Thunderbolt controller firmware update - X1 Carbon gen6

[LordChaos73]

Hi,

I'm one of the many owners with this laptop and I've lost HDMI output. I'm not sure when it exactly happened, but I think it was when I updated the Intel ME firmware a month or three ago. Basically, nothing happens when an external monitor is connected.
I've read a lot about this particular issue on (Lenovo) forums and it seems the following firmware update can fix this issue:

https://pcsupport.lenovo.com/nl/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-X-SERIES-LAPTOPS/THINKPAD-X1-CARBON-6TH-GEN-TYPE-20KH-20KG/20KH/downloads/DS502615

The laptop has the latest BIOS update (1.57) and the latest Intel ME firmware installed as well.
The thing is, my laptop is running Arch Linux solely. Could this update be made available for Linux users (fwupdmgr) as well?

[hughsie]

@LordChaos73 what firmware version are missing? Thanks.

[LordChaos73]

@hughsie My question is: is the thunderbolt controller firmware update (as linked above) available on the LVFS platform?

[mrhpearson]

Hmmm - looks like we last updated the TBT controller on the X1 Carbon 6 two years ago.. with version 43.
I'll check with the FW team when (hopefully not if) the next update is - it looks like they're now up to version 47.

All that being said - I don't see why a TBT controller update would have any impact on HDMI display - unless you're connected via a TBT dock maybe? Any reason you think this particular FW update will help? I'm happy to chase an update (it should be done) but I don't think it's going to fix the root cause of your issue.

I've created internal ticket LO-1984 for tracking

[LordChaos73]

@mrhpearson please see the following posts:

https://forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/X1-Carbon-6th-gen-HDMI-Thunderbolt-stopped-working/m-p/5120432

https://forums.lenovo.com/t5/thinkpad-x-series-laptops/x1-carbon-6th-gen-hdmi-not-working/td-p/4091511

https://forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/X1-Carbon-6th-Gen-HDMI-Not-Working-and-Thunderbolt-Missing/m-p/4326149

[mrhpearson]

Got it - thanks.

[dal00]

I have the same issue with thunderbolt not working and hdmi also having issues. I'm even unable to see thunderbolt in lspci.
Windows can't see it in the device manager too and I'm unable to flash it from windows.

@LordChaos73 Are you even able to see the thunderbolt controller in lspci?

[mrhpearson]

Do you know which version of FW you had on there previously? There was a critical update a while back (2019) that was published and I'm pretty sure we put those updates on LVFS.
https://support.lenovo.com/ca/en/solutions/ht508988-critical-intel-thunderbolt-software-and-firmware-updates-thinkpad

My understanding was that if the FW wasn't updated it was possible to brick your TBT controller.
If you already had that update then we can ignore that as a theory. If it's not working in Windows it is worth calling customer support for assistance - you may have a HW issue.

[LordChaos73]

I remember about the critical update back in 2019 and I've always had the latest possible firmware installed since. Since so many X1C6 owners seem to have this issue, I'm wondering if the patch was successful in the first place.
Anyway, since this was my production machine until very recently, I know everything was working fine until we had the Intel ME issues that failed to install. I think I lost HDMI output around that time. And if I remember correctly, there was also a new BIOS release at the time.
I'm also not seeing my Thunderbolt controller using lspci (I've attached the output of 'sudo lspci -v').
lscpi.txt

[dal00]

@mrhpearson I'm not sure as I'm unable to connect to the controller in any way that I know of.

But here is a dump of the fw from the W25Q80DVSNIG
x1c6_tb3.zip

[mrhpearson]

Ack - thanks for the details and they've been forwarded to the FW team.

[mrhpearson]

Hi - can you confirm the BIOS, EC and ME FW versions please (easiest is to grab them from the BIOS setup screen - F1 during early boot). The note from the FW team says:

I checked history, there was an issue that system will lost TBT controller and fixed by one EC firmware on X1 Carbon G8 project, never hear this issue on X1 Carbon G6 project. So that is why I suggest to have a try with upgrade BIOS/EC to newest, feel sorry that cannot give specifics of which version of EC.

