linuxboot · tlaurion · Jul 24, 2026 · Jul 24, 2026 · Jul 29, 2026
diff --git a/About/Heads-threat-model.md b/About/Heads-threat-model.md
diff --git a/About/Keys.md b/About/Keys.md
@@ -8,6 +8,9 @@ parent: About
 
 ## Keys and passwords in Heads
 
+{: .note }
+See also: [doc/keys.md](https://github.com/linuxboot/heads/blob/master/doc/keys.md) for recommended passphrase lengths per secret.
+
 There are "too many secrets" involved in booting a Heads system. Luckily most
 of them are stored in hardware and only a few need to be memorized by the
 users. This page documents their usage and the risks if an attacker can

diff --git a/Installing-and-Configuring/Flashing-Guides/SPI-Programmer-Best-Practices.md b/Installing-and-Configuring/Flashing-Guides/SPI-Programmer-Best-Practices.md
diff --git a/Installing-and-Configuring/Flashing-Guides/T420-maximized.md b/Installing-and-Configuring/Flashing-Guides/T420-maximized.md
@@ -9,21 +9,84 @@ grand_parent: Installing and configuring
 
 Lenovo T420 (Maximized)
 ===
+<details open markdown="block">
+  <summary>
+    Table of contents
+  </summary>
+  {: .text-delta }
+1. TOC
+{:toc}
+</details> 
 
-## ⚠️ Safety First
+## ⚠️ EOL: No microcode updates
+{: .warning }
+This board's CPU generation has reached End of Servicing Updates.
+See [per-board EOL/ESU status](https://github.com/linuxboot/heads/blob/master/doc/BOARDS_AND_TESTERS.md#per-board-eolesu-status)
+for ESU dates and [Heads threat model]({{ site.baseurl }}/Heads-threat-model/#binary-blobs-microcode-updates-and-transient-execution-vulnerabilities)
+for security implications.
+
+## ✅ PROTECTED: TPM GPIO Reset
+{: .warning }
+
+Pre-Skylake platform — dedicated PLTRST# pin, not GPIO-shared.
+See [Per-Board Protection Status]({{ site.baseurl }}/Heads-threat-model/#per-board-protection-status),
+[TPM GPIO Reset Vulnerability](https://github.com/linuxboot/heads/blob/master/doc/TPM_GPIO_Reset_Vulnerability.md).
+
+
+
+## ⚡ Safety First
 
 **Before starting, please read our [SPI Programmer Best Practices guide]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for essential safety information and programmer recommendations.**
 
 [T420 Hardware Maintenance Manual](https://download.lenovo.com/pccbbs/mobiles_pdf/t420_and_t420i_ug_en.pdf)  
 
-The thinkpad T420 has only one SPI flash chip that holds the BIOS, ME, etc. It is located under the palm rest. Similarly to the T430, to access this chip complete disassembly is required. It is a straightforward process and takes approximately 30 minutes. For this follow the T430/x230 guide. 
+## Disassembly
+
+→ **[Libreboot T420 external flashing guide](https://libreboot.org/docs/install/t420_external.html)** (detailed disassembly photos)  
+→ **[Lenovo T420 Hardware Maintenance Manual](https://download.lenovo.com/pccbbs/mobiles_pdf/t420_and_t420i_ug_en.pdf)**
+
+The T420 has a **single 8 MB SPI flash chip** (Winbond W25Q64CV) that holds the BIOS, ME firmware, and flash descriptor. Unlike the T430 and X230 (which use two separate chips), no ROM splitting is required.
+
+### Tools required
+
+- Flat-nose pliers (or sleeve tool for VGA screws)
+- Phillips screwdriver (various sizes)
+- Small crowbar or spudger (for prying keyboard and bezel)
+- CPU thermal grease (for reassembly)
+- Spare screws (some may strip during disassembly)
 
-**Critical**: Remove all batteries (including CMOS) AND disconnect the AC adapter before starting.
+**Critical**: Remove all batteries (including the CMOS RTC battery) AND disconnect the AC adapter before starting.
 
