Librebooting the ThinkPad T480

https://ezntek.com/posts/librebooting-the-thinkpad-t480-20241207t0933/

by axiologist • 2 years ago

193 80 2 years ago

axiologist• 2 years ago

https://libreboot.org/docs/install/t480.html

merpkz• 2 years ago

I have a T480 as my main machine, but after skimming this blog post I am still not sure why would I want to flash libreboot on it, what will it improve?

Propelloni• 2 years ago

Your Thinkpad would have a free and open source BIOS/UEFI. For some, that is an improvement.

opengears• 2 years ago

It improves your machine by disabling Intel Management Engine, which is a back-door in your computer.

chithanh4• 2 years ago

It is not possible for 3rd parties to disable Intel ME. Nobody but Intel themselves can disable ME.

The most you can do is drop it to some kind of reduced functionality mode some time after boot (through the HAP bit, or hackery which overwrites part of the flash memory). This is why dishonest vendors like Purism resort to confusing terminology like "neutralize".

https://x.com/rootkovska/status/939058475933544448 https://x.com/rootkovska/status/939064351008395264

onemoresoop• 2 years ago

What does the Intel Management Engine do? Does it phone home? Can that port be blocked?

chgs• 2 years ago

https://libreboot.org/ Has reasons why you would want a Free bios

bubblethink6• 2 years ago

For this particular model, not much, other than having a partially open source bios. That can provide better security and bug fixes compared to the original bios, but that's the sort of thing that'll be mostly transparent to you. You can make this a robust system like chromebooks with verified boot or use a project like heads, but these require quite a bit of effort. For older models, there used to be more practical benefits too such as removing wifi whitelists.

dailykoder2• 2 years ago

what will it improve?

it will make you (as of now) unable to use thunderbolt and therefore a dock. Maybe you see that as improvement. I kinda like my thunderbolt

solatic• 2 years ago

That is about as simple as librebooting gets.

I had a nice chuckle at this. Buying chip clips? A separate Raspberry Pi to wire everything together and perform the flashing process?

Is there really no chance of some kind of click-and-reboot process, same as how official proprietary firmware gets updated?

deaddodo• 2 years ago

As long as Flash Write Protection is a thing and the default Lenovo BIOS enables it, yes that is how it goes.

Almondsetat• 2 years ago

There are some boards where librebooting can be done entirely via software

rollcat2• 2 years ago

Hackability is always at odds with physical security.

The general rule of thumb for the security-paranoid is that once you lose sight of your device, you should assume it's been owned (any imaginable variant/combination of evil maid, DMA exploit thru a physical port, etc).

In recent years there has been a steady push to raise the bar (TPM, SecureBoot, etc). Whether that's effective for protecting the median user's privacy and security is a separate matter, but the side effect is of course that this is increasingly becoming a hurdle for power users, enthusiasts, OS developers, etc.

ARM Macs are at a very weird spot on this spectrum. On one hand, we have a new, bespoke, and undocumented system architecture, and keeping a macOS partition is a requirement to continue receiving firmware updates; on the other, Apple has left a clearly labeled escape hatch for OS developers, and kept it from accidentally breaking. You can't have a fully libre boot chain, but it's not like Lenovo (or most other PC vendors) would endorse that either.

mschuster91• 2 years ago

Personal opinion: flash chips of all kinds should be write-protected so that even a clip flash does not work... but they should have an authentication mechanism with, say, a 64 bytes passphrase that the end-user gets on a keycard. That way you'd need a literal "evil maid" in the household of the owner to do any modifications that might compromise the device.

bubblethink6• 2 years ago

Subsequent updates can be. The original flashing process has to be this way for everything other than chromebooks.

numpad0• 2 years ago

It's just more straightforward and robust that way, because you won't be exploiting anything but using a product as the (ROM chip)manufacturer intended. Software's come too complicated these days.

devops99• 2 years ago

What else would you like to put on the wish list for Santa?

yjftsjthsd-h• 2 years ago

Yeah, I have a Chromebook where the process to switch to coreboot was basically unscrew a write-protect screw (AIUI newer models might not even need that) and then you just run an installer script. That's a (...kinda) different particular firmware, but the process works. It just depends on your hardware.