Not sure why they can't tell me which version of FW...(I'm pretty annoyed about it, but it gets worse)

It looks like they released a new BIOS/EC combo update on the Lenovo support site - but the EC has not been released on LVFS (the BIOS has). I'm really grumpy about that (the BIOS is updated)

Can you try the cab file that is on the Lenovo site (https://download.lenovo.com/pccbbs/mobiles/n2wul23w.zip). I did the update on mine ('fwupdmgr install N2WHT20W.cab' - I had to set 'OnlyTrusted=false' in /etc/fwupd/daemon.conf) and it looks good - but I also wasn't having TBT issues.

I don't know if the new EC will fix the issue - there is nothing in the internal release notes that references it - but it sounds like it should be tried. I'm pushing them to get the EC on LVFS ASAP.

Mark

[LordChaos73]

I´m not sure the cab files you provided are the correct ones?

[levid@x1carbon6 n2wul23w]$ fwupdmgr install N2WHT20W.cab
Decompressing… [ - ]
No supported devices found

[levid@x1carbon6 n2wul23w]$ fwupdmgr install N2WET37W.cab
Decompressing… [ \ ]
No supported devices found

[LordChaos73]

By the way, I downloaded the ISO of the latest BIOS and wanted to see if I could re-apply it. So I created a bootable USB stick with the latest BIOS, but I can't seem to re-apply it; the setup program states there is nothing to do. Is there any way to re-apply the BIOS update? I was hoping the ISO is carrying the EC update as well.

[mrhpearson]

Sorry - those are X1Carbon 8 items...my bad.
I'll look for the X1 Carbon 6 ones.

[LordChaos73]

Hi @mrhpearson were you able to find them?

[mrhpearson]

I checked and the X1 Carbon 6 versions I can find are the same you already have - so I went back to the FW team and asked for any other suggestions. Not heard back yet.

[LordChaos73]

@mrhpearson what about the EC update that was never provided on lvfs?

[mrhpearson]

EC 1.22 is here (and under stable) https://fwupd.org/lvfs/firmware/5728

Checking the released notes on the support site it's the latest version:
https://download.lenovo.com/pccbbs/mobiles/n23ul35w.txt:
1.57 (N23UL35W) 1.57 (N23ET82W) 1.22 (N23HT37W) 01 2022/08/25

[LordChaos73]

Is there any hope on restoring Thunderbolt/HDMI functionality? A BIOS update maybe?

[LordChaos73]

I see there's a new version of the Intel ME available - 11.8.93.4323. It's not on LVFS yet?

[cdrn]

Howdy all -- having the exact same issue w/ the exact same bios. Any suggestions here?

[kmauleon]

I see there's a new version of the Intel ME available - 11.8.93.4323. It's not on LVFS yet?

hi @LordChaos73 still under testing... hopefully will be available by end of this month... please open separate issue for proper tracking. thank you very much

[RAY5D]

@cdrn Same issue here. I'm trying the full hardware route by buying W25Q80DVSNIG chips to replace the one on my motherboard that has gone bad, and programming them through a CH341-based programmer. Before the fix, the laptop was not shutting down properly by Windows, could only pull 15W from the charger instead of 65W, and had no HDMI output. The binary file provided by @dal00 fixed the charging issue, but nothing else. I'm not sure if that's a compatibility issue between BIOS, EC, and TB versions or there are other problems. I have BIOS 1.57 and EC 1.22, which I think is the latest. I just need to find a working binary for the TB controller.

[tw0flower]

I also have this issue (HDMI and DP not working). When I first noticed it I updated all firwmares through fwupd so I have everything on the latest version now. I have no idea if the critical fix from 2019 was applied on this computer as it is second-hand so I'm not very hopeful in my case. Does anyone know if it was rolled out automatically through Windows Update?

I'm in the process of getting an EEPROM programmer myself, because the controller does not even appear in lspci output or in Windows Device Manager.

