Lenovo T440p (Maximized)

Table of contents

1. Lenovo T440p (Maximized)
   1. ⚠️ EOL: No microcode updates
   2. ✅ PROTECTED: TPM GPIO Reset
   3. ⚡ Safety First
   4. Disassembly
      1. Step-by-step disassembly
   5. Flashing
      1. Haswell-specific notes

⚠️ EOL: No microcode updates

This board’s CPU generation has reached End of Servicing Updates. See per-board EOL/ESU status for ESU dates and Heads threat model for security implications.

✅ PROTECTED: TPM GPIO Reset

Pre-Skylake — dedicated PLTRST# pin. See Per-Board Protection Status, TPM GPIO Reset Vulnerability.

⚡ Safety First

Before starting, please read our SPI Programmer Best Practices guide for essential safety information and programmer recommendations.

Disassembly

The T440p has two SPI flash chips — an 8 MB chip (SPI1) and a 4 MB chip (SPI2). The Heads ROM must be split before flashing:

dd if=heads-t440p-maximized.rom of=spi1_8mb.rom bs=1M count=8
dd if=heads-t440p-maximized.rom of=spi2_4mb.rom bs=1M skip=8

Flash the 8 MB chip (SPI1) with spi1_8mb.rom and the 4 MB top chip (SPI2) with spi2_4mb.rom.

Step-by-step disassembly

1. Remove the back cover screws and the main battery.
2. Slide off the back cover.
3. Unplug the CMOS battery, the fan cable, and the black LED cable.
4. Remove all visible screws holding the bottom assembly (the ultrabay screw loosens but does not come out).
5. Pry up around the sides of the bottom assembly to release the clips, then lift it open like a clamshell toward the front — take care not to snap any wires.
6. The two flash chips are now visible near the RAM. The chip labeled SPI1 is the 8 MB chip; the chip labeled SPI2 (mounted above it) is the 4 MB chip.

For reference photos and detailed mechanical guidance, consult:

• Libreboot T440p external flashing guide — photo disassembly and ROM-splitting instructions
• Coreboot T440p documentation — chip layout and flashing commands
• The Lenovo hardware maintenance manual is available from Lenovo support (search for “Hardware Maintenance Manual”)

Flashing

Connect your SPI programmer to the chip(s) being programmed, respecting pin 1 on each chip. Write each half of the split ROM to the corresponding chip:

Use [flasher] of your choice (flashrom or flashprog – see Tool Interchangeability) with the programmer you selected ([programmer] – see Programmer Selection):

[flasher] --programmer [programmer] --chip "W25Q64FV" --write spi1_8mb.rom
[flasher] --programmer [programmer] --chip "W25Q32FV" --write spi2_4mb.rom

Replace [programmer] with your hardware (e.g. linux_spi:dev=/dev/spidev0.0, ft2232_spi:type=2232H, or ch341a_spi).

Haswell-specific notes

• thinkpad_acpi: After the first boot with Heads, the thinkpad_acpi kernel module may need the fan_control=1 parameter to enable manual fan control. Add thinkpad_acpi.fan_control=1 to the kernel command line or pass it as a module parameter.
• MRC (Memory Reference Code): The T440p uses Haswell MRC training data stored in SPI flash. If the flash layout is corrupted or you are flashing a completely blank board, the machine may not boot until MRC training runs. Heads does not include a built-in MRC cache; the first boot after flashing may take 30–60 seconds as the platform retrains memory. Subsequent boots will reuse cached parameters.
• GPIO PLTRST#: As noted above, the T440p has a dedicated PLTRST# pin for TPM GPIO reset, making it one of the better-protected pre-Skylake boards in the Heads threat model.