ThinkPad T420/T420S external flashing

Edit this page -- Back to previous index

NOTE: Separate ROMs build (in the build system) for T420 and T420S. Make sure to use the correct one for your laptop.

You can find flashrom under the flashrom/ directory in the osboot source code release archives. Build it (from source) using the osboot build instructions page.

This assumes that you unlocked the regions using ifdtool, and ran me_cleaner, when installing osboot the first time. osboot currently does not provide pre-compiled utilities, but you can download the source code archive of osboot from the download page and build these utilities using the instructions at osboot build instructions page.

You do not need to use a flash layout file in flashrom for this, but you can if you want. This guide assumes that you don’t. The only time you really need one is when you’re doing internal flashing, like when updating/changing your coreboot ROM after already having flashed it externally for the first time.

This guide shows you how to install coreboot (or osboot, in this case) onto an T420/T420S that currently has the Lenovo BIOS firmware on it.

Refer to the Raspberry Pi page which tells you how to set up a Raspberry Pi for SPI flashing. Just buy some 2.54mm or 0.1inch dupont leads and use those with a test clip for SO8/SOIC8/SO-IC8 chip.

Ideally, if you know how to solder, you should cut the data wires in the middle (but not power and ground) on the flasher, on the wires from the flasher to the test clip, strip them, and solder 47ohm resistors. That is, don’t use straight thru wire connection (0ohm) but use 47ohm resistors on the data lines. However, this isn’t strictly required, just recommended. This applies when doing ISP (in system programming) but isn’t really required when flashing new chips that have not yet been soldered to a mainboard.

Then with your resistors on the data lines, you can insulate using heat shrink tubing and a hot air jet.

Use of resistors is optional, but highly recommended if you’re comfortable with doing a bit of soldering.

Remove all screws from the bottom of your laptop. Then push the keyboard forward and lift it out, disconnect it. Remove the palmrest.

This photo shows the flash chip (peel back the tape to see it):

NOTE: this image is hotlinked from coreboot.org, for licensing reasons (it is not clear what license coreboot.org is using), because no T420/T420S was physically available for the purpose of making this guide. Look at that picture and, note:

Look carefully at the above photo. It shows the pin numbers on the chip. These numbers correspond to the numbers on the RPi flasher guide

It’s 8MiB 25XX NOR flash.

It is assumed that you have the ROM images and me_cleaner compiled (well, the me_cleaner utility is written in Python 3 and does not need to be compiled). It is also assumed that you have the cbutils module compiled.

If not, build osboot using these instructions

Configure a Raspberry Pi for flashing 25XX NOR flash (you can use any SPI flasher, but the Raspberry Pi is currently the only SPI flasher documented on the osboot website).

DISCONNECT the charger and battery, so that there is no power supplied to the T420/T420S mainboard. You will need to fully disassemble your laptop to remove the mainboard, to access the flash chip. No disassembly instructions are yet provided on the osboot website.

Connect your RPi via SOIC-8 test clip to the T420/T420S flash chip (see above photo) and dump the firmware. After your clip is connected to a chip (remember, use external 3.3v from your Raspberry Pi. Pin 1 on the RPi GPIO header is 3.3v as specified on the RPi guide)

Never connect the clip while 3.3v is live. Only turn on the power after the clip is connected, to reduce the chance of shorting/frying anything by mistake.

Ideally, your data lines (from RPi to test clip) should have 47ohm resistors on them (manufacturers recommend this when doing ISP, short for In System Programming. it’s when you flash a chip that’s already mounted to a mainboard which is exactly what you’re doing in this case).

On your Raspberry Pi, it is assumed that you’re running Raspbian. In Raspbian you can just do sudo raspi-config and enable SPI in there.

Assuming you’ve got your RPi wired correctly, your clip correctly connected and 3.3v is active on the VCC pins of the flash chips, you should be able to flashrom.

Do not flash yet. First, you should make a full backup of the chip:.

sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 8mb_dump.bin

Make several dumps, and compare them in sha512sum. If the dumps all have the same checksum, then they are good dumps.

This is flashrom running on your Raspberry Pi, which you SSH’d into. You can actually download osboot (from Git) on your Raspberry Pi, and build flashrom using the instructions on the osboot website

If flashrom complains about multiple detected flashchips, per definitions, just do what it says and pick one using -c option. If it fails, pick another one. Make sure to get a good dump.

If these are successful, you’ll see these files created. Take several of these and compare in sha512sum to verify the hashes; if you dump a ROM with the same checksum several times, then it’s very likely a good dump.

Keep these dumps safe, backed up in several places on several storage mediums. You might need them at some point in the future.

Now, please note: the first 5MiB of the dump you made contains descriptor, ME and GbE. You need these!

Extract the 5MiB region (final 3MiB part is BIOS region):

dd if=8mb_dump of=5mb.bin bs=5M count=1

The file 8mb_dump above is the full backup you made of the flash contents.

osboot distributes 8MiB ROM images, for just the BIOS region in the upper 3MiB of the chip on your T420/T420S. You should join the 5MiB file from above with the upper 3MiB of your osboot ROM. However, before you do so:

./meclean 5mb.bin

Then your file will be under bin/neutered/ in the osboot build system. Now use ifdtool to set all regions read-write (this makes internal re-flashing much easier later on). Like so (ifdtool built in the osboot build system):

./coreboot/x230_4mb/util/ifdtool/ifdtool --unlock ./bin/neutered/5mb.bin.neutered

The above commands are from the osboot build system, and assume you’ve build the cbutils and me_cleaner modules. It is strongly recommended that you run me_cleaner and unlock your descriptor+ME region using ifdtool, as above.

When you run the ifdtool command, you’ll have a new file named 5mb.bin.neutered.new

Now, take your 8MiB ROM from osboot and insert the 5MiB file containing your neutered Intel ME with unlocked IFD regions:

dd if=5mb.bin.neutered.new of=8mb.t420.osboot.rom bs=5M count=1 conv=notrunc

Previously, the first 5MiB of the osboot ROM was just 0xFF padding but now it should contain your descriptor, GbE and Intel ME. The ROM is now ready to flash on your machine.

In the above example, 5mb.bin.neutered.new is the first 5MiB of the dump from your T420/T420S (prior to flashing), run through me_cleaner and then run through ifdtool --unlock; combined, these two tasks neutered the Intel ME and set all regions read-write in the flash. The 8mb.t420.osboot.rom file in the above example is simply a 8MiB T420/T420S ROM (of your choice) from osboot, either in a release or compiled by you from the source code.

Now flash osboot (8MiB image). We will use the ROM images prepared above. Like so (Raspberry Pi was used, when writing this guide):

sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w 8mb.t420.osboot.rom

Ditto about multiple flashchip definitions thing. Use -c option if flashrom tells you to. When you’ve successfully flashed.

If successful, flashrom will say VERIFIED after you’ve finished flashing.

If you’re not successful, check RPi wiring and check you’re connecting the clip the right way round. Also, check the software configuration on your RPi.

If you still can’t get it working, check the voltage again on the flash chip vcc pins. Ensure that you are correctly providing 3.3v to pin 8 of the flash chip.

Edit this pageLicenseTemplateAuthorsDonateBuy preinstalled

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License Version 1.3 or any later version published by the Free Software Foundation with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts. A copy of this license is found in /docs/fdl-1.3.html