Do you still have the original data that was on your chip before you flashed it by any chance @RAY5D ? I'd be interested in comparing it to what I have. It's interesting that after changing the chip for a new one you still seem to face some issues.

[RAY5D]

@tw0flower Sorry, I don't have any data backed up. When I used the programmer on the old chip, it read all 0xff, which I think is the "default" value for this type of storage. It will still read 0xff even after writing whatever data, so the chip is most likely dead as dust since the programmer could still read its model number, indicating a correct connection. I'm pretty sure the only thing I need now is the binary file, but that is, unexpectedly, hard to find. Can you post your data here so I can try? Thanks!

[tw0flower]

@RAY5D Ah, I misunderstood your comment. I thought you had already replaced the chip, and that some other component was writing 0xFF data all over the new chip after you flashed it.

I will post my data, but I don't think flashing it will be useful as my computer also has the HDMI/DP problem. Have you checked these binary files on the LVFS website? https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN23TF.firmware

During my desperate search for answers on this issue, I also found this blog post from a user that had a somewhat similar problem years ago on a Thinkpad P1. He apparently had to flash zeroes over the chip before being able to flash the actual firmware.

It goes without saying, I don't know much about hardware so anyone reading this please take it with a grain of salt. At this point I'm desperate and accepting the risk of bricking things.

[RAY5D]

@tw0flower I did replace the chip and flash the firmware. I also saw that post earlier, but apparently I didn't notice the part about writing 0's first and then flashing the actual firmware (oops). I'll do more testing with the binary files I found and post updates here. However one thing that confused me was that the official binary files from both Lenovo and https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN23TF.firmware are exactly 260KB while the chip is 1MB, and the dumped binary in this issue has some content after that region, so I'm not sure about what should I write after the 260KB.

[tw0flower]

@RAY5D That's what I hope I will find out if I can still extract some data from my chip. There might be some padding involved. I wonder if this information might not be available somewhere in the LVFS files? Because the flashing software must be aware of it right?

But in theory if you zero-out the chip first, then flash the firmware, this would ensure that only the firmware on the chip I think. If there is some padding involved you could also try writing it at the end of the memory by concatenating some zeroes followed by the 260kb file so that the total is 1MB. If the padding is some arbitrary value however we have to find another way.

[RAY5D]

@tw0flower OK I did some more testing. I had 2 binary files, the first one was the 260KB official release, with the extra space filled with 0's, the second one is the dumped data from this issue posted by dal00. For each test case, I filled the chip with a certain value (0x00 or 0xff), started the PC, shutdown, flashed the binary, and start again to see if it works. Here are the results:

1. 0x00 fill, 260KB+0's: No HDMI, charging works, Windows couldn't shutdown properly.
2. 0xff fill, 260KB+0's: No HDMI, charging works, Windows couldn't shutdown properly.
3. 0x00 fill, dumped: No HDMI, charging works, Windows couldn't shutdown, sometimes freezes and goes into BSOD.
4. 0xff fill, dumped: Windows did not complete boot, black screen at login, tried Manjaro, no HDMI.

The results looked overall similar to my previous attempts. Only the charging speed was fixed. However, before the tests today, I noticed that the replacement chip was dead again (wtf!?!?). I think I tried enabling assist mode in BIOS earlier, maybe that caused the early death? Anyways, I just replaced the chip again before the tests since I bought 10, and was careful to only enable assist mode while using Linux, and the chip still works for now. I don't think there is a lot left to do before we can find more binaries to compare and test with. Should I try the official binary but extended with 0xff next time?

[tw0flower]

I got my CH341 SPI today and I found a few things.

First of all @RAY5D if you only see 0xFF bytes on your chip it might be that your clamp is not properly attached. I had this issue at first, I solved it by re-attaching it until I read some data and by using flashrom instead of ch341eeprom. If the RUN led on your SPI board is not on when reading/writing it means something is wrong in your setup.

The first thing I did was to extract the firmware I had installed on my machine. Compared to the firmwares I found online, it had an offset: the first 4096 bytes were all 0xFF. What remained was similar to the firmares I found online.