-[Here](https://www.coreboot.org/Board:lenovo/t420) is the location of the chip. At some models the location of the dot where the red wire from programmer should go may be misleading. The dot you need is just black.
+### Disassembly steps
+
+Full motherboard extraction is required — the T420 is more involved than the T430 because the main board must be separated from the magnesium frame. Budget approximately 30 minutes.
+
+1. **Bottom covers** — Remove the main battery, ultrabay device, and all screws on the black bottom cover.
+2. **Keyboard** — Use a small crowbar to push the keyboard gently toward the screen. Lift it and detach the ribbon cable.
+3. **Front cover (palm rest)** — Pry up around the sides with a spudger, lift the palm rest off, and disconnect the touchscreen/pointing-stick ribbon cable.
+4. **Internal components**:
+   - Speaker (red screws)
+   - Modem/telephone jack and WWAN card (pink screws)
+   - Screen assembly (green screws) — note cable routing for reassembly
+5. **Fan assembly** — Disconnect the USB port connections (blue) and remove the fan screws (red).
+6. **Bottom cover** — Flip the machine over and remove all visible screws securing the magnesium frame.
+7. **VGA port** — The VGA connector screws are unusually tight; loosen with flat-nose pliers or a sleeve tool.
+8. **Main board** — Lift the main board carefully off the magnesium frame, checking that no cables remain attached.
+
+The SPI flash chip is on the front of the board once the main board is free:
+
+[Here](https://doc.coreboot.org/mainboard/lenovo/t420.html) is the location of the chip. On some models the orientation dot marking pin 1 may be misleading — the correct dot is just black.
 
 ![T420 SPI flash chip]({{ site.baseurl }}/images/T420_SPI_chip.jpg)
 
 **Note**: See the [SPI Programmer Best Practices]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for programmer recommendations (Tigard recommended; CH347F preferred budget option; CH341A rev1.6+ acceptable with a physical selector).
 
+## Preparing the ROM
+
+First [download]({{ site.baseurl }}/Downloading) or build the maximized board ROM for the T420 and verify its hash. Since the T420 uses a single 8 MB flash chip, no ROM splitting is needed — the full `heads-t420-maximized.rom` is written directly to the single chip.
+
+## Flashing
+
+Use `[flasher]` (flashrom or flashprog -- see [Tool Interchangeability]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#tool-interchangeability)) to create a backup, verify, then write the Heads ROM. See the Libreboot guide linked above for chip location and `[flasher]` command examples.
+
 You should then follow through with [configuring keys]({{ site.baseurl }}/Configuring-Keys/).
diff --git a/Installing-and-Configuring/Flashing-Guides/T430-maximized.md b/Installing-and-Configuring/Flashing-Guides/T430-maximized.md
@@ -2,23 +2,49 @@
 layout: default
 title: Lenovo T430 Maximized
 permalink: /T430-maximized-flashing/
-nav_order: 3
+nav_order: 5
 parent: Step 2 - Flashing Guides
 grand_parent: Installing and configuring
 ---
 
 Lenovo T430 (Maximized)
 ===
+<details open markdown="block">
+  <summary>
+    Table of contents
+  </summary>
+  {: .text-delta }
+1. TOC
+{:toc}
+</details> 
 
-## ⚠️ Safety First
+## ⚠️ EOL: No microcode updates
+{: .warning }
+This board's CPU generation has reached End of Servicing Updates.
+See [per-board EOL/ESU status](https://github.com/linuxboot/heads/blob/master/doc/BOARDS_AND_TESTERS.md#per-board-eolesu-status)
+for ESU dates and [Heads threat model]({{ site.baseurl }}/Heads-threat-model/#binary-blobs-microcode-updates-and-transient-execution-vulnerabilities)
+for security implications.
+
+## ✅ PROTECTED: TPM GPIO Reset
+{: .warning }
+
+Pre-Skylake platform — dedicated PLTRST# pin, not GPIO-shared.
+See [Per-Board Protection Status]({{ site.baseurl }}/Heads-threat-model/#per-board-protection-status),
+[TPM GPIO Reset Vulnerability](https://github.com/linuxboot/heads/blob/master/doc/TPM_GPIO_Reset_Vulnerability.md).
+
+
+
+## ⚡ Safety First
 
 **Before starting, please read our [SPI Programmer Best Practices guide]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for essential safety information and programmer recommendations.**
 
 [T430 Hardware Maintenance Manual](https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/t430_t430i_hmm_en_0b48304_04.pdf)  
 
