LENOVO Thinkpad L14 Gen 2 HL4A0 HL5A0 NM-D271 REV 1.0

[Andromedus_81]

Can someone check where I made a mistake in the editing?
Laptop: Lenovo ThinkPad L14 / Gen 2 Type 20X1 / S/N 3VQTP1.
I dumped the EC using SVOD, modified it to remove the BIOS password. Unfortunately, after flashing the edited firmware, the laptop won’t turn on—there are no signs of life. So I can’t reflash the original dump unless there’s something I don’t know that could help.

[reformatt]

Can someone check where I made a mistake in the editing?
Laptop: Lenovo ThinkPad L14 / Gen 2 Type 20X1 / S/N 3VQTP1.
I dumped the EC using SVOD, modified it to remove the BIOS password. Unfortunately, after flashing the edited firmware, the laptop won’t turn on—there are no signs of life. So I can’t reflash the original dump unless there’s something I don’t know that could help.

To answer my original post, SVOD3 does not support the NPCE68xx NUVOTON. I had to upgrade to a SVOD4.

To remove the password, you only need to fill 5C420 ~ 5C459 and 5D420 ~ 5D459 with 0's. You overwrote more than that in your modded file. Just use your SVOD4 to rewrite the EC code. You do need to pull the battery and power after updating the EC.

In HxD, you can just select block 5C420 (length 50) and 5D420 (length 50) and fill with 0's for both locations. Don't touch anything else.

For reference, serial number is at 5C155 ~5C15C and 5D155 ~ 5D15C.

[reformatt]

There also seems to be a bug with the SVOD4 and reading this EC. On initial startup, I select NUVOTON, connect USB-C power to the laptop, select Read ID, then Config NUVOTON for 384K, NPCE38/48/58/68, then hit Read. Regardless of SPI speed, this read is very slow and results in null data.

If I select Read ID again, then Config Nuvoton again, the Read is relatively quick and I get the correct data. As long as I don't relaunch the software, all subsequent read/writes are fine. If you walk off after programming and come back much later, a verify fails. But if you do the Read ID, Config NUVOTON steps again, verify succeeds. Might be handy to others as I was wondering WTF was going on. I'll message them on Telegram and see what they say.

[reformatt]

Did some more experimenting with the slow read on the NPCE68BPA0DX EC with SVOD4. After launching the SVOD4 software, I would select Nuvoton as program mode, select Read ID, then Config Nuvoton to 384k and check NPCE38/48/58/68. This would result in a very slow read (around 10 minutes) and data would all be E7. Sidenote: SVOD4 will only detect the EC with both battery and power plugged in. Battery also needs to be pulled and reconnected after write to get the system to boot.

If however, you select Config Nuvoton first, then Read ID, the chip is identified but size returns to 128kb, so you have to hit Config Nuvoton again to set size back to 384kb. Then the read only takes a minute or so and you get the correct data. Have communicated this back to Aditya11ttt and he will follow up with the developer. But it's a workaround at least and I wasted some time on this. Hope this helps others.

One of the 6 laptops I'm doing the fix in Post 142 result in SVP bad data error, all the others are fine. This is a checksum issue in the password area but no idea where that is specifically. It appears that this machine machine support multiple levels of supervisor passwords and I believe this specific machine had more than one. I copied over another file from the other laptop and changed the serial number etc manually, but this resulted in a RFID mismatch. Needs more editing, but I'll upload the file here if I can't work it out.

[Maxpower3]

result in SVP bad data error,

post your dump

[reformatt]

Always get SVP error on this one, the other 5 I did worked fine. If i splice one of the other EC files into it from 5C120 and modify S/N, works ok, but get RFID error. Giving up so work your magic.

[Stefan Steff]

Always get SVP error on this one, the other 5 I did worked fine. If i splice one of the other EC files into it from 5C120 and modify S/N, works ok, but get RFID error. Giving up so work your magic.

Before master Maxpower3 make his magic please try this patched file and provide some feedback.

[Maxpower3]

Before master Maxpower3 make his magic please try this patched file and provide some feedback.