My initial situation is that everything worked except plugging a second display (HDMI or via Thunderbolt).
I then tried the following:

1. I flashed the newest 47 firmware from the LVFS website. No changes.
2. I flashed the 47 firmware with a 4096 bytes offset. Charging was not using the full power from the adapter.
3. I flashed the 43 firmware from the LVFS website. Charging was working normally again but no luck with the screen.
4. I went in the BIOS and reset the options to default with Windows 10 optimised settings. But unfortunately that didn't help.

So in my case:

• My problem is not caused by a hardware defect from the chip that stores the Thunderbolt firmware. I can read and write on it perfectly. I even made sure that reading after writing a file produced the exact same result.
• Changing the firmware does have an effect. I lost charging. But it had no effect on the external display.
• There was an offset on my firmware. I wasn't compatible with the 47 version. I have not tried it on the 43 version, but it made charging work again without it.

The files that I flashed on the chip are in the attached zip file.
firmwares_x1cgen6.zip

[kubabuda]

Thanks

[tw0flower]

I tried downgrading the BIOS of my computer yesterday. I really don't get why our Thunderbolt are working in USB mode but completely transparent at the same time (no listing in Windows Device Manager and lspci). Could it be a killswitch that was introduced in some an update?

The paper published on the Thunderspy vulnerability states that there is no fix for computers released before 2019. The X1 Carbon Gen 6 was released in 2018. So this vulnerability simply cannot be fixed when it comes to memory protection.
Therefore it's also unlikely that the BIOS or Intel ME could detect our firmwares as being "untrusted" at least that's what the author of the paper seems to suggest in the Q&A:

Why has Intel not fixed Thunderspy?
In our vulnerability disclosure procedure, Intel has confirmed the following:

All three versions of Thunderbolt are affected by the Thunderspy vulnerabilities.
Only systems shipping Kernel DMA Protection mitigate some, not all, of the Thunderspy vulnerabilities.
Only some systems that began shipping since 2019 come with Kernel DMA Protection.
Beyond [Kernel DMA Protection](https://thunderspy.io/#kernel-dma-protection), Intel will not provide any mitigations to address the Thunderspy vulnerabilities. Hence, Intel will not assign any CVEs to the Thunderspy vulnerabilities, or release any public security advisories to inform the general public.

Despite our repeated efforts, the rationale to Intel's decision not to mitigate the Thunderspy vulnerabilities on in-market systems remains unknown. Given the nature of Thunderspy, however, we believe it would be reasonable to assume these cannot be fixed and require a silicon redesign. Indeed, for future systems implementing Thunderbolt technology, Intel has stated they will incorporate additional hardware protections.

Kernel DMA Protection is only available on a limited number of recent systems. Hence, all systems released before 2019, and more recent systems that do not ship Kernel DMA Protection, will remain fully vulnerable to Thunderspy forever. Please refer to Kernel DMA Protection for more information.

Thunderspy involves several problems. One of which is that the signature of the firmware is not checked during boot. I believe this is what the author is referring to when he says that Intel has not done anything beyond Kernel DMA Protection.

But what if they found a way to change this recently and introduced a bug? And the chip is wrongly and silently being deactivated at some stage?

Downgrading the BIOS did nothing, and we cannot downgrade Intel ME through software solutions, I've also tried. Might be doable through a SPI programmer.

I've begun analyzing the files I have with tcfp yesterday, I'll write my results here tonight.

[tw0flower]

Everyone's research on this has been very useful IMO. We have no idea what's causing the issue and it takes a lot of time to dig information. And we're all doing that on our free time.

I'm personally not convinced that the problem lies with the Thunderbolt chip itself. But this might be wrong. One interesting thing to try would be to patch one of the bin files with the Thunderspy vulnerability to force it to the SL0 level.
Unfortunately, and this is what my attempts from yesterday showed, none of the firmwares I've tried has a signature compatible with the signatures provided by the tcfp tool. So we'd have to find how to patch it ourselves.

