Service Forum

[RoelG]

I've used the search and seens the pictures of a R51. I found several chips on the x41 but not one that looks to me like an AMTEL. Maybe I'm wrong but I don't know which one it is.

If I look on an RSA-adapter I can see one there, so I know how it should look like... I guess.

I've looked near the Intel chip, nothing found... help :/

[semaj]

look for the 24RF08 chip
my chip was labeled that
i found the chip underneith the wireless card internally
with the case on it is underneith the touchpad inbetween the palmrests
i have a ibm thinkpad t41
i believe these laptops are sister models. if you need more help feel free to post. If you cant find it still take a detailed digital picture of the board and i can help you find it. especially take a picture where i said to look

[RoelG]

Ok, done that... nothing there. There are no chips underneath my wireless card.
Offcourse my batteries are empty of my camera, and I've got no recharger here... doh.

I'll try to manage to take some pictures somehow.

[semaj]

ok ill wait for the pictures
you may want to get the ibm service manual that you can find somewhere on this site and open the pc completely apart. then take a picture of the board in a digital picture that i can zoom in on.

[victor]

X41 has PCA 24S08. R24RF08 can cope with this eeprom as well. The procedure is the same.

[RoelG]

Solved, it is indeed the philips-chip as victor mentioned!
Read it out with rf24f08 and decoded it with ibm pass 1.1.
I think all IBM laptops without the amtel chip have got the philips.

Many thanks to Victor and ALLservice.ro!

[RickDeckard]

At first thanks Victor for yours great instructions and software.
And thanks RoelG for your hints on philips chip location.
SVP revealed without any problem, but it seems that I can't enable the embedded security chip anymore.
Its enabled in bios, but IBM Client Security Software try to enabled it every time without success.
You can live without IBM CSS, but the worst is that the bigger partition of my HD has been encrypted with Ultimaco Safeguard Easy 4.11 (TwinBoot, with one partition encrypted and machine binding check during windows logon).
As the machine binding check try to read the ess chip, gives an error which can't be recovered even with the SVP, and you can only shutdown.
I can't eliminate the binding check because I don't have administrator rights with my safeguardeasy logon, so I can't use the partition needed for my job anymore.
The first hint that something is wrong is when you press AccessIBM during POST; while before I had the lock picture asking for SVP, now it gives you the choice between F1 for bios or esc for normal boot.
As I couldn't find microclips I suspect that maybe dissoldering at the end of the job I caused an overtemperature to the chip; I can't guess anything else.
So now I can't do everything with the PC but using it for what it has been given to me.
Any suggestion before I return the PC to my company assistance (with a lot of embarrassment and shame)?

[victor]

All I can say is that you need the administrator right for the Safeguard Easy if you still want to access your data. Since you recovered the SVP you can control the hardware protection, you can enable/disable security chip. Booting an encrypted drive, well, that is another story..

So if you had access to the drive, you are in depth to ask your company to help you regain the right to use the encrypted partition.
Or delete the partitions, reformat the drive and enjoy a new clean OS installation

All the best.

[RickDeckard]

I wish I could enable my security chip. Any idea on why it seems to be permanently disabled, doesn't matter what you choose in bios or what you try with IBM security center (enabling/disabling from my private windows partition)? Could I have cooked it while dissoldering? Do you think is worthy disassembling everything again and checking the chip condition or is better to forget about it and consider the security chip gone?

Thanks for your patience and kindness.

[victor]

The prom 24RF08 is not the security chip. This is only an eeprom that stores serials, UUID, MAC sometimes, SVP and some vital settings.
The security chip is usually the ATMEL AT90SP0801, some models have this chip on a daughter board.
So, the eeprom is working since you can enter BIOS, you can save a SVP. If not the EAIA error should be displayed.
Also if the security chip is not working or is corrupt, 0192 -0195 embedded security tamper error should be displayed.

1.What chip you dissoldered then?
2. If you enable the security chip in BIOS Setup, does it remain enabled?

Else, I don't think you have a hardware but a software problem, I mean a problem with the Safeguard that doesn't allow you to access the software.

[RickDeckard]

Glad to know they are different, so shouldn't be an hardware matter.

1. I just wired pin 4, 5 and 6 of the Philips PCA24S08, following your very clear instructions and getting the SVP without any problem, than I dissoldered the wires (just the wires I added before!);
2. The chip remain always enabled in setup but:

during encrypted partition boot, I get the message "the IBM embedded security subsystem has been disabled. The logon process can not be protected until the chip has been enabled..." with a following "safeguard authentication - machine binding failed" and a choice of shut down or recovery (this last, if choosen, ask for an administrator password used during initialization, and inserting my SVP it gives a "no recovery is possible").
Not any other tamper or other kinds of error message.
And what drives me crazy is the following:
booting on my personal partition, the Thinkpad Configuration Utility (Security information) sees the security chip enabled (I suppose it just read the bios setting without interaction with the chip), while the Think Vantage Client Security Solution software tells me that the embedded security chip is deactivated?!?
It leaves me the choice of activating it, ask for the SVP, then there's a kind of reboot with a double post (there's a black screen between two "IBM Thinkpad" screen, with the sound of the HD head reparking) and everything is like before.
Could something from safeguard in the HD MBR deny the enabling of this security chip, disregarding bios setting?
I followed the hardware maintenance manual in disassembling, and I remember that it instructed to disconnect the backup battery, which I did, and has been disconnected for half an hour before reassembling.
I don't know if it can have anything to do.
Everything in bios seems to be OK, but something during boot doesn't take in consideration security chip bios setting.
Maybe they can solve this from the safeguard administrator control panel or with the IBM Hardware Maintenance Disk, which I know exists but don't know what is capable of.
Should I surrender to the company assistance?

[victor]

As I expected there is nothing wrong with the hardware. The security chip is working perfect in my humble opinion. I don't know this Safeguard as I never used it, to give you a final solution. but I set up applications that use the TCG/TCPA functions. The problem is with the software that cannot work in the current conditions, i.e security chip was disabled then re-enabled or erased, the sum's coruptions occurs or other missbehaviours during access.

I think you should ask your company tech to help you solve the problem. In fact the security software is there with a reason, to protect the company property that is. There's nothing embarasing and is the right thing to do.

Good luck