Need help to unlock Lenovo M720q BIOS settings

Hi, This tiny system is designed to work with lower power intel ‘T’ chips.

But I’ve put a regular intel chip (i7 8700) and it works perfectly fine, except for if turbo-boost is enabled in the BIOS.
When turbo-boost is enabled I get a BSOD error (WHEA UNCORRECTABLE ERROR) in Windows 10 which has been confirmed to be probably because of insufficient CPU voltage.

In HWmonitor I’ve looked at the temps/ wattage and I’m not able to draw more than 60w out of the cpu, which is just a little more than the max wattage of a ‘T’ cpu.

I’m guessing the hidden bios settings are configured for these low power 35w CPU’s so I’d like access to the menu to see if I can get a regular non ‘T’ CPU stable.

I’ve got a CH431a programmer and test clip and have dumped a backup of my bios, which is 16,384kb

I’ve looked at the file on EUFItool and MMtool and it looks like there are options in the bios to change power/cpu settings. I just don’t know how! Would greatly appreciate any help

The bios version is: M1UKT50A
https://download.lenovo.com/pccbbs/think…/m1ujt50usa.zip

EDIT by Fernando: Thread title shortened

Lets see if you can flash mod BIOS or not, using this method… Unless you just want to use flash programmer?
If you do want to just use programmer, make a dump and upload to tinyupload.com or uploadfiles.io and I’ll make a test edit for you to see if I can give you the other advanced section or not.


Check BIOS main page and see if ME FW version is shown, if not then download HWINFO64
Then on the large window on left side, expand motherboard and find ME area, inside that get the ME Firmware version.
Once you have that, go to this thread and in the section “C.2” download the matching ME System Tools Package
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
Intel Management Engine: Drivers, Firmware & System Tools

Once downloaded, inside you will find Flash Programming Tool folder, and inside that a Windows or Win/Win32 folder.
Select that Win folder, hold shift and press right click, choose open command window here (Not power shell).
At the command prompt type the following command and send me the created file to modify >> FPTw.exe -bios -d biosreg.bin

Right after you do that, try to write back the BIOS Region dump and see if you get any error >> FPTw.exe -bios -f biosreg.bin
If you do get error, show me image of the command entered and the error given
^^ This is important step, don’t forget ^^


If you are stuck on Win10 and cannot easily get command prompt, and method I mentioned above does not work for you, here is some links that should help
Or, copy all contents from the Flash Programming Tool \ DOS folder to the root of a USB Bootable disk and do the dump from DOS (FPT.exe -bios -d biosreg.bin)
https://www.windowscentral.com/how-add-c…creators-update
https://www.windowscentral.com/add-open-…menu-windows-10
https://www.laptopmag.com/articles/open-…ator-privileges

Or here is simply registry edit that adds “Open command window here as Administrator” to the right click menu
Double-click to install, reboot after install may be required
http://s000.tinyupload.com/index.php?fil…134606820377175

Thanks a lot for getting back to me!

I successfully backed up but was not able to flash following the instructions. This is the result:
-----------------------------------------------------------------------------------------------------
Intel (R) Flash Programming Tool Version: 12.0.49.1536
Copyright (C) 2005 - 2019, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
GD25B128C ID:0xC84018 Size: 16384KB (131072Kb)


Error 167: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable
Protected Range Registers.

FPT Operation Failed.

-------------------------------------------------------------------------------------------------------

I’d be happy to use the CH341A programmer to do it.

link to bios dump: http://s000.tinyupload.com/?file_id=00940287937113596034

-------------------------------

Also, if it helps…I was able to dump bios.bin from ch341a programmer via terminal on Linux mint

There’s also a ‘service mode’ on this pc that is accessed by moving a jumper on my motherboard. Not sure what it actually does but It was able to automatically remove the supervisor password I had set after booting up into the bios with the jumper in place.

I don’t mind if there’s a possibility that the new bios could ‘brick’ my board. I’m willing to take the risk I guess, as long as I’m learning something in the process.

Thanks again!

Since you have service jumper, you should be able to put that on, reboot twice, then FPT and dump the entire BIOS (FPTw.exe -d SPI.BIN), or the above BIOS region only dump write back would work too (Please confirm).
So no need for CH341A when you have service jumper, unless it bricks, then you will need to use CH341A to program back in your backup to recover it. And, since you have programmer, there is no such thing as brick

So there are two jumpers, one is ‘SW_CLR_CMOS’ and one is 'ME_DIS’

I’m guessing one clears the CMOS and the other disables Intel ME, but neither of the options allow me to flash the dump back via FPTw.exe

Getting the same ‘Error 167’, even when Intel ME is showing 0 (disabled) in bios.