-Similarly to the x230, the thinkpad T430 has two SPI flash chips that hold the BIOS, ME, etc. They are located under the palm rest. To access these chips, complete disassembly is required. It is a straightforward process and takes approximately 30 minutes. For this you will need: some screwdrivers, thermal paste (since the CPU cooler needs to be removed too), a recommended SPI programmer (see our [Best Practices guide]({{ site.baseurl }}/SPI-Programmer-Best-Practices/)), and another laptop/PC with Ubuntu installed. Other linux based OS should be fine too. 
+→ **[Coreboot T430 documentation](https://doc.coreboot.org/mainboard/lenovo/t430.html)** (chip layout, flashing instructions)
 
-**Critical**: Remove all batteries (including CMOS) AND disconnect the AC adapter before starting.
+## Disassembly
+
+First remove the battery and the cable powering your device.
 
 ![Keyboard tilted up]({{ site.baseurl }}/images/t430/1_1_back_view_removed_battery.jpg)
 
@@ -59,25 +85,23 @@ Left chip corresponds to the "bottom" flash chip (8192 kb) and right corresponds
 ![SPI flash chips]({{ site.baseurl }}/images/t430/10_spi_flash_chips.jpg)
 
 
-First [download]({{ site.baseurl }}/Downloading)  or build (please see [general building]({{ site.baseurl }}/{{ site.baseurl }}/x230-maximized-building/) / [building x230]({{ site.baseurl }}/x230-maximized-building/))  the maximized board roms (top and bottom) for this board and verify their hashes.
-
-**Note:** If you need to reflash or customize the EC firmware while still on proprietary platform firmware, refer to the **EC firmware & customizations** section in the [Prerequisites]({{ site.baseurl }}/Prerequisites) for guidance on performing EC updates and customizations from vendor firmware prior to the initial Heads flash.
+First [download]({{ site.baseurl }}/Downloading)  or build (please see [general building]({{ site.baseurl }}/x230-maximized-building/) / [building x230]({{ site.baseurl }}/x230-maximized-building/))  the maximized board roms (top and bottom) for this board and verify their hashes.
 
 
 Try to read the name on the top SPI flash chip. I was unable to do that. The dots on the chip help to identify the correct clip orientation. 
 
 ![SPI flash chips closed view]({{ site.baseurl }}/images/t430/11_spi_chips_closed_view.jpg)
 
- Then, connect the clip and SPI programmer to the "top" (4096 kb) SPI flash chip. In my set up, the red wire should be where the dot is.
-
-**Note**: See the [SPI Programmer Best Practices]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for programmer recommendations (Tigard recommended; CH347F preferred budget option; CH341A rev1.6+ acceptable with a physical selector). The commands below use `[programmer]` as a placeholder; see the SPI Programmer Best Practices guide for example commands for specific programmers.
+ Then, connect the clip and ch341a programmer to the "top" (4096 kb) SPI flash chip. In my set up, the red wire should be where the dot is.
 
 ![Flashing 4 mb chip]({{ site.baseurl }}/images/t430/12_flash_4mb_spi_chip.jpg)
 
- Use flashrom to check the chip that you are connected to:
+## Flashing
+
+Use `[flasher]` of your choice (flashrom or flashprog -- see [Tool Interchangeability]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#tool-interchangeability)) with the programmer you selected ([programmer] -- see [Programmer Selection]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#programmer-selection)):
 
 ```shell
-sudo flashrom --programmer [programmer]
+sudo [flasher] --programmer [programmer]
 ```
 
 
@@ -88,20 +112,18 @@ sudo flashrom --programmer [programmer]
 Find the chip and create a backup and verify it (For me the SPI flash chip is `YYY`):
 
 ```shell
-sudo flashrom --programmer [programmer] --read ~/top.bin --chip YYY
-# Quick sanity check: inspect the start of the dump for obvious garbage
-hexdump -C ~/top.bin | head -20
-sudo flashrom --programmer [programmer] --verify ~/top.bin --chip YYY
+sudo [flasher] --read ~/top.bin --programmer [programmer] --chip YYY && \
+    sudo [flasher] --verify ~/top.bin --programmer [programmer] --chip YYY
 ```
 
 If the files differ then try reconnecting your programmer to the SPI flash chip
- and make sure your flashrom software is up to date.
+ and make sure your flashrom/flashprog software is up to date.
 
