Sorry for the late reply and thanks for doing some digging!
I had been digging through this a bit, both the jedec pmic5100 doc and whatever pmic/spd datasheets I can find.
As you found out, nothing on the PMIC specifically would “lock” or write to 0x2F. The dimm vendor startup configuration registers don’t seem to include a configuration for this nor is 0x2F copied from the dimm vendor region to the host region (as some others are).
Yeah, the datasheets I could find didn’t make a single mention of the CAMP pin at all. They all seem to indicate that the 0x2F needs to be set to programming mode by the host before VR_ENABLE signal is sent and that’s it.
What hurts my brain about that is there must be something going on spd/pmic side that locks that out (maybe the camp thing?) as there are both dimms/sodimms that come from the factory being able to be “unlocked”, so it’s not as though the host motherboard isn’t trying to set 0x2F appropriately.
As far as I can tell, the “CAMP” pin is being referred to as “PWR_GOOD” in the PMIC docs. GSI_n is also mentioned a lot with them as well. I wouldn’t be surprised if those two plus masking bits play some role in how the PMIC is being forced into “secure mode” by some programming, somewhere. (I just saw you already made the connection in your own docs haha).
I looked through the spd writer code as well and funny enough, they recently tried to allow jedec voltage changes but reverted the change as it didn’t seem to work. I don’t know how they tried to edit jedec voltages (probably something worth asking) but I do not think merely adding them to the jedec timing registers (as is done with xmp) is enough.
One possible avenue would be to alter the dimm vendor region registers for voltages/thresholds (yes, would be a pain from an ‘in the field’ perspective but ..). During the power up sequence, the dimm vendor region registers are copied over to the internal PMIC registers.
There is a default password for the dimm vendor region. From experience of other ICs, most will leave this password at default: “The default password for DIMM vendor register is 0x9473.”
As for the write protected stuff, it seems you are looking at PMIC5010 documentation. From my findings, most consumer level dimm/sodimm are using PMIC5100 standards (and the PNs on the dimms I have looked at all come back as such). This may be why I don’t see any reference to ‘CAMP’ (I have been using jedec PMIC5100 docs). It seems the method for disabling WP is much more straightforward on consumer dimms (from what I can see).
This still doesn’t change the fact that something is preventing host changes in programmable mode.
I am adding another photo (can’t add two since I’m a new user) below for the process of accessing/writing to dimm vendor region.
I didn’t add much to the conversation but thanks again for taking a look into it.