Lenovo ThinkPad T430 / Nitrokey NitroPad T430

In my experience the only places where you get a “win” on being able to add more RAM to a laptop than the laptop specs state is when a) the CPU supports larger RAM than is currently available on the market or for manufacturer certification and b) the manufacturer writes support for the RAM size into the BIOS (but, again, cannot test it to certify it).

The x230 has only a pair of RAM slots, and the CPU only supports 8GB per.

This is one reason that the era’s W-series are so useful w/ Qubes: they have four slots to support the era’s quad-core CPUs and therefore can support 32GB. Note there are a few W-series that are dual core an that are also limited to 16GB.


1 Like

4.1 HCL - Lenovo Thinkpad T430

Installed Qubes 4.1.0 on Lenovo Thinkpad T430

  • Flashed BIOS to latest 2.82 (21 Aug 2019) before install
  • Qubes settings: default OS changed to Debian, all other defaults kept
  • installation successful, no problems, everything tested works normally

Tested and verified, works normal, no fix needed:
track point mouse
touch pad
wired ethernet
wireless ethernet
usb port (connected mouse)
usb port (connected external SSD)
audio + audio control buttons

Not tested:
expresscard slot
memory card slot
fingerprint reader

[user@dom0 ~]$ qubes-hcl-report untrusted -s
Qubes release 4.1 (R4.1)

Model: 2347G2U
BIOS: G1ETC2WW (2.82 )

Xen: 4.14.3
Kernel: 5.10.96-1

RAM: 16081 Mb

Intel(R) Core™ i5-3320M CPU @ 2.60GHz
Intel Corporation 3rd Gen Core processor DRAM Controller [8086:0154] (rev 09)
Intel Corporation 3rd Gen Core processor Graphics Controller [8086:0166] (rev 09) (prog-if 00 [VGA controller])

Intel Corporation 82579LM Gigabit Network Connection (Lewisville) (rev 04)
Intel Corporation Centrino Advanced-N 6205 [Taylor Peak] (rev 34)

WDC WDS500G2B0A Rev: 00WD

HVM: Active
I/O MMU: Active
TPM: Device present
Remapping: yes

Qubes HCL Files are copied to: ‘untrusted’
Qubes-HCL-LENOVO-2347G2U-20220220-124431.yml - HCL Info
Qubes-HCL-LENOVO-2347G2U-20220220-124431.cpio.gz - HCL Support Files

Qubes-HCL-LENOVO-2347G2U-20220220-124431.yml (910 Bytes)

Qubes-HCL-LENOVO-2347G2U-20220220-124431.cpiogz (9.4 KB)

Additional detailed installation notes to follow in follow-up posts to forum thread


Thank you for the report! Did you also test the suspend?

Yes suspend works normally, wired/wireless ethernet reconnects, vpn (adv conf) reconnects, no problems.

1 Like

Thank you @oldschool for your HCL report, which is online now.

I also moved your thread here to have all reports about the T430 in one place.

I was extremely lucky and got a “new” (aka unused) T430 that spend the last 10 years in original packaging at an IT warehouse. After upgrading it to make it identical to the one I already have, I installed R4.1 on both of them.

HCL reports:

This machine is the best and it certainly works flawlessly without any workarounds or troubleshooting with R4.1. This being said I have a couple of notes I want to share:

  1. If you use Coreboot/Heads make sure you upgraded to the current version Heads-v0.2.0-1150 or the install won’t work.

  2. dom0 needs zenity installed for things like qvm-move-to-vm to work. Also in case you want to use Whiskermenu one now has to install xfce4-whiskermenu-plugin which was included by default previously.

  3. Most of the Qubes OS UI in dom0 is now Qt5 based and doesn’t by default adhere to the selected theme, which is especially annoying when using a dark theme. Luckily this can easily be remedied by installing qt5-qtstyleplugins and exporting QT_QPA_PLATFORMTHEME=gtk2 (e.g. in /etc/environment).

  4. I get a very noticeable performance bump when using Btrfs as opposed to whatever is the default. I don’t have the technical understanding to explain this but I have done repeated A-B-A experiments on two identical computers and at least with my exact hardware (see above HCLs) the difference is very noticeable. This was the case with R4.0.4 and subjectively is even bigger with R4.1 (e.g. due to the current world situation I have a qube permanently streaming CNN in a window on my screen… this was not fluid and somewhat bumpy in the default install but runs smooth as butter now with Btrfs – I know that doesn’t make sense on the face of it, but it is what I see; also general qube startup times are several seconds shorter) … so I continue to strongly recommend this for this machine.