All images provided by Lenovo are using the SL1 level (user authorization). One interesting thing to note is that the version 47 advertises a fix for a vulnerability without mentioning which one. I don't know any other Thunderbolt-specific vulnerability outside of Thunderspy.

As opposed to the newer firmwares provided by Lenovo, my original firmware's SL level is not even detected by the tool. When I looked manually it seemed close to one of the signatures listed in the tool's code (see here) in terms of offset but the values are different. I have not tried any of the other firmwares that people uploaded here but it might be worth a try.

I'd like to contact the researcher that worked on the Thunderspy paper to ask him if he heard of any mitigation that might have been developed recently. I'll write him a message tomorrow or this weekend.

I've only ever owned Thinkpads as well, my first one was a T42 that I might still have somewhere haha! I remember a common fix for the ATI GPU overheating was to put the motherboard in the oven. Maybe we should try that ;-)

[jnada2021]

Hey. I've managed to get a working bin from a generous donor.
Give it a try and let me know if it solves your issues. Happy holidays!
x1c6-win-tb.zip

[RAY5D]

Hey. I've managed to get a working bin from a generous donor. Give it a try and let me know if it solves your issues. Happy holidays! x1c6-win-tb.zip

Surprise Christmas present O.o?! Did you get it through a programmer or some sort of software means? My friend has an Thinkpad tablet on the problematic list and wants to back up the firmware before anything bad happens. However, the flash chip in that model is not readable without desoldering, and is a pretty annoying DFN package, so it would be very helpful if we can get the data without messing with the motherboard.

[jnada2021]

Some good samaritan responded to my post from December last year. He extracted it with a SOIC clip.

[RAY5D]

Still not working for me. If the bin works for other machines, the problem might be that it contains a public key as mentioned in the Black Hat Thunderbolt 3 Security slide page 29. I searched in the file, and the string "RSA" appeared at 0x38E00 and 0xB8000. The content seems to be the same at both locations, maybe the 2 copies are for assist mode and no assist mode? Anyways, page 31 says all TB3 controllers have unique IDs fused in silicon, but it also mentioned that the statement is inaccurate, not sure what that means. However if we need unique keys just to use the binary on our TB3 chips, we'll have to find a way to read the ID. Any ideas?

[andreidragu]

Hey. I've managed to get a working bin from a generous donor. Give it a try and let me know if it solves your issues. Happy holidays! x1c6-win-tb.zip

can you help me get one for T580?

[jclaveau]

@LordChaos73

I've always had my laptop on the latest (lvfs) updates; I haven't ran Windows in years. Still, I've lost HDMI/TB3 output a few months ago. I'd like to thank @jnada2021 and @RAY5D for all their hard work regarding this issue. Where is Lenovo in all of this? I have a (out of warranty) laptop I no longer can use at work since I no longer can connect it to an external display. I'd like to know if this issue is fixable through some firmware updates. Or should I buy a new machine?

I have a similar issue but I'm waiting my SOIC clips for more than a month now (delivery issue) to be sure.

Meanwhile, I bought an usb-c/HDMI dongle and I can now have a second screen: https://www.cdiscount.com/informatique/clavier-souris-webcam/hub-usb-c-adaptateur-multiport-10-en-1-vers-hdmi-e/f-1070229-elc0713325730599.html#desc (i can't find an english link but you should get the idea)

Hoping this workaround can help you.

[jiahe224]

I installed the Thunderbolt Firmware Update Utility (https://pcsupport.lenovo.com/us/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-X-SERIES-LAPTOPS/THINKPAD-X1-CARBON-6TH-GEN-TYPE- 20KH-20KG/downloads/DS502615),
but the NVM firmware version is 30 instead of 46, my problem is, I set the display to turn off after 10 minutes and the computer never goes to sleep, when the display turn off, the external display will sleep（I'm not sure that whether the status is sleep） because it loss of input signal。When pressed the keyboard or moved the mouse to light up the screen, the X1C will continue to emit a prompt sound that the USB device is not recognized, but the external display can display the image normally, and there is no yellow exclamation mark in the device manager(but the device list will be refreshed constantly), and the prompt sound will disappear after plugging and unplugging the display . My computer is connected to the display through Thunderbolt, and the external display can provide 65W power supply to the computer, I am not using an HDMI cable. I am not sure whether this problem is related to thunderbolt, because my other computer X13 is not installed with thunderbolt software, But everything works fine.

