Lenovo ThinkStation P710, system bios fix, recover

[aurel1510]

Thanks again, I was thinking the same and also had some doubts about the 5V on data lines issue so I have ordered a v1.7 green CH341 programmer as well, this one only comes straight from China, so I have to wait a bit longer, hopefully it arrives next week.

I am also planning to try programming the chip directly via the raspberry pi SPI interface on GPIO pins as described on the flashrom documentation pages here. I got myself some more and longer jumper wires and I also got the blue Pomona 5250 SOIC-8 test clip. The only thing I am missing is the 4.7uF decoupling capacitor, I have only found a 100nF one without a set, so hopefully I won’t be needing one for the R/W stability.

[Leland]

CMOS battery and jumper is not necessary. connect the power cable let a few electric stimulate the MOBO then ch341 could deal with it.
about ch341: I have THREE black ch341, with NeoProgrammer, just using the default set, without any specific jumper/mod, u really do not need Linux/raspberry, make things get complex

[aurel1510]

I see, so just plug in the power to the PSU but make sure the PC itself is turned off, and leave the CMOS battery outside and the clear CMOS jumper on the default position (pin 1 and 2), is that right?

[aurel1510]

I am back with good and bad news, the CH341 programmer didn’t work no matter what I tried. I tried plugging power into the PSU, powering on the PC, putting back the CMOS battery, black and blue clips, nothing worked, it always just lit up the RUN LED and disconnected the device.

After that I thought, maybe it’s really the device that’s not working and decided to set up the raspberry pi 4 SPI interface via GPIO pinout.

I will send more in detail notes and instructions once I get on a PC tomorrow, but the setup looked like this in the end, see the pictures above.

After the chip finally got detected, I performed about two failed reads and finally after adjusting the blue clip, I have succeeded in making a valid dump with a recognizable structure in the UEFIToolNE. I made three such dumps and made sure they were identical by running them through sha256 checksum.

After that I decided that since the backup was successful, I might as well try erasing the chip, writing the P710enme.bin @ItxLeo used before and verifying it. Everything went smoothly with flashrom and raspberry pi 4 SPI and to my surprise the PC even managed to boot without a hitch!

Thanks a lot for all your advice and help, everyone, I’ll share my sources, the dump BIN file as well as the commands used comes morning. Cheers!

[MeatWar]

Glad you finally made it, i always forget the possibility of defective CH341A…glad our buddy lfb6 remembered us.

[aurel1510]

So basically, I used my Raspberry Pi 4 to R/W the BIOS chip, I feel like the machine really is just OP, I recommend anyone already having a Pi (possibly even Pi 3) to not buy the CH341 Programmer but instead just buy a SOIC-8 clip (I recommend the blue Pomona 5250) and set up a SPI interface via a RPi.

I have the 64-bit Raspbian Lite installed on my RPi4, with ssh and network setup via Pi Imager. After accessing my Pi via pwsh, I used raspi-config command to enable the SPI interface, which is disabled by default and rebooted the RPi. After that I proceeded to connecting the clip to the GPIO pinout according to the flashrom documentation (as well as my BIOS chip datasheet), you can access the RPi GPIO pinout referrence as well, just to make sure you are 100% sure what should go where. (By the way, I used a basic breadboard to jump the three pins that need to be connected to the 3.3V rail with one of the 3.3V GPIO pins, but you should be able to jump then in any other way.) For illustration purposes, see the pictures I sent above in the post number 24.

As a side note, I have unplugged the power cable from the PSU as well as taken out the CMOS battery, also all the jumpers were at the default position and finally held the power button for a few seconds to make sure there is no power left inside, or you can just take a peek at the PSU green power LED and you should be good to go if it’s not lit up even without holding the power button.

After attaching the clip, try probing for the chip in question:

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1000 -c "MX25L12833F/MX25L12835F/MX25L12845E/MX25L12865E/MX25L12873F" -V

You might want to reattach the clip unless you get a successful probe consecutively at least 3 or 4 times, or you can try reading right away:

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1000 -c "MX25L12833F/MX25L12835F/MX25L12845E/MX25L12865E/MX25L12873F" -r dump.bin

Beware, the reading time can take up to or even over 10 minutes for a 16MiB chip! Once you start reading, try and have some patience!

Afterwards, make sure you get a correct dump via hexdump and adjust the clip each time you get an empty dump, i.e. xyz MiB of zeroes or some other gibberish. Once you finally get a valid dump, don’t forget to check the BIOS structure in UEFIToolNE and make at least two more dumps. Make sure they are completely identical to the valid dump with a correct BIOS structure tree recognized by the UEFIToolNE:

sha256sum dump1.bin dump2.bin dump3.bin

You should get the same checksum for all three dumps. And that’s it for reading. In case you don’t understand a command, just use man or --help to read more about its usage. As for writing, it’s basically the same thing just with the -w option. Also, if I remember correctly, the -w write option automatically reads the contents into RAM for failure recovery purposes, erases and writes the chip as well as verifies the chip contents against the written file afterwards, but you can do any of those actions with option arguments yourself in case you like it more manual.

The promised corrupted BIN dump of my original BIOS:
ThinkStationP710_30B6S0FK16_corrupted20250330.zip (8.6 MB)

In case you have any questions, don’t hesitate to contact me here, I should get notified via email so as long as I am able to help you, I will try my best. Have a nice day, everyone!