[Request] Modded Lenovo ThinkStation S30 Type 0606 BIOS

BIOS/UEFI Modding BIOS Modding Requests
1

Hi! I have Lenovo s30 workstation (older version) that got no further bios updates - unfortunately.

For now it’s running on e5-1620 , but I want to put e5-2697 v2 (https://www.cpu-world.com/CPUs/Xeon/Intel-Xeon%20E5-2697%20v2.html) (ID 306E4) instead.

I’ve tried to do it by manual and added additional microcode from archive, but motherboard not starting - 00 on post monitor. I’ve tried to add NVMe boot support but there is no such option showed after I’ve added driver from NVMe manual as well.

What I did wrong?

image
image1387×1029 67.8 KB

mce.zip (4.9 KB)

Thanks in advance!

original rom: IMAGEA0.zip (3.0 MB)
modded: new.zip (3.2 MB)


Edit by Fernando: Thread title shortened and customized

2

It may be possible but not assured in these OEM branded machines that some times have locks/blacklist, some systems need to have ME FW up to 8.x
Another topic on the issue…

Does the system have Intel ME v7 or v8?

S30.pdf (lenovo.com)
Seems older board revisions, Machine Types are unlucky…ME FW v7
Only a user who forced to v8 can report success or failure…

The shared file is a Lenovo update file with no ME FW, if it was a dump of the current system bios it could be identifiable.
The 306E4 should be added if enough volume space or replacing an existent one.
MMtool or HeX editor can do this.

Your NVMe mod is not correct and i don’t even see the inserted DXE driver.
The DXE should be inserted in the end of volume 1, the same as CSMCORE, as stated in the guide (to read…not to glance only), by MMtool or UEFI method

image
image616×550 12.6 KB

And how did you flashed this mod?

EDIT: Now ( new_nvme.zip) looks OK, original pad on the end of volume remains present.

…You should be using at least the last version of system bios, before any mods, seems to be the A2KT70A (2020), this one added IvyBridge support and new mcodes, no mod need and yours is A0KT61A (2017)

Seems the main issue is the system was never updated with ME FW v8 from Lenovo…as the link posted states…

3

Yes, sorry, I’ve added bios without NVMe driver - here is fixed one:

new_nvme.zip (3.3 MB)

Flashed from OS with LENOVO’s flasher…

Forgot to get full dump, will do tomorrow.

As for now - I can get no higher than this one: https://support.lenovo.com/us/en/downloads/ds501921-intelr-management-engine-firmware-update-tool-thinkstation-c30-d30-s30

Thanks!

4

Yes, but there is trick…

S30 comes in several revisions and fw from 2020 is for 4351 and 4352

https://support.lenovo.com/uu/en/downloads/ds035724-flash-bios-update-thinkstation-s30-type-4351-4352

cap file for that update: IMAGEA2.zip (3.6 MB)

Buuut I have : 0606 I guess

And I can’t flash it :frowning:

5

Yours is 7 versions below, check the readme of an update bios file, for the revision history.
You should try to make gradual updates starting the newest one after yours BIOS release - A0KT61AUS 03/27/2017, then on the last one flashed, the MVMe mod should be done on top of it.
From A2KT62A to A2KT68A and then the last one A2KTxxA
EDIT: Confirmed last for Type 0606 its your current A0KTxx, the ones A2KTxx are for the more recent type machines.

Some bios updates will block the standard flash to use mod bios files… so your choice only, due to security modifications on the firmware made by Lenovo… that’s why i asked how did you flashed the mod file initially…

EDIT: “0606 I guess”… that’s a poor identification of the system…being in your possession… you have service tags and chassi labels, but its correct and its uses same bios revisions, at least by Lenovo web engine redirection…
Any way, contribution done, all the best and good luck with it.

EDIT: My initial post updated with more information on ME FW on MT type 0568, 0569, and 0606 against the 4351, 4352

6

Thank You anyway, I guess I need to check ME version combability now and swap it (somehow) - I have flasher, so I don’t afraid of brick of motherboard.

7

Careful… a big mess here

8

Ouch… Maybe it’s possible to disable / update ME ?

9

Disable or trying to force ME FW v8 images on Type 0606 (Sandy Bridge), its a mod and requires tests from a user side, with high chances of several fails, only a user that can spare such system for testing purposes.

Like the this D30

Officially for type 0606, if you’ve done the latest update Management Engine Firmware Update Tool - ThinkStation C30, D30, S30) package from Lenovo 7.1.92.3273, it’s the last one known.

10

Hi.

Regarding the old version (0606 and those older)

I have been contemplating at upgrading the bios, but never got any further, but now the motherboard is and old dino, and perhaps it could live on if I upgraded the Bios ? I’m awaiting a CH314a, hopefully it will arrive around start to February, so bricking will be ok.

A question (without knowing too much about bios/uefi):

The current BIOS allow for disabling the Intel ME (at least that is what in fact what the bios says), would it when be possible for me to inject CPUID code into the UEFI and support E5 v2 processors, would this work ?

The other thing I would like to try is to enable Re-Sizeable BAR, as the motherboard does support Above 4D decoding (GitHub - xCuri0/ReBarUEFI: Resizable BAR for (almost) any UEFI system)

Any other interesting idea ?

11

Ok, I finally got some hardware now. The CH341a programmer arrived from china, quality is decent and seems worth the money. I still need to verify downloading data from a generic SPI chips works, aka. setup verification, before I use the “claw” on the two real chips. Seems like both the intel and bios is sitting in separated chips.

