Is the ME_DIS JP15 between the white pci slot and the CLR_CMOS jumper in the photo the service mode jumper ?
Hi,
so I put a jumper bridge on ME_DIS JP15 and then used my efi shell usb boot stick with the suitable version of fpt.efi for the Lenovo M93p on it to dump the bios and the full flash.
As a side note - without the jumper bridge on ME_DIS JP15 I can dump the bios part but not the full bios.
Then I used UEFITool version 0.28.0 to inject the NvmExpressDxe_5.ffs nvme DXE module.
However when comparing the original bios file and the modified one after the modification with UEFITool I see that the two final pad file areas have changed in size. They have not disappeared, but changed their size. Is that normal expected behaviour or a problem ?
@MeatWar Would you please have a look at the two versions and tell me if it looks ok to you - so that I can ask myself if I am feeling lucky enough today to flash my nvme modded bios file ?
This is the original version of the bios:
lenovo_m93p_bios_with_jumper_on_jp15.zip (4.2 MB)
And this is my modified version:
lenovo_m93p_bios_with_nvme_mod.zip (4.2 MB)
Thanks
Also a second question:
The previous Dell Inspiron 3847 that I modified a few weeks ago had a dumped bios which was a nice 8192 kb sized image.
This Lenovo M93p had an odd sized bios dump. Is that ok ?
The ME service jumper enables the full access (Read, but most important Write) to regions, of course that dumping can be made (most of the machines) without enable it, but on these ME jumper machines for writing the jumper must be set.
Post the FRU and white label of the motherboard ISX…
Your mod seems ok, inserted in the correct volume, there are no pad-files on the end of the insertion volume, this is the volume to check for.
Now is these a full SPI (bios_region?)…doesnt seems so. Preserve a full SPIs for backup/safe keeping.
Dump the bios_region and mod it, them flash only the bios regions with FPT, no need to touch other regions.
Careful with the tool (its own cmds), it writes what ever you want and doesnt care nothing else, so if bad it writes bad.
Pay attention to what your doing.
2 SPIs, we want to mod the bios_region of SPI 1 ID: 0xEF4017.
This computer on which I am trying add the nvme boot is a Lenovo M93p tower, machine type 10A7.
These are the white label stickers on the motherboard, one is right under the cpu cooler between the cpu and the memory slots and can only be properly read with cooler removed. The other label is between the cpu and the rear io.
This is the text of the labels:
(1P)0C17276
ASM (03T7183) for MB Fru W8P
11S0B63207ZVQ2FK3681ZK
2ND LVL INTCT:el
From a quick search: 03T7183 is the part number of the mainboard
1 Like
Since I had the cpu cooler already removed for taking the photos I wanted to exchange the old cpu i5 4570 for a newer i7 4790S that I had bought on ebay.
However at first the new CPU looked dead, but I found this old article and it described my situation perfectly.
So I updated the Intel ME from 9.0 to 9.1 with a Lenovo supplied firmware update and also the bios to the most recent FBE0A. And with a new ME the computer booted with the newer cpu.
These are the dumped bios and full firmware files with the new ME and the most up to date bios version.
lenovo_m93p_new_bios_only.zip (4.2 MB)
lenovo_m93p_new_bios_only_with_nvme_mod.zip (4.2 MB)
lenovo_m93p_new_full_firmware.zip (7.2 MB)
Later I modded the new bios again to include the nvme boot DXE, checked for pads, which looked all good to me and then I proceeded to try to flash.
Sadly I am now running into a new obstacle with the JP15 ME_DIS jumper bridge present:
When booting from an efi boot shell usb disk and trying to flash I get the error message:
“Error 280: Failed to disable write protection for the BIOS space!”
Here is an article about a modification for a M82:
And here is an article of a mod of a Lenovo M92
Both times their work around was putting the machine to sleep to disable the write protection. But for that I would need to boot into windows and attempt to flash from there.
Here is another article about putting the machine to sleep to enable flashing, but I do not really understand things explained there. Also discussed there is that newer bios version fix the work around of putting the machine to sleep to work around the write protection.
Any hints please on how to proceed from here now ?
Thanks
The old/previous screens from previous bios, the access looked granted for read/write operations, and on this new bios still granted?
FPT -i
The FPT operation in EFI shell is not mandatory, indeed usually recommended, but many can be done in OS environment by CMD admin, ME driver must be loaded in the OS installed.