 
 If they are the same then write `t430-maximized-top.rom` to the SPI flash chip:
 
 ```shell
-sudo flashrom --programmer [programmer] --chip YYY --write ~/heads/build/x86/t430-maximized/t430-maximized-top.rom
+sudo [flasher] --programmer [programmer] --chip YYY --write ~/heads/build/x86/t430-maximized/t430-maximized-top.rom
 ```
 
  While everything goes well you should see the blue LED on the programmer.
@@ -115,14 +137,14 @@ sudo flashrom --programmer [programmer] --chip YYY --write ~/heads/build/x86/t43
 
 
 Try to read the name on the bottom SPI flash chip. Then, connect the clip and
- SPI programmer to the bottom SPI flash chip. 
+ ch341a programmer to the bottom SPI flash chip. 
 
 ![flashing bottom 8 mb chip]({{ site.baseurl }}/images/t430/16_flash_8mb_chip.jpg)
 
- Use flashrom to check the chip that you are connected to:
+Use `[flasher]` of your choice (flashrom or flashprog -- see [Tool Interchangeability]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#tool-interchangeability)) with the programmer you selected ([programmer] -- see [Programmer Selection]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#programmer-selection)):
 
 ```shell
-sudo flashrom --programmer [programmer]
+sudo [flasher] --programmer [programmer]
 ```
 
 Here is my output.
@@ -132,20 +154,15 @@ Here is my output.
 Find the chip and create a backup and verify it (For me the SPI flash chip is `ZZZ`):
 
 ```shell
-sudo flashrom --programmer [programmer] --read ~/bottom.bin --chip ZZZ
-# Quick sanity check: inspect the start of the dump for obvious garbage
-hexdump -C ~/bottom.bin | head -20
-sudo flashrom --programmer [programmer] --verify ~/bottom.bin --chip ZZZ
+sudo [flasher] --read ~/bottom.bin --programmer [programmer] --chip ZZZ && \
+    sudo [flasher] --verify ~/bottom.bin --programmer [programmer] --chip ZZZ
 ```
 
 The 8M bottom chip contains the ME firmware.  It is neutralized in maximized version. You can flash it specifying the same chip you found under ZZZ:
 ```shell
-sudo flashrom --programmer [programmer] --chip ZZZ --write ~/heads/build/x86/t430-maximized/t430-maximized-bottom.rom
+sudo [flasher] --programmer [programmer] --chip ZZZ --write ~/heads/build/x86/t430-maximized/t430-maximized-bottom.rom
 ```
 
-**Note about GBE:** The T430 contains a GBE region (board MACs) inside the Intel Firmware Descriptor (IFD). **Always back up the full chip before the initial flash** and inspect the dump (for example, `hexdump -C ~/bottom-backup.bin | head -20`).
-
-If you need to preserve a board's MAC/GBE, the reliable approach is to create a custom GBE during the Heads build (see the `boards/<boardname>` configuration in linuxboot/heads). For details on preserving board-specific regions, consult the SPI Programmer Best Practices guide and the board's build documentation, and refer to issue #120 for community discussion.
 If all goes well, you should see the keyboard LED flash, and within a second Heads will boot in its GUI. 
 
 Two reboots are sometimes needed after flash. Force power off by holding the power button for 10 seconds. Since the memory training data was wiped by the content of the full flashed ROM, this is normal.

