Motherboard Group Buy/Crowdfunded Modded BIOS for the Asrock A300m (Deskmini A300)

[Danlopez1222]

Another update:

It looks like there is an "activator chip" that is used to configure the feature set of any given fake "Chipset" (i.e. A300, X300, Pro 500). Using the information from this article- Run a current Ryzen without an AMD chipset? I was able to locate the chip on the A300 motherboard.

And here is a close-up of the chip

The markings on the chip wont help identify it. According to the author of the post above, only 4 pins are used of the 8, and it is connected to I2C channel 2 of the CPU (reference). I've bought a cheap logic analyzer off of amazon and I'll be able to find out what exactly this chip is telling the CPU. This would explain why the X300 bios won't allow for overclocking on the A300, even though the settings aren't hidden.

If I'm right, then there is another issue- I need to get my hands on an activator chip for the X300 series to see what the protocol is for enabling overclocking, then copying the protocol and finding a way to program a new IC to interface with the CPU. I think I can use some adafruit trinkets to get it figured out.

This might translate to allowing overclocking on embedded and mobile platforms if the FP5 socket uses the same protocol as the AM4 socket.

Of course none of this matters if I never get access to the X300 activator chip.

 

[Curiosity]

Get info, hopefully you're able to get ahold of an X300 chip to analyze. It could be a big boon to a ton of people!

 

[gustav]

only 4 pins are used of the 8

Highly suggest looking at: https://ww1.microchip.com/downloads/en/DeviceDoc/AT24C16C-data-sheet-20006051A.pdf
Regarding 4 PINS used out of 8 - they are similar, what do you think of the 8-Pad UDFN/FN package.
Vcc, GND, I2C_CLK, I2C_DATA? It should/could be a flash chip...

Edit x: About PIN 7 "WR":

Write-Protect (WP) The write-protect input, when connected to GND, allows normal write operations. When the WP pin is connected directly to VCC, all write operations to the protected memory are inhibited.

So, I guess, you should/could measaure atleast 2 times stables Vcc.

adafruit trinkets to get it figured out

Out of personal xp I would suggest not to use those. Those are "custom" ATTiny85 with an intergrated USB Bootloader. This bootloader will always be in your way.
Ok, if you have any spare, sure, try it out. Since there is ATtiny85 - it actually has a I2C built-in.

I still would suggest to go with ATmega168/ATmega328 (like Arduino Pro Mini) it has a proper serial interface and you can use Arduino's Serial.print() which is not possible on attiny85, since there is no HW-UART. It adds overhead, since you would have to implement it by yourself (could use the USI register) / use a software lib.

Actually had recently a project with an trinket. The software uart (lib I wanted to use for ATtiny85) and the usb bootloader had incompatability. The 328 would be easy to dev a bench station. I got rid of trinket (still here in front of me) and replaced it with a proper 3.3V attiny85...

Yea, this would be the second point to make out: Could you measure the Vcc of the IOC? The ATmega's are - as Trinkets - placed on PCB with fuse bits set and set expected VccThe Vcc they get, they will redistribute to their GPIOs, so. Take that into considerations before connecting to I2C.

I think you have enough knowledge to know that, but still I just wanted to share.

Hint for it being a flash: if the SMU IP is the same LattceMico32, then the I2C-chip could be connected to that (it has one I2C bus available). And once SMU has it's FW loaded (on start) it asks the board for config - via I2C.

Kindly,
gustav

 

[Danlopez1222]

Another update: I think I found out what the activator chip is. Because we know that it uses an I2C interface, I assumed it was an EEPROM. By comparing the image from the leaked activator chip datasheet here and page 20 of this datasheet, I think these two devices are of the same family:

This is a huge breakthrough on finding the functionality and interaction protocol of the activator chip. It may be possible that the activator chip is a custom variant of the AT34C02D design that is permanently write-protected. However, buying the standard chip is only $0.22 USD each. I should be able to reprogram the generic chip to have the same functionality as the activator chip.

 

[ermac318]

Another update: I think I found out what the activator chip is. Because we know that it uses an I2C interface, I assumed it was an EEPROM. By comparing the image from the leaked activator chip datasheet here and page 20 of this datasheet, I think these two devices are of the same family:

This is a huge breakthrough on finding the functionality and interaction protocol of the activator chip. It may be possible that the activator chip is a custom variant of the AT34C02D design that is permanently write-protected. However, buying the standard chip is only $0.22 USD each. I should be able to reprogram the generic chip to have the same functionality as the activator chip.

