Those of you who have followed me on my more informal social media accounts for a while probably know about my wacky BGA-to-LGA LGA1151 “QNVH” engineering sample. If you want more information on them, there’s an LTT video from a good few years ago where the seller/originator for these, a certain “Mr. Su”, sent Linus Media Group a hardware sample from the first batch of these, along with a pre-modified motherboard, in order to test them out on camera. They kinda nerd sniped me, and against my better judgement I got one in like, late 2021. For a period of a couple years, it was the CPU in my main PC, and it served admirably, compiling stuff and virtualizing very well and all of that jazz. For the spec nerds, it’s a hexa core processor with hyperthreading, base clock 2.0ghz, max boost 3.6ghz with an all-core turbo limit by default. So, not a powerhouse, but about on par with the kind of CPU you get in a gaming laptop. Internally, as far as I know, this doesn’t precisely correspond to any SKU that Intel ever sold in the 8th generation, but it’s basically a notch below an i7-8700T, and runs with the same “906ea” microcode, which generally seems to correspond to 8th generation, high end i5s and low end i7s. It seems to be intended to draw 35-45W TDP and has default power limits corresponding to this. Previously, I posted a small configuration change I made in order to change these power limits and allow for faster all-core clock speeds. There did seem to be some limits imposed by the CPU itself though.
The vendors that sell these CPUs are kind enough to provide BIOS modification as a service, and claim to be able to get their Coffee/Comet lake BGA to LGA CPUs running on many 100/200 series LGA1151 chipsets. Since I had built a Coffee Lake system with a B365 motherboard, I didn’t have a chance to test this out when I first got it. However, that B365 motherboard, a Gigabyte B365M Wifi seems to be.. unreliable, badly designed, something like that? It would often act very dead after abrupt power cuts, which are quite common in my area, and would then start POSTing and working fine again without any explanation. I had pretty much narrowed it down to the motherboard, and I had similar problems with the predecessor to this system, which had a non-Wi-fi B365M DS3H with an i3-9100F, so it seems like some sort of low-level motherboard issue that I wouldn’t be able to really solve. Eventually I got sick of it and built a B450/Ryzen 4600G system, now my main desktop. But letting that CPU goes to waste feels bad. As far as I know, it’s still perfectly functional, jank factor aside, and hey, maybe I could play with overclocking a bit to make it perform a bit better than a mobile CPU. So, again against my better judgement, I got a Z170 motherboard I had verified online that other people had put Coffee Lake CPUs into, and asked the vendor if they were willing to modify another BIOS for me, since I was too lazy to do it myself with the “CoffeeTime” utility, since there’s a lot I don’t understand going on there. In my case, I got an Asrock Z170 Extreme3. Basically, I got it as a test bench. This motherboard also has some other fun bits and bobs that may come into play in the future, but I’m getting off topic. It had a socketed BIOS chip, I have a few different ways of programming SPI flash chips, and worst-case scenario I do have decent Skylake CPUs to put in there.
Firstly, kind of a note on CH341 programmers and SPI flash chips that I kind of want to get out there, even though it’s largely tangential. libreboot has various comments on their website where they warn against using CH341 programmers. From everything that I can tell, looking at schematics, libreboot’s comments, and various forum posts that libreboot linked to, this is not due to the CH341 per se, but due to a hardware flaw in the ones built with the fancy ZIF DIP socket for programming SPI and I2C flash. They route 3.3v to the IC socket via a regulator in the proper places, but they unfortunately power the CH341 itself off of the 5V USB directly, which makes it output 5V logic. I have a general-purpose CH341 dongle, and I investigated it with a multimeter to see if it has this problem - it does not, if you are careful. The 3x2 jumper block directly controls the power that is going to the CH341’s VCC pin, switching it between USB power and an onboard 3.3V regulator, and according to the CH341 datasheet, the logic level is going to be (approximately) VCC. If you follow other recommendations, such as connecting the WP and HOLD pins to 3.3v via 1-10k resistors rather than directly jumping them to 3.3v, this seems to be completely fine to use for the purposes of programming 3.3v SPI flash, as this makes the circuitry roughly equivalent to the modifications that are recommended for these programmers to make them safely usable with 3.3v flash. You’ll still need to use some sort of logic level converter if it’s a 1.8V chip though, but that’s not relevant here. With all of this said, I would actually recommend one of these CH341 do-it-all dongles for various flashing / dumping operations over the purpose built programmers - they’re usually even cheaper.
So I got the motherboard and tested it out very quickly with an i3-6100 - this will be relevant, I promise. After that, I moved on pretty quickly to yanking the EFI firmware flash chip and re-flashing it with the CPU seller’s modified firmware.
Flashing itself is pretty easy, if you’re able to comprehend the circuitry or are using an SPI programmer that works with 3.3v. I referenced libreboot’s installation guides heavily here, as I didn’t really want to boot into Windows and use some sketchy utility. First, dumped and verified it against what was on the chip: sudo flashrom -p ch341_spi -r z170-extreme3-efifwbackup.bin; sudo flashrom -p ch341_spi -v z170-extreme3-efifwbackup.bin, then I flashed the modified firmware: sudo flashrom -p ch341_spi -r Asrock-Z170-Extreme3.bin; sudo flashrom -p ch341_spi -v ASRock-Z170-Extreme3.bin. Everything came back okay, so I swapped the flash chip back and tried to boot it with the Skylake CPU. Nothing. Uh oh. I did recall something that I had read when considering doing the BIOS mod on my own with the CoffeeTime utility, however - you need to find and insert the proper microcode for the CPU. What microcode did this modded BIOS have on it anyway? Long story short, I used MCExtractor because that’s what I found and that’s what worked.
