VLB IDE controller, S3 video card... then you get it back to your desktop and bang: it didn't boot or just kept beeping.
Wasn't it like that?  ;D

Again, thanks for the info !


For the Z420 / 620, the easiest approach is to simply download the latest bios from HP website (v.3.91 as of now), open it in hex editor and in line offset 00001000 put in your mac address (00 - 05). This will give you latest bios, ME firmware and  bootblock, and the bios will have your MAC address hardcoded. Then just flash that to the bios chip.

If one wants an additional refinement you can also add the NVMe support module NvmExpressDxE_2 by following this guide: http://www.win-raid.com/t871f16-Guide-How-to-get-full-NVMe-support-for-all-Systems-with-an-AMI-UEFI-BIOS.html

Or to make things easy just use this bios file (already includes the NVMe module) and edit the MAC address before flashing: https://uploadfiles.io/y0zyf

For the Z800 things are somewhat more complicated since it is not a UEFI bios so you cannot use e.g. UEFI Tool. However, I would do as follows:
- dump your original bios from the chip, using your chip clip and programmer
- using a hex editor find the location / hex address of your MAC address in the file you dumped
- then follow the above procedure - download the latest bios from HP, add your MAC address in the location you found above and flash it to the chip. This is IMHO the easiest way to get a consistent / coherent latest bios.

You probably already know this, but when flashing with the chip clip disconnect all power from the board - mother board and CPU connectors and remove the CMOS battery. If you are still having problems it sometimes helps by disconnecting the power / VCC pin from the bios chip, so the programmer is not trying to power the whole board.

plattfuss1972

Hello.
I'm stuck with programming new SPI with Andy's flash bios.bin from 003 board.
Can You guide me through this.
I placed the chip on CH341, programmm detects it. Then I open Andy's bios, erase the chip, and then I press program/write.
But after 10-15 seconds I get error write timeout.
What could be the problem?

Regards
Gorazd
Plattfuss & Bigfoot co.