Try it…
Now… i told you to dump, mod and flash only the bios_region, is this correct?
If a simple test, dumping of the bios_region fpt -bios -d bios_reg.bin and then flashing again this dump fpt -bios -f bios_reg.bin, if the result is the same then is indeed the JP15 the ME jumper…dunno, the other not pinned…dunno, i told i dont have this board or her schematics.
The same SLEEP state is also used by this report on a M92, but performed on OS environment:
Modify the BIOS of a Lenovo M92 to enable native NVMe support (tachytelic.net)
Read the whole thread
SPI Protected Range Registers Affected by S3 Sleep Mode - Lenovo Support US
EDIT: Dont recommend it because you already updated also the ME FW 9.1…
Downgrades are much more risky and this system has 2 SPIs… the recover can be painful and only with SPI programmer.
And to finish all my help on this case… if you dont have any luck with it and if the machine is not a primary system for you, the use of a programmer for the mod could be the last resource in this matter, a MUST using this tool is making dumps of the 2 SPIs before any other action, good luck.
@MeatWar In your opinion: Would I be possible to downgrade to before the bios version FBKTD5A that is referenced in the Lenovo document that you linked and then flash the modded newer version using the S3 sleep bug from a pre-FBKTD5A bios with the windows tool fptw64.exe ?
According to Lost_N_BIOS only if EC FW didn’t change…
I just checked: The most recent bios version FBE0A uses the embedded controller version FBCT13A.
And the older pre-FBKTD5A bios version FBD4A still uses embedded controller version FBCT13A too.
So I should be able to first install bios version FBD4A with the Lenovo supplied installer and then install my nvme modded bios version FBE0A using the S3 sleep bug with fptw64.exe ?
@MeatWar @lfb6 Thank you both for your help.
I am going to order a SPI programmer to further proceed with the SPI programmer. These two gifted M93p that I got here are not main computers, I would like to use them for hobby (a cnc mill controller computer and a fun proxmox server). So there is no rush and if I make a mistake, then so be it.
There are three Winbond ICs that I see on the mainboard. Two ICs are close together marked with a blue and a green dot located close to the sata ports.
Blue dot: Winbond 25Q64FVSIQ 1310
Green dot: Winbond 25Q32FVSIQ 1314
And another IC with a pink dot is close to the ram slots and close to the chip with the golden metallic sticker labeled “AMI-Aptio DT 2006 RG57 4010”.
Pink dot IC: Winbond 25Q80BVSIG 1312
Are the two ICs with the green and blue dot the ones holding the bios/firmware ? Or is it the one with the pink dot and I am not seeing a second since I am expecting two ICs ?
Thanks
U4 and U5 seems to be main bios SPIs, U107 seems to be the EC (56k/58k), try to find the mainboard shcematics /board view.
Read thread: Bad embedded controller flash Lenovo Thinkcentre M93p - BIOS/UEFI Modding / BIOS Modding Guides and Problems - Win-Raid Forum (level1techs.com)
Use forum search box and google is your friend.
You answered the question already yourself.
I’m attempting this. I use Xeon E3 1241v3 processors. Usually about 15-20 USD. They are 3.5Ghz-4.0GHz processors, 4 core 8 thread. Much cheaper than i7 I find.
I’ll try an SPI read before I start. Then a full BIOS update l, then the NVMe mod (real shame if it doesn’t have native NVMe, since it does have the rare x4 PCIe slot)
I did not do the SPI read. Bricked my board. Flashed the Tiny EC to my tower motherboard 
Should have done an SPI read of all 3 chips
Which chip(s) did you dump?
And which chip(s) did you flash with which file(s)?
I attempted a straight OEM 2022 BIOS update. But I clicked the EC update (unbeknownst to me the Tower motherboard has had no EC update since launch, so I was flashing the Thinkcentre Tiny EC). It hung and has not posted since. No beeps, nothing. The EC chip is 1MB, while most dumps I can find are 128KB. I’ve tried various 4mb+8mb ‘ME cleaned’ images. Black screen, no beeps. The last one had all 3 images (Badcaps .net), and it tries a reboot as though it was resetting the ME or training the RAM, but still no POST. I have to believe the checksums aren’t lining up and the ME isn’t happy.
Just a warning not to skip dumping all 3 chips before attempting anything. Even a Lenovo BIOS update.