[atoch419]

Has anyone made any progress on this. I have exactly the same issue No thunderbolt no alt DP no hdmi no external display outputs showing up on Xrandr but fast charging still works. from reading this whole thread it seems like something is missing and the reported issue with a bad firmware isn't the whole story. Sounds like replacing the eporom and reflashing dosent work? could the issue be further down stream or are people thinking it's a signature issue? Interestingly I got my machine in mid 2020. I did all the updates on the Lenovo website in windows befor swapping to Linux so I should of installed the thunderbolt firmware fix. although I can't recall reading about this issue until it happened to me. could it be that damage was already done to the chip and even with new firmware it's life time shortened and this failure was going to happen sooner or later?

[RAY5D]

Has anyone made any progress on this. I have exactly the same issue No thunderbolt no alt DP no hdmi no external display outputs showing up on Xrandr but fast charging still works. from reading this whole thread it seems like something is missing and the reported issue with a bad firmware isn't the whole story. Sounds like replacing the eporom and reflashing dosent work? could the issue be further down stream or are people thinking it's a signature issue? Interestingly I got my machine in mid 2020. I did all the updates on the Lenovo website in windows befor swapping to Linux so I should of installed the thunderbolt firmware fix. although I can't recall reading about this issue until it happened to me. could it be that damage was already done to the chip and even with new firmware it's life time shortened and this failure was going to happen sooner or later?

I still think the issue is with the firmware flash chip. The reason mine wasn't fixed is that the original chip has lost all the data, which seemed to be somewhat unique to each computer. I also had a Thinkpad tablet that is vulnerable to this problem, but I backed up the original data, then replaced the chip and updated to the latest version. In this way, no further damage can be done during the update process, and it's still working fine.

[fowoz]

Has anyone made any progress on this. I have exactly the same issue No thunderbolt no alt DP no hdmi no external display outputs showing up on Xrandr but fast charging still works. from reading this whole thread it seems like something is missing and the reported issue with a bad firmware isn't the whole story. Sounds like replacing the eporom and reflashing dosent work? could the issue be further down stream or are people thinking it's a signature issue? Interestingly I got my machine in mid 2020. I did all the updates on the Lenovo website in windows befor swapping to Linux so I should of installed the thunderbolt firmware fix. although I can't recall reading about this issue until it happened to me. could it be that damage was already done to the chip and even with new firmware it's life time shortened and this failure was going to happen sooner or later?

I still think the issue is with the firmware flash chip. The reason mine wasn't fixed is that the original chip has lost all the data, which seemed to be somewhat unique to each computer. I also had a Thinkpad tablet that is vulnerable to this problem, but I backed up the original data, then replaced the chip and updated to the latest version. In this way, no further damage can be done during the update process, and it's still working fine.

[jiahe224]

I installed the Thunderbolt Firmware Update Utility (https://pcsupport.lenovo.com/us/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-X-SERIES-LAPTOPS/THINKPAD-X1-CARBON-6TH-GEN-TYPE- 20KH-20KG/downloads/DS502615), but the NVM firmware version is 30 instead of 46, my problem is, I set the display to turn off after 10 minutes and the computer never goes to sleep, when the display turn off, the external display will sleep（I'm not sure that whether the status is sleep） because it loss of input signal。When pressed the keyboard or moved the mouse to light up the screen, the X1C will continue to emit a prompt sound that the USB device is not recognized, but the external display can display the image normally, and there is no yellow exclamation mark in the device manager(but the device list will be refreshed constantly), and the prompt sound will disappear after plugging and unplugging the display . My computer is connected to the display through Thunderbolt, and the external display can provide 65W power supply to the computer, I am not using an HDMI cable. I am not sure whether this problem is related to thunderbolt, because my other computer X13 is not installed with thunderbolt software, But everything works fine.

