[Help Request] Flashing new bios with cleaned up CSME

Hello people!

I’ll start off by saying I have a laptop, a Lenovo Yoga C940 14-IIL.
This laptop had a few issues with its speakers not properly working on Linux, and the Lenovo engineers eventually caved in and published a beta bios that we could run a few years ago that would fix this issue (the latest bios as of now still doesn’t fix it, but this one does).

So I flashed it via their recommended way of doing so, and everything was nice.

Except I found out that it had every hidden option visible and accessible, which was great because I could mess around with things and figure out how stuff really worked under the hood (It’s running some Insyde H2O stuff, btw). (The regular bios images they send do not let you do any of this, they even lock you out of underclocking/undervolting)

Fast forward up to 3 months ago, when I was with some lads, and I was showing them this. We were drinking a bit, and we decided “hey, look, there’s an “ME State” option, let’s set it to disabled”.

So I did. And then I saved the settings and exit.

I booted up into Linux (on wayland), and well, my keyboard and trackpad would no longer work, and my soundcard would not get detected either.

That is a little weird, so I decided to also try booting into windows (I have it on a small partition, for that one use it gets every year). I was noticing something was off when the boot-up time was around a minute if not more. Windows used to boot in a few seconds, this is all stored on a WD Black SN850 SSD (arguably overkill for this laptop as it’s bottlenecked by the PCIe Gen 3.0 slot), so this was very strange.

And then once booted, I still was not able to use my keyboard or trackpad, and my soundcard was also not recognized (Looking in device manager, I saw a warning sign next to the Intel SST OEM entry).

Touchscreen works, thankfully, and I can still connect USB devices, and they work. Funnily enough the Fn+Space key combination DOES still work and does change the brightness of the LEDs underneath the keys (On the motherboard I noticed they even have a separate cable just for this, pretty funny).

Now, since the only thing I had changed was Intel ME’s state, I decided to turn it back on, buuuut this is where the issues began.

Going to that region in the bios settings, I saw that, unlike before, Intel ME’s version was now zero’d out (0.0.0.0 or something like that), and setting it to “Enabled” instead of “Disabled” didn’t change anything (tried multiple times).

This made me think of the possibility that the Intel ME region may have gotten corrupted, so I searched around and I’ve been lurking these forums for the past few months just to learn what could be the issue and what could be the fix.

Thankfully, I’ve managed to do a few things.

I’ve downloaded CSME System Tools v13.0 r7, as these were the ones required for the Ice Lake platform from what I’ve read.

Here’s what I tried to do but did not work:

Running FPT and other tools simply did not work on Windows as I kept getting “GetSystemFirmwareTable” errors or “unable to locate ME module” kind of errors.

Running them under Linux also proved to not work as I could not figure out how to make Wine see PCI devices and stuff (if anyone knows, PLEASE let me know, it may just work).

Also, for some reason, the keyboard and trackpad WORK under linux, but only on Xorg (no idea why, tried looking in logs, I have no clue what is wrong. also the sound card still does not work).

Since I didn’t really know what else to do, I tried to look for some native linux methods, and I found flashrom.

I read a bit about it, and saw that I could dump the bios contents with everything, CSME and FDT regions, as well.

So I did “sudo flashrom --programmer internal -r dumped.bin”.

And, what do you know, it worked!

I now have the image. I ran MEAnalyzer on it with -dfpt, and I saw the Intel ME region with its version and details as well as all the other stuff in it.
(Images: https://imgur.com/a/zAF9Uad)

I then read the guide on how to clean up the CSME region of this image, so I used FIT and a corresponding RGN clean CSME image file with a version that was very, very, very close to the one I got (same major and minor, and even the hotfix/build were very close).

I made that new bios image, and I ran MEAnalyzer on it, and it looked fine from what I’ve read.
(Images: https://imgur.com/a/6vVLcrm)

I have to remark that FIT DID actually say that the dumped firmware has Intel ME’s version set to 0.0.0.0 (or something like that), and, after the clean-up, the new image’s Intel ME’s version was no longer 0.0.0.0, but the correct one. (Maybe the data segment got corrupted? No idea)

It looked fine from what I’ve read it ought to look like, so then the next part comes: Flashing it.

This is where I am kind of stuck.

Trying to flash it with FPT results in those errors (Both under Windows and UEFI).

Flashrom doesn’t seem to be able to flash it, since it doesn’t know how to erase the memory in that zone. (See image below)

So I am kind of stuck.

I did disable all the bios locks, so I just don’t really know what to do from here.

I just need to flash this image.
Can anyone help me with this?

I don’t really want to resort to physical SPI flashing, but I’ll do it if I really have to (if you guys could help me with that, too, I’ll be so, so glad!)

Also, from what I’ve been able to tell, I do not see an Intel ME debug pin on the motherboard. I can’t pinmod, either, because the sound chip is BGA (no way in hell am I gonna take it off, and I can’t access the pads underneath).

There is a J_DEBUG zone, unpopulated (as expected), with 5 pins. I do not know what those pins are. I have been unable to find a schematic for this laptop.

Please, help a lad out!

Also, if you need any more data, please let me know what data is required! :smiley:

I also ran it with the latest flashrom (1.4 devel)
It’s better, but still doesn’t work.

https://imgur.com/a/REyAQ8U

You might try a fptw -i and post the output.

But even with fpt working it’s still the flash descriptor that probably will look like:

(You might check your own dump)

If you can’t unlock your flash descriptor and get fpt to work I suppose it’s the programmer…

Yeah, you’re right, it seems I don’t have write permissions, even after all this.

Let me try some more BIOS options, maybe I’ve missed some; but if all else fails, using an external programmer is bound to work regardless of those protections, right?

Take good care of your backups!

Changing setup variables changes them in NVRAM, a place directly in the firmware which often can’t be reset by a ‘CMOS’ reset.

1 Like

Seems like the BIOS settings aren’t actually doing anything.

The flash protection registers are disabled, yet I still cannot write to them.

I’ve ordered a CH341A SPI flasher, hopefully that’s enough for this Winbond chip.