Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller
On Tue, Jan 12, 2021 at 05:25:48PM +0100, reddunur@online.de wrote:
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
The two 2Mib NOR Flash chips you've identified so far do not have enough storage capacity to store modern platform firmware. All the other chips you identified are probably power supply related.
Did you looked under black isolation stripes?
There is one soic-8 at the top of this photo
https://pasteboard.co/JJjRjLU.jpg
next to superio U49. There can be more chips under expansion cards.
BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
Petr
Dne 12. 01. 21 v 17:25 reddunur@online.de napsal(a):
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Yes, I have removed all strips, ram and extension cards, so I have seen all SOIC8 chips on the board. But this is what I do not understand, I find no more then I showed in the pics. I will send some more/better pics, so you could see more details. I removed all strips and extensions, where any SOIC like chip is located, the other strips and extensions I put back before making the pictures.
Here are all images in high res, that I have made.
https://pasteboard.co/JJklNqI.jpg https://pasteboard.co/JJknICr.jpg https://pasteboard.co/JJkovSn.jpg https://pasteboard.co/JJkoX3I.jpg https://pasteboard.co/JJkpubK.jpg https://pasteboard.co/JJkpYwS.jpg https://pasteboard.co/JJkqp7Ai.jpg https://pasteboard.co/JJkqYgH.jpg https://pasteboard.co/JJkrSsC.png https://pasteboard.co/JJksajd.jpg
It puzzles me, that I could not even find out where the fw image is stored. This will probably mean that there will be no secure (extern) flashing process, if no core boot, not even disable ME, if I did not miss something..
I have seen that some coreboot tutorial ( I think for a thinkpad x220, but not shure ) mentioned that the 12 MB firmware of the system was physically joined by 2 chips (8+4MB) to a virtual flash chip.
Is it possible that
a) the 8MB flash is assembled by part of the 12 pieces of M B07 N03 EKH 1409 ? b) or it is stored in another non SOIC 8 format ? c) or even part of the intel cpu /chipset ?
Sorry for asking maybe not sensible questions, I have yet too few knowledge on these bios hardware concepts.
Am 12.01.21 um 17:45 schrieb Petr Cvek:
Did you looked under black isolation stripes?
There is one soic-8 at the top of this photo
This is one more "unmarked" of the smaller SOIC8 I labeled with "b" b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
next to superio U49. There can be more chips under expansion cards.
BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
Petr
Dne 12. 01. 21 v 17:25 reddunur@online.de napsal(a):
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
lol I've found it :-D it's not a chip, it's actually a socket
right of wifi https://pasteboard.co/JJknICr.jpg "BIOS ROM" on PCB
Petr
Dne 12. 01. 21 v 19:14 Peter Mueller napsal(a):
Yes, I have removed all strips, ram and extension cards, so I have seen all SOIC8 chips on the board. But this is what I do not understand, I find no more then I showed in the pics. I will send some more/better pics, so you could see more details. I removed all strips and extensions, where any SOIC like chip is located, the other strips and extensions I put back before making the pictures.
Here are all images in high res, that I have made.
https://pasteboard.co/JJklNqI.jpg https://pasteboard.co/JJknICr.jpg https://pasteboard.co/JJkovSn.jpg https://pasteboard.co/JJkoX3I.jpg https://pasteboard.co/JJkpubK.jpg https://pasteboard.co/JJkpYwS.jpg https://pasteboard.co/JJkqp7Ai.jpg https://pasteboard.co/JJkqYgH.jpg https://pasteboard.co/JJkrSsC.png https://pasteboard.co/JJksajd.jpg
It puzzles me, that I could not even find out where the fw image is stored. This will probably mean that there will be no secure (extern) flashing process, if no core boot, not even disable ME, if I did not miss something..
I have seen that some coreboot tutorial ( I think for a thinkpad x220, but not shure ) mentioned that the 12 MB firmware of the system was physically joined by 2 chips (8+4MB) to a virtual flash chip.
Is it possible that
a) the 8MB flash is assembled by part of the 12 pieces of M B07 N03 EKH 1409 ? b) or it is stored in another non SOIC 8 format ? c) or even part of the intel cpu /chipset ?
Sorry for asking maybe not sensible questions, I have yet too few knowledge on these bios hardware concepts.
Am 12.01.21 um 17:45 schrieb Petr Cvek:
Did you looked under black isolation stripes?
There is one soic-8 at the top of this photo
This is one more "unmarked" of the smaller SOIC8 I labeled with "b" b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
next to superio U49. There can be more chips under expansion cards.
BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
Petr
Dne 12. 01. 21 v 17:25 reddunur@online.de napsal(a):
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Great! thank you Petr for finding this "easter egg" :) I've looked so strongly on SOIC that I didn't even mention a socketed bios, especially if it would be hidden in a housing.. One have to open the grey plastic box to access the not even soldered 64Mbit Bios chip
https://pasteboard.co/JJl7Wts.png
Without your help I would have given up :))
Could you give me a hint, how this type of Rom could be handled ?