I no longer use the monitor to power the computer, but use the power supply that comes with the computer, and use a type-c cable to connect the thunderbolt interface and the monitor, and it seems to be normal now.

[atoch419]

Hey REY5D So i think im in exactly the same boat as you now
I checked my eeprom and it is full of fs if I flash anything to it nothing changes. if use hex dump it there is absolutely nothing there. Can you remind me if you tried the zero filling and booting after replacing the chip befor flashing the firmware. I dont understand how the person at this link https://nadim.computer/posts/2018-10-26-thinkpad.html which has been posted befor could of flashed the chip with zeros then flashed the firmware and got a fully working machine if their has to be something on the chip that ids it. unless the chips ID or serial number or somthing is stored in the chip and recorded else where in the machine (maybe on the other bios chip?) or another chip?

[RAY5D]

Hey REY5D So i think im in exactly the same boat as you now I checked my eeprom and it is full of fs if I flash anything to it nothing changes. if use hex dump it there is absolutely nothing there. Can you remind me if you tried the zero filling and booting after replacing the chip befor flashing the firmware. I dont understand how the person at this link https://nadim.computer/posts/2018-10-26-thinkpad.html which has been posted befor could of flashed the chip with zeros then flashed the firmware and got a fully working machine if their has to be something on the chip that ids it. unless the chips ID or serial number or somthing is stored in the chip and recorded else where in the machine (maybe on the other bios chip?) or another chip?

I didn't zero the EEPROM out before all the attempts of re-flashing, I did it for at least some of the binaries, but these attempts were apparently not successful.
I did some more searching and found the schematic of the motherboard, the "model" of which is NM-B48 on my laptop. The flash chip, U184, is connected only to U182 and U192, U182 is a JHL6540 Thunderbolt controller, and U192 is a TPS65988 PD CONTROLLER. I think only the TB controller has the processing capability to run a firmware since it has a XTAL Y7 nearby, while U192 looks mostly like a dumb power chip.
Whether the JHL6540 contains a serial is unknown, it's also possible that the JHL6540 get the serial from somewhere else (maybe through communicating with BIOS?), but this is just a hypothesis. Given that people have had success with other Thinkpad models, I'm starting to doubt that the firmware contain unique data for each chip at all. I'll try the flashing process more carefully and see what happens.
I'm attaching the schematic and relevant photos below. I also found this post from the badcaps forum, which looks like the exact issue we're having, although they are struggling with the binary as well.

Lenovo X1 Carbon LCFC YODA-2 NM-B48 6th Gen.pdf

[dal00]

Hey! That's my original post but I've kind of given up on this. I did swap the chip even and it didn't help. So must be the firmware. I'll follow your progress though.

[atoch419]

things don't fully add up. with other thinkpads people have fixed this issue flashing the official .bin from Lenovo after over writing with zeros. so it dosent seem like there should be something in the binary that is IDing the chip. You your self have managed to replace a chip on another machine with a working binary pulled from the same machine so it dosent make sense that the chip ID is baked in to silicone either as then the replacement chip wouldn't have worked.
as an experiment could you back up the chip on your other working machine. then flash the official Lenovo binary on to it and see what happens? maybe you don't want to mess with a working machine though

[RAY5D]

things don't fully add up. with other thinkpads people have fixed this issue flashing the official .bin from Lenovo after over writing with zeros. so it dosent seem like there should be something in the binary that is IDing the chip. You your self have managed to replace a chip on another machine with a working binary pulled from the same machine so it dosent make sense that the chip ID is baked in to silicone either as then the replacement chip wouldn't have worked. as an experiment could you back up the chip on your other working machine. then flash the official Lenovo binary on to it and see what happens? maybe you don't want to mess with a working machine though

The one I replaced was flashed with its own extracted binary, so it for sure will work. I did it because I think the software update will damage the flash IC to some extent, and wanted to be safe with a new IC before trying the software update. The experiment idea you had is actually pretty smart, but I'm afraid it's not practical on my side because the model (X1 Tablet 3rd Gen) requires desoldering the flash chip to read and write it correctly (imagine messing with the board twice just to try one binary, rip). But I'll try something else.

