HOWTO: Lenovo T480 (and others) BIOS update

Original forum link
https://forum.qubes-os.org/t/29323
Original poster
Barto
Created at
2024-10-02 11:44:02
Posts count
1
Likes count
7

Lenovo have released a BIOS update for the older models, probably the last one for T480. Looking at the changelog here (note that Lenovo's site is not reachable through Tor), there are quite a few CVE's fixed in this 1.52 release, so I will install it.

How?

  1. get your system details with dmidecode in Dom0 

[user@dom0 ~]$ sudo dmidecode | grep -A4 "System Information"
System Information
    Manufacturer: LENOVO
    Product Name: 20L6XXXXXX
    Version: ThinkPad T480
    Serial Number: YYYYYYYY
[user@dom0 ~]$
2. Make sure that your Product Name prefix (in my case 20L6) matches the BIOS image you'll download! 3. So start a disposable based on a Debian template (not a "minimal"), start Firefox, go to https://support.lenovo.com 4. Click on PC, type "T480" in the search field (note that T480 and T480s are different products!), click on Downloads, Manual Update. 5. (optional) put in your Serial Number from #1 above to be 100% sure you're downloading the right image. 6. Type "BIOS" in the "Search by keywords" field. 7. Identify the Bootable CD entry scr1|690x58 8. Download this and the copy the SHA256 checksum. Optional: read the changelog. 9. Open a Terminal in the disposable (from the "blue cube" Qube Manager icon in the top right, select your current disposable, and choose "Run Terminal") 10. Optional but recommended: check the integrity of the downloaded file by running sha256sum Downloads/*iso and make sure it matches the SHA256 from #8. 11. Install "genisoimage" sudo apt install genisoimage 12. Run: 
user@disp2323:~$ cd Downloads
user@disp2323:~/Downloads$ geteltorito -o t480_152.img *iso
Booting catalog starts at sector: 20 
Manufacturer of CD: NERO BURNING ROM VER 12
Image architecture: x86
Boot media type is: harddisk
El Torito image starts at sector 27 and has 67584 sector(s) of 512 Bytes

Image has been written to file "t480_152.img".
13. Good! now we have the "t480_152.img" file which can be written to a USB stick. Insert a USB stick THAT CAN BE SAFELY ERASED and connect it as a USB device to your disposable cube using the menu. Optionally, run "sudo dmesg" and make sure of the name, usually /dev/sda, under which it was connected. This being a disposable, 99.99% it will be /dev/sda. 14. copy the bootable image to the USB stick: sudo dd if=t480_152.img of=/dev/sda 15. Optional, if you need to flash the same BIOS to more laptops later, use qvm-copy to copy the t480_152.img file to some other qube, like "Personal". 16. Now you can reboot the laptop directly, from the top-right menu, then press Enter during boot, select to boot from the USB stick, follow the prompts, and there you are - on the next boot you're all updated! the BIOS screen and dmidecode should show the new BIOS version.

Notes: * I use "*iso" instead the full name assuming you're doing this in a disposable. If not, it is a good idea to use the file name, like "n24ur39w.iso". * At #14, you're already in ~/Downloads (from #12) * if you want to change the boot logo, for example with this @renehoj masterpiece, the readme.txt on the page at #7 explains how.

Enjoy.