Nitrokey / heads

A minimal Linux that runs as a coreboot or LinuxBoot ROM payload to provide a secure, flexible boot environment for laptops and servers.
http://osresearch.net/
GNU General Public License v2.0
15 stars 1 forks source link

documentation on switching to heads, desired #22

Closed FrostKnight closed 11 months ago

FrostKnight commented 1 year ago

How would I go about, changing a thinkpad from coreboot to nitrokey heads?

Like say, do I, do this?:

flashrom -p internal -w top.rom flashrom -p internal -w bottom.rom

For X230, or T430, etc...

tlaurion commented 1 year ago

Before doing anything else, please make sure that nothing is locked by doing "flashrom -p internal".

Look at https://osresearch.net/Downloading#migrating-from-on-board-configuration-to-another

How would I go about, changing a thinkpad from coreboot to nitrokey heads?

Coreboot is not prescriptive about its configuration. ME/IFD regions could be locked and internal flashing from flashrom could result into a " brick".

Migrating when nothing is locked should be safe, but having an external reprogrammer is always a good idea. Heads provides top and bottom ROMs for xx30 platforms which are meant to be externally flashed, not internally. The full ROMs can be internally flashed (they will erase and write everything) only if nothing is locked.

FrostKnight commented 1 year ago

So this rom would be needed? I assume this is the full rom: https://github.com/Nitrokey/heads/releases/download/v1.4/nitropad-x230-maximized-v1.4.rom

This will work under 2 conditions:

If nitrokey heads bios isn't already on it?

And, if its not determined to be locked when I use flashrom -p internal

Yes?

FrostKnight commented 1 year ago

Would i do it this way: flashrom -p internal -w nitropad-x230-maximized-v1.4.rom

And then reboot?

tlaurion commented 1 year ago

@szszszsz ?

daringer commented 11 months ago

Would i do it this way: flashrom -p internal -w nitropad-x230-maximized-v1.4.rom

And then reboot?

In theory yes, you might also want to use the more recent roms - but from our experience most of the devices have a locked flash, thus I assume you'll need an external flashing device to do the migration - we also offer this as a service.

closing for now, please re-open if needed