[atoch419]

Ok bit more digging today
turns out i was using my clip wrong or the software i was using wasn't great, anyway i have swapped to flashrom and got everything working. pulled the original bin off stuck a zero file on booted up stuck the TBT.bin on. got my fast charging back but no display outputs. did some reading of the thunder spy presentation you posted and noticed something. the strings after RSA match up between both firmware but the section after SEC DGST is different on my pulled firmware and on the TBT.bin did a search for SEC DGST and it is something to do with keys so will look at transplanting this section from my dump in to the TBT.bin and try re flashing it tomorrow

[LinuxOnTheDesktop]

I have an X1CG6. I find that at some point the HDM port stopped working. I was about to try to get my motherboard fixed or replaced . . and I find now that one of Lenovo's carefully crafted updates might have borked the port.

I seem to see too - from all the posts above - that . . there is no fix, at least not for Linux.

I am hoping that someone can tell that actually there is a fix - and one that does not involved some special piece of flashing hardware.

It does not help that finding out which version of the relevant firmware I am running does not seem very easy on fwupd.

[LinuxOnTheDesktop]

@mrhpearson

I bought my expensive X1CG6 in order partly to give presentations. Seemingly a firmware update has broken the HDMI port (and perhaps - for something has broken this - the main charging port). I bought a USB-C-to-HDMI adaptor to try to work around the problem. It does not work. So now I cannot give presentations. How is this Lenovo going to make this situation right?

[mrhpearson]

I think you need to contact customer support for this issue
Mark

[LinuxOnTheDesktop]

@mrhpearson

Thanks, but I fear I'd have terrible trouble getting someone who is able and willing to help (and, perhaps, who has even heard of Linux). Could you supply an email address to which to write? Please note that, having had terrible problems ever since I got this machine, if I replace the machine it might not be with a ThinkPad. The problems: the trackpoint have never worked with Linux, despite a motherboard change; the motherboard change means one firmware update will never install, and now this broken port.

[mrhpearson]

As this is a FW update problem and you should be able to demonstrate HDMI not working from the BIOS setup menu. I don't think the OS should matter.
If the system was brought with Windows they may ask you to boot that to confirm, but that shouldn't be a big deal.
Afraid I can't help with RMA's - I'm not in the support organisation. I recommend calling them.

[LinuxOnTheDesktop]

@mrhpearson

I emailed Lenovo support, giving a brief account of the issue. The response: 'We regret to inform you that the repair of your machine is not covered under the terms of warranty. Please advise if you wish to proceed with a billable repair.' (I know that you do not work in support, but whom else are we to turn to?) I will try reasoning with the support people . .

UPDATE: the support people were unable or unwilling to discuss anything with me; they kept repeating that I would have to pay.

[NightWinkle]

Just as a follow up for anyone with the same issue :
I tried resoldering another chip and flashing the TBT firmware and it didn't work.

[theajmalrazaq]

Any leads, how can i fix this problem??

[ymilly]

Similar to many in this thread. I bought a used X1 G6 in mid 2023. It came with Windows installed. I installed Ubuntu and video out worked (USB and HDMI).

As it was a new install, I was running through the updates shown to me in Ubuntu. One was for a firmware. My external monitor was plugged in and working (via USB C). Upon reboot, the external monitor was not receiving video, and I've never been able to get video output to work again via USB C or HDMI in Windows or Linux.

I'm not sure what the exact connection of steps were that caused the video output to brick. Was it because I was running an external monitor while updating the firmware? Did I update the firmware out of order? Was the wrong firmware detected? Did updating firmware in Linux, when previous updates had been done via Windows, creating inconsistencies?

Lenovo support has been total hogwash. After being a long time Lenovo advocate, I've fallen into the camp of never buying another, and telling others the same.

But I'd like to understand what happened, and if there are options to get it working. It seems so hit and miss to troubleshoot this issue. No clear answers from anything I've found online.