LENOVO THINKPAD E540 supervisor Password

[malighasn]

hi guys
sorry I don't know where to post this
I search everywhere for about 8 month to how to remove supervisor password and got nothing out of it.
lenovo said I have to replace motherboard and .....

I set supervisor password ( I think 3 charechter or 3word3number3word like XXX540XXX ) and hard disk password (3 character ) and i forgot SU password I used hiren boot cd 15.2 but nothing works
I set HDD AND SU two separate password i know the HDD pass cause I had to enter it every time to use laptop but I forgot su password sadly this was the second time i forgot the su password last time i set it like (hmd) and after update it to 2.27 i change t something i don't remember

PLEASE HELP ME REMOVE THE SU PASSWORK.
thanks in advanced

I have 
LENOVO THINKPAD E540 laptop
system model 20C600ABUE
with BOIS Version J9ETA2WW (2.88) 2018-06-20 - i update it myself*
SMBIOS VERSION 2.7

*-------------lenovo readm file regarding 2.88 bios update-----------------------
BIOS: 2.28/ ECP:2.27
This release includes following changes for E440,E540.
[New functions or enhancements]
- Security fix addresses LEN-22133 Speculative Execution Side Channel Variants 4 and 3a (CVE-2018-3639, CVE-2018-3640).
Summary of Changes

  Where: <   >        Package version
         UEFI:        UEFI BIOS version
         ECP:         Embedded Controller Program version
         [Important]  Important update
         (New)        New function or enhancement
         (Fix)        Correction to existing function

Memory Map Information
----------------------


Reserved Area:
The following conventional memory addresses are reserved by the UEFI BIOS and
others.

  C0000-CFFFF : Reserved for Video BIOS
  D0000-D0FFF : Reserved for Option ROM of Ethernet (*a)
  E0000-FFFFF : Reserved for System BIOS

  *a: This area will be released in case of Ethernet LAN Option ROM was NOT used
      at system boot.


Usable Area:
The following memory address can be used by the memory manager such as EMM386.

  D0000-DFFFF or D1000-DFFFF (*b)

  *b: Memory address will be changed to D1000-DFFFF when Ethernet LAN Option ROM
      was used at system boot.

  Note:
  Certain addresses in this area will be reserved for optional devices by
  Operating Systems. The addresses vary and depend on the design of each
  Operating System.


-------------------------------------

[DeathBringer]

Make a current dump BIOS.

[malighasn]

Make a current dump BIOS.

HOW??

[DeathBringer]

Current dump of BIOS will not help.
You need to read Security EEPROM (USROM1) by hardware programmer. E.g. CH341A and SOIC8-clip.
BTW: How much new motherboard is cost?

[malighasn]

Current dump of BIOS will not help.
You need to read Security EEPROM (USROM1) by hardware programmer. E.g. CH341A and SOIC8-clip.
BTW: How much new motherboard is cost?

I don't know exactly how much it cost - i just ask question on community forum.
where can i get one of E.g. CH341A and SOIC8-clip? and  how much i cost me?
if I buy and read the Security EEPROM with what ever programmer WILL I COULD wipe SU PASSWORD without and damage?
IS THERE a guarantee?
and how can i find EEPROM on my motherboard? i mean how can i locate them?

[DeathBringer]

Too many questions. I think you can't do it.
Go to service.

[KONNEX]

It's the smaller chip next to the 2 bios chips. It says something like "L01 8" (do not remember) Pretty much exactly under the buttom cover for the HDD.
So would have to disassembly the whole device to get next to the chip (if I remember right).