Skip to content

Latest commit

 

History

History
220 lines (169 loc) · 9.64 KB

README.md

File metadata and controls

220 lines (169 loc) · 9.64 KB
Raw

Skulls - Thinkpad T440P

front_bootsplash

Latest release

Get it from our release page

  • coreboot: We take coreboot's master branch at the time we build a release image.
  • microcode update: revision 0x28 from 2019-11-12
  • SeaBIOS: version 1.16.0 from 2022-03-01

Note: This release includes a non-free binary blob mrc.bin that is used for dram initialisation.

table of contents

TL;DR

  1. run sudo ./skulls.sh -b t440p on your current T440P Linux system
  2. Power down, remove the battery. Remove the keyboard and palmrest. Connect a hardware flasher to an external PC (or a Raspberry Pi with a SPI 8-pin chip clip can directly be used), and run sudo ./external_install_bottom.sh on the lower chip and sudo ./external_install_top.sh -b t440p on the top chip of the two.
  3. For updating later, run ./skulls.sh -b t440p. No need to disassemble.

And always use the latest released package. This will be tested. The git master branch is not meant to be stable. Use it for testing only.

First-time installation

before you begin

Run Linux on your T440P, install dmidecode and run sudo ./skulls.sh -b t440p. It simply prints system information and helps you to be up to date.

Make sure you have the latest skulls package release by running ./skulls.sh -b t440p -U.

preparation: required hardware

open up the T440P

Follow any disassembly tutorial you can find online. You need to almost fully disassemble if you want to flash (unlock and me_cleaner) the 8M chip too. The 2 chips are rotated 180 degrees to one another on the board.

flash_4m

flash_8m

... choose one of the following supported flashing hardware examples:

Hardware Example: Raspberry Pi 3

A Raspberry Pi can directly be a flasher through it's I/O pins, see below. Use a test clip or hooks, see required hardware.

On the RPi we run Raspbian and have the following setup:

  • Connect to the console: Either

  • in the SD Cards's /boot/config.txt file enable_uart=1 and dtparam=spi=on

  • For flashrom we put spi_bcm2835 and spidev in /etc/modules

  • Connect to a wifi or ethernet to sudo apt-get install flashrom

  • connect the Clip to the Raspberry Pi 3 (there are prettier images too):

         Edge of pi (furthest from you)
                 (UART)
   L           GND TX  RX                           CS
   E            |   |   |                           |
   F +---------------------------------------------------------------------------------+
   T |  x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x  |
     |  x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x   x  |
   E +----------------------------------^---^---^---^-------------------------------^--+
   D                                    |   |   |   |                               |
   G                                   3.3V MOSIMISO|                              GND
   E                                 (VCC)         CLK
     Body of Pi (closest to you)
Plug your RPI into an 8 Pin SOIC Clip
Pin Number Clip (25xx signal) Raspberry Pi
1 CS 24
2 MISO 21
3 not used not used
4 GND 25
5 MOSI 19
6 CLK 23
7 not used not used
8 3.3V

Connect corresponding RPI Pins, according to the images above.

Now copy the Skulls release tarball over to the Rasperry Pi and continue on the Pi.

Hardware Example: CH341A based

The CH341A from Winchiphead, a USB interface chip, is used by some cheap memory programmers. The one we describe can be bought at aliexpress but it's available elsewhere too. This means you need a different computer running a Linux based system here. Also, we don't use the included 3,3V power output (provides too little power), but a separate power supply. If you don't have any, consider getting a AMS1117 based supply for a second USB port (like this or this).

  • Leave the P/S Jumper connected (programmer mode, 1a86:5512 USB device)
  • Connect 3,3V from your external supply to the Pomona clip's (or hook) VCC
  • Connect GND from your external supply to GND on your CH341A programmer
  • Connect your clip or hooks to the rest of the programmer's SPI pins
  • Connect the programmer (and power supply, if USB) to your PC's USB port

ch341a programmer with extra USB power supply

unpack the Skulls release archive

tar -xf skulls-<version>.tar.xz
cd skulls-<version>

ifd unlock and me_cleaner: the 8MB chip

With the chips at the edge of the board closer to you, this is the left chip. Flashing the left chip is optional but highly recommended. It has the same pinout as the other chip. When you don't unlock it with an external flasher, you can't flash internally and fix the security issues in the Intel Management Engine.

sudo ./external_install_bottom.sh -m -k <backup-file-to-create>

That's it. Keep the backup safe. Here are the options (just so you know):

  • The -m option applies me_cleaner -S -d before flashing back, see me_cleaner.
  • The -l option will (re-)lock your flash ROM, in case you want to force yourself (and others) to hardware-flashing, see updating.

Your BIOS: the 4MB chip

This is the right chip of the 2. Choose the image to flash during running:

sudo ./external_install_top.sh -b t440p -k <backup-file-to-create>

This selects and flashes it and that's it. Keep the backup safe, assemble and turn on the T440P. coreboot will do hardware init and start SeaBIOS.

Updating

If you have locked your flash (i.e. ./external_install_bottom -l) you can flash externally using external_install_top.sh -b t440p just like the first time, see above. Only the "upper" 4MB chip has to be written.

It is recommended to do the update directly on your T440P using Linux though. This is considered more safe for your hardware and is very convenient - just install the "flashrom" program and run ./skulls.sh -b t440p, see below.

  1. boot Linux with the iomem=relaxed boot parameter (for example in /etc/default/grub GRUB_CMDLINE_LINUX_DEFAULT)
  2. download the latest Skulls release tarball and unpack it or check for updates by running ./skulls.sh -b t440p -U.
  3. run sudo ./skulls.sh -b t440p and choose the image to flash.

Hint: In case your Linux distribution's GRUB bootloader doesn't use the full screen, put the line GRUB_GFXMODE=1366x768x32 in your /etc/default/grub file (and run update_grub).

Why does this work?

On the T440P, there are 2 physical "BIOS" chips. The 4MB one holds the actual bios we can generate using coreboot, and the 8MB one holds the rest that you can modify yourself once, if you like, but strictly speaking, you don't need to touch it at all. What's this "rest"? Mainly a tiny binary used by the Ethernet card and the Intel Management Engine. Read the coreboot documentation for more details.

how to reproduce the release images

  • git clone https://github.com/merge/skulls
  • cd skulls/t440p
  • git checkout 1.0.0 for the release you want to build.
  • ./build.sh and choose the configuration you want to build.

replace the splashscreen image

In order to create your own splashscreen image, before building, overwrite the splashscreen.jpg with your own JPEG, using

  • "Progressive" turned off, and
  • "4:2:0 (chroma quartered)" Subsampling