Beginner questions about BIOS and IME on Thinkpad T460

I found this thread, here, and have almost the same issue.

The ME Firmware Version on BIOS Main screen is blank.
To boot, I’m forced to press the power button a few dozen times and even then it boots intermittently.
When it does boot, it takes almost a minute to POST but everything seems to be working just fine afterward save refusing to reboot and just shuts down instead.

I have another identical T460 that works just fine and has latest BIOS (v1.42.1.11 R06ET68W) and IME (11.8.70.3626) flashed.

I’m going to purchase this kit.
Can I simply read the working chip and write it to the non working machine?

OK, so I’ve got the programmer and a clean dump by following section D4. CSME 11 - 12 of the Clean Dumped Intel Engine guide.
I did all of this in Windows and everything seems to check out. (File sizes identical and DATA section is Configured and NOT Initialized.

My issue now is with step 15.



I’m not sure how I go about flashing the cleaned .bin to the chip.

I tried using flashrom in Linux but got an error:

1
2
3
4
5
6
7
8
 

$ sudo flashrom --programmer ch341a_spi -w outimage.bin
flashrom v0.9.9-r1954 on Linux 5.3.0-40-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
 
Calibrating delay loop... OK.
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
Error: Image size (6303744 B) doesn't match the flash chip's size (16777216 B)!
 


How do I actually flash it with the programmer?
I can use either Windows or Linux if that makes things easier for anyone willing to help me out.

Use Flash Programming Tool under Windows for flashing. Did you dump/clean the entire 16MB SPI image or just the CSME region? For the entire 16MB SPI image, flash via "fptw64 -f spi_image.bin". For the CSME region only, flash via "fptw64 -me -f csme_image.bin". Either way, upon completion, run "fptw64 -greset" and wait for the system to restart.

Thanks for the reply.
I flashed the me region only, but the ME Firmware version is still empty and the serial number is still incorrect.
Perhaps I’m not understanding Section D4, step 9 in the Clean ME guide correctly?

I ended up successfully dumping the BIOS from my other T460 20FM model.
That dump is here: https://anonymousfiles.io/yYyAfAif/
(I tried attaching it to the post, but it was too large.

I’m really not sure what I’m doing wrong here. :frowning:

If you use a bare CSME region only (not full SPI image), you had to follow the “Note” at Step 9 instead (changed the text now to be more clear). That’s why it is generally easier to follow the guide using a full SPI image. Since you have a programmer, that’s exactly what you should do. Dump the SPI image from the broken system, follow the guide and flash back the resulting SPI image via the programmer. If you want to verify that you followed the guide properly on your dumped SPI image, attach/link it here and I’ll follow it on my side as well.

Again, thanks for the reply.

EDIT: just saw that you changed the wording, disregard this:
I’m not quite understanding what that note is wanting me to do exactly. It’s worded a bit strangely.
Also I’m not sure how I follow along on a full SPI as the guide seems to always result in a ME Region only file as alluded to in post number two of this thread (the flashrom size mismatch).

The working dump is in my previous post.
Here is the original: https://anonymousfiles.io/kZfcTJTt/

I really appreciate your help. :wink:

Unable to flash:

Error 368: Failed to disable write protection for the BIOS space.
FPT operation failed.

Are you sure the “orig_t460backup.bin” SPI read is proper, meaning the same as what you used to clean initially? I’m asking because I’m seeing severe CSME region firmware corruption which does not even allow the use of FIT because it crashes. Anyway, since you thankfully have a working T460 system, I cleaned its CSME region firmware dump and then replaced it over at “orig_t460backup.bin”. Here is a temporary link with the full 16MB SPI image for the original T460 with its CSME firmware repaired/cleaned. Flash via the programmer, remove all power from the system (AC + Battery) for 1 minute and boot it. It should work properly now.

Insofar as I know, the second dump I gave you was “proper”.
I read it via the CH341A software when I first got it.

Flashing your repaired/cleaned copy via the CH341A software now.
I’ll report back after I put it back together and have a look.


I’m not sure how someone can attempt to clean that when FIT crashes upon loading it. Try it and you’ll see what I’m talking about. Anyway, let’s see how the fixed image works out.

Everything seems to be working with your copy.
It still had the incorrect MTM and Serial number and one or two settings seem to be different/missing but I can live with that.
I ended up running the Lenovo Maintenance Disk, https://archive.org/details/i7tm38us, and corrected the MTM and Serial.

Thanks so much for all your help!

Out of curiosity, which image did you choose at step 4?
Maybe I was using the wrong one.


The equivalent or closest COR LP NPDM RGN from the repository, as explained at the guide.

Understood.
I don’t know where I went wrong, but I tried both NPDM RGN and YPDM RGN and still failed.
:frowning:


Maybe because of the corrupt source image. Alas, the system is working now and we’re around in case you need to do this in the future again so no problem.

I think I know where I went wrong.
Step 6 in section D4 says:

6. From the System Tools folder, go to Flash Image Tool > WIN subfolder and run fit.exe. Drag & drop the dumped SPI/BIOS image you want to clean. Go to "Build > Build Settings", select "No" at the option to "Generate Intermediate Files", leave all other settings intact and click Close.

But looking at the spoiler image, in the lower left, it appears as though you dragged and dropped the bin file from the repository (the one from step 4 before renaming) instead.
Is this correct?

Ha, yes but that was only done as a placeholder to create the picture. You need to drag & drop the dumped image, not the RGN firmware. The text does say so.

That explains it then.
Thanks again for all your help.

Hi!

I have the same problem with a T460. It started off as an increasingly long time between pressing the power button and the manufacturer logo popping up, and now the laptop is refusing to boot altogether. I believe this might be due to a broken UEFI, so I wanted to try flashing the image that @plutomaniac posted on MEGA. ("Here is a temporary link with the full 16MB SPI image for the original T460 with its CSME firmware repaired/cleaned."). But the link was temporary and unavailable now! If you still have the file around plutomaniac, would it be possible to post it again? I would be super grateful.

No I don’t keep temporary images. You can get a full SPI chip dump from a T460 and follow [Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization to produce the same result. If you use a 3rd party T460 dump, use UEFITool (non NE) afterwards to transfer the cleaned “ME region” from the generated SPI image to your own dump.

I managed (half a year later :slight_smile: to fix the laptop, but I did it differently. Instead of trying to find a working image somewhere and cleaning it using the guide, I dumped the SPI flash from the bricked laptop via an external flasher. Next, I ran corna’s me_cleaner utility on the image. Then I wrote the cleaned flash onto the board and miraculously, the laptop works now. So for posterity, if someone runs into the same issue, try me_cleaner!