UEFI BIOS T420 BIOS Structure

T420 SPI Flash Structure

It seems like the T420 BIOS update file (.FL1) is not an UEFI capsule as found for the Edge S430.

This page describes work in progress.

Structure of a Dump of the T420 SPI Flash

This is the output of the UEFITool for a dump of a T420 SPI Flash:

The SPI flash of the T420 has a size of 8MByte with this structure:

Offset	Length	Description
0x0	0x1000	descriptor region
0x1000	0x2000	GbE region
0x3000	0x4fd000	Intel ME region
0x500000	0x300000	BIOS region

Structure of a .FL1 File

This file was taken from the Windows BIOS Update for version 1.37 (83ET67WW) of the T420.

The padding of 0x520000 bytes matches the offset of the BIOS part in the flash (0x500000) plus the padding area at the start of the flash (0x20000). The following four volumes, up to and including the volume with the GUID 7A9354D9-0468-444A-81CE-0BF617D890DF, have a combined size of 0x2E0000. Their GUIDs match the ones retrieved from the SPI flash.

Therefore the current assumption is that we can update the BIOS in the T420 SPI flash by writing these four volumes, starting at flash offset 0x520000. We may have to erase the area between 0x500000 and 0x520000, as it may contain UEFI variables (which may lock the boot process).

Extract the BIOS part from an .FL1 file including the padding at the beginning:

dd if=*.FL1 of=bios.bin bs=1 count=$((0x300000)) skip=$((0x500000))

and without the padding:

dd if=*.FL1 of=bios.bin bs=1 count=$((0x2e0000)) skip=$((0x520000))

The first file must be flashed at offset 0x500000, the second one at 0x520000.