As a geek this is super cool stuff. But I'm wondering if the effort is worth it when the cost of replacing your A300 with an X300 is so low... I mean it's not 22 cents, but I'm not sure how many people are chomping at the bit to take a soldiering iron to their A300-ATX board...

 

[Danlopez1222]

As a geek this is super cool stuff. But I'm wondering if the effort is worth it when the cost of replacing your A300 with an X300 is so low... I mean it's not 22 cents, but I'm not sure how many people are chomping at the bit to take a soldiering iron to their A300-ATX board...

Very true. However, I don't know how available the x300 will be in here in the states, and this entire project has transformed more into reverse engineering and development from the quick and easy overclocking bios mod that it was supposed to be.

It's more for me to see if I can at this point. None of this is very practical as a DIY modification.

 

[Danlopez1222]

MAJOR UPDATE: Because I am waiting for the logic analyzer to arrive, I decided to focus back on the bios modification itself. I was able to successfully modify the setup menu and change the forms visible! I flashed my custom x300 bios and changed the default main form from this version (stock):

To this version (modified):

The menu at the bottom still houses the original Main tab.

I think that this is a much bigger development than the X300 activator chip, but still may not actually unlock overclocking. I can write a tutorial if anyone is interested on how to do the bios mods themselves.

I'm need to make sure this is safe before I release modified versions. Then I'll work on releasing versions that won't need a hardware programmer to flash.

 

[gustav]

Oh I'm proud to hear that! That seems like some good news. Maybe it would be possible to re-enable the SOC VID on 3.60S - thinking back then. As I see you have also leverage your access. Something AMIBCI "should " allow one to do, but I spent only one day on that subject. Glad to hear that! Did you also use the BCI-Tool? I still would like to kinda have the bugfixes from S and features of R

This was exactly my intention leading to thinking about this UI re-enablement.

At least I can recognize the BIOS Major und Minor strings from BCI - they were also there.

I may kindly ask, would you not mind to apply the patch I was wanting to do myself? I think you are more into the subject... And I kinda have to have time for it to dig inside like 1 week+ or so. I really would appreciate it
Or even I would be the first one to request such a guide you are speaking about either way

Greetings.

 

[ramalhais]

MAJOR UPDATE: Because I am waiting for the logic analyzer to arrive, I decided to focus back on the bios modification itself. I was able to successfully modify the setup menu and change the forms visible! I flashed my custom x300 bios and changed the default main form from this version (stock):

To this version (modified):

The menu at the bottom still houses the original Main tab.

I think that this is a much bigger development than the X300 activator chip, but still may not actually unlock overclocking. I can write a tutorial if anyone is interested on how to do the bios mods themselves.

I'm need to make sure this is safe before I release modified versions. Then I'll work on releasing versions that won't need a hardware programmer to flash.

Can you enable the integrated graphics overclocking and set it over the max frequency of your APU (checking in windows)?
It should be under Advanced -> OC Tweaker -> Graphic Configuration

 

[Danlopez1222]

Can you enable the integrated graphics overclocking and set it over the max frequency of your APU (checking in windows)?
It should be under Advanced -> OC Tweaker -> Graphic Configuration

I can manually enter frequencies for the CPU and GPU, but they don't actually do anything. It looks like the chip ignores anything out of spec.

Also, my logic analyzer came in and works great. I was able to tap into my hardware SPI flasher's interaction while reading the bios:

I'm waiting for some more stuff from amazon this afternoon, then I can decode the interaction between the activator chip and the CPU.

 

[ramalhais]

I can manually enter frequencies for the CPU and GPU, but they don't actually do anything. It looks like the chip ignores anything out of spec.

Also, my logic analyzer came in and works great. I was able to tap into my hardware SPI flasher's interaction while reading the bios:

I'm waiting for some more stuff from amazon this afternoon, then I can decode the interaction between the activator chip and the CPU.

Can't wait for that enabler chip dump. Hopefully it's just an SPI EEPROM and we can unlock our A300
Maybe you can try to read it with the SPI Flasher

 

[gustav]

Most likely it should be possible if it's a bulk flash with an interface. I agree on that @ramalhais
Yesterday talked to a more advanced person in embedded hardware, in my uni, showin him igorslab and danlopez findings, also my thoughts on that IC.
This was also his point most likely to be a (maybe custom) simple flash.
I'm also very interested in Dan's further findings.

He (my colleague) offered me a 10Mhz logic analyzer in that regard. Me denied so far, as it's Dan's project. Maybe he wants to write up a paper on that idk.

