UEFI BIOS T420 BIOS Structure

Aus ThinkPad-Wiki

T420 SPI Flash Structure

It seems like the T420 BIOS update file (.FL1) is not an UEFI capsule as found for the Edge S430.

This page describes work in progress.

Structure of a Dump of the T420 SPI Flash

This is the output of the UEFITool for a dump of a T420 SPI Flash:


xxx

xxx


The SPI flash of the T420 has a size of 8MByte with this structure:

Offset Length Description
0x0 0x1000 descriptor region
0x1000 0x2000 GbE region
0x3000 0x4fd000 Intel ME region
0x500000 0x300000 BIOS region


Structure of a .FL1 File

This file was taken from the Windows BIOS Update for version 1.37 (83ET67WW) of the T420.

UEFI Tool Output for BIOS Update 1.37

The padding of 0x520000 bytes matches the offset of the BIOS part in the flash (0x500000) plus the padding area at the start of the flash (0x20000). The following four volumes, up to and including the volume with the GUID 7A9354D9-0468-444A-81CE-0BF617D890DF, have a combined size of 0x2E0000. Their GUIDs match the ones retrieved from the SPI flash.

Therefore the current assumption is that we can update the BIOS in the T420 SPI flash by writing these four volumes, starting at flash offset 0x520000. We may have to erase the area between 0x500000 and 0x520000, as it may contain UEFI variables (which may lock the boot process).

Extract the BIOS part from an .FL1 file including the padding at the beginning:

dd if=*.FL1 of=bios.bin bs=1 count=$((0x300000)) skip=$((0x500000))

and without the padding:

dd if=*.FL1 of=bios.bin bs=1 count=$((0x2e0000)) skip=$((0x520000))

The first file must be flashed at offset 0x500000, the second one at 0x520000.