Skip to content

add GbE perserving external flashing to initial external flashing / internal upgrade #209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
nestire wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

add GbE perserving external flashing to initial external flashing / internal upgrade #209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
155dd62
add GbE perserving external flashing to t480 install
nestire Nov 10, 2025
1316285
dont use ifdtool to perserve mac adress
nestire Nov 11, 2025
c05112f
general change to mac adress perserving flashing
nestire Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion About/Historical-Legacy-Migration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,10 +99,18 @@ mount-usb
flashprog -p internal -w /media/PathToMaximizedRom.rom
```

on board with Intel based Ethernet you might want to use:

```
sudo flashrom -p internal --ifd -i bios -i me -i fd -w /media/PathToMaximizedRom.rom
```

to perserve the orignal mac adresse

**Note**: Use `flashprog` on newer Heads firmware (2025+) or `flashrom` on older firmware versions, depending on what is available in your Heads system.

On next reboot, Heads would guide you into factory resetting your USB Security dongle or import your previously generated public key matching your USB Security dongle's private key.

It would then regenerate a TOTP/HOTP secret and sign /boot content. You would then have to define a new default boot and optionally renew/change your Disk Unlock Key to be released to to OS to unlock your encrypted OS installation to move forward.

In the case nothing was found installed on your disk, Heads would propose you to boot from USB to install a new Operating System, prior of being able to do the above steps prior of booting into your system.
In the case nothing was found installed on your disk, Heads would propose you to boot from USB to install a new Operating System, prior of being able to do the above steps prior of booting into your system.
9 changes: 8 additions & 1 deletion Installing-and-Configuring/Flashing-Guides/T480-maximized.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,12 +101,19 @@ diff <(hexdump -C t480_original_bios.bin) <(hexdump -C t480_original_bios_1.bin)
If the files differ or the chip content does not match the dump, try reconnecting your programmer to the SPI flash chip and make sure your flashrom/flashprog software is up-to-date.


If they are the same, then write `T480-hotp-maximized.rom` to the SPI flash chip:
If they are the same, you can then write `T480-hotp-maximized.rom` to the SPI flash chip.

```shell
sudo flashrom -p ch341a_spi -c YYY -w ~/heads/build/x86/T480-hotp-maximized/T480-hotp-maximized.rom
```

On boards with Intel-based Ethernet, such as the T480, this will also overwrite the GbE region in the BIOS, which stores the MAC address of the chip, with a forged one (MAC: 00:DE:AD:C0:FF:EE). This has the privacy benefit that the chip uses this shared MAC so it can't be used as a personal identifier for this exact board. The downside is that this can create connectivity problems on local networks if other heads boards with the same MAC address are present. To preserve the original MAC address of the board, use:

```shell
sudo flashrom -p ch341a_spi -c YYY --ifd -i bios -i me -i fd -w ~/heads/build/x86/T480-hotp-maximized/T480-hotp-maximized.rom
```


Here is a successful attempt. Be patient, it may take a while.
![erase/write done]({{ site.baseurl }}/images/T480/9_flash.jpg)

Expand Down
13 changes: 11 additions & 2 deletions Installing-and-Configuring/Upgrading.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,16 @@ If you are installing Heads for the first time, you will need to perform an exte
- Verifying file integrity.
- Preparing for external flashing.

You can use this command
```shell
sudo flashrom -p ch341a_spi -c YYY -w [HEADS_ROM]
```
On boards with Intel-based Ethernet, this will also overwrite the GbE region in the BIOS, which stores the MAC address of the chip, with a forged one (MAC: 00:DE:AD:C0:FF:EE). This has the privacy benefit that the chip uses this shared MAC so it can't be used as a personal identifier for this exact board. The downside is that this can create connectivity problems on local networks if other heads boards with the same MAC address are present. To preserve the original MAC address of the board, use:

```shell
sudo flashrom -p ch341a_spi -c YYY --ifd -i bios -i me -i fd -w [HEADS_ROM]
```

**Note**: This process is only required for the initial installation of Heads.

---
Expand Down Expand Up @@ -121,8 +131,7 @@ If you need to validate the current firmware integrity against the last flashed
**Note on `CONFIG_FLASH_OPTIONS`**:
- The `CONFIG_FLASH_OPTIONS` variable specifies the board-specific flash options to ensure proper handling of SPI regions during flashing. These options are defined in the board's configuration file.
- Boards may specify different SPI regions to flash. For example:
- The `novacustom-v540tu` board preserves the `GBE` (Gigabit Ethernet) region, ensuring the manufacturing MAC address remains intact.
- The `x230-hotp-maximized` board overwrites the entire SPI flash, including the `GBE` region, replacing it with a generic configuration.
- All boards with intel based ethernet chips preserves the `GBE` (Gigabit Ethernet) region, ensuring the MAC address remains intact.
- To inspect the flash options for your board, use the `env` command in the recovery shell:
```shell
env
Expand Down