T430 BIOS upgrade

[rjsrjs]

Is there any reason at all I should upgrade (if possible) my Lenovo T430's BIOS? I'm currently running Linux Mint 19.1 and all is running well. If so, where do I get it, how do I do it. I have never done this before and don't want to brick my machine.
Also I seem to have a problem with Fn>F4 sleep keyboard button. It doesn't do anything when pressed. I made a keyboard combination using Crtl>Alt>S to put my computer in suspend mode. The F4 problem is no big thing, I'm just curios.
Here is the info off my machine.

Type: Laptop System: LENOVO product: 2347C32 v: ThinkPad T430
serial: <filter>
Mobo: LENOVO model: 2347C32 serial: <filter> UEFI [Legacy]: LENOVO
v: G1ET45WW (1.20 ) date: 08/07/2012

Thanks:
rjsrjs

[Cigarguy]

I wouldn't do a thing. Sure updating the BIOS from Lenovo's support site will probably do no harm 99% of the time. At this stage in the T430's life cycle the BIOS is old, matured and tested. I doubt you'll notice any performance difference. If it ain't broken don't keep fixing it until it breaks.

[rjsrjs]

Gotcha Cigarguy thats what I was thinking also. Thanks for the quick reply.

rjsrjs

[skx]

Gotcha Cigarguy thats what I was thinking also. Thanks for the quick reply.

rjsrjs

Not in agreement - Lenovo is still providing bios updates in 2019 for T430. You should at least update to BIOS 2.81 (G1ETC1WW) EC 1.13 (G1HT35WW) issued on 2019/07/04 which include various intel CPU [censored] fixes and that bios still allows you to modify the EC to whitelist batteries and use old keyboard mods. The fact that your CPU is old and made by Intel is one of the biggest attack vectors for the coming years and why we should start moving to newer CPU's with our thinkpad addictions.

[Sydney]

I am pondering the same question OP asked.
While I agree one should not attempt to fix what's not broken, the secuity updates seem relevant.
Would anybody know if the fix skx suggested would prevent me from performing any upgrades such as the ones described in the following link in the future ? https://medium.com/@n4ru/the-definitive ... ff3f6a8e2e
While I aim for a secure system I also don't want to install something that would prevent me from tweaking my system in the future, and reading through the information Lenovo put out I understand that in most cases it is not possible to downgrade a once updated Bios.

And just to double-check, for op's scenario (T430, Linux OS) one would download the v2.81 iso from this site: https://support.lenovo.com/us/en/downloads/ds029252 and burn the image to create a bootable CD, correct ?
Thanks very much for your thoughts and input.

[RealBlackStuff]

I would look into doing the IVprep/1vyrain stuff above this thread, quite informative.

[dr_st]

You should at least update to BIOS 2.81 (G1ETC1WW) EC 1.13 (G1HT35WW) issued on 2019/07/04 which include various intel CPU [censored] fixes and that bios still allows you to modify the EC to whitelist batteries and use old keyboard mods.

That's good to know.

The fact that your CPU is old and made by Intel is one of the biggest attack vectors for the coming years and why we should start moving to newer CPU's with our thinkpad addictions.

We should, in general, of course, but the fact is that Spectre/Meltdown have been made public almost 3 years ago, and so far I couldn't find a single practical attack based on these vulnerabilities, only proof-of-concept toys by researchers.

[MikalE]

I keep getting new BIOS update notifications from Lenovo for my T520. I can't update it though as I have a white list BIOS loaded now from several years ago to use an updated Wi-Fi card.

[Sydney]

@RealBlackStuff: thanks so much for pointing me to that topic. Unfortunately the lingo is slightly above my paygrade, I'm afraid. I find it difficult to understand if having to look up every second word such as "jailbreak". And what is ME, by the way ?
Anyway, I think I understood that IVprep is only to downgrade the Bios before using 1vyrain, but since I currently have a 2013-version I guess I won't need that.
Regarding 1vyrain: is there a ELI5 anywhere ? Specifically: what does it do other than to unlock a bunch of features that I do not understand and am not sure I will need ? Or should I need them ? I wish I could share the excitement ! Does it ALSO update the BIOS ? Or do I still have to update the BIOS after I installed 1vyrain ?
Thanks so much for clarifying !

Edit: According to this video https://www.youtube.com/watch?v=LSFgV_9wVow 1vyrain installs BIOS v. 2.82 (2019-08-07) so I guess it includes the update. Still not entirely sure which is the better solution: install a Lenovo-update that I can always downgrade with the help of ivyprep, or install 1vyrain ?

[atagunov]

Hi, limited knowledge here, so probably not all your questions will be answered..

word such as "jailbreak". And what is ME, by the way ?

Huh? Is anybody "jailbreaking" Thinkpads? Never heard of it! Heard it used when talking about smartphones.. Usually means to acquire ability to install the software you want rather than the software the maker has limited you too.

Intel ME is Intel Management Engine, pls. look that up online if you want.. It's a bit of software running on your machine that can be seen as providing a backdoor for malicious or perhaps government agents to get into your machine.. At least that's the perception I know it sounds a bit like like a conspiracy.. The original/official purpose is to make it easier to manage laptops in large corporations I guess. It seems quite sensible for me to want to disable it. 1vyrain offers an option to disable it but there are more radical solutions too.

BTW go into bios and make sure "Computrace" is "Permemantly disabled". That's another backdoor. This time a very real backdoor if gets activated for whatever reason which it rather rarely but apparently can do.

Anyway, I think I understood that IVprep is only to downgrade the Bios before using 1vyrain, but since I currently have a 2013-version I guess I won't need that.

I think you're right to describe this utility as a way to install whichever version you want of the official BIOS. Can go up, can go down in version

Regarding 1vyrain: is there a ELI5 anywhere?

