UEFI BIOS T420 BIOS Structure
The procedure to update the BIOS was tested with both T420 und T520 and it will probably also be applicable with X220 and W520.
T420/T520 SPI Flash Structure
It seems like the T420/T520 BIOS update file (.FL1) is not an UEFI capsule as found for the Edge S430.
Structure of a Dump of the T420/T520 SPI Flash
This is the output of the UEFITool for a dump of a T420 SPI Flash:
The SPI flash of the T420 has a size of 8MByte with this structure:
| Offset | Length | Description |
|---|---|---|
| 0x0 | 0x1000 | descriptor region |
| 0x1000 | 0x2000 | GbE region |
| 0x3000 | 0x4fd000 | Intel ME region |
| 0x500000 | 0x300000 | BIOS region |
Structure of a .FL1 File
This file was taken from the Windows BIOS Update for version 1.37 (83ET67WW) of the T420.
The padding of 0x520000 bytes matches the offset of the BIOS part in the flash (0x500000) plus the padding area at the start of the flash (0x20000). The following four volumes, up to and including the volume with the GUID 7A9354D9-0468-444A-81CE-0BF617D890DF, have a combined size of 0x2E0000. Their GUIDs match the ones retrieved from the SPI flash.
Therefore we can update the whole BIOS in the T420 SPI flash by writing 3MByte starting at flash offset 0x500000.
Connect a RaspberryPi to a T420/T520
This is similar to the S430. Only difference is, that in the T420/T520 all regions (IntelME, GbE, BIOS and descriptor table) reside in one 8MByte SPI Flash.
If the SPI flash has WSON package, you must solder wires to either the pins of the IC or to the 2x5 connector J100 (T520) / J27 (T420):
| Pin | Description |
|---|---|
| 3 | CS |
| 4 | Vcc (3.3V) |
| 5 | MISO |
| 8 | CLK |
| 9 | Ground |
| 10 | MOSI |
Flash Access with flashrom
- Take the *.FL1 file from the official Lenovo BIOS Update, e.g. $01C9100.FL1, and truncate it to exactly 8MByte:
dd if=\$01C9100.FL1 of=t520_spi.bin bs=$((0x800000)) count=1
- Copy this file to the RaspberryPi, e.g. using scp.
- Backup the old content. This may take some minutes:
flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_old.bin
- You may need to tell the tool which flash IC it is with the "-c" option:
flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6405 -r t520_old.bin
- Repeat the backup with another filename and compare the content of both files. If they don't match, do this a third time.
flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_oldB.bin
md5sum t520_old*.bin
- If you still get different files, re-check the cabling and re-connect the Ponoma chip to the flash chip.
- As we want to write only the BIOS part in the SPI flash starting at offset 0x500000, we need a layout file:
echo -e "000000:4fffff dummy\n500000:7fffff bios" > t520.layout
- Update the BIOS portion in the SPI flash:
flashrom -p linux_spi:dev=/dev/spidev0.0 --layout t520.layout -i bios -w t520_spi.bin