diff --git a/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md b/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md
@@ -0,0 +1,80 @@
+---
+layout: default
+title: Lenovo T440p Maximized
+permalink: /T440p-maximized-flashing/
+nav_order: 6
+parent: Step 2 - Flashing Guides
+grand_parent: Installing and configuring
+---
+
+Lenovo T440p (Maximized)
+===
+
+<details open markdown="block">
+  <summary>
+    Table of contents
+  </summary>
+  {: .text-delta }
+1. TOC
+{:toc}
+</details> 
+
+## ⚠️ EOL: No microcode updates
+{: .warning }
+This board's CPU generation has reached End of Servicing Updates.
+See [per-board EOL/ESU status](https://github.com/linuxboot/heads/blob/master/doc/BOARDS_AND_TESTERS.md#per-board-eolesu-status)
+for ESU dates and [Heads threat model]({{ site.baseurl }}/Heads-threat-model/#binary-blobs-microcode-updates-and-transient-execution-vulnerabilities)
+for security implications.
+
+## ✅ PROTECTED: TPM GPIO Reset
+{: .warning }
+Pre-Skylake — dedicated PLTRST# pin.
+See [Per-Board Protection Status]({{ site.baseurl }}/Heads-threat-model/#per-board-protection-status),
+[TPM GPIO Reset Vulnerability](https://github.com/linuxboot/heads/blob/master/doc/TPM_GPIO_Reset_Vulnerability.md).
+
+## ⚡ Safety First
+**Before starting, please read our [SPI Programmer Best Practices guide]({{ site.baseurl }}/SPI-Programmer-Best-Practices/) for essential safety information and programmer recommendations.**
+
+## Disassembly
+
+The T440p has **two SPI flash chips** — an 8 MB chip (SPI1) and a 4 MB chip (SPI2). The Heads ROM must be split before flashing:
+
+```shell
+dd if=heads-t440p-maximized.rom of=spi1_8mb.rom bs=1M count=8
+dd if=heads-t440p-maximized.rom of=spi2_4mb.rom bs=1M skip=8
+```
+
+Flash the 8 MB chip (SPI1) with `spi1_8mb.rom` and the 4 MB top chip (SPI2) with `spi2_4mb.rom`.
+
+### Step-by-step disassembly
+
+1. Remove the back cover screws and the main battery.
+2. Slide off the back cover.
+3. Unplug the CMOS battery, the fan cable, and the black LED cable.
+4. Remove all visible screws holding the bottom assembly (the ultrabay screw loosens but does not come out).
+5. Pry up around the sides of the bottom assembly to release the clips, then lift it open like a clamshell toward the front — take care not to snap any wires.
+6. The two flash chips are now visible near the RAM. The chip labeled **SPI1** is the 8 MB chip; the chip labeled **SPI2** (mounted above it) is the 4 MB chip.
+
+For reference photos and detailed mechanical guidance, consult:
+- **[Libreboot T440p external flashing guide](https://libreboot.org/docs/install/t440p_external.html)** — photo disassembly and ROM-splitting instructions
+- **[Coreboot T440p documentation](https://doc.coreboot.org/mainboard/lenovo/t440p.html)** — chip layout and flashing commands
+- The Lenovo hardware maintenance manual is available from [Lenovo support](https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t440p) (search for "Hardware Maintenance Manual")
+
+## Flashing
+
+Connect your SPI programmer to the chip(s) being programmed, respecting pin 1 on each chip. Write each half of the split ROM to the corresponding chip:
+
+Use `[flasher]` of your choice (flashrom or flashprog -- see [Tool Interchangeability]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#tool-interchangeability)) with the programmer you selected ([programmer] -- see [Programmer Selection]({{ site.baseurl }}/SPI-Programmer-Best-Practices/#programmer-selection)):
+
+```shell
+[flasher] --programmer [programmer] --chip "W25Q64FV" --write spi1_8mb.rom
+[flasher] --programmer [programmer] --chip "W25Q32FV" --write spi2_4mb.rom
+```
+
+Replace `[programmer]` with your hardware (e.g. `linux_spi:dev=/dev/spidev0.0`, `ft2232_spi:type=2232H`, or `ch341a_spi`).
+
+### Haswell-specific notes
+
+- **[thinkpad_acpi](https://www.kernel.org/doc/html/latest/admin-guide/laptops/thinkpad-acpi.html)**: After the first boot with Heads, the `thinkpad_acpi` kernel module may need the `fan_control=1` parameter to enable manual fan control. Add `thinkpad_acpi.fan_control=1` to the kernel command line or pass it as a module parameter.
+- **[MRC](https://doc.coreboot.org/soc/intel/fsp.html) (Memory Reference Code)**: The T440p uses Haswell MRC training data stored in SPI flash. If the flash layout is corrupted or you are flashing a completely blank board, the machine may not boot until MRC training runs. Heads does not include a built-in MRC cache; the first boot after flashing may take 30–60 seconds as the platform retrains memory. Subsequent boots will reuse cached parameters.
+- **GPIO PLTRST#**: As noted above, the T440p has a dedicated PLTRST# pin for TPM GPIO reset, making it one of the better-protected pre-Skylake boards in the Heads threat model.