dokyun• 2 years ago

Aren't people using GNUboot nowadays?

bubblethink6• 2 years ago

Nice. Somewhat tempting to upgrade from my ivy bridge, but then I'm reminded that intel's last decade has been such a dumpster fire that everything from the last decade may be more or less the same. What does libreboot mean these days ? Does T480 do native RAM init ? Or does it still need FSP ? It may be easier to use coreboot directly. I don't think libreboot does anything more than coreboot these days. This is also exciting as T480 is the same as T25, so you may be able to use T25's keyboard with it. That's the old style keyboard that they don't make any more.

dTal2• 2 years ago

T480 is the same as T25, so you may be able to use T25's keyboard with it

The mod is complicated and very, very expensive. But possible, if you can find one in your preferred layout, which is very doubtful at this point - they've all been snapped up by people doing what you describe.

I do use the T25 keyboard on my T480. Is it nice? Oh hell yes. Was it worth the time and expense? Absolutely not, unless you are a serious keyboard nerd and have more money than sense. Which I did, at the time.

bubblethink6• 2 years ago

Yeah, I looked up what people have done, and the EC alone makes it not worthwhile. And like you said, there's no availability. Ebay only shows the Japanese layout. I think the T480(s) keyboard is fine. I'm quite comfortable with the Tx30 chiclet keyboard, and 480 looks about the same. I was debating buying X1C 13, but this T480(s) may be a fun Christmas break project.

ezntek2• 2 years ago

i believe that raminit isnt done via a blob anymore. you might as well read the official docs.

coreboot isnt even in the main tree yet! you have to use libreboot unless if you want to hunt down mate kukri's branch and go off that. you also have to use deguard to disable intel boot guard. It is more work than ivy bridge, which is why I use libreboot; its all done for you, its reliable and updates are done by someone else (you dont have to update your own payload yourself and recompile and retinker etc).

nxobject• 2 years ago

As an aside, I'm surprised that the author's suggesting that 16GB is a sweet spot for a configuration – I'm not sure that's true today (I don't think it is for quite a few workloads on top of heavy webengine apps), but I doubt it'll be true in five years.

This is coming from an M1 MBP user with 32GB who, even with aggressive paging in and out of an uber-fast disk, manages to fill about ~20GB on a regular basis.

daghamm• 2 years ago

I assume a workload with many Docker containers will need much less memory on Linux compared to osx.

jsndnx• 2 years ago

I don't understand it either, a 16 GB DDR5 stick costs like $50

Not having enough RAM slows you work to a halt, I would always go a tier down in CPU or GPU to have enough RAM

And it's also easy to expand later

iforgotpassword• 2 years ago

Don't know what it's like today, but more ram always means more power usage, so maybe makes sense for people who work on battery frequently...

Otoh, my main rig is also on 16gb today and I never run into issues. But then again I don't run electron apps and don't do webdev or microservice stuff with 30 VMs.

trinix9122• 2 years ago

And it's also easy to expand later

As I pointed out in another comment, RAM is soldered on most non-desktop computers these days. It's not easy to expand later. The hardware companies are well aware of that, pushing overpriced RAM upgrades at the time of purchase and it's not like you can just walk into a store and say "I'd like this laptop but with last year's GPU model and 2x the RAM for the same price."

dewey3• 2 years ago

manages to fill about ~20GB on a regular basis

Unused memory is wasted memory, so makes sense to always have a lot in memory. Doesn't mean that you'd have a worse experience with 16GB.

UweSchmidt3• 2 years ago

"unused memory is wasted memory" is a meme, technically true from a narrow point of view, but leading to bloat and encouraging bad practices. A little bit of care could shave off orders of magnitude of memory use, as well as performance, which could ultimately allow for cheaper computers, sustainable use of legacy hardware and keeping performance reserve for actual use. In reality, I the idea of increased efficiency by using more memory ultimately leads to software requiring that memory that used to be optional, and software not playing nice with other programs that also need space. Of course even with the idea to have everything ready in memory, software is not generally snappy these days, neither in starting up and loading even from fast SSDs and during trivial UI tasks. Performance and efficiency is also generally not something that programmers regularly seem to consider the way real Mechanical-, Civil-, or Electrical Engineers would when designing systems.

