[Help Request] Flashing new bios with cleaned up CSME

Hello people!

I’ll start off by saying I have a laptop, a Lenovo Yoga C940 14-IIL.
This laptop had a few issues with its speakers not properly working on Linux, and the Lenovo engineers eventually caved in and published a beta bios that we could run a few years ago that would fix this issue (the latest bios as of now still doesn’t fix it, but this one does).

So I flashed it via their recommended way of doing so, and everything was nice.

Except I found out that it had every hidden option visible and accessible, which was great because I could mess around with things and figure out how stuff really worked under the hood (It’s running some Insyde H2O stuff, btw). (The regular bios images they send do not let you do any of this, they even lock you out of underclocking/undervolting)

Fast forward up to 3 months ago, when I was with some lads, and I was showing them this. We were drinking a bit, and we decided “hey, look, there’s an “ME State” option, let’s set it to disabled”.

So I did. And then I saved the settings and exit.

I booted up into Linux (on wayland), and well, my keyboard and trackpad would no longer work, and my soundcard would not get detected either.

That is a little weird, so I decided to also try booting into windows (I have it on a small partition, for that one use it gets every year). I was noticing something was off when the boot-up time was around a minute if not more. Windows used to boot in a few seconds, this is all stored on a WD Black SN850 SSD (arguably overkill for this laptop as it’s bottlenecked by the PCIe Gen 3.0 slot), so this was very strange.

And then once booted, I still was not able to use my keyboard or trackpad, and my soundcard was also not recognized (Looking in device manager, I saw a warning sign next to the Intel SST OEM entry).

Touchscreen works, thankfully, and I can still connect USB devices, and they work. Funnily enough the Fn+Space key combination DOES still work and does change the brightness of the LEDs underneath the keys (On the motherboard I noticed they even have a separate cable just for this, pretty funny).

Now, since the only thing I had changed was Intel ME’s state, I decided to turn it back on, buuuut this is where the issues began.

Going to that region in the bios settings, I saw that, unlike before, Intel ME’s version was now zero’d out (0.0.0.0 or something like that), and setting it to “Enabled” instead of “Disabled” didn’t change anything (tried multiple times).

This made me think of the possibility that the Intel ME region may have gotten corrupted, so I searched around and I’ve been lurking these forums for the past few months just to learn what could be the issue and what could be the fix.

Thankfully, I’ve managed to do a few things.

I’ve downloaded CSME System Tools v13.0 r7, as these were the ones required for the Ice Lake platform from what I’ve read.

Here’s what I tried to do but did not work:

Running FPT and other tools simply did not work on Windows as I kept getting “GetSystemFirmwareTable” errors or “unable to locate ME module” kind of errors.

Running them under Linux also proved to not work as I could not figure out how to make Wine see PCI devices and stuff (if anyone knows, PLEASE let me know, it may just work).

Also, for some reason, the keyboard and trackpad WORK under linux, but only on Xorg (no idea why, tried looking in logs, I have no clue what is wrong. also the sound card still does not work).

Since I didn’t really know what else to do, I tried to look for some native linux methods, and I found flashrom.

I read a bit about it, and saw that I could dump the bios contents with everything, CSME and FDT regions, as well.

So I did “sudo flashrom --programmer internal -r dumped.bin”.

And, what do you know, it worked!

I now have the image. I ran MEAnalyzer on it with -dfpt, and I saw the Intel ME region with its version and details as well as all the other stuff in it.
(Images: https://imgur.com/a/zAF9Uad)

I then read the guide on how to clean up the CSME region of this image, so I used FIT and a corresponding RGN clean CSME image file with a version that was very, very, very close to the one I got (same major and minor, and even the hotfix/build were very close).

I made that new bios image, and I ran MEAnalyzer on it, and it looked fine from what I’ve read.
(Images: https://imgur.com/a/6vVLcrm)

I have to remark that FIT DID actually say that the dumped firmware has Intel ME’s version set to 0.0.0.0 (or something like that), and, after the clean-up, the new image’s Intel ME’s version was no longer 0.0.0.0, but the correct one. (Maybe the data segment got corrupted? No idea)

It looked fine from what I’ve read it ought to look like, so then the next part comes: Flashing it.

This is where I am kind of stuck.

Trying to flash it with FPT results in those errors (Both under Windows and UEFI).

Flashrom doesn’t seem to be able to flash it, since it doesn’t know how to erase the memory in that zone. (See image below)

So I am kind of stuck.

I did disable all the bios locks, so I just don’t really know what to do from here.

I just need to flash this image.
Can anyone help me with this?

I don’t really want to resort to physical SPI flashing, but I’ll do it if I really have to (if you guys could help me with that, too, I’ll be so, so glad!)

Also, from what I’ve been able to tell, I do not see an Intel ME debug pin on the motherboard. I can’t pinmod, either, because the sound chip is BGA (no way in hell am I gonna take it off, and I can’t access the pads underneath).

There is a J_DEBUG zone, unpopulated (as expected), with 5 pins. I do not know what those pins are. I have been unable to find a schematic for this laptop.

Please, help a lad out!

Also, if you need any more data, please let me know what data is required! :smiley:

I also ran it with the latest flashrom (1.4 devel)
It’s better, but still doesn’t work.

https://imgur.com/a/REyAQ8U

You might try a fptw -i and post the output.

But even with fpt working it’s still the flash descriptor that probably will look like:

(You might check your own dump)

If you can’t unlock your flash descriptor and get fpt to work I suppose it’s the programmer…

Yeah, you’re right, it seems I don’t have write permissions, even after all this.

Let me try some more BIOS options, maybe I’ve missed some; but if all else fails, using an external programmer is bound to work regardless of those protections, right?

Take good care of your backups!

Changing setup variables changes them in NVRAM, a place directly in the firmware which often can’t be reset by a ‘CMOS’ reset.

1 Like

Seems like the BIOS settings aren’t actually doing anything.

The flash protection registers are disabled, yet I still cannot write to them.

I’ve ordered a CH341A SPI flasher, hopefully that’s enough for this Winbond chip.

Sorry for the necrobump, but since there might just be one other person out there in my boat, I’ll share my findings:

Flashrom was simply not working. Other in-situ methods also did not work.

I have thus waited for the last resort: the external programmer.

It’s just some generic chinesium SPI programmer, I think any that support QSPI would work (you need QSPI for this, according to the datasheet of this Winbond chip at least).

I located the correct chip on the motherboard (There seem to be two chips, both flash chips that can be programmed via SPI, but I do not know the use of the other. Just make sure you locate the right one).

After getting a good connection of the CH341A SPI flasher on the Winbond chip, I used an external Linux station to run Flashrom to try to read the contents of the chip using the external flasher via QSPI (It did not want to talk in any other mode, which is expected, it’s a QSPI flash chip) confirming that I got the right chip connected to, because the image downloaded is the same as the one I downloaded using Flashrom to read in-situ.

I then tried to flash the newly compiled firmware, with the repaired Intel ME data region, and, after getting the chip properly on there, I got a nice confirmation of the write attempt finishing succesffully.

And hey, what do you know, it worked! It’s like brand new! I mean, it theoretically should be pretty much as the Intel ME region should be from the factory on first boot, so it makes sense.

This happened shortly after I posted the last comment here, but I think the information here might be of relevance for others like me in the situation.

TL;DR:
If you cannot disable the required registers from the BIOS (Or worse, if the BIOS engineers did not actually implement that functionality, but exposed it), don’t bother, just get an external programmer, and practice great care, have back-ups, you do not want to brick your device.

The laptop has been working amazingly ever since, I still own it, and use it as my main device.