There are two Lenovo D30 Thinkstation machine types (MT):
MT4223,4228,4229
A1JxxxUSA bios/uefi
Intel Active Management Technology 7 (SB)
Security chip: Nuvoton NPCT421L for TPM function
Realtek®ALC662 codec
Two LGA2011 sockets, supports up to two processors from Intel Xeon E5-2600
Dual onboard gigabit ethernet, Intel 82579 and 82574
Motherboard: Descartes rev 1.0, Descartes rev 1.1
MT4353,4354
A3JxxxUSA bios/uefi
Intel Active Management Technology 8 (SB/IVB)
Security chip: STMicroelectronics ST33TPM12LPC for TPM function
Realtek®ALC662 codec
USB 3.0 capability – with tracings and hardware added to the main board
Two LGA2011 sockets, supports up to two processors from Intel Xeon E5-2600 v2
Dual onboard gigabit ethernet, Intel 82579 and 82574
Motherboard: Descartes rev. 2.0
SPI chip - MX25L12835EMI
The D30 motherboard uses a 16MB, 16-pin SOIC chip by Macronix International Co., Ltd.
[[File:SOIC16_rw(1).jpg|none|auto]]
Although there are 16-pins, only 8 pins are actually involved in communication and these are the ones that are used to program the flash memory using the CH341A Programmer and a SOP16 clip. I will be using ASProgrammer 1.41 as it has the SPI entry that is required in their drop down list.
hardware dump method
The bios chip has 3.28V of power between pins 2 (Vcc) and 10 (GND) even when the computer is turned off, but power cord still plugged in. I’m not sure why? Still, I removed the power cord completely. My attempts to read the SPI chip failed. I was obtaining “FF” with the chip_ID selection using the CH341A_SPI programmer. I don’t think it has enough power as this is a very large motherboard with dual CPUs and lots of memory slots. Plugging the power cord back in and retesting didn’t work. Powering up the computer to a POST and attempting the dump also didn’t work, probably because it was interfering with the data lines when active. I unplugged everything again. I purchased a variable external DC power supply similar to what @gyrator used. I turned up the amperage to 600mA and voltage “fine tuned” it very slowly upwards until I got to around ~3.4volts. ASProgrammer was finally able to recognize the chip and dumped the entire SPI contents. The SPI dump had UEFI errors when parsing it using UEFITools. ASprogrammer didn’t work for me. I used CH341A Programmer Version 1.18, this finally got me a very accurate SPI dump without any parsing errors.
software dump method
A full software SPI dump can be achieved by jumping pin JP56, it is labelled: ME_DISABLE
This will allow a dump of the full SPI image using fpt -d spi.bin. I’ve already applied the “FF” bytes to the 3 main areas of the descriptor code. No need to use any pin-mod here.
Once I altered the descriptor region and flashed it back into the bios, I didn’t need to use the jumper any longer for future flashes. However, the BIOS region has 2 major protections, FLOCKDN bit and BIOS_CNTL. These need to be overcome to get fpt to fully work.
Thankfully, the OEM manufacturer, Lenovo has created an ivb-capable bios A3J366USA. They only made it possible to use in the MT4353 and MT4354 machines because these have been outfitted with ME8 firmware (hopefully that’s the only restriction).
I opened FITc v7, loaded the original SPI dumped image and kept the window open.
Opened FITc v8, adjusted the SKU at the top (C600, Patsburg A), then imported the: BIOS Region (A3J366USA bios), GbE Region, OEM, PDR from the FITC v7 decomp folder.
Next, I imported the ‘8.1.72.3002_5MB_PRD_RGN’ at the ME region and afterwards manually adjust every single FITc v8 setting found at the tool to match the values from FITc v7 ME region.
Problems
There is a FITc v8 crash when I adjust the GPIO Expander Enable parameter from ‘true’ to ‘false’
When I load the File Descriptor region only in both versions of the software I get this:
So I plan to just leave this alone, and see what happens.
When I open up the ME7.1 region by itself in FITc v7 (SKU: C600, Patsburg A), I get these values:
When I load the full SPI image in FITc v7 (SKU: C600, Patsburg A), and look at the ME tab, I get these values:
I believe these values in the above pic are known as default values, because when I change the File Descriptor:PCH Strap 17 to “buffered through mode” a window pops up that says all the ‘FCIM/BTM Specific ICC Registers’ will be reset to default.
The original SPI image had PCH strap 17 set to “buffered through mode” so I’m thinking it should be that way, but why are the ME Region values by itself so different?
per @plutomaniac , it likely is the FITc bug reported in other posts here.
My solution to this was to drag/drop the desc.bin region right into FITc 8 right from the beginning and then use a separate instance of FITc 7 that has just the ME Region loaded it, and then edit the FITc 8 ME region accordingly, they then matched up without conflict. I loaded in the other regions (GBe, PDR) per usual with the input-file command. So basically, the only editing to do is in the ME tab.