I accept trade-offs concerning development effort and time-to-market, however the phrase "Unused memory is wasted memory" does not seem appropriate for a developer who's proud if their work.

Little friday rant, sorry :-)

dailykoder2• 2 years ago

And that's a really really sad story.

And then seeing people say >I don't understand it either, a 16 GB DDR5 stick costs like $50

50 bucks is a lot of money to a whole lot of people. Yes, actual computations and compilation etc take a lot of memory, but there is so much memory wasted through js bloat, it's just sad. But if you take a little effort and optimize your system, then 16GB is still more than enough and "just works"

edude03• 2 years ago

I'm hoping I haven't become an out of touch tech bro, but I believe if you're able to flash libreboot on your software development machine you're able to afford $50.

_should_ you have to spend more money to support bloated software? No of course not, especially since many users of such software _aren't_ tech bros, but as someone in tech, shelling out a little more money seems like a much more pragmatic solution vs having your computer be slow and/or waiting for the industry to change.

trinix9122• 2 years ago

It's not just the price, there are tons of new computers out there being sold with <=16 GB of RAM soldered onto the motherboard. It's not like one can just pop it out and put a new stick in.

amatecha2• 2 years ago

Yup, $50 is definitely a lot when the whole computer was $150! Whatever it came with from the person I got the machine from on Craigslist, that's what it's generally staying with until I have to replace something - especially as I try to acquire multiples of my machines so I can continue to use them for a very long time. An entire functioning machine is more important to me than a RAM upgrade. (That said, it's really nice to be able to pop in new RAM if I happen to have some on hand, so having RAM slots is pretty important regardless!)

zelphirkalt• 2 years ago

Got a refurbished X200 with 8 GB RAM and a CPU that has only 2 cores. Can develop software using it just fine. Can even watch YouTube videos in acceptable quality just fine. Can do all things ordinary people do just fine, all applications I need opened at the same time just fine. It all depends on ones software choices. If MacOS cannot cope with less than 16GB RAM, then that is a defect in itself.

bigfatkitten2• 2 years ago

There's also a lot of power wasted. That extra stick of RAM will cause a hit to your battery life.

whalesalad• 2 years ago

Anyone considering a T480 is not at all interested in performance at this point in time. Modern chips are going to be substantially more capable and use less power.

ezntek2• 2 years ago

creator here. greetings.

32 is great for editing and such, but I do assume that one would be using linux, and in that case, I can consistenly open over 100 tabs in firefox and do programming and have electron apps open on the side on KDE plasma with no issues, no out of memory errors. Things do get squeezy and noticeably slow at those extremely heavy workloads; for heavy tasks of course get 32 but if 16 can do you that far its fine.

I even won a hackathon with 16gb of ram on an X230, if I can do that and be productive even at home its enough. macOS is just very RAM heavy, theres always at least 50 weirdly names background processes active.

71bw2• 2 years ago

Amazing to see this. One step closer to my true dream of a P-series workstation with coreboot... albeit that's not very likely due to the dGPU.

morgansolis• 2 years ago

What are some of the most significant challenges you've encountered when transitioning an existing system to Libreboot on a T480, particularly regarding hardware compatibility and performance optimization? Additionally, how do you ensure the integrity and security of the system during and after the installation process?

markus_zhang• 2 years ago

The post mentioned IRC. I haven't used it for ages. Any channel I should join to meet technical greybeards?

mkasberg• 2 years ago

Love seeing stuff like this on old laptops!

I recently built https://linuxlaptopprices.com/, inspired by diskprices.com.

morjom• 2 years ago

Any chance it could have a region filter?

tmiku• 2 years ago

Hi! Big fan of linuxlaptopprices - it's exactly what I've been looking for. Have you considered adding a "ships to" filter? I live in Alaska and I'm looking to replace my T14s with bad soldered memory, but a lot of the listings don't ship to AK/HI.

Librebooting the ThinkPad T480

Related Stories