[Request] Lenovo Yoga 900 BIOS Unlock / AHCI enable (attached BIOS fd)

[jameshermann]

Hi, on the latest Lenovo Yoga 900-13ISK2 [i7-6560U, 16GB LPDDR3, 512GB SM951 NVMe) with a newer SSD (not the previous model with SATA SSD) Linux cannot be installed as the SSD operates in RAID mode, and the BIOS settings are locked, so I cannot get it into AHCI mode, which is required for Linux to detect the SSD.

I did some digging with the latest available BIOS update from Lenovo (attached zipped fd file) and extracted the IFR strings where it says that the EFI Variable to switch SATA operation mode is 0xB69 and it needs to be set to 0x1 (currently it's 0x2).

I can boot into an EFI shell but cannot set these variables using the UEFI shell setup_var as I think the BIOS is locked, operation fails with error 0x000000000000001a .

Alternatively I used the latest version of the Intel Flash Programming Tool (fptw64) bundled with Management Engine Tools to extract the BIOS Section from the SPI Flash [which for this model is a W25Q64]. The dump is 6144KB in size and also included down here. I opened it in a hex editor but couldn't really make much sense of the data inside.

Any leads to either unlock the BIOS / hidden settings or be able to alter the EFI variables would be highly appreciated.

[Da Vinci Code]

Hello!
What is error type and number do you see at results screenshot?
All new bioses are rewrite protected so mod can be flashed using SPI PGM+Pomona Clip only!
Do you have these tools?

[jameshermann]

Hello!
What is error type and number do you see at results screenshot?
All new bioses are rewrite protected so mod can be flashed using SPI PGM+Pomona Clip only!
Do you have these tools?

I posted the error code I get when I do setup_var in the EFI shell as above -- the error code it gives is - 0x000000000000001a and it flat out refuses to set the variable.

I haven't yet tried using Intel's FPT utility to write into the SPI Flash the dump that I created, and I know that it might not work due to lock.

But if I were to use the hardware SPI flash programming tools, what would I have to change, and how?

Alternatively, is it possible that there is a key sequence that might trigger advanced settings? If so, how do I find it in the BIOS dump?

[Da Vinci Code]

Intel FPT tests your bios chip(s) and show what are presented.
You already posted it is W25Q64.
Bios dump located into chip and can be read using Programmer.
After that you must upload it here so i can modify it.
Now you can flash bak mod using programmer,then we can see results.
Anyway, if mod will brick your laptop so you can easy recover it flashing old bios dump

[jameshermann]

I'll get the tools. In the meantime, can the BIOS dump I attached above made using FPTW ( command given : fptw64 -d bios.bin -bios ) help?

[Da Vinci Code]

Yes, it can help!
It show us what are chips presented on you MB, so you can know it names.
This tool tell us about rewrite protection to your chips if presented.

[jameshermann]

Cool. I wonder if the BIOS mod can be performed on the FPT dump itself, and flashed back using FPT.

[Da Vinci Code]

I no think so,modern bios chips are rewrite protected.This protection injected to laptops from 2013 year old.

[Bownairo]

Is there any update on this? I have the same issue and am looking forward to a fix.

[notz]

Is there any update on this? I have the same issue and am looking forward to a fix.

I have a 900s and the same problem. The 900s have a different eeprom chip (W25X40CLIG) which is not compatible with an ch341a programmer. I now have ordered an TL866 which should be able to read/write my chip. Hopefully with this and some help from an advanced Bios-Hacker i will be able to install linux, because Lenovo don't care.