t480_libreboot

A Libreboot Guide for the T480 ThinkPad

Overview

This repo contains a Dockerfile that builds injected Libreboot ROMs for the T480 using the lbmk toolchain and the official Libreboot 26.01rev1 release archive. The injected ROMs are exported to ./roms/.

Downloading the ROM archive

Download the T480 16MB archive from the Libreboot 26.01rev1 release:

libreboot-26.01rev1_t480_vfsp_16mb.tar.xz

Place it in the root of this repo before building.

What mk inject does

The mk inject command injects proprietary vendor blobs (Intel ME, GbE firmware) into the ROM archive. Libreboot can't ship these pre-injected, so the tool extracts the archive, patches each ROM with your MAC address, and rewrites the tar in place. The resulting ROMs are safe to flash.

Building the ROMs

Note: In order to proceed you will need to ensure that docker is installed and running on your system. More information here.

The Dockerfile requires three build args:

Arg	Description
GIT_NAME	Your name (used for git config inside the build)
GIT_EMAIL	Your email (used for git config inside the build)
MAC_ADDRESS	Your T480's MAC address (injected into the ROMs)

docker build \
  --build-arg GIT_NAME="Your Name" \
  --build-arg GIT_EMAIL="you@example.com" \
  --build-arg MAC_ADDRESS="xx:xx:xx:xx:xx:xx" \
  -t lbmk-final .

Then extract the ROMs:

docker create --entrypoint /bin/sh --name lbmk-tmp lbmk-final
docker cp lbmk-tmp:/ ./roms/
docker rm lbmk-tmp

Pre-built ROMs are already in ./roms/.

Choosing a ROM

ROMs follow the naming pattern:

<payload>_t480_vfsp_16mb_<display>_<keyboard>.rom

• Payload: seagrub (GRUB bootloader, recommended) or seabios (legacy BIOS)
• Display: libgfxinit_corebootfb (graphical, recommended) or libgfxinit_txtmode (text mode)
• Keyboard: usqwerty, ukqwerty, usdvorak, colemak, etc.

For a standard US setup:

seagrub_t480_vfsp_16mb_libgfxinit_corebootfb_usqwerty.rom

Downgrade / Upgrade Factory BIOS

The T480 must be on BIOS version 1.52 (N24UR39W) before flashing Libreboot. Downgrade or upgrade to this version first.

Download the Lenovo BIOS ISO and convert it to a bootable USB image using geteltorito:

wget https://download.lenovo.com/pccbbs/mobiles/n24ur39w.iso

git clone https://github.com/rainer042/geteltorito
chmod +x geteltorito/geteltorito.pl
geteltorito/geteltorito.pl -o t480_bios_update.img n24ur39w.iso

sudo dd if=t480_bios_update.img of=/dev/sdX bs=4M conv=fsync status=progress

Replace /dev/sdX with your USB drive (check with lsblk).

In the Lenovo BIOS before booting the USB:

• Disable Secure Rollback Prevention (under UEFI BIOS Update Option)
• Enable Flash BIOS Updating by End Users
• Disable SecureBoot

Make sure the laptop is fully charged or plugged in before proceeding.

Boot the USB via F12 at the Lenovo logo and follow the on-screen instructions.

---

BIOS Prep (do this before flashing)

In the Lenovo BIOS:

• Disable Secure Rollback Prevention
• Enable Flash BIOS Updating by End Users
• Disable SecureBoot
• Enable Legacy BIOS

Also: remove the external battery, disconnect the internal battery, and disconnect the CMOS battery before attaching the programmer.

Flashing with an External Programmer

Note: Libreboot warns against using the CH341A programmer. See the Libreboot flashing guide for their recommended programmers.

Install flashrom (Arch / CachyOS)

sudo pacman -S flashrom

1. Detect the chip

sudo flashrom -p ch341a_spi

2. Take backups

sudo flashrom -p ch341a_spi -c "W25Q128.V" -r backup1.bin
sudo flashrom -p ch341a_spi -c "W25Q128.V" -r backup2.bin

3. Verify backups match

sha256sum backup1.bin backup2.bin | awk '{print $1}' | uniq -d

Only proceed if the hash is printed (nothing printed means they didn't match!!!)

4. Flash

sudo flashrom -p ch341a_spi -c "W25Q128.V" -w roms/seagrub_t480_vfsp_16mb_libgfxinit_corebootfb_usqwerty.rom

References

• Libreboot T480 install guide
• Libreboot 26.01 download page