[Problem] Howto get full NVMe support for Lenovo X1 Carbon Gen 3?

While it does not officially support booting from NVMe, a few sources have indicated that this is entirely possible, and may be a BIOS/UEFI imposed limitation. Would it be possible for someone to take a look at this and give me a more detailed response as to how this can be achieved? I know it’s possible with clover but I want to avoid the hassle of needing multiple bootloaders (since I’m going to dual boot). Thanks!


Edit by Fernando:
Since there were at least 2 threads about the same topic, I have merged them and customized the title.

@DarkWorld - Need link to BIOS, or you can do the mod yourself - [Guide] How to get full NVMe support for all Systems with an AMI UEFI BIOS



Here’s a link, scroll down for older versions

https://pcsupport.lenovo.com/us/en/produ…nloads/ds101975


Does Lenovo use AMI? I’m slightly concerned that I might brick the laptop.

Thanks!

Check BIOS main page and see if ME FW version is shown, if not then download HWINFO64 and on the large window on left side, expand motherboard and find ME area, inside that get the ME Firmware version.
Once you have that, go to this thread and in the section “C” download the matching ME System Tools Package (ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
Intel Management Engine: Drivers, Firmware & System Tools

Once downloaded, inside you will find Flash Programming Tool folder, and inside that a Windows or Win/Win32 folder. Select that Win folder, hold shift and press right click, choose open command window here (Not power shell).
At the command prompt type the following command and send me the created file to modify >> FPTw.exe -bios -d biosreg.bin

If you are stuck on Win10 and cannot easily get command prompt, and method I mentioned above does not work for you, here is some links that should help
Or, copy all contents from the Flash Programming Tool \ DOS folder to the root of a USB Bootable disk and do the dump from DOS (FPT.exe -bios -d biosreg.bin)
https://www.windowscentral.com/how-add-c…creators-update
https://www.windowscentral.com/add-open-…menu-windows-10
https://www.laptopmag.com/articles/open-…ator-privileges

This is Phoenix BIOS not AMI. It is UEFI BIOS though, so NVME Mod can be applied, once we find safest method to do that

Also, once you do find the ME FW version, and get the ME Tools package, please also run the following command from MEInfoWin folder >> MEInfoWin.exe -verbose
and show me the bottom of that report (Checking to see if bootguard is enabled here, on left/FPF side if Measured + Verified Boot are both enabled then you cannot modify BIOS)

Alright, the laptop actually had to be sent back for a day or so to get it wiped (former enterprise laptop, they forgot to wipe it), but I’ll do that once I get it back. I’ll need a SOIC8 Flash Programmer to flash the modified BIOS since this is Broadwell right?

Also, if I brick it will I be able recover by flashing back the original firmware with a live USB or do I need to flash it back with the programmer?

Why did you waste your time and someone’s $$ (Free money for postal service I suppose ) you could and should have wiped it yourself

Broadwell has nothing to do with needing a programmer or not, we’ll only know if you need one you can dump the BIOS region.
I forgot to mention also, as soon as you dump it, try to write it back and if error show me the command entered and the error given all on same screen. Here is command to write it right back to BIOS after you dump >> FPTw.exe -bios -f biosreg.bin

If you brick the board then it’s a brick, usually no recover will be possible without flash programmer. However, some systems have a built in recovery method, that if the BIOS is not bricked badly enough, that can sometimes recover the BIOS via USB
If you can write back BIOS region without hassle, then no worries, it wont brick from NVME Mod.



Not my choice lol since company asked for it back, getting it back in a few hours from now.

I thought maybe you purchased and told someone it contained data, so they wanted it back. Sounds more reasonable if it wasn’t a purchase you made, if it was they should have just told you to wipe the drive.
It makes no sense to worry enough to have you send it to them so they could erase, you could have already copied data and been ruling the world with their data in that scenario

That may be, but I’ve gotten it back now, so just a few days wastyed :smiley:

The UEFI dump is here: https://drive.google.com/file/d/0B5SvZ7D…iew?usp=sharing

The error log when trying to flash it back is here: https://drive.google.com/file/d/0B5SvZ7D…iew?usp=sharing

And the chip ID is: MX25L12805D

thanks!




