UEFI BIOS T420 BIOS Structure: Unterschied zwischen den Versionen

Aus ThinkPad-Wiki
Keine Bearbeitungszusammenfassung
 
(6 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
== T420 SPI Flash Structure ==


It seems like the T420 BIOS update file (.FL1) is not an UEFI capsule as found for the [[UEFI_BIOS_Update_with_a_Raspberry_Pi|Edge S430]].
The procedure to update the BIOS was tested with both T420 und T520 and it will probably also be applicable with X220 and W520.


This page describes work in progress.
== T420/T520 SPI Flash Structure ==


=== Structure of a Dump of the T420 SPI Flash ===
It seems like the T420/T520 BIOS update file (.FL1) is not an UEFI capsule as found for the [[UEFI_BIOS_Update_with_a_Raspberry_Pi|Edge S430]].
 
=== Structure of a Dump of the T420/T520 SPI Flash ===


This is the output of the UEFITool for a dump of a T420 SPI Flash:
This is the output of the UEFITool for a dump of a T420 SPI Flash:
Zeile 24: Zeile 25:
|0x1000      ||  0x2000        || GbE region
|0x1000      ||  0x2000        || GbE region
|-
|-
|0x3000      || 0x4d0000       || Intel ME region
|0x3000      || 0x4fd000       || Intel ME region
|-
|-
|0x500000    || 0x300000        || BIOS region
|0x500000    || 0x300000        || BIOS region
Zeile 40: Zeile 41:
GUIDs match the ones retrieved from the SPI flash.
GUIDs match the ones retrieved from the SPI flash.


Therefore the current assumption is that we can update the BIOS in the T420 SPI flash by writing these four volumes, starting at flash offset 0x520000.
Therefore we can update the whole BIOS in the T420 SPI flash by writing 3MByte starting at flash offset 0x500000.
We may have to erase the area between 0x500000 and 0x520000, as it may contain UEFI variables (which may lock the boot process).
 
=== Connect a RaspberryPi to a T420/T520 ===
 
This is similar to the [http://thinkwiki.de/UEFI_BIOS_Update_with_a_Raspberry_Pi#Attach_the_Raspberry_PI_to_the_SPI_Flash S430]. Only difference is, that
in the T420/T520 all regions (IntelME, GbE, BIOS and descriptor table) reside in one 8MByte SPI Flash.
 
If the SPI flash has WSON package, you must solder wires to either the pins of the IC or to the 2x5 connector J100 (T520) / J27 (T420):
 
{| class="wikitable"
|-
! Pin !! Description
|-
| 3 || CS
|-
| 4 || Vcc (3.3V)
|-
| 5 || MISO
|-
| 8 || CLK
|-
| 9 || Ground
|-
| 10 || MOSI
|}
 
=== Flash Access with flashrom ===
 
* Take the *.FL1 file from the official Lenovo BIOS Update, e.g. $01C9100.FL1, and truncate it to exactly 8MByte:
'''dd if=\$01C9100.FL1 of=t520_spi.bin bs=$((0x800000)) count=1'''
 
*  Copy this file to the RaspberryPi, e.g. using scp.
 
* Backup the old content. This may take some minutes:
'''flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_old.bin'''
 
* You may need to tell the tool which flash IC it is with the "-c" option:
'''flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6405 -r t520_old.bin'''


Extract the BIOS part from an .FL1 file including the padding at the beginning:
* Repeat the backup with another filename and compare the content of both files. If they don't match, do this a third time.
'''flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_oldB.bin'''


'''dd if=*.FL1 of=bios.bin bs=1 count=$((0x300000)) skip=$((0x500000))'''
'''md5sum t520_old*.bin'''


and without the padding:
* If you still get different files, re-check the cabling and re-connect the Ponoma chip to the flash chip.


'''dd if=*.FL1 of=bios.bin bs=1 count=$((0x2e0000)) skip=$((0x520000))'''
* As we want to write only the BIOS part in the SPI flash starting at offset 0x500000, we need a layout file:
'''echo -e "000000:4fffff dummy\n500000:7fffff bios" > t520.layout'''


The first file must be flashed at offset 0x500000, the second one at 0x520000.
* Update the BIOS portion in the SPI flash:
'''flashrom -p  linux_spi:dev=/dev/spidev0.0 --layout t520.layout -i bios -w t520_spi.bin'''


[[Category::BIOS]]
[[Category:BIOS]]

Aktuelle Version vom 8. Mai 2016, 19:57 Uhr

The procedure to update the BIOS was tested with both T420 und T520 and it will probably also be applicable with X220 and W520.

T420/T520 SPI Flash Structure

It seems like the T420/T520 BIOS update file (.FL1) is not an UEFI capsule as found for the Edge S430.

Structure of a Dump of the T420/T520 SPI Flash

This is the output of the UEFITool for a dump of a T420 SPI Flash:


xxx

xxx


The SPI flash of the T420 has a size of 8MByte with this structure:

Offset Length Description
0x0 0x1000 descriptor region
0x1000 0x2000 GbE region
0x3000 0x4fd000 Intel ME region
0x500000 0x300000 BIOS region


Structure of a .FL1 File

This file was taken from the Windows BIOS Update for version 1.37 (83ET67WW) of the T420.

UEFI Tool Output for BIOS Update 1.37

The padding of 0x520000 bytes matches the offset of the BIOS part in the flash (0x500000) plus the padding area at the start of the flash (0x20000). The following four volumes, up to and including the volume with the GUID 7A9354D9-0468-444A-81CE-0BF617D890DF, have a combined size of 0x2E0000. Their GUIDs match the ones retrieved from the SPI flash.

Therefore we can update the whole BIOS in the T420 SPI flash by writing 3MByte starting at flash offset 0x500000.

Connect a RaspberryPi to a T420/T520

This is similar to the S430. Only difference is, that in the T420/T520 all regions (IntelME, GbE, BIOS and descriptor table) reside in one 8MByte SPI Flash.

If the SPI flash has WSON package, you must solder wires to either the pins of the IC or to the 2x5 connector J100 (T520) / J27 (T420):

Pin Description
3 CS
4 Vcc (3.3V)
5 MISO
8 CLK
9 Ground
10 MOSI

Flash Access with flashrom

  • Take the *.FL1 file from the official Lenovo BIOS Update, e.g. $01C9100.FL1, and truncate it to exactly 8MByte:

dd if=\$01C9100.FL1 of=t520_spi.bin bs=$((0x800000)) count=1

  • Copy this file to the RaspberryPi, e.g. using scp.
  • Backup the old content. This may take some minutes:

flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_old.bin

  • You may need to tell the tool which flash IC it is with the "-c" option:

flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L6405 -r t520_old.bin

  • Repeat the backup with another filename and compare the content of both files. If they don't match, do this a third time.

flashrom -p linux_spi:dev=/dev/spidev0.0 -r t520_oldB.bin

md5sum t520_old*.bin

  • If you still get different files, re-check the cabling and re-connect the Ponoma chip to the flash chip.
  • As we want to write only the BIOS part in the SPI flash starting at offset 0x500000, we need a layout file:

echo -e "000000:4fffff dummy\n500000:7fffff bios" > t520.layout

  • Update the BIOS portion in the SPI flash:

flashrom -p linux_spi:dev=/dev/spidev0.0 --layout t520.layout -i bios -w t520_spi.bin

Abgerufen von „https://thinkwiki.de/index.php?title=UEFI_BIOS_T420_BIOS_Structure&oldid=24311“