I’m looking to get a T430 (from Nitrokey) and I can see quite a few here have experience with a T430. I’m not well versed in laptop hardware, but does the Atheros AR9462 work alright with the T430 and with QubesOS? I’ve got the option to choose between the Intel 802.11b/g/n 2200N and the Atheros AR9462 (for a small additional price), but I’m not aware of the differences between them.

The AR9462 is popular with folks doing monitoring and injecting on WiFi networks (aka spying and hacking). In other words: if you have to ask, you don’t need it.

The Intel option is perfectly fine for most users.

I have only a few weeks of experience with Nitropad T430 so far, but yes, Atheros AR9462 (ath9k) wifi works perfectly.

Edit: Someone on Nitrokey’s support forum has various experiences with ath11k driver. Qubes 4.1 installer doesn’t work because the driver is not compiled in the kernel, it seems.

I believe the max memory stated on the Lenovo website was 8GB, but the actual max is 16GB. so you are half right, the stated maximum isn’t the maximum

Sven which storage memory is recommended for t430

Hi @anon23935512 there is no special recommendation for just the T430. In general the use of an high quality SSD is recommended. Do a little research about their specs and then choose one that fits your budget.

Personally I am using the Samsung 860 PRO 1TB 2.5 Inch SATA III SSD and are very happy with it. In my own experiments I found that my T430 performs a lot better if I use BTRFS instead of the default option. Especially with R4.1. However, I cannot explain this or guarantee that you will see the same performance boost I see. I did confirm it with multiple installs on two different T430’s.

Hi @Sven do you put the 1tb 2.5 Inch SATA on the drive slot on right or inside the mob, Is this where you install the Qubes on the slot SSD or on the mob thanks.

I have no drive in the place where the CD drive was. Just one hard drive in the bay on the left. Qubes OS is the only system installed on my T430.

Do you run Qubes OS on USB slot?

No. I am running it on the internal hard drive (SSD). I fear we have a language problem.

1 Like

I have ordered a Lenovo T430.

I see guides to flash the ROM. https://github.com/merge/skulls/blob/master/t430/README.m

and I see, https://medium.com/@n4ru/the-definitive-t430-modding-guide-3dff3f6a8e2e

By George Kushnir who says he has created 1vyrain to do a lot of the things that ROM Flash would do. Since the guide from George Kushnir does not mention it. I am guessing that 1vyrain does not have a path to install Heads, and verify that the computer has not been tampered with. Nor does it mention 'Anti-Evil Maid." which I think there is some independent way to do, besides ROM Flashing.

Kushnir mentions replacing screen, keyboard, Wireless adapter.

Of course Memory. Up to 16 GB and SSD, which I notice Sven said to use something on the par with Samsung Pro.

Since if I am going to fail on doing a ROM Flash, I would rather not put more dollars into hardware first. Like a Screen. I need to determine whether the ROM Flash is the best route, and whether we have progressed to the point we can do through Software what a CH341 Flasher, programmer can do?

Any other suggestions as to how to proceed? Order to proceed?

don’t get me wrong, but the T430 is a very old hardware with known and unpatchable (CPU) flaws and very limitied hardware resources (low RAM and lack of nvme)
I would not invest a single penny to this thing - if you serious about security.
Of course, it is still valuable - if your goal to learn things…

Please provide references.
But isn’t it being ‘very old’ in this context a benefit? Modern Intel ME cannot be removed. You can start here, https://twitter.com/markel__, to see how modern intel platforms have far greater attack surface from the start.

What’s your alternative?

I wouldn’t use ivyrain, I’d actually flash heads and remove Intel ME while you’re at it.

My reccommendations:
Remove microphone
Remove webcam
Remove wireless/bluetooth*

*Use a usb wireless adapter/compute-stick, (Added benefit you can now use a non-intel non-x86 device, and you can enforce a vpn tunnel on that device for redundancy). Also t430 has multiple usb controllers, so you can dedicate one usb port to sys-usb-net, which brings multiple benefits.

1 Like