Not to rush you, but any updates?

My old laptop broke today so I’m using the 128gb SSD in the X1C for now :slight_smile:

@DarkWorld - Sorry for the delay, I’m always behind, hard to keep up sometimes

So you do, or do not have a flash programmer? BIOS Lock and SMI/SMM Lock are both enabled, and these are located in a non-standard module so I don’t think you can change them using setup_var

If you have a programmer, send me full dump with programmer. If you do not, we’ll have to test and see if the stock update package will flash in a mod BIOS for you or not, I will make this for you tonight

IN the ME System tools folder you downloaded previously, find the MEInfo folder, and run the following from admin command prompt >> MEInfoWin.exe -verbose
Check the end of this report, on Measured and Verified boot, do you see enabled on the left/FPF side? If yes, you cannot use mod BIOS, if no, then we’re OK (This is Intel BootGuard)

Will do!

Don’t worry about it if you’re busy, I’m using another SSD for now.

(Sorry, no flash programmer)

OK, let me know about MEInfo result before I send any mod BIOS



I’m so sorry for not getting back to you, I ended up being in China for the past few months where I couldn’t do any work on my laptop.

Anyway, here’s the dump

1
2
3
4
5
6
7
8
9
10
 
                                        FPF                 ME
--- --
Force Boot Guard ACM: Enabled
Protect BIOS Environment: Enabled
CPU Debug Disabled: Disabled
BSP Initialization Disabled: Disabled
Measured Boot: Disabled
Verified Boot: Enabled
Key Manifest ID: 0x1
Enforcement Policy: 0x3
 

Any update? Same MEInfo result, same laptop here.

@DarkWorld - Sorry I lost your thread until now!! Verified Boot is enabled at PCH (Intel Boot Guard), but it looks like maybe DXE BIOS volume is not protected - If you have programmer we can test edit if you want.

@cryptopsy - See above, do you have flash programmer? If not, it’s huge risk of not being able to recover from brick if boot guard does cover the volume we want to edit. It doesn’t look like it, but I can’t be 100% sure (99.9% sure though)

If you both want to try anyway, watch this thread and see if we get past the locks stopping us from writing back via FPT, then if so we can try.
Unlocking 280 write protection in X1 Carbon Gen 3 for NVMe support


* Edit - I checked around to see if anyone flashing mod BIOS on these, and I see whitelist and unlocked menu BIOS here, so boot guard does not cover the regions we need to edit as I suspected
https://www.bios-mods.com/forum/Thread-G…Lenovo-thinkpad

BUT, if we can’t get past the locks you will need flash programmer + SOIC8 test clip

@Lost_N_BIOS : Hi there! I am new here on the forum and to BIOS modding, but hope you can help me.

I also got X1C3 and did the biosreg.bin. Please find it here:
… error … need more posts to add links. Can I send you a PN please?

Intel ME Version is 10.0 and the Boot Guard is enabled.

me_version.PNG



What are the next steps I should take to get my laptop to support NVME?
Thanks in advance!

Whoops, I completely forgot I made a thread on this!

Thanks for taking a look at it, but unfortunately this laptop is currently OOS with a smashed screen, otherwise I’d have taken up that offer :stuck_out_tongue:

@ag4189 - Sorry for the delay, I just replied to you PM as well!

Once I see your BIOS region, I will either tell you we can’t mod, or I will give you new info to dump a certain volume not covered by boot guard (if you are lucky)
I looked at DarkWorld’s dump, and it looks like we can do NVME insert, but I’ll have to have you do dump differently since we can’t write entire BIOS region.
Here, make new dump with this command and send me this file too, along with the biosreg.bin I asked you to reupload in PM
FPTw.exe -a 0xA00000 -l 0x3F0000 -d DXEVOL.bin

@DarkWorld - Find cheap screen on ebay, order from china and wait, then you can fix easy

Thanks for your reply and welcome back! I hope you are well recovered. :slight_smile:

I have done the second dump. I will send you a PN with the link, because I still can’t post any here.
-----------------

Okay, strangely enough I can’t send PNs anymore. :frowning: