Return to index

Libreboot supports both the T480 and T480s variants. It is available in the Libreboot 20241206 release or later.

PLEASE READ THESE INSTRUCTIONS BEFORE INSTALLING, OR YOU MIGHT BRICK YOUR MACHINE: SAFETY PRECAUTIONS

Regarding memory: T480s (S model) has 8GB onboard RAM, and an available DIMM slot on which an additional 32GB SODIMM can be installed. The regular T480 has two DIMM slots, allowing 2x32GB DDR4 SODIMMs.

Thanks go to Mate Kukri who implemented both of these excellent coreboot ports; he is also the author of the deguard utility, which is used to disable the Intel Boot Guard on these machines; disabling the Boot Guard was necessary in order to get coreboot working!

ThinkPad T480/T480S is available to purchase with Libreboot pre-installed. See: https://minifree.org/product/libreboot-t480/

**Unavailable in Libreboot 20241008 or earlier. You must compile from source, or alternatively an image from Libreboot 20241206 or higher.

Official information about the T480 can be found here:
https://psref.lenovo.com/syspool/Sys/PDF/ThinkPad/ThinkPad_T480/ThinkPad_T480_Spec.PDF

…and information about the T480s can be found here:
https://psref.lenovo.com/syspool/Sys/PDF/ThinkPad/ThinkPad_T480s/ThinkPad_T480s_Spec.pdf

This port is implemented in Libreboot by merging Mate Kukri’s T480/T480s patchset. See: https://review.coreboot.org/c/coreboot/+/83274 - as of 5 December 2024, Libreboot’s code matches that of patchset 22.

Libreboot already disables the Intel ME by default, using me_cleaner, but the T480/T480s specifically have an additional quirk:

One of the benefits of deguard for Intel MEv11 is that it sets the ME in such a state where you can run unsigned code in there. This is how the Intel Boot Guard was disabled, because it is the ME that enforces such restrictions; more information about deguard is available on a dedicated page.

The deguard utility could also be used to enable the red-unlock hack, which would permit unsigned execution of new CPU microcode, though much more research is needed. Because of these two facts, this makes the T480/T480s the most freedom-feasible of all relatively modern x86 laptops.

With deguard, you have complete control of the flash. This is unprecedented on recent Intel systems in Libreboot, so it’s certainly a very interesting port!

Libreboot uses both me_cleaner and deguard on the T480/T480s.

Intel graphics, internal screen, ethernet, USB, WLAN, HDA verbs (e.g. headphone jack), S3 suspend/resume, M2 NVMe SSDs and SATA, all works perfectly. External video outputs and webcam also work. Microphone works, line-out works… everything works. UART also available via line-out jack (jumpers required on the mainboard).

There are a few minor exceptions as to what works; this will be covered in other sections of this page. This port is almost perfect, but with some caveats.

Please refer to the standard build instructions first.

The build target, when building from source, is thus:

./mk -b coreboot t480_fsp_16mb
./mk -b coreboot t480s_fsp_16mb

NOTE: The T480 and T480s may be similar, but they do have several critical differences in their wiring, so you MUST flash the correct image. Please choose one of the above build targets accordingly.

If you’re using a release ROM, please ensure that you’ve inserted extra firmware required. Refer to the guide for that. (failure to adhere to this advice will result in a BRICKED machine)

Libreboot’s build system automatically downloads and processes these files if you build Libreboot from source, but the same logic that it uses must be re-run if you’re using a release image. This is to bypass certain restrictions on direct distribution, for files such as the Intel Management Engine firmware.

The pre-compiled images do not contain an Intel ME, so you must first insert it using the above guide. Libreboot’s build system automatically grabs it, disables it after boot with me_cleaner, and configures it with deguard to disable the Intel Boot Guard - this automation is either applied at build time, or you can use it on release images.

Again:

If you’re building from source via Libreboot’s build system, these files are inserted during build. You only need to manually insert them, using the above linked guide, on the pre-compiled release images!

This platform uses an Intel Flash Descriptor, and defines an Intel GbE NVM region. As such, release/build ROMs will contain the same MAC address. To change the MAC address, please read nvmutil documentation.

NOTE: If changing the MAC address, please give ifdtool the following argument when using it: --platform sklkbl - otherwise, ifdtool will handle the IFD incorrectly!

The thunderbolt firmware on launch units had a bug where certain debug info is written on certain events, such as plugging in a charger to the USB-C connector. This logging is stored in the Thunderbolt firmware’s own SPI flash, which is separate from the main SPI flash containing the system firmware e.g. coreboot.

If that flash gets full, thunderbolt (on factory firmware) stops working and fast charging stops working. It can be prevented by updating the Thunderbolt firmware. You can do this from Lenovo’s firmware, using these instructions:

https://pcsupport.lenovo.com/gb/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480s-type-20l7-20l8/solutions/ht508988-critical-intel-thunderbolt-software-and-firmware-updates-thinkpad

If you’re already affected by the bug, you can restore it to a working state by flashing the Thunderbolt firmware externally. For example this is where its NOR flash is on a T480:

This page shows how to do that:

https://gitlab.com/MobileAZN/lenovo-t480-thunderbolt-firmware-fixes

You unbrick the Thunderbolt controller by pulling the firmware from Lenovo’s update, from Lenovo’s update utility. Once extracted, you then pad it properly so that it can be flashed manually, using a normal SPI flasher (the same one that you would use to flash Libreboot).

Use the 25XX NOR flashing guide if you need to flash this chip. It’s the same guide that you will use for the main system flash, which is a separate flash IC.

AGAIN: This is not the Libreboot flash IC. This is separate to the system flash. Read on to know how to reprogram the main system flash!

If you’re already running Libreboot, and you don’t have flash protection turned on, internal flashing is possible.

The default Libreboot setup removes all flash restrictions, allowing you to flash internally, from a Linux or BSD systems running on the T480/T480. You must also disable /dev/mem protections for internal flashing to work.

First, please assimilate all knowledge in the 25XX NOR flashing guide - it shows how to program these flash chips, using a dedicated flash programmer, which is something that you will physically connect to the flash chip.

Again: this is only necessary if you have Lenovo BIOS, or if you enabled flash write protections on an existing Libreboot setup.

MAKE SURE to update the Lenovo UEFI firmware before installing Libreboot. You must also make a dump of the NOR flash, before updating Lenovo’s firmware, and once again before flashing Libreboot, being sure you have good dumps.

Please ensure also that you’ve already dealt with the Thunderbolt issue, which is described above.

Find videos online of how to disassemble this, and/or find Lenovo’s own service manual online. Otherwise, observe:

Remove all screws, and you can gently pry off the lower chassis and remove, which then allows you to see the inner mainboard:

WARNING: PLEASE MAKE SURE to remove the battery before flashing. The T480 and T480s can both contain INTERNAL batteries, and the T480 has an additional external battery. Remove the internal battery via the connector, like so (T480):

On the T480s (S model) the internal battery is much larger, and the connector on it is built into the battery, so it is necessary to carefully remove the entire battery; on regular T480 (non-S model) the internal battery can be isolated via the connector as depicted above.

This photo shows the flash:

There is another flash, for the Thunderbolt firmware, which you are to briefly ignore; we’ll cover it later:

To be clear: the system flash (16MB) is what you put Libreboot on. The Thunderbolt firmware flash is much smaller, so you’ll know because flashprog will complain about wrong flash size if you’re trying to flash the wrong one.

On the T480s (S model), the flashes are in slightly different places but in both machines, the system flash (for Libreboot) is toward the centre, near the memory.

These next sections will tell you how to use certain hardware features, which work a little bit differently due to idiosyncrasies of coreboot.

Sometimes the headphone jack might not work automatically. Simply install the pavucontrol program. Under Output Devices, you can select the headphones you’ve inserted manually.

If it says “Unplugged”, try it anyway. The HDA Verb may be incorrect. This will be investigated and a hotfix patch made to the Libreboot 20241206 images.

You can get audio from Displayport/HDMI, but you must select it manually. For example, you can select it in pavucontrol if you’re using PulseAudio or PipeWire.

Backlight controls work, via software control (e.g. xbacklight utility), but the Fn keys for it don’t currently work, as of 6 December 2024.

You can set the backlight manually, or use a hotkey, depending on your window manager or desktop environment.

To our knowledge, this functionality is only available in coreboot-based firmware such as Libreboot. It is completely unsupported on the original firmware!

A serial console is possible via the line-out (headphone jack). Not yet tested on the T480s (S model), nor implemented, but it is working on the regular T480 (non-S model).

TODO: show photo and wiring diagram here.

Use baud rate 115200 in your favourite serial terminal client, e.g. GNU Screen.

Next to the headphone jack on the T480, you will find pads for two 0ohm jumpers, normally unpopulated, but you can bridge each jumper yourself using a 0ohm 0201 jumper; alternatively, simply strip a bit a wire (30awg solid core) and carefully solder the wire across each of the pad jumpers, then carefully using a pair of side cutters to cut off the excess wire, being careful not to rip the pads!

If you do this, please make sure to have the latest EC firmware as of 5 December 2024 (do not use older than what was latest on this day, and don’t use newer versions), because the code for this in coreboot targets a specific area of code within the EC firmware.

You can then wire a 3.5mm stereo plug. On the other end you will wire your TX/RX lines as you wish, to a suitable UART adapter; any 3.3v-rated TTL adapter should work. The Raspberry Pi Pico can be used for this, which is handy because that can also be used as a serprog-based NOR flasher!

The T480s (S model) schematics is a bit different and the signals are properly muxed. Note that this is not to be confused with spkmodem, which has not been tested on these boards (but could theoretically be possible too).

