Fixed: Lenovo P14s Gen 1 (type 20Y1, 20Y2) Laptop (ThinkPad) bricked by a withdrawn BIOS update (r1buj82w)
Hi!
Went dumpster-diving and found a bricked Lenovo P14S in trash, few weeks earlier. Symptoms - no screen, no POST, no beep, just keyboard LEDs flashing on powerup. Mute button+LED was responding though, and the display self-test was still working (via the key combo Ctrl+Fn+Power held for some seconds, see the Service manual).
Incidentally, Windows 11 have recently started auto-flashing computer BIOS in our region. Even more suspiciously, Lenovo has released a BIOS update just few days before the PC was trashed. About a week later, the BIOS update image has been oficially marked as "WITHDRAWN" by Lenovo and the update R1BUJ82W has received two patched versions, latest being R1BUJ82W_V3 at this time. See the table on the following link: https://download.lenovo.com/pccbbs/m.../r1buj81w.html
Note, how the release notes say:
I will choose to translate that corporate speak as "Microsoft has blocked our update to avoid bricking even more machines", hehe.
Anyway, since I failed to find any working key combo for Crisis recovery tool (The Fn+R thing where the BIOS auto-recovers from FAT32 GPT partition), although the BIOS firmware clearly contains references to said Crisis tool, I had eventual success desoldering the W25Q128JW chip and flashing it manually.
How to do it:
I ordered the cheap CH341A programmer (warning - it has 5V logic, will fry the chip if used directly), and a voltage shifter (TXS0108E) to turn 5V SPI signals into 1.8V, as required. Desoldered the chip by kapton-taping the surroundings, drenching one side in lead solder (it has lower melting point) and lifting that part of the chip slightly upwards. Then rinse and repeat on the other side, until I "wiggled" it free from the motherboard. (Careful not to apply pressure unless entirety of the solder is melted, or you will ireversibly break off the PCB pads.) Cleaned excess solder with solder wick, soldered the chip into the programmer.
Used linux with the flashrom tool (apt install flashrom) to backup the image, which was showing R1BHT77W version was installed. Probably corrupted somehow, wasn't really clear to see what was wrong. Then I used UEFItool software to extract the 16M (16777216 bytes) image from the *.FL1 image which you get from the official update binary when it extracts itself.
Flashed the binary into the chip, soldered it back. On power up, nothing happened for several long seconds, then the Self-healing BIOS backup procedure kiced in. And it BOOTS! Yay. Had to downgrade to R1BET81W and "back" to R1BET82W_V3, otherwise the utility would refuse (and I was stuck with older version of the ECP chip).
Went dumpster-diving and found a bricked Lenovo P14S in trash, few weeks earlier. Symptoms - no screen, no POST, no beep, just keyboard LEDs flashing on powerup. Mute button+LED was responding though, and the display self-test was still working (via the key combo Ctrl+Fn+Power held for some seconds, see the Service manual).
Incidentally, Windows 11 have recently started auto-flashing computer BIOS in our region. Even more suspiciously, Lenovo has released a BIOS update just few days before the PC was trashed. About a week later, the BIOS update image has been oficially marked as "WITHDRAWN" by Lenovo and the update R1BUJ82W has received two patched versions, latest being R1BUJ82W_V3 at this time. See the table on the following link: https://download.lenovo.com/pccbbs/m.../r1buj81w.html
Note, how the release notes say:
Version 1.51 (UEFI BIOS), 1.51 (ECP)
[Important updates]
- Fixed an issue where BIOS Update Utility will be blocked by Microsoft "Vulnerable Driver Blocklist".
[Important updates]
- Fixed an issue where BIOS Update Utility will be blocked by Microsoft "Vulnerable Driver Blocklist".
Anyway, since I failed to find any working key combo for Crisis recovery tool (The Fn+R thing where the BIOS auto-recovers from FAT32 GPT partition), although the BIOS firmware clearly contains references to said Crisis tool, I had eventual success desoldering the W25Q128JW chip and flashing it manually.
How to do it:
I ordered the cheap CH341A programmer (warning - it has 5V logic, will fry the chip if used directly), and a voltage shifter (TXS0108E) to turn 5V SPI signals into 1.8V, as required. Desoldered the chip by kapton-taping the surroundings, drenching one side in lead solder (it has lower melting point) and lifting that part of the chip slightly upwards. Then rinse and repeat on the other side, until I "wiggled" it free from the motherboard. (Careful not to apply pressure unless entirety of the solder is melted, or you will ireversibly break off the PCB pads.) Cleaned excess solder with solder wick, soldered the chip into the programmer.
Used linux with the flashrom tool (apt install flashrom) to backup the image, which was showing R1BHT77W version was installed. Probably corrupted somehow, wasn't really clear to see what was wrong. Then I used UEFItool software to extract the 16M (16777216 bytes) image from the *.FL1 image which you get from the official update binary when it extracts itself.
Flashed the binary into the chip, soldered it back. On power up, nothing happened for several long seconds, then the Self-healing BIOS backup procedure kiced in. And it BOOTS! Yay. Had to downgrade to R1BET81W and "back" to R1BET82W_V3, otherwise the utility would refuse (and I was stuck with older version of the ECP chip).