It looks clean, try it reformatt
several pieces in this version. Stefan Steff cleaned up

[reformatt]

Thanks team. Get the following error on boot:

0183: Bad CRC of Security Settings in EFI variable.

I thought this was something in the EC code but after reprogramming the EC again to experiment, the CMOS checksum was bad and defaults were loaded. The checksum error above then disappeared so that must have originated from the BIOS, not the EC. So your new EC upload was perfect.

Many thanks for this guys, I still have a bit to learn.

[reformatt]

I'm not one to just plug and play - I need to know how to do this was done! So I did a file compare to see the differences so I'll jot this down so I remember it in future (don't want to keep bugging you guys when the I have a another big shipment of these).

So the data at 5C470 ~ 5C47F is the key. This appears in multiple locations in this file, however for each later instance after 5D470 the 5th byte increments by 1. So you just search on the first 4 bytes (in this case 01 38 C7 80) and it shows 7 more instances incrementing by 1 for each one.





So in addition to filling 5C420 ~ 5C46F and 5D420 ~ 5D46F with 00, also have to find each instance of the 5C470 ~ 5C473 pattern and fill the preceding line with 00. Example from 5D810, fill 5D800 ~5D80F with 00.



Such a black art but hopefully this will be all I have to do for the next shipment. Thanks to Maxpower3 and Stefan Steff for the massive help in showing me what to do.

[reformatt]

Ran into a problem on this machine when I was packing it up. CMOS battery was a bit low at 2.8V so replaced it. After that machine fails to respond to power button. It flashes 3 times when power is applied but doesn't power on. Power button drops to 0V when pressed, EC verifies ok. It draws around 6ma. Only thing I can think off is maybe the BIOS corrupted itself while I replaced the CMOS battery? I attach it here. It looks complicated in UEFI tool with protections etc so I have no idea. I was a bit concerned the RTC voltage may have spiked and killed the PCH, but resistance seems fine and 3V is present ok.

[Stefan Steff]

Ran into a problem on this machine when I was packing it up. CMOS battery was a bit low at 2.8V so replaced it. After that machine fails to respond to power button. It flashes 3 times when power is applied but doesn't power on. Power button drops to 0V when pressed, EC verifies ok. It draws around 6ma. Only thing I can think off is maybe the BIOS corrupted itself while I replaced the CMOS battery? I attach it here. It looks complicated in UEFI tool with protections etc so I have no idea. I was a bit concerned the RTC voltage may have spiked and killed the PCH, but resistance seems fine and 3V is present ok.

What I do when changing the 3V battery is to short the battery pins on MB for 2-3 seconds before plug in the new battery, unplug the main battery(s) then insert the power plug and leave as is.
Can take sometimes a lot of time to startup but i hear the beeps for time setting even if I'm on the other corner of my lab.

[reformatt]

It's not a BIOS issue - I did try a clean ME BIOS known to be working and result is the same. Referring to the NM-D271 schematic power sequence, it gets stuck at VCCST not being enabled. The internal 1.05V is being generated by the PCH, but it's not asserting VCCST_OVERRIDE to enable the voltage switches for VCCST. Only info I can find on that is that it should be enabled when USB-C is connected. USB-C is going from 5V to 20V ok, but charging is not being enabled (presumably because it hasn't completed a CMOS reset). About the only thing I can think to try is USB-C firmware. Other than that it's probably a CPU/PCH fault.

[Stefan Steff]

It's not a BIOS issue - I did try a clean ME BIOS known to be working and result is the same. Referring to the NM-D271 schematic power sequence, it gets stuck at VCCST not being enabled. The internal 1.05V is being generated by the PCH, but it's not asserting VCCST_OVERRIDE to enable the voltage switches for VCCST. Only info I can find on that is that it should be enabled when USB-C is connected. USB-C is going from 5V to 20V ok, but charging is not being enabled (presumably because it hasn't completed a CMOS reset). About the only thing I can think to try is USB-C firmware. Other than that it's probably a CPU/PCH fault.

At least there is a chance with the USB-C firmware...anyway keep us updated about results...maybe about how did you fix it
Good Luck !