Too sad I'm low on money to have a spare A300 to play around with and my probes may not be that small. I have to remove the cooler mount. To be able to access the chip. Dang

@Danlopez1222 Which Voltage-level could you measure on the WP pin (Pin No.7) and Vcc would be also interesting 3.3 or 5V? Just to take us with on your journey
In your post #430 you are issuing a read_cmd 03 and the address+length probably, so from where and how much to read. But why is the answer FF? Seems to be empty space

 

[duha21]

China, by the way, is full of Renoirs. Nobody took it yet?

165.17US $ 32% OFF|AMD Ryzen 5 PRO 4650G R5 PRO 4650G 3.7 GHz Six Core Twelve Thread 65W CPU Processor L3=8M 100 000000143 Socket AM4|CPUs| - AliExpress

Smarter Shopping, Better Living! Aliexpress.com

www.aliexpress.com

211.79US $ |NEW AMD Ryzen 7 PRO 4750G R7 PRO 4750G 3.6 GHz Eight Core Sixteen Thread 65W CPU Processor L3=8M 100 000000145 Socket AM4 no fan|CPUs| - AliExpress

Smarter Shopping, Better Living! Aliexpress.com

www.aliexpress.com

 

[Curiosity]

If I had the cash I'd order one for sure aha

 

[Danlopez1222]

So the activator chip runs at 3.3V.

I was able to wire the pins of interest to a spare header I had lying around. I recorded the startup interaction on I2C channel 2 5 times: 3 normal boots without overclocking enabled, 1 restart from bios with the CPU frequency increased in bios, and 1 restart from bios with the CPU and GPU frequencies increased in bios. It did not seem to change the interaction between the chip and the CPU.

One strange thing is that the CPU would read and write the same addresses on the activator chip on each start, but the data it is reading or writing would be different. Maybe someone can help me understand what I'm looking at, and I'm just misinterpreting the logic analyzer output?

Here are the Pulseview session files for the Analyzer

The next issue is that my hardware flasher won't read anything from the chips when set to 24xxx I2C EEPROM. It detects that an i2C chip exists there, but it just reads empty files. Is there a substantial difference between the 24xxx series of EEPROMS and the 34xxx series? I though the same i2C commands existed for both.

 

[steven0220]

So the activator chip runs at 3.3V.

I was able to wire the pins of interest to a spare header I had lying around. I recorded the startup interaction on I2C channel 2 5 times: 3 normal boots without overclocking enabled, 1 restart from bios with the CPU frequency increased in bios, and 1 restart from bios with the CPU and GPU frequencies increased in bios. It did not seem to change the interaction between the chip and the CPU.

One strange thing is that the CPU would read and write the same addresses on the activator chip on each start, but the data it is reading or writing would be different. Maybe someone can help me understand what I'm looking at, and I'm just misinterpreting the logic analyzer output?

Here are the Pulseview session files for the Analyzer

The next issue is that my hardware flasher won't read anything from the chips when set to 24xxx I2C EEPROM. It detects that an i2C chip exists there, but it just reads empty files. Is there a substantial difference between the 24xxx series of EEPROMS and the 34xxx series? I though the same i2C commands existed for both.

So the activator chip runs at 3.3V.

I was able to wire the pins of interest to a spare header I had lying around. I recorded the startup interaction on I2C channel 2 5 times: 3 normal boots without overclocking enabled, 1 restart from bios with the CPU frequency increased in bios, and 1 restart from bios with the CPU and GPU frequencies increased in bios. It did not seem to change the interaction between the chip and the CPU.

One strange thing is that the CPU would read and write the same addresses on the activator chip on each start, but the data it is reading or writing would be different. Maybe someone can help me understand what I'm looking at, and I'm just misinterpreting the logic analyzer output?

Here are the Pulseview session files for the Analyzer

The next issue is that my hardware flasher won't read anything from the chips when set to 24xxx I2C EEPROM. It detects that an i2C chip exists there, but it just reads empty files. Is there a substantial difference between the 24xxx series of EEPROMS and the 34xxx series? I though the same i2C commands existed for both.

The Knoll activator looks more like an ATECC series authentication chip. PSP authenticate the chip during boot time and the data (challenge response) varies each time.

 

[ramalhais]

Although i feel it's a waste of time trying to understand a security chip (because it's probably impossible), this is all i got:

Spoiler: knoll.txt

Format:
XXw YY XXr ZZ: wrote to chip address XX memory address YY, read value ZZ. Meaning it read memory YY=ZZ? The following lines without XXw are the same but different memory address and value read
XXw YY: command?