Since I have the Ch341a programmer with the soic8 clip I think I’d rather do it that way, as I seem to be making absolutely no progress trying to flash the bios through Windows!

ME_Dis would be the service jumper, usually this also disables FD locks too but yes I guess not here. I’m surprised it override the password for you but not the FD locks.
Send me the CH341A dump and I will unlock FD and see if I can also disable the issue causing 167 too, then you program back in and we test dump again.
Then once sorted we can carry on with FPT, since this is much safer and more ideal than a bunch of flashes via programmer

Probably ME is locked from read/write in FD, even with ME Disabled this is causing the error. You can try to dump FD/GBE/ME and see which one causes the error, I assume ME
FPTw.exe -desc -d fd.bin
FPTw.exe -gbe -d gbe.bin << May error, if not present, ignore if this is true
FPTw.exe -me -d me.bin

With the ME_DIS jumper in place:

I tried the three dump commands you gave me, and all three successfully dumped

I then executed those three commands again, but with ‘-f’ instead of ‘-d’ in each one. Every one came back with ‘RESULT: The data is identical…’ and 'FTP Operation Successful’

Strange?

Heres the CH341a dump, I noticed that it’s a different size to the dump from FPTw.exe :
http://s000.tinyupload.com/?file_id=70617268389685760361

@missingsince - So, jumper in place works?! Did you then try FPTw.exe -d SPI.bin? If not, try it again, but be sure to reboot to windows 3 times after putting jumper in place.
If that fails, it makes no sense, because you above dumped and wrote to both regions that would normally cause error/be blocked (FD and ME)
Of course, write to BIOS region is blocked too (via PRR), but this shouldn’t give error at SPI Dump attempt since it’s a read only dump, only the FD or ME Blocked within FD would cause that.
Unsure if PRR gets disabled via jumper like FD, you’ll have to test and confirm by doing another BIOS region dump/write back while in that state too and see if you still get 167 error or not
Make sure you are in valid state by dumping and writing back FD/ME again, once you do that without error again, then test BIOS dump/write and SPI Dump

Yes, BIOS dump will always be full size of chip. BIOS region dump is always just BIOS region, usually 6-12Mb depending on BIOS, the rest = SPI dump >> (FD + ME + GbE if present + BIOS region = Full size/match to programmer dump)

Anyway, all oddities aside, here is FD unlocked BIOS, program back in and now you can dump FD/ME without jumper. I tried to bypass 167 error, maybe OK now, or may still need other edit on the module.
If 167 error still present here at BIOS region dump/write back, then program in FDOnly BIOS for now
http://s000.tinyupload.com/index.php?fil…860035994882967

Sorry for the late response. My cheap SOIC8 clip stopped working / wouldn’t grip properly so I had to order and wait for a new one to arrive.

programmed both files you supplied me, no luck (with and without ME_dis jumper in place)

Still getting Error 167 when trying to flash SPI / bios

@missingsince - I know that clip issue all too well, sorry to hear! I got tired of it and ordered Pomona 5250, those are MUCH better than the cheap $3 clips
Bummer on the 167 error, I could keep trying if you wanted, but that is more risk on continuing using programmer and may be all for no reason if I can’t eventually bypass the lock causing error 167.
Sometimes it’s easy to find, others it looks like correct ones but never ends up being the right one

Very odd you can dump FD/ME with jumper in place but not write BIOS region. BIOS region is the only thing unlocked in FD, both FD and ME are NO for read or write, I guess the jumper only overrides the FD locks, not the actual FPRR lock inside BIOS region.
So, we must continue with programmer for any edits, unless you want me to look again and see about giving that 167 error another try

For the actual edit you wanted, access to the other Advanced menu, please give me a zip of ALL pages of your BIOS, all menus, submenus, all root pages, all settings.
This way I can find something you currently don’t see, that you wouldn’t want or need, replace that with a link to the other advanced and then make it visible for you.

Funnily enough - I ordered a Pomona 5250 too as I can see the plastic on this new replacement clip wearing down already! Will be good to have in the future.

