Hello everyone. I have a lenovo thinkpad t430 and I want to flash it with heads firmware, but I can’t find guide how to compile heads with no binary blobs to make it fully open source and how to flash my laptop with it
Hello and welcome to the community. You should probably try on their forums, since in your post there is nothing Qubes OS specific.
@anon76675874 : T430/W530 are similar to the the x230 on a firmware level (xx30: Ivy bridge).
Unfortunately, nobody contributed back a t430 disassembly/flashing guide and only a stakeholder page exists : Lenovo T430 - Heads - Wiki
You will find related information searching for t430 in issues.
Here are the board owners (who agreed to be tagged directly) that you can tag in issues (@their_alias):
This issue differentiates platform related blobs situation as well.
For building, it would be the same as for x230, but changing “x230” to “t430” in board name. Depending if you have a HOTP compliant GPG USB dongle or not, choosing to build maximized or hotp-maximized flavor of the ROM.
The same prerequisites applies. Building on top of debian-11, installing host requirements, running blobs download and extract scripts.
Heads is officially a community driven project. The community is centered around its Github projects (heads and heads-wiki, the later rendered under https://osresearch.net) to centralize issues and knowledge and to reduce scattered information across unlimited social platforms that are unrelated to Heads effort.
Issues/pull requests on documentation should happen under GitHub - osresearch/heads-wiki: Documentation for the Heads firmware project
Issues/pull requests related to codebase should happen under GitHub - osresearch/heads: A minimal Linux that runs as a coreboot or LinuxBoot ROM payload to provide a secure, flexible boot environment for laptops and servers.
I’ve flashed the t430 with heads. Unfortunately you have to pull the whole thing apart to get at the u49 and u99 which needs flashing, unlike the x230.
Here is @Sven writeup, and here is mine.
@Plexus @Sven : Would definitely love to see that contribution under Lenovo T430 - Heads - Wiki
I see a lot of manual commands in the guide, which download and clean script does automatically, including downloading, hash validation, ME neutering using unlocked IFD related regions and hashing of expected outcome while placing binaries where expected.
I also read a lot of confusion in this thread about 1vyrain.
1vyrain deactivates ME when 1vyrain is used. When flashing something else, that deactivation disappears. 1vyrain should be used to use 1vyrain, or flash skulls, but should not be used to flash Heads if the goal is to have neutered ME and have freed space guaranteed (modules are gone) nor to use extended Heads features in the long run. External flashing of Maximized Heads builds should be done externally, once.
I understand the desire of users to not have to open a t430 and disassemble it completely to access SPI chips, but unfortunately, flashing Heads through 1vyrain is not equivalent to flashing Heads maximized roms directly and externally. The reasoning for that is explained at multiple places under Heads documentation.
In a quick summary, flashing through 1vyrain will only flash legacy versions of Heads. That is, flashing t430-flash which will fit 4mb region, which can then be used to boot and flash the t430/t430-hotp counterpart (8mb image), which will neither deactivate nor neuter ME. Legacy builds were created to not modify neither IFD (which is considered locked) nor consider ME to be deactivated nor neutered: they are considered left untouched. Legacy builds are made to be flashed into IFD defined BIOS region, which is limited by the size occupied by non-neutered ME, and won’t permit those regions to be internally modified, unless the IFD and ME themselves are unlocked per an external initial flash of the 8mb SPI chip (requiring external dump, ifdtool usage to unlock IFD and flash back. So why using legacy at that point). This requires initial external flashing and cannot be done internally. This is done through flashing Maximized boards builds produced top (4mb) and bottom (8mb) rom images.
- History that lead to maximized versions which neuter ME and take that freed space to be usable for Heads Prerequisites for Heads - Heads - Wiki
- Warnings if using legacy board configurations Prerequisites for Heads - Heads - Wiki
- Warnings on upgrade guide: Upgrading Heads - Heads - Wiki
Basically and I repeat: while legacy and maximized boards configuration might seem the same, they aren’t.
Once on a maximized build, internal flashing reflashes the whole 12mb combined opaque SPI chip (flashrom -p internal) which serves a lot of purposes, including
- the possibility for one to reflash the same ROM and not have any measurement changed. This permits to the paranoid to make sure firmware has not been tampered with when away and then flash a newer version of Heads prior of using the system when reaching final destination.
- permits the user to combine his backups and flash them internally. No IFD region is locked. Consequently, it is possible to reflash internally. Of course, flashing externally will be required from there.
- Neutering ME frees around 4mb of SPI space, making it available to Heads to pack additional tools through internal upgrades, bringing available SPI flash from 7.5Mb to 11.5Mb. This cannot be done from 1vyrain and requires external flashing.
Again, this is why contributions to heads-wiki would be beneficial from board owners. This should happen under
Where instructions to do massive changes is documented under: Community - Heads - Wiki
Otherwise, efforts are duplicated and information is scattered and incomplete, as seen here with user recommendations and missed, important information.
Thanks you all, guys! =)
@enmus I understand where your reply comes from, but since all certified models are actually being based on Heads, this is somewhat relevant to Qubes community.
I try to make users/collaborators contribute back and clarify under Heads and Heads-wiki repositories, but in vain for the moment. Most of Heads users are actually Qubes users. Would love to see synergies happen.
No problem. What prevented you to comment that a month ago, in your post right after mine? Why now suddenly?
I received yet another notification of someone having referred/liked one of my past replies on the subject, this time in this thread being the most general of them all, bringing back to my attention the whole content of this thread, other posts linked from/to this forum and your own reply. I just wanted to show I heard you, while restating the whys people will continue to post in this forum because of the current tight link between Qubes OS and Heads enabled machines being currently certified. And hopefully, someone documentation-driven will propose changes in the heads-wiki, where that information should be upstreamed by their platform users (this thread being t430 oriented, which I do not own).
Posting here to be able to refer in other thread.
I modified Step 2 - Flashing Guides | Heads - Wiki to add two useful flashing related videos.
A video showing how to properly connect a SOIC clip:
A video showing how to automatize SPI chip detection upon correct SOIC clip connection:
4 posts were split to a new topic: How to verify Heads integrity