Now you're speaking a cryptic language! ELI5?..

Specifically: what does it do other than to unlock a bunch of features that I do not understand and am not sure I will need ? Or should I need them ? I wish I could share the excitement ! Does it ALSO update the BIOS ? Or do I still have to update the BIOS after I installed 1vyrain ?
Thanks so much for clarifying !
Edit: According to this video https://www.youtube.com/watch?v=LSFgV_9wVow 1vyrain installs BIOS v. 2.82 (2019-08-07) so I guess it includes the update.

I'll leave to others to advise.. If you don't feel like you need any of the features probably no need to go for the trouble.. Was there something about managing fan noise there?.. Many people think X230 is loud

Still not entirely sure which is the better solution: install a Lenovo-update that I can always downgrade with the help of ivyprep, or install 1vyrain ?

I believe you should still be able to use ivyprep to go back to stock BIOS after you have installed 1vyrain variation of it, though I haven't tried

[Sydney]

@atagunov: thanks for the computrace tip and for the Intel Management Engine definition.
Sorry for the web-language. ELI5 = "explain like I'm five", i.e. dumb it down for the uninitiated
No fan issues, all I was after was a potential BIOS update, and someone suggested looking into 1vyrain.
What's important to know is this, in case someone else is wondering:
If you want to swap out the T430 keyboard to a 7-row (T420 / T410) you need to flash your EC first, as 1vyrain does not do that, and the flash can't be done once 1vyrain is installed. The flash also requires a relatively recent BIOS update. However, said BIOS update prevents an 1vyrain install and requires downgrading with ivyprep first. So all in all it's a bit fiddly. And 1vyrain can have unintended consequences, as is obvious from the other topic. So I guess I'll give it a pass for now. The 1vyrain thread gives a rough overview of what it's supposed to be doing, but I am not the only one who asked what exactly it changes. There seemed to be some unintended consequences with regards to the Windows key and the fingerprint reader a while back, which are irrelevant for me but whoever goes down the 1vyrain route and requires that functionality should check whether this has been fixed.

[RealBlackStuff]

Many people just want to remove the wifi-whitelist that stupid Lenovo installs on many of their laptops.
Since there are no longer any 'standard' modded BIOSes possible, which remove this WL, they came up with IVprep/1vyrain, which is now available for all xx30 machines.
(and soon also for xx40, if you believe the grapevine).
If you only want the WL removed and don't care about all the extras you also get, then ignore the extras!
And AFAIK the EC-mod for classic KB and no-battery-check can be done regardless of 1vyrain applied or not.
FYI: that EC-mod is more complicated to apply than IVprep/1vyrain.

[atagunov]

And AFAIK the EC-mod for classic KB and no-battery-check can be done regardless of 1vyrain applied or not.

I actually was under impression that the sequence of actions is roughly this

1) make sure you're on the right version of BIOS to install EC mod (ivprep or another way) - it seems "last good" version is described as "2.81" on thinkpad-ec project page - and "first bad" as "2.82"
2) install thinkpad-ec which technically is a BIOS update that also happens to update EC code
3) if current BIOS version is above 2.64 then downgrade - but it may undo the EC mods!!
3) install 1vyrain - which eventually results in another BIOS upgrade
4) do not do any further BIOS upgrades or else loose either EC or 1vyrain features or possibly both

[RealBlackStuff]

Why don't you ask the 1vyrain people?

[atagunov]

Interesting, for ivprep here's what its main page says:

NOTE: Neither this tool nor 1vyrain will modify your EC ... Both IVprep and 1vyrain will only modify the BIOS region! You can safely use 1vyrain to update to the latest BIOS without losing your other mods!

So is this the safest sequence of actions for a T430?

1) make sure you have BIOS 2.81 (version number specific to T430 and documented here on thinkpad-ed's page); if this is an upgrade perhaps official method is best; if it's a downgrade - not sure; use ivprep?.. or play with official installation process - some skill is required
2) install thinkpad-ec as documented
3) use ivprep to downgrade to 2.64 (version number specific to T430 and documented here on 1vyrain's page); do use ivprep
4) install 1vyrain - you should end up with customized BIOS based on a fairly recent BIOS version, think latest .rom was uploaded in Feb 2020

My only fear is that between stages 3 and 4 we have EC and BIOS of "unmatching" versions.. Probably better not to keep machine in that state for long

[skx]

Would anybody know if the fix skx suggested would prevent me from performing any upgrades such as the ones described in the following link in the future ? https://medium.com/@n4ru/the-definitive ... ff3f6a8e2e

yes, you would be able. imagine you messed up and flashed the latest bios version, nothing is lost as you always can flash back an older version. but if you are looking into these kind of upgrades, I strongly advise you to look into coreboot and to completely get rid of Lenovo bios

[skx]

We should, in general, of course, but the fact is that Spectre/Meltdown have been made public almost 3 years ago, and so far I couldn't find a single practical attack based on these vulnerabilities, only proof-of-concept toys by researchers.

I would agree with you in the nineties where malware was designed to mess up your OS, today I strongly disagree. malware is designed to remain unnoticed. in Belgium the main ISP provider got state funded malware installed for years on their ISP infrastructure... unnoticed.

[dr_st]

I would agree with you in the nineties where malware was designed to mess up your OS, today I strongly disagree. malware is designed to remain unnoticed. in Belgium the main ISP provider got state funded malware installed for years on their ISP infrastructure... unnoticed.

You do have a point, although as usual in security discussions, it is some facts, mixed with a whole deal of fear-mongering.

Besides, for anyone who routinely runs their Windows PCs as an administrator without UAC set to high sensitivity, Spectre/Meltdown mean next to nothing anyways, since all they do is allow invisible privilege escalation.