16 KiB
Intel graphics, internal screen, ethernet, USB, WLAN, HDA verbs (e.g. headphone jack), S3 suspend/resume, M2 NVMe SSDs and SATA, all works perfectly. External video outputs and webcam also work. Microphone works, line-out works... everything works. UART also available via line-out jack (jumpers required on the mainboard).
The thunderbolt controller is currently unconfigured, so you can't use Thunderbolt, but the thunderbolt and regular USB-C connector can both be used for charging, and both can be used for video output (it shows up in xrandr as a DisplayPort). NOTE: https://review.coreboot.org/c/coreboot/+/83274 is the patchset enabling Thunderbolt, but it currently breaks on S3 resume from sleep, so it's not included yet. This will be added to the Libreboot 20241206 release as a hotpatch when it's ready, and in the next testing release after Libreboot 20241206. This is true as of 6 December 2024.
Backlight controls work, via software control (e.g. xbacklight utility), but
the Fn keys for it don't currently work, as of 6 December 2024.
Nvidia dGPU doesn't work and is disabled as of 6 December 2024; the Intel graphics are still available even on Nvidia models, so Intel graphics are used.
WWAN slot untested.
Build ROM image from source
The build target, when building from source, is thus:
./mk -b coreboot t480_fsp_16mb
./mk -b coreboot t480s_fsp_16mb
NOTE: The T480 and T480S may be similar, but they do have several critical differences in their wiring, so you MUST flash the correct image. Please choose one of the above build targets accordingly.
Installation
Insert binary files (DO THIS FIRST)
If you're using a release ROM, please ensure that you've inserted extra firmware required. Refer to the guide for that. (failure to adhere to this advice will result in a BRICKED machine)
Libreboot's build system automatically downloads and processes these files if you build Libreboot from source, but the same logic that it uses must be re-run if you're using a release image. This is to bypass certain restrictions on direct distribution, for files such as the Intel Management Engine firmware.
The pre-compiled images do not contain an Intel ME, so you must first insert it
using the above guide. Libreboot's build system automatically grabs it, disables
it after boot with me_cleaner, and configures it with deguard
to disable the Intel Boot Guard - this automation is either applied at build
time, or you can use it on release images.
Again:
If you're building from source via Libreboot's build system, these files are inserted during build. You only need to manually insert them, using the above linked guide, on the pre-compiled release images!
Absolutely unsigned Intel ME!
Libreboot already disables the Intel ME by default, using me_cleaner, but
the T480/T480S specifically have an additional quirk:
One of the benefits of deguard for Intel MEv11 is that it sets the ME in such a state where you can run unsigned code in there. This is how the Intel Boot Guard was disabled, because it is the ME that enforces such restrictions; more information about deguard is available on a dedicated page.
The deguard utility could also be used to enable the red-unlock hack, which would permit unsigned execution of new CPU microcode, though much more research is needed. Because of these two facts, this makes the T480/T480S the most freedom-feasible of all relatively modern x86 laptops.
With deguard, you have complete control of the flash. This is unprecedented on recent Intel systems in Libreboot, so it's certainly a very interesting port!
Set MAC address
This platform uses an Intel Flash Descriptor, and defines an Intel GbE NVM region. As such, release/build ROMs will contain the same MAC address. To change the MAC address, please read nvmutil documentation.
NOTE: If changing the MAC address, please give ifdtool the following
argument when using it: --platform sklkbl - otherwise, ifdtool will
handle the IFD incorrectly!
WARNING about GPU compatibility
The Nvidia GPUs were tested, on models that have them. It is completely dysfunctional and currently disabled in Libreboot. On models that have Nvidia, the Intel graphics is still available so Libreboot uses Intel graphics exclusively.
The Intel GPU is fully supported with native source code (libgfxinit) in coreboot, which Libreboot uses for initialisation.
Use of Intel graphics is recommended, because it has much better (and libre) driver support in Linux, and free initialisation code in coreboot, whereas Nvidia is mostly all binary blobs (unless perhaps you use the nouveau driver in Linux).
Thunderbolt issue (READ THIS BEFORE FLASHING)
The thunderbolt firmware on launch units had a bug where certain debug info is written on certain events, such as plugging in a charger to the USB-C connector. This logging is stored in the Thunderbolt firmware's own SPI flash, which is separate from the main SPI flash containing the system firmware e.g. coreboot.
If that flash gets full, thunderbolt (on factory firmware) stops working and fast charging stops working. It can be prevented by updating the Thunderbolt firmware. You can do this from Lenovo's firmware, using these instructions:
If you're already affected by the bug, you can restore it to a working state by flashing the Thunderbolt firmware externally. For example this is where its NOR flash is on a T480:
This page shows how to do that:
https://gitlab.com/MobileAZN/lenovo-t480-thunderbolt-firmware-fixes
You unbrick the Thunderbolt controller by pulling the firmware from Lenovo's update, from Lenovo's update utility. Once extracted, you then pad it properly so that it can be flashed manually, using a normal SPI flasher (the same one that you would use to flash Libreboot).