Am 12.01.21 um 20:03 schrieb Petr Cvek:
lol I've found it :-D it's not a chip, it's actually a socket
right of wifi https://pasteboard.co/JJknICr.jpg "BIOS ROM" on PCB
Petr
Dne 12. 01. 21 v 19:14 Peter Mueller napsal(a):
Yes, I have removed all strips, ram and extension cards, so I have seen all SOIC8 chips on the board. But this is what I do not understand, I find no more then I showed in the pics. I will send some more/better pics, so you could see more details. I removed all strips and extensions, where any SOIC like chip is located, the other strips and extensions I put back before making the pictures.
Here are all images in high res, that I have made.
https://pasteboard.co/JJklNqI.jpg https://pasteboard.co/JJknICr.jpg https://pasteboard.co/JJkovSn.jpg https://pasteboard.co/JJkoX3I.jpg https://pasteboard.co/JJkpubK.jpg https://pasteboard.co/JJkpYwS.jpg https://pasteboard.co/JJkqp7Ai.jpg https://pasteboard.co/JJkqYgH.jpg https://pasteboard.co/JJkrSsC.png https://pasteboard.co/JJksajd.jpg
It puzzles me, that I could not even find out where the fw image is stored. This will probably mean that there will be no secure (extern) flashing process, if no core boot, not even disable ME, if I did not miss something..
I have seen that some coreboot tutorial ( I think for a thinkpad x220, but not shure ) mentioned that the 12 MB firmware of the system was physically joined by 2 chips (8+4MB) to a virtual flash chip.
Is it possible that
a) the 8MB flash is assembled by part of the 12 pieces of M B07 N03 EKH 1409 ? b) or it is stored in another non SOIC 8 format ? c) or even part of the intel cpu /chipset ?
Sorry for asking maybe not sensible questions, I have yet too few knowledge on these bios hardware concepts.
Am 12.01.21 um 17:45 schrieb Petr Cvek:
Did you looked under black isolation stripes?
There is one soic-8 at the top of this photo
This is one more "unmarked" of the smaller SOIC8 I labeled with "b" b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
next to superio U49. There can be more chips under expansion cards.
BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
Petr
Dne 12. 01. 21 v 17:25 reddunur@online.de napsal(a):
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Dne 12. 01. 21 v 20:42 Peter Mueller napsal(a):
Great! thank you Petr for finding this "easter egg" :) I've looked so strongly on SOIC that I didn't even mention a socketed bios, especially if it would be hidden in a housing..
Yeah I didn't realised that first too. It was almost: "where the SOIC flash could be located, mosfet, mosfet, superio, socket, usb ... wait ..." :-)
One have to open the grey plastic box to access the not even soldered 64Mbit Bios chip
https://pasteboard.co/JJl7Wts.png
Without your help I would have given up :))
glad to help
Could you give me a hint, how this type of Rom could be handled ?
It should be supported by flashrom, so just get the supported SPI adapter.
Fingers crossed for making coreboot work.
Petr
Am 12.01.21 um 20:03 schrieb Petr Cvek:
lol I've found it :-D it's not a chip, it's actually a socket
right of wifi https://pasteboard.co/JJknICr.jpg "BIOS ROM" on PCB
Petr
Dne 12. 01. 21 v 19:14 Peter Mueller napsal(a):
Yes, I have removed all strips, ram and extension cards, so I have seen all SOIC8 chips on the board. But this is what I do not understand, I find no more then I showed in the pics. I will send some more/better pics, so you could see more details. I removed all strips and extensions, where any SOIC like chip is located, the other strips and extensions I put back before making the pictures.
Here are all images in high res, that I have made.
https://pasteboard.co/JJklNqI.jpg https://pasteboard.co/JJknICr.jpg https://pasteboard.co/JJkovSn.jpg https://pasteboard.co/JJkoX3I.jpg https://pasteboard.co/JJkpubK.jpg https://pasteboard.co/JJkpYwS.jpg https://pasteboard.co/JJkqp7Ai.jpg https://pasteboard.co/JJkqYgH.jpg https://pasteboard.co/JJkrSsC.png https://pasteboard.co/JJksajd.jpg
It puzzles me, that I could not even find out where the fw image is stored. This will probably mean that there will be no secure (extern) flashing process, if no core boot, not even disable ME, if I did not miss something..
I have seen that some coreboot tutorial ( I think for a thinkpad x220, but not shure ) mentioned that the 12 MB firmware of the system was physically joined by 2 chips (8+4MB) to a virtual flash chip.
Is it possible that
a) the 8MB flash is assembled by part of the 12 pieces of M B07 N03 EKH 1409 ? b) or it is stored in another non SOIC 8 format ? c) or even part of the intel cpu /chipset ?
Sorry for asking maybe not sensible questions, I have yet too few knowledge on these bios hardware concepts.
Am 12.01.21 um 17:45 schrieb Petr Cvek:
Did you looked under black isolation stripes?
There is one soic-8 at the top of this photo
This is one more "unmarked" of the smaller SOIC8 I labeled with "b" b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ )
next to superio U49. There can be more chips under expansion cards.