Also bought (locally) a Axagon PCEM2-N PCIE NVME M.2 ADAPTER, including a NVME drive, Team Group SSD MP33 512GB M.2 PCI Express 3.0

Also bought a E5-4610 v2 from eBay, the E5-4610 v2 will arrive within days. I will later upgrade to E5-2697 v2, when I find a decent price on AliExpress, eBay prices are #¤%, I might end up buying one from AliExpress. The key word here E5-x6xx series, the “6” denotes support for atomic pci operations (need for AI image generation on a AMD RX 480 using stable diffusion/pytorch)

The cool thing is : all the bios version from both HW versions are available all the way down to the earlier versions, they are all hidden but present on Lenovo’s download server. Url was https://download.lenovo.com/pccbbs/thinkcentre_bios/?name?>, where ?name? could be a0jy61usa.exe, a0jy60usa.exe,… (a0 = old HW, a2 = new HW). The number denotes the release number.

I created a new bios to test. I found the the FIT table was screwed up regarding micro CPU codes, but since I have two bios, near identical, I just replaced the old E5-V1 with the new E5-V2 table, time will tell if this is ok. I also injected PCIe NVME boot driver and Resizable BAR driver.

Now all I need to time to backup the two chips, reprogram and verify.

Due to holiday, kids, life and other stuff, next free “timeslot” is next Tuesday.

12

Ok, I was toying around with flashrom and dmidecode while waiting for time to disassemble everything. Using dmidecode I found that my bios was an older version “A0KT46AUS” and using flashrom I found that the it’s only ONE chip (not two) and it’s 128Mbit big and contains:

FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG1: BIOS region (0x00800000-0x00ffffff) is read-write.
FREG2: Management Engine region (0x00014000-0x007fffff) is locked.
FREG3: Gigabit Ethernet region (0x00012000-0x00013fff) is read-write.
FREG4: Platform Data region (0x00001000-0x00011fff) is read-write.

Then I used this to create a layout file:

0x00000000:0x00000fff descriptor
0x00001000:0x00011fff data
0x00012000:0x00013fff giga
0x00014000:0x007fffff intel
0x00800000:0x00ffffff bios

and dumped the bios region using:

flashrom -p internal --layout layout.txt --image bios -c MX25L12805D -r dump.bin

then I split the file in two equal sizes (bios = upper 8M) using split and renamed it

split -n 2 dump.bin
mv xab bios.rom

I got the bios ROM, but it does not match exactly the image from a0jy46usa.exe, which is really odd, as they both contain the same number and id string “A0KT46A”. UEFITool (also UEFITool/NE) accepts the ROM and it checks out ok. FIT table is still odd. A diff shows there are multiple regions that differs, in total 143566 bytes are different (“cmp -l”), odd, maybe a there was multiple A0KT46AUS versions around, never mind.

But :slight_smile: … I can flash the bios via flashrom and I don’t need the stupid programmer on (only when bricking)

Too bad this aint the case for the Intel ME section, I’ll need the programmer if I need to mess with that one

13

I had a little chat with ChatGPT :grin: asking it how to upgrade ME from 7.x to 8.x, it ain’t stupid.

ChatGPT : Got it! Since you have a CH341A programmer and a full flash dump, you can directly modify and reflash the BIOS. Here’s the streamlined process:

  1. Extract & Analyze the BIOS Dump
    Open the full flash dump in UEFITool or Intel FITC (from ME System Tools).
    Identify the following regions:
    Flash Descriptor (FD)
    Intel ME Region
    BIOS Region
    Boot Block (inside BIOS region)
  1. Upgrade Intel ME from 7.x to 8.x
    Download a clean ME 8.x firmware for X79/C600.
    Use FITC to replace the ME 7.x region with ME 8.x.
    Ensure FD settings allow ME to function normally (not in locked/debug mode).
    Rebuild the BIOS image.
  1. Preserve the Boot Block
    Use UEFITool or Hex Editor to compare the original and modified BIOS.
    Ensure the boot block (usually at the start of the BIOS region) is unchanged.
    If necessary, merge the old boot block into the new BIOS before flashing.
  1. Flash the Modified BIOS
    Use CH341A + AsProgrammer or NeoProgrammer to write the new BIOS.
    Verify the flash after writing to ensure integrity.
  1. Test with Xeon V2
    Install Xeon V2 and power on.
    If no boot, check:
    ME Status (meinfowin.exe -verbose)
    Microcode updates (may need adding for Ivy Bridge)
    BIOS settings for PCIe & CPU initialization
    This should get your S30 running Xeon V2. Need help finding ME 8.x firmware?

Also later when I was asking where I could find ME dumps it said winraid :grinning:

14

Tried to connect the CH341a to the bios, but the clamp is bad quality and it does not stick to the chip as it should - the clamp solution is really bad, so I could only get a partial bios out. Next step is to solder on 8 wires so I can connected the CH341a without the clamp.

I also looked for ME_DISABLE jumper without luck, there is however jumpers to allow ME firmware update and others, but I also need to solder on jumpers to test those.

15

POMONA 525x

Already explained, some boards do not have the pins soldered to the header, some do.

16

Dragged the entire thing to work so I could solder, but during inspection of the motherboard with proper lighting and magnifying glasses I accidentally found the ME_DISABLE jumper. I did not solder anything on the BIOS, as it was to difficult to solder without the motherboard completely removed from the chassis.

jp56
jp56882×666 268 KB

After booting Linux with a jumper jp56 the entire BIOS region is now read/write.