Use the 25XX NOR flashing guide if you need to flash this chip. It's the same guide that you will use for the main system flash, which is a separate flash IC.
AGAIN: This is not the Libreboot flash IC. This is separate to the system flash. Read on to know how to reprogram the main system flash!
Flash a ROM image (software)
If you're already running Libreboot, and you don't have flash protection turned on, internal flashing is possible.
The default Libreboot setup removes all flash restrictions, allowing you to flash internally, from a Linux or BSD systems running on the T480/T480. You must also disable /dev/mem protections for internal flashing to work.
Flash a ROM image (hardware)
First, please assimilate all knowledge in the 25XX NOR flashing guide - it shows how to program these flash chips, using a dedicated flash programmer, which is something that you will physically connect to the flash chip.
Again: this is only necessary if you have Lenovo BIOS, or if you enabled flash write protections on an existing Libreboot setup.
MAKE SURE to update the Lenovo UEFI firmware before installing Libreboot. You must also make a dump of the NOR flash, before updating Lenovo's firmware, and once again before flashing Libreboot, being sure you have good dumps.
Please ensure also that you've already dealt with the Thunderbolt issue, which is described above.
Find videos online of how to disassemble this, and/or find Lenovo's own service manual online. Otherwise, observe:
Remove all screws, and you can gently pry off the lower chassis and remove, which then allows you to see the inner mainboard:
WARNING: PLEASE MAKE SURE to remove the battery before flashing. The T480 and T480S can both contain INTERNAL batteries, and the T480 has an additional external battery. Remove the internal battery via the connector, like so (T480):
On the T480S (S model) the internal battery is much larger, and the connector on it is built into the battery, so it is necessary to carefully remove the entire battery; on regular T480 (non-S model) the internal battery can be isolated via the connector as depicted above.
This photo shows the flash:
There is another flash, for the Thunderbolt firmware, which you are to briefly ignore; we'll cover it later:
To be clear: the system flash (16MB) is what you put Libreboot on. The Thunderbolt firmware flash is much smaller, so you'll know because flashprog will complain about wrong flash size if you're trying to flash the wrong one.
On the T480S (S model), the flashes are in slightly different places but in both machines, the system flash (for Libreboot) is toward the centre, near the memory.
Backlight controls
The xbacklight (or equivalent in Wayland) can be used to manually control
the backlight; the buttons on the keyboard do not currently work, at least as
of 6 December 2024.
You could map the appropriate xbacklight command in Linux to a hotkey combo, depending on your window manager or desktop environment.
UART
A serial console is possible via the line-out (headphone jack). Not yet tested on the T480S (S model), nor implemented, but it is working on the regular T480 (non-S model).
TODO: show photo and wiring diagram here.
Use baud rate 115200 in your favourite serial terminal client, e.g. GNU Screen.
Next to the headphone jack on the T480, you will find pads for two 0ohm jumpers, normally unpopulated, but you can bridge each jumper yourself using a 0ohm 0201 jumper; alternatively, simply strip a bit a wire (30awg solid core) and carefully solder the wire across each of the pad jumpers, then carefully using a pair of side cutters to cut off the excess wire, being careful not to rip the pads!
If you do this, please make sure to have the latest EC firmware as of 5 December 2024 (do not use older than what was latest on this day, and don't use newer versions), because the code for this in coreboot targets a specific area of code within the EC firmware.
You can then wire a 3.5mm stereo plug. On the other end you will wire your TX/RX lines as you wish, to a suitable UART adapter; any 3.3v-rated TTL adapter should work. The Raspberry Pi Pico can be used for this, which is handy because that can also be used as a serprog-based NOR flasher!
The T480S (S model) schematics is a bit different and the signals are
properly muxed. Note that this is not to be confused with spkmodem, which
has not been tested on these boards (but could theoretically be possible too).
Idea for 2nd NVMe mod
Interestingly, on boards without the Nvidia graphics, the solder pads for all the componentry (including the GPU) is still present, so you could theoretically design a QSB that solders to the right pads, and use it to wire a 2nd NVMe SSD; the port is still enabled in Libreboot even if nothing is plugged into it, so it should just work. (this doesn't actually exist yet, but it is electrically possible, quite feasible to design/manufacture and already supported in the Libreboot firmware in principle, since than PCI-E lane is enabled in the devicetree)
Mate Kukri came up with this idea. It's a great idea, so it's written here. This mod is possible on both the T480 and T480S, though on T480S there would be less clearance; using a smaller internal battery and having a makeshift NVMe caddy in the remaining space would be how to go about it there. On the regular T480, the existing caddy area could easily fit two NVMe drives.