Lenovo ThinkPad T430 / Nitrokey NitroPad T430

I use this $12 one: https://a.co/d/cIejWui

1 Like

I think I have all the parts. Yes, I will give it a go and record what happens, and highlight differences between what I expected and what happened.

No hurry. I have some other projects I need to work on. and I will be busy until after the July Fourth.

1 Like

Remarks

Work well. Been using it for a while now with no issues. Heads t430 maximized with nitrokey.

  • Video
  • Networking, wireless
  • sleep
  • USB

Qubes-HCL-LENOVO-2349DT9-20220809-092830.yml (959 Bytes)

Attachments

3 Likes

Thank you for your HCL report @thewanderer and welcome to the T430 club!

I moved your post into the T430 superthread (in general I aim to have one thread per OEM/model in this category).

You report is online now!

@sven write-up is good.
Here is another one from tlaurion. Explains how to start from scratch to build heads. (Need to replace board with t430, not x230 as in write up but otherwise same).

I used this Tigard flasher, with a Pomonda soic clip. It works well out of the box and doesn’t require any modifications. The Pomona soic clips are more expensive but better quality than the cheap ones you get from China. I have used both.

There are two chips u49 and u99 that need flashing. The write up on skulls isn’t too bad for this part of the process. If you follow the skulls writeup and use a raspberry pi make sure you check your pinout, don’t just use the one they have. Pinouts change between raspberry pi versions. Also double check the flashrom pinout as per manufactures datasheet once you have identified which ones you have.

Unfortunately with the T430 you need to pull the whole system apart to get access to them. unlike the x230 they are easier to access. There is a good service manual that guides you through each step. My suggestion is to take photos along the way and to have a good method to sort and remember which screws went where.

Good luck.

1 Like

G1ETC2WW (2.82) with the 1vyrain mod: https://1vyra.in/

Remarks

After 1vyrain mod you have to re-enable Intel Virtualization & VT-d!
TPM activated in BIOS, but I didn’t test it with AEM yet.

Attachments

Qubes-HCL-LENOVO-2347FY7-20230127-014255.yml (926 Bytes)

2 Likes

Thank you @iamroot for your HCL report, which is online now!

I’ve moved your post into this machine thread, so all the posts regarding the T430 are in one place.

1 Like

@Sven I’ve read that you have two T430 each with the i7-3840qm.
In 1vyrain there’s the option to limit the TDP of the T430. Have you, or anyone else, tried something similar in Heads (like underclocking) to reduce the heat that’s coming from the CPU?

Nope, I don’t think that’s necessary either. The fans seem to handle it just fine (using a Thinkfan profile to make it less annoying).

I do have noticed though that R4.1 appears to need a lot more resources than R4.0. I’ll post about that soon.

1 Like

Definitely looking forward to your post!
Thinking about upgrading my T430 (fhd upgrade + i7 = ~$300), but I came to the conclusion that maybe a Lenovo P50 would be a better investment in terms of CPU and especially memory…Not to forget the incredibly fast NVMe drive slots! Most importantly it seems to work well with Qubes too.
But I’ll never give up my T430 :slight_smile:

Self-flashed t430 with heads-hotp-maximized. The Nitrokey USB dongle works great with this machine. Using edited thinkfan profile so the fans reach full-tilt when temps reach 70 degrees.

Big thanks to Sven’s write-ups and https://osresearch.net/

Qubes-HCL-LENOVO-2347H76-20230212-200832.yml (1.0 KB)

1 Like

Thank you @Litter_Box for your HCL report, which is online now!

While I very much agree with your remark and link, the HCL is not the place for it.

1 Like

Is there any protection against specter/meltdown in T430 processors? Xen/Coreboot probably can’t mitigate these vulnerabilities, do I understand correctly?

Hi @CaesarVialpando, you might enjoy this post by @Insurgo.

1 Like

Thank you all so much for all the information provided in this thread.

I am at the moment in the process of building and costumizing my own Thinkpad T430.

In this context I have a non-Qubes-specific question I cant find information on and wondered if someone here might be able to help.

At the moment I have flashed Skulls via 1vyrain and am not finding information whether this also removes the Wlan-Whitelist.