Interestingly, on boards without the Nvidia graphics, the solder pads for all the componentry (including the GPU) is still present, so you could theoretically design a QSB that solders to the right pads, and use it to wire a 2nd NVMe SSD; the port is still enabled in Libreboot even if nothing is plugged into it, so it should just work. (this doesn’t actually exist yet, but it is electrically possible, quite feasible to design/manufacture and already supported in the Libreboot firmware in principle, since than PCI-E lane is enabled in the devicetree)

Mate Kukri came up with this idea. It’s a great idea, so it’s written here. This mod is possible on both the T480 and T480s, though on T480s there would be less clearance; using a smaller internal battery and having a makeshift NVMe caddy in the remaining space would be how to go about it there. On the regular T480, the existing caddy area could easily fit two NVMe drives.

Some features either don’t work, or are untested, when running Libreboot on the ThinkPad T480 or T480s.

Some T480 models might have NFC support but this is untested in Libreboot, and probably dosen’t work in current Libreboot releases.

The PCH’s NFC device is unsupported in Linux anyway.

Some T480 machines have touchscreens. These are untested; the touch functionality probably doesn’t work yet, in Libreboot.

The digitizer is simply a USB device, which is enabled, but it’s just untested.

The smartcard reader is enabled but it is still untested. If you have one, please test it and report back to the Libreboot project.

Thunderbolt is a way to get PCI-E on a USB port. With it, you can use high-bandwidth devices such as 10Gbps network interfaces.

The thunderbolt controller is currently unconfigured, so you can’t use Thunderbolt, but the thunderbolt and regular USB-C connector can both be used for charging, and both can be used for video output (it shows up in xrandr as a DisplayPort).

This patch can be added, enabling Thunderbolt, but be warned: it is completely untested, as of Libreboot 20241206. This patch is NOT included in the release, because it breaks on S3 resume, and may cause a kernel panic. Also: currently testing only reveals that the ThunderBolt controller shows up, and it was confirmed that USB devices do work on the port, but everything else is UNTESTED.

You also need the gerrit patch adding a Thunderbolt driver to coreboot.

To apply these patches, do the following in a fresh clone of lbmk.git and do:

git checkout 20241206-t480-thunderbolt-unstable

In it, you’ll find this commit:

commit 3881160b863ff53df9064a29a25aab55c76ee9c4 (HEAD -> 20241206-t480-thunderbolt-unstable)
Author: Leah Rowe <leah@libreboot.org>
Date:   Tue Dec 10 23:35:47 2024 +0000

    experimental/unstable t480 thunderbolt support
    
    Signed-off-by: Leah Rowe <leah@libreboot.org>

This was created by the following steps, applying the patches referenced above and amending the coreboot configs for T480/T480s, within lbmk, from a fresh clone of lbmk (Git repository):

git reset --hard b910424b5df8ed7c931a7b8f5cc8e34eacf0ca3e # 20241206rev2
./mk -f coreboot next
cd src/coreboot/next
wget https://libreboot.org/docs/install/t480-thunderbolt-20241206-unstable.patch
git fetch https://review.coreboot.org/coreboot refs/changes/86/75286/12 && git cherry-pick FETCH_HEAD
git am t480-thunderbolt-20241206-unstable.patch
git format-patch -n2
mv 0001-drivers-intel-dtbt-Add-discrete-Thunderbolt-driver.patch ../../../config/coreboot/next/patches/0010-drivers-intel-dtbt-Add-discrete-Thunderbolt-driver.patch
mv 0002-thunderbolt-fix-ish.patch ../../../config/coreboot/next/patches/0011-thunderbolt-fix-ish.patch
cd -
./mk -u coreboot t480s_fsp_16mb
./mk -u coreboot t480_fsp_16mb
git add config/coreboot/next/patches/
git add config/coreboot/t480_fsp_16mb/
git add config/coreboot/t480s_fsp_16mb/
git commit -s -m "experimental/unstable t480 thunderbolt support"

You can now follow standard build instructions.

The branch named 20241206-t480-thunderbolt-unstable already has the above patches applied, including the configuration changes made by ./mk -u, and you can follow the same build instructions. In this lbmk branch, that gerrit patch above (refs/changes/86/75286/12) is already included.

Whether you use the lbmk branch, or you add the patches manually as above, you can then flash the resulting image and boot it.

AGAIN: This will likely cause kernel panics, and it will break on resume from S3 (resume from sleep). If you do test this, please report whether the Thunderbolt devices actually work, but remember that you must NOT suspend or put your machine to sleep.

Nvidia dGPU doesn’t work and is disabled as of 6 December 2024; the Intel graphics are still available even on Nvidia models, so Intel graphics are used.

WWAN slot untested.

It has been reported that thinkpad_acpi does not load correctly on the T480. This should also be the case for the T480s.

If you encounter this issue, check
this page for details as to how to fix this.

Markdown file for this page: https://libreboot.org/docs/install/t480.md

Subscribe to RSS for this site

Site map

This HTML page was generated by the Untitled Static Site Generator.