This sums up discussion related to Lenovo P14s Gen5 in this thread. Credits go to Sbaro and especially Maxpower3. The locked dump is attached.

The device is based on NM-F871 motherboard with Nuvoton NPCK397 series controller. The motherboard also contains three BIOS chips: two different Winbond chips for main BIOS and external EC flash, and also a Gigadevice chip which purpose I do not know. The password information is contained directly in controller and thus can be manipulated by reprogramming it, so reprogramming BIOS chips is technically not required, however you may wish to make...

Yes, everything, the model, serials, UUID, license etc.




Maybe. A one-byte checksum is not the best integrity protection, but one may try to calculate it on the "password" lines and see if it matches.

The write protection errors appeared somewhat intermittently, sometimes they were shown, sometimes they were not. The setting that I changed (for testing purposes) on and subsequently off (the Fn button role) also showed weird behavior. Sometimes it was in fact enforced although in BIOS is was shown as off. All in all, BIOS appeared unstable...

OK I see the logic. Sweep the supposed password fields and the pointers as well. Many thanks, that brought great progress. Here's what happened:

1. Initial state: CMOS battery disconnected, SSD disconnected.
2. EC patched
3. Power supplied, the laptop loads with SVP retry count error, but without bad SVP data error. SVP not requested, can enter BIOS. Power disconnected.
4. CMOS battery connected, power supplied. SVP retry count error persists. Enter BIOS. Set date and time, turn off the SVP retry counter. Save changes (successful). Restart.
5. SVP retry count...

Vertyanov SUCCESSOR BASE4. As the MB connection description file of the programmer suggests, it does not support NM-F871, only NM-F871P (dunno if the difference matters), but anyway the settings for NM-F871P sufficed. Also, the description suggests to remove EC flash (if I understood it correctly), but I managed to read the EC without desoldering its external flash. Also note that the motherboard KB connector is 36 pin, but if you look attentively you see that the last 5 pins are not used. So you do not need a 36 pin cable, the 32@0.5mm cable which ships with Vertyanov suffices....

Well spotted, thanks. Especially those small squares, these are clearly pointers....

Which encoding is this?

Meanwhile, continuing to attack the problem.

6. Returned to my original dump and zeroed 0x0003E420 to 0x0003E48F only. No way: "Retry counter exceed" and "Bad SVP data".
7. Same as attempt 4, "mended" register sequences but only the first "password" region zeroed. This is closest to what succeeded for L15 G4. No way: "Retry counter exceed" and "Bad SVP data".

Something tricky is going on. I suspect that the retry counter messes the password check, probably if it's exceeded...

Ah thanks, seems better than I thought :-)

Hi all, not a laptop repair professional, but the necessity to restore the SVP to my own laptop which I set and lost record of brought me here. Yep I procured CH341A and then Vertyanov to this sole end, gradually getting deeper into the stuff. Cheers!

Hi, thanks for sharing. Did you zero the region from 0x0003F420 to 0x0003F48F manually as well, or that happened automatically after the power-on?

I am struggling to restore the SVP on P14s Gen5, serial PF-4XL6BX, the MB is NM-F871 Rev 1.0 and the EC is NPCK397KA08, dump attached.



The problem is additionally complicated by the "Supervisor password retry count exceeded error." So far I was unable to locate the position of this counter in the dump.

I noticed that the dump for P14s G5 is structured pretty in the same way as for L15 G4,...