---
37w 00

# (1) This one is exactly the same values as below (3) but with chip address 50 instead of 51
50w 00 50r 23
FE 45
FF AD
7E CD
7F 34

# 7F is the last mem address above
37w 7F

# (2) This one is exactly the same values as below (4) but with chip address 50 instead of 51
50w 5E 50r 80
5F CE
40 04
41 CD

# 41 is the last mem address above
36w 41

# 41 is the last mem address above
36w 41

# (3) Same as above but chip address 51
51w 00 51r 23
FE 45
FF AD
7E CD
7F 34

# 7F is the last mem address above
37w 7F

# (4) Same as above (2) but chip address 51
51w 5E 51r 80
5F CE
40 04
41 CD

# 41 is the last mem address above
36w 41

# (5) Very similar to below except last address 82 (6)
50w 80 50r 0C (33 bytes with some addresses repeated at the end? 80, 81, 82)
81 4A
82 05
83 20
89 94
84 00
8C 05
91 5A
92 5A
93 5A
94 10
95 D7
96 31
97 F0
98 0A
99 20
9A 08
9B 00
9C 05
9D 00
9E C0
9F 14
A0 27
A9 E6
AA 00
AB 00
AC 00
AD 00
AE 00
AF 00
80 0C
81 4A
82 05

# (6) Very similar to above (5)
51w 80 51r 0C (32 bytes with some addresses repeated at the end? 80, 81. addresses seem sequential but have some missing 85-88, 84 and 8C out of order, 8A-90, A1-A8)
81 4A
82 05
83 20
89 94
84 00
8C 05
91 5A
92 5A
93 5A
94 10
95 D7
96 31
97 F0
98 0A
99 20
9A 08
9B 00
9C 05
9D 00
9E C0
9F 14
A0 27
A9 E6
AA 00
AB 00
AC 00
AD 00
AE 00
AF 00
80 0C
81 4A

52w 82 52r 05
53w 80 53r FF
80 FF
36w 00 00
50w 02 50r 0C
0C 01
51w 02 51r 0C
0C 01
52w 02 52r FF
53w 02 53r FF



64R 04
64W 02
64W 00



64w 03 07 02 82 40 00 09 A4 (8 bytes)


64R 23 55 55 7C A4 DF F5 5D 2C 1F 4B 7A EB B5 66 27 6A 33 CB 2D FB A8 4B 0D 52 CC D1 88 4D 33 A1 55 55 4C B4 (35 bytes. 3bytes for memory bank/address and 32bytes result?)
64W 03 07 02 00 00 00 1E 2D (8 bytes)

64R 07 01 23 63 5D FF 35 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF (35 bytes. 3bytes for memory bank/address and 32bytes result?)
64W 03 07 02 00 03 00 11 2D (8 bytes)

64R 07 B5 11 01 00 9A 43 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF (35 bytes. 3bytes for memory bank/address and 32bytes result?)
64W 03 27 08 00 00 00 66 40 45 EB 6A E0 35 32 50 21 19 EB AD E9 34 12 8D D8 CA 97 27 A2 B8 6D 67 6A B3 22 B4 88 88 D9 F7 9A (40 bytes)

64R 23 D1 9B 0E 2E 04 93 E7 36 36 D3 55 C9 B2 DF 4A C8 2F 00 9F 4A 88 8E 90 2E 1E 8C 7E 7E 99 1F 25 D9 9E 23 (35 bytes. 3bytes for memory bank/address and 32bytes result?)

So the activator chip runs at 3.3V.

I was able to wire the pins of interest to a spare header I had lying around. I recorded the startup interaction on I2C channel 2 5 times: 3 normal boots without overclocking enabled, 1 restart from bios with the CPU frequency increased in bios, and 1 restart from bios with the CPU and GPU frequencies increased in bios. It did not seem to change the interaction between the chip and the CPU.

One strange thing is that the CPU would read and write the same addresses on the activator chip on each start, but the data it is reading or writing would be different. Maybe someone can help me understand what I'm looking at, and I'm just misinterpreting the logic analyzer output?

Here are the Pulseview session files for the Analyzer

The next issue is that my hardware flasher won't read anything from the chips when set to 24xxx I2C EEPROM. It detects that an i2C chip exists there, but it just reads empty files. Is there a substantial difference between the 24xxx series of EEPROMS and the 34xxx series? I though the same i2C commands existed for both.

 

[ramalhais]

BTW, has anyone tried booting a non-APU CPU again, but using the BIOSes from JZ? or using the X300?

 

[steven0220]

BTW, has anyone tried booting a non-APU CPU again, but using the BIOSes from JZ? or using the X300?

My asrock x300 just arrived. Will try ryzen R5 3600 on it latter.

 

[duha21]

My asrock x300 just arrived. Will try ryzen R5 3600 on it latter.

Where did you buy it? Seen on sale in China on Taobao and JD