Firmware Update¶
This guide describes how to update the Heads firmware of the NitroPad.
These instructions are relevant in the following cases:
You want to update the Heads firmware.
You have already performed an OEM factory reset, but the TPM counter has not been reset.
Procedure¶
Preparation
Connect your NitroPad to a power plug and load its battery to over 70%
Download the latest firmware and store it on a USB drive. For the:
NitroPad T430:
firmware-nitropad-t430-[version].zipNitroPad X230:
firmware-nitropad-x230-[version].zipNitroPad NV41:
firmware-nitropad-nv41-[version].zipNitroPad NS50:
firmware-nitropad-ns50-[version].zipNitroPad T480:
firmware-nitropad-t480-[version].zipNitroPad T480s:
firmware-nitropad-t480s-[version].zipNitroPad V54:
firmware-nitropad-v54-[version].zipNitroPad V56:
firmware-nitropad-v56-[version].zip
Firmware Signature Check
To verify the firmware follow these steps:
Download sha256sum.sig and store it
Download and import Markus Meissners gpg key
Verify the signature:
gpg --verify sha256sum.sig sha256sum
You expect an output like this one:
gpg: Signature made Wed 05 Jul 2023 04:30:34 PM CEST gpg: using RSA key C7E32619E2F71736F5910BB144CB2D868DD16BDA gpg: Good signature from "Markus Meissner <meissner@nitrokey.com>" [ultimate] gpg: aka "Markus Meissner <coder@safemailbox.de>" [ultimate]
This verifys the file.
Procedure
This is the actual update procedure. Usually the first two screens will not be shown - in that case please start from step 3.
(Optional screen) Select “Ignore error and continue to default boot menu”.
(Optional screen) Select “Ignore error and continue to default boot menu”.
Go to “Options”.
Select “Flash/Update the BIOS”.
Please confirm the first option.
Confirm the process with Enter.
Select the desired .npf file.
Confirm the process with Enter.
Confirm the restart with Enter.
You have successfully updated your firmware!
Starting with v1.4, due to elementary changes inside Heads and the firmware layout, the update requires some additional considerations. This applies for both NitroPads X230 and T430.
Should I update my NitroPad?
When updating your firmware to 1.4 (without using an external flasher device) the graphical HEADS dialogues will be replaced with a less convenient text-only version.
If you use Ubuntu, Debian, Linux Mint, or Qubes 4.0, updating the firmware beyond v1.3.1 is (as of today) not needed. If you use Qubes 4.1 without the integrated Ethernet port, you don’t need to update the firmware either.
If you want to use Qubes 4.1 or newer and the integrated Ethernet port, you need to update the firmware to 1.4.
Hint
If the .npf file is not accepted by HEADS, you are likely not running the latest HEADS version. So either first update to version 1.3.1, or unzip the .npf file and use the resulting .rom file instead.
How can I update my NitroPad?
There are two different ways to update from v1.3.1 onwards:
Legacy update using either
nitropad-t430-v1.4.npfornitropad-x230-v1.4.npffrom the Heads menu, see the procedure above.When using an external flasher device you can use the
-maximizedimages. This keeps the graphical HEADS dialogues working. Read about the external flashing below.
Warning
Never try updating your NitroPad using the -maximized image if you do not know exactly what you are doing! You will brick your NitroPad and it can only be repaired using an external flasher!
How can I update to -maximized?
Hint
We highly recommend NOT DOING THIS ON YOUR OWN, as long as you do not know exactly what you are doing!
We have a service to do this upgrade on your NitroPad. Please write an e-mail to “shop at nitrokey.com” together with your sales order number (SOxxxxxx).
The following procedure describes roughly how to flash your NitroPad using an external flasher - it is intentionally on a high level, as we do not recommend doing this process on your own. But for the sake of completeness we document this here for the curious.
Make sure you have a (
flashrom) compatible flasher likech341a_spiwith a SOIC-8 clamp.Open the device (see coreboot docs) and make sure you can access both flash chips.
Using
flashrom, read out the bottom flash (the 8MB image).Using
ifdtool(coreboot ifdtool docs), extract theGbEflash region from the image and replace theGbEregion inside your-maximizedimage.Split the modified firmware image using
dd(as described in the coreboot documentation) into-topand-bottom.Flash the images to the matching flash chips using your flasher and clamp.
Reboot into your system (you should see
-maximizedinside the Heads menu).
Background information
The new firmware class of -maximized images changes the firmware
layout in a way that it is incompatible with Heads’ internal firmware
upgrade feature on the NitroPads.
This change mainly originates from a reduced Management Engine size
inside the firmware image. Furthermore, the -maximized images do
contain all flash regions inside the firmware; this also includes GbE,
which contains the Ethernet MAC address.
The non -maximized images have no functional differences compared
to the -maximized images except for the reduced Heads GUI.