Has someone flashed their Thinkpad via 1vyrain with Skulls and replaced the Wlan-Card with something better like the AX200HMW and can report whether or not the card works?

I am at the moment in the process of building and costumizing my own
Thinkpad T430.

Bravo and best regards. Please report back your successes or failures.

In this context I have a non-Qubes-specific question I cant find
information on and wondered if someone here might be able to help.

Tip: Lenovo T430 | Heads - Wiki

At the moment I have flashed Skulls via 1vyrain and am not finding
information whether this also removes the Wlan-Whitelist.

I believe it should, but have no real experience with 1vyrain or Skulls.

“* Whitelist removal to use any WLAN/WWAN adapter”

Has someone flashed their Thinkpad via 1vyrain with Skulls and replaced
the Wlan-Card with something better like the AX200HMW and can report
whether or not the card works?

Sorry can’t help here, I’ve used neither 1vyrain with Skulls or
experimented with an AX200HMW. Maybe @Sven will have better tips.

Reference for the brave:
https://medium.com/@p0358/removing-wlan-wwan-bios-whitelist-on-a-lenovo-laptop-to-use-a-custom-wi-fi-card-f6033a5a5e5a

AFAIK, the EC is involved only into battery whitelisting removal, and coreboot replacement removes the whitelisting of Intel wlan cards only.

A quick search validates the hypothesis Removing whitelists? T430 T420 etc · Issue #85 · hamishcoleman/thinkpad-ec · GitHub

You also need to flash the EC if you want to use the classic 7-row keyboard from the x220 on the x230

I heard that 5(,5)V is only a problem if you always hardware flash every update, not for one time flashing,as from then one software flashing is possible

Thanks for the tip! I tried it and had some issues, this is what I used:

# Heads T430 build

distrobox-create Coreboot -i docker.io/library/debian:stable

distrobox-enter Debian

sudo apt install nala

sudo nala install build-essential zlib1g-dev uuid-dev libdigest-sha-perl libelf-dev bc bzip2 bison flex git gnupg iasl m4 nasm patch python3 wget gnat cpio ccache pkg-config cmake libusb-1.0-0-dev autoconf texinfo ncurses-dev doxygen graphviz udev libudev1 libudev-dev automake libtool rsync innoextract

mkdir Download

git clone https://github.com/osresearch/heads

wget https://raw.githubusercontent.com/corna/me_cleaner/master/me_cleaner.py

wget https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe

sha256sum me_cleaner.py
sha256sum g1rg24ww.exe

#f60e1990e2da2b7efa58a645502d22d50afd97b53a092781beee9b0322b61153 g1rg24ww.exe
#28e9c1904690a39d9bbb913ddfde38f6f6a6428654105be3ca911fd53866b27a me_cleaner.py

innoextract g1rg24ww.exe -d heads/blobs/xx30

python3 me_cleaner.py -r -t -O heads/blobs/xx30/me.bin heads/blobs/xx30/app/ME8_5M_Production.bin

cd heads

make BOARD=t430-maximized CPUS=$(nproc)

cd ..

python3 me_cleaner.py -s heads/build/t430-maximized/heads-t430-maximized-*-bottom.rom

# flashing
sudo flashrom --programmer ch341a_spi -c "MX25L6406E/MX25L6408E" -r t430-8mb.rom

sudo flashrom --programmer ch341a_spi -c "MX25L6406E/MX25L6408E" -w heads-t430-hotp-maximized-v0.2.0-1150-g0670bcd-bottom.rom

sudo flashrom --programmer ch341a_spi -c "MX25L3206E/MX25L3208E" -r t430-4mb.rom

sudo flashrom --programmer ch341a_spi -c "MX25L3206E/MX25L3208E" -w heads-t430-hotp-maximized-v0.2.0-1150-g0670bcd-top.rom

I want to convert this to a script that fails when one thing in the chain fails. For that it would be great to also have the test with reading the bios image and comparing the diff or some hashsums like sha256.

Also, there is no python python2 in debian, as well as no python command, at least for me. I used python3 instead and it worked.

Now when trying to build the image I get the error:

Makefile:170: *** "t430-maximized: neither CONFIG_COREBOOT nor CONFIG_LINUXBOOT is set?".  Stop.

How and what config would I use here?