Stock BIOS:
╔════════════════════════════════════════════╗
║ MC Extractor v1.101.0 r303 ║
╚════════════════════════════════════════════╝
asrock-z170extreme3-efifw.bin (1/1)
╔══════════════════════════════════════════════════════════════════════════════════════════════════╗
║ Intel ║
╟───┬───────────┬───────┬──────────────┬──────────┬────────────┬───────┬─────────┬──────────┬──────╢
║ # │ Type │ CPUID │ Platforms │ Revision │ Date │ State │ Size │ Offset │ Last ║
╟───┼───────────┼───────┼──────────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 1 │ Microcode │ 506E3 │ 36 (1,2,4,5) │ C2 │ 2017-11-16 │ PRD │ 0x18400 │ 0xE10280 │ No ║
╟───┼───────────┼───────┼──────────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 2 │ Microcode │ 906E9 │ 2A (1,3,5) │ 84 │ 2018-01-21 │ PRD │ 0x18000 │ 0xE28680 │ No ║
╚═══╧═══════════╧═══════╧══════════════╧══════════╧════════════╧═══════╧═════════╧══════════╧══════╝
Modified BIOS:
╔════════════════════════════════════════════╗
║ MC Extractor v1.101.0 r303 ║
╚════════════════════════════════════════════╝
ASRock_Z170_Extreme3.BIN (1/1)
╔═══════════════════════════════════════════════════════════════════════════════════════════════╗
║ Intel ║
╟───┬───────────┬───────┬───────────┬──────────┬────────────┬───────┬─────────┬──────────┬──────╢
║ # │ Type │ CPUID │ Platforms │ Revision │ Date │ State │ Size │ Offset │ Last ║
╟───┼───────────┼───────┼───────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 1 │ Microcode │ 906EA │ 22 (1,5) │ AA │ 2018-12-12 │ PRD │ 0x18000 │ 0xE10268 │ No ║
╟───┼───────────┼───────┼───────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 2 │ Microcode │ 906EC │ 22 (1,5) │ BE │ 2019-05-17 │ PRD │ 0x18000 │ 0xE28268 │ No ║
╟───┼───────────┼───────┼───────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 3 │ Microcode │ 506E8 │ 22 (1,5) │ 34 │ 2016-07-10 │ PRD │ 0x17800 │ 0xE40268 │ Yes ║
╟───┼───────────┼───────┼───────────┼──────────┼────────────┼───────┼─────────┼──────────┼──────╢
║ 4 │ Microcode │ 906ED │ 22 (1,5) │ BE │ 2019-05-17 │ PRD │ 0x17C00 │ 0xE57A68 │ No ║
╚═══╧═══════════╧═══════╧═══════════╧══════════╧════════════╧═══════╧═════════╧══════════╧══════╝
No shared microcode at all between the two BIOSes.. so they just ripped out the Skylake microcodes… that’d definitely do it. Sure, whatever. It was annoying to have no means of verifying that the modded BIOS even POSTed before having to do the swap, which is non-trivial due to the.. odd construction of these CPUs. After that was done, however, it did POST.
Side note, part of the reason I went for the z170 board specifically rather than something else was due to overclocking capability. The various listings I’ve seen for this particular engineering sample model were somewhat contradictory on whether they were capable of overclocking, but the short answer appears to be ’not really’. You can get things operating better in the manner I described in my previous by removing limitations on all-core turbo and default power limits, but there does unfortunately seem to be something inside of the CPU itself that is preventing it from boosting over 3.3 all core / 3.6 single core. I can set the multiplier to be higher in the BIOS, and if polling the CPU frequency like watch -n.1 grep MHz /proc/cpuinfo it appears to ephemerally boost above 3.6GHz, but viewing it via a different command like cpupower frequency-info shows the maximum clock speed pinging between 3.6 and whatever I set it to, and running some performance tests gives me no real gains in performance. Oh well. In this process though, I did realize this CPU may be somewhat more interesting than I gave it credit for, as it does run at quite a low voltage indeed - like 0.7v for its highest frequencies by default, and I’ve managed to crank the voltage down about 75 more millivolts and it seems stable. This also makes the thermals quite nice for a CPU with only a low profile cooler and a single fan.
Now, I can finally be free of this god damned cursed bargain bin motherboard. It only cost $40, but it was a very shitty $40 indeed. I do get some scary errors upon booting into Linux, including an error related to the bios, and two machine checks (!!). These problems seem largely benign though, I’m not even sure if Windows would complain. I’m characterizing the problem a little bit better and maybe I can message the CPU vendor to help me through the language barrier, but if not, I’ll probably order an extra SPI flash chip and try my hand at modifying it myself. It’ll keep me busy for a while.
>> Home