I also noticed that when putting the ME_dis back jumper back to the regular position, ME is still off and is showing as ‘0.0.0.0’ on the bios. I’ve restarted multiple times and tried to clear CMOS etc. Very strange. I think the Bios must be a little different on this machine since it’s made for business use…so may have extra protection

Let’s go with the programmer, it took me a couple of hours and a few different versions of software until I was able to succesfully program it - but can confirm ASprogrammer 1.4.1 is able to get the job done fine.

There’s been a recently released Bios Update, so I’ve updated the BIOS to the latest version. I’ve provided the latest Bios Dump in the zip file.

Thanks again for this, hopefully I can get some settings related to CPU / power.

I’ve looked on the CPU section of HWiNFO64 and it’s showing a few options as ‘supported, disabled’ such as Programmable ratio limits, programmable TDC/TDP limits. I’m also seeing ‘current/EDP limit throttling: Yes’ on Intel XTU - if that helps


http://s000.tinyupload.com/index.php?fil…825687626324474

@missingsince - Plastic isn’t the issue with any of the cheap clips, it’s actually irrelevant and can be filed down/away as you see fit.
The issue is with the “fingers” in the clip itself, inside where it actually grabs the BIOS legs, there is tiny “bumps” that help grip, those very quickly flatten/wear out on cheap clips and this is the problem.

Sounds like ME FW is corrupted. Unless you need to reset ME State. Try this, if this still leaves ME FW 0.0.0.0 or NA then ME FW is corrupted
Remove power block, remove CMOS batter if you can easily access it, if you cannot then press and hold the power on button for 1+ FULL Minute. This will reset ME FW State due to zero power for one minute +
If it does not, I will clean and update ME FW, then once you program back in it should be fine.

Need new images please, those are resized way too small to be able to read anything, enlarging them makes everything illegible.
800px wide would be OK

Sorry, didn’t realise that the pictures were too small, picked the smallest file size oops

Also, tried removing CMOS battery / Clear CMOS jumper and had no luck with restoring ME FW

http://s000.tinyupload.com/index.php?fil…109434164917856

Thanks, I will try to get on this tonight. Clearing CMOS wouldn’t help with ME FW, so no need to waste more time on that
Just wait, it will be fixed in BIOS I send you

Thank you, will be waiting!

@missingsince - do you ever use/change anything on the “Power” menu? If not, I’m thinking of swapping advanced for the hidden one, and swapping power for chipset. All things in power would still be applied at their defaults, you just wouldn’t see that section anymore.
Or, if you’ve looked with AMIBCP 5.02.0024 or 5.02.0031 and see chipset section, if there’s not anything you need there then we can skip that and just give you both Advanced (leave original, replace power with hidden advanced)
Which sounds best to you?

I can’t find those versions of AMIBCP anywhere, only 5.02.0023 - and can’t see the chipset section on this ‘0023’ version.

The power settings I use are:

After Power Loss: Power Off
Enhanced Power Saving mode : Enabled
Smart Power On: Disabled

Intelligent cooling engine : Better Thermal Performance

If it would be possible to set to those settings before removing the menu, that would be great. If not, I guess I can live with them being set to default

What’s in the Chipset section ?

I’ll send you a PM re BCP
Yes, I can change defaults of those settings, if that’s something you normally do, then swap the menus.

Yeah, if you could change the defaults of those power settings that would be great, I won’t need to change them once they’ve been set.

Is there a reason why opening the BIOS file in those specific versions of AMIBCP allows you to see the ‘setup configurations’ tab ?

OK, will do. Certain versions of AMIBCP work or not simply due to age of AMIBCP released and BIOS compatibility or not. Newer BIOS need newer AMIBCP, simple as that
And I was actually wrong when I mentioned 5.02.0024 above, it doesn’t open fully in that either! I didn’t check when I mentioned that version earlier and assumed maybe you opened in 4.xx or something
5.02.0024 is 2016 and the 5.02.0031 is 2017 release, this is latest leaked one we know about as of now.
It’s about time someone leak a newer version already, we’ve been waiting a while now, it’s been 3 years (yes… you… I know you can hear me )

* edit, forgot to ask! So, after looking at BIOS in proper AMIBCP, do you need chipset, or not?
If not, I can do the power/ADV swap and leave the original ADV in place, or just swap ADV/ADV, leaving all the default ADV stuff as-is (or change per what you want first)

Security or Startup tab could be replaced as well, all up to you (but these do have plenty hidden that we could enable, so maybe not best choices)