BTW you can eliminate chips which doesn't have the standard SPI pinout (for example you can try measure continuity test for GND pin of the SPI - this can be done safely on unpowered board, other can be Vcc, maybe clock).
Petr
Dne 12. 01. 21 v 17:25 reddunur@online.de napsal(a):
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Hi Peter,
On Tue, Jan 12, 2021 at 6:15 PM Peter Mueller reddunur@online.de wrote:
Ah, I see it: it's on the top right quadrant next to the USB connector. That gray thing is a socket, and should contain the flash chip we're looking for. Lucky you! With the flash chip in a socket, you can simply put it in one of these sockets to program it: https://i.imgur.com/QPOSDAM.jpg
Best regards,
Angel
Thank you all for your interest and your kind support! Maybe I will someday achieve to run coreboot on an zotac ci 640 zbox, I am a small step further now :)
Am 12.01.21 um 20:41 schrieb Angel Pons:
Hi Peter,
On Tue, Jan 12, 2021 at 6:15 PM Peter Mueller reddunur@online.de wrote:
Ah, I see it: it's on the top right quadrant next to the USB connector. That gray thing is a socket, and should contain the flash chip we're looking for. Lucky you! With the flash chip in a socket, you can simply put it in one of these sockets to program it: https://i.imgur.com/QPOSDAM.jpg
Best regards,
Angel _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Hi Peter,
On Tue, Jan 12, 2021 at 4:26 PM reddunur@online.de wrote:
Hello coreboot community,
as an open source fan I recently get to know coreboot and really like the idea behind. Sadly I bought my computer HW before learning more on libre friendly hardware that respects your freedom. Now I try to figure out if I could do one or both of a) installing coreboot , b) remove /disable ME from my zotac mini PC, or I had to look out for already supported HW to do so.
I use a zotac CI 640 nano fanless mini PC with kaby lake Intel Core i5-8250U and intel UHD grafics. https://www.zotac.com/product/mini_pcs/ci640-nano#spec
You may be able to port it, though you will need to use Intel FSP. I'm afraid no one wrote a coreboot porting guide for FSP platforms yet. If you ask me, I'd rather write a FSP replacement, but ENOTIME.
In the process of cleaning FW I got stuck while figuring out, what is the relevant flash IC storing the bios. Form running linux I could read an 8MB flashrom with flashrom tool and internal programmer.
While reading, flashrom reported chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem." and gave the warning "SPI configuration lockdown activated". The programmer flashchip was reported as "Opaque flash chip" 8192kB. At least ME Cleaner worked with not errors on the captured fw image.
Problem: I want to flash the modified image back to the IC using a raspberry 4b with gpio spi setup using a SOIC8 clip. But I could not manage to find the correct IC on the mainboard. I kept looking for SOIC8 200mil with some "25" signature and found only a GD25Q20C(2M-bit)Serial flash chip, that I could successfully read with raspberry spi setup. However, it contains only 256k data. strings showed me lots of HDMI related stuff.
This chip contains the LSPCON (Parade PS175) firmware. I know because I've got a different board here with the same setup. It is a SPI flash chip, but it's not the one you are looking for.
I have created a list of chips I found while disassembling and some pics. I hope that someone more experienced could explain me how the 8MB fw is stored on this zotac and if it is "safely" possible to rewrite it. I it is to difficult or dangerous, as beginner I will stick with new hardware from already supported hw list.
The "promising" IC chips I found were a - 1 piece of "G labeled" AH1815 25Q2 1BT EE455, I think it is related to the GigaDevice GD25Q20C(2M-bit)I found on web. this chip I managed to read out.. b - 12 pieces of SOIC8 150mil (or samller?) : M B07 N03 EKH 1409 (Macronix? could not find anything:/ ) c - 1 piece of Issi IS25LQ020: 256K x 8 (2 Mbit) (maybe related to USB-C extension module) d - 1 piece of RT9059 GSP6E TOC, which I think could be a RichTek ultra low power voltage regulator? e - 4 pieces of "P labeled" 6982 GA9C1E ICs, I do not know what they are, maybe some MOSFET? f - 1 piece of "P labeled" 4435 GL9B2E SOIC8 200mil which I know nothing about
None of these is large enough. You are looking for a SOIC8 200mil chip: https://doc.coreboot.org/_images/librem_mini_flash.jpg
Pics of the mainboard front and back are here: https://pasteboard.co/JJjQqQO.jpg https://pasteboard.co/JJjRjLU.jpg https://pasteboard.co/JJjRCDt.jpg
I can't see any flash chip on the pictures you sent. Could you please take one picture of each side of the mainboard without any obstructions (RAM sticks, add-in cards, tape...) on it?
Any suggestion how to go on or stop it anyway would be appreciated.
kind regards,
Peter Mueller _______________________________________________ coreboot mailing list -- coreboot@coreboot.org To unsubscribe send an email to coreboot-leave@coreboot.org
Best regards,
Angel
-
Angel Pons -
Jonathan A. Kollasch -
Peter Mueller -
Petr Cvek -
reddunur＠online.de