unified internal dell latitude flashing guide
Signed-off-by: Leah Rowe <info@minifree.org>master
Leah Rowe
parent
ee575a619b
commit
de0e141087
|
|
@ -0,0 +1,90 @@
|
|||
---
|
||||
title: Internally flash Dell Latitude laptops
|
||||
x-toc-enable: true
|
||||
...
|
||||
|
||||
Make sure SecureBoot is disabled, if you're running a UEFI-based Latitude.
|
||||
Other steps also required, described on this page and in the `README.md`
|
||||
file included with `dell-flash-unlock`.
|
||||
|
||||
Internal flashing
|
||||
=================
|
||||
|
||||
You can simply boot GNU+Linux or BSD, on the Dell Latitude you wish to flash, and
|
||||
run `flashprog` from there, for Canoeboot installation. Certain other steps
|
||||
are also required, documented in the steps below:
|
||||
|
||||
Flashing from BSD
|
||||
-----------------
|
||||
|
||||
Basically identical to GNU+Linux, except that you must
|
||||
set `kern.securelevel` to -1 on boot, which is equivalent to `iomem=relaxed`
|
||||
under GNU+Linux, for this purpose.
|
||||
|
||||
The `dell-flash-unlock` utility will compile and run just fine. It has been
|
||||
tested on OpenBSD, NetBSD and FreeBSD. With this in mind, simply follow the
|
||||
GNU+Linux instrucctions but adapt accordingly.
|
||||
|
||||
If unsure, just boot a live GNU+Linux distro via USB and run it all there.
|
||||
|
||||
Flashing from GNU+Linux
|
||||
-------------------
|
||||
|
||||
MAKE SURE you boot with this Linux kernel parameter: `iomem=relaxed` - this
|
||||
disables memory protections, permitting `/dev/mem` access needed by flashprog.
|
||||
The flash is memory mapped and flashprog accesses it via `/dev/mem`.
|
||||
|
||||
You can flash Canoeboot directly from the vendor (Dell) BIOS, without taking
|
||||
the machine apart. It can be done entirely from GNU+Linux. It will probably also
|
||||
work on BSD systems, but it has only been testing on GNU+Linux thus far.
|
||||
|
||||
**NOTE (15 October 2023): The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
|
||||
Check `util/dell-flash-unlock` in the `cbmk.git` repository, or in releases.
|
||||
|
||||
Go in there:
|
||||
|
||||
cd util/dell-flash-unlock
|
||||
make
|
||||
|
||||
**With this program, you can unlock the flash in such a way where everything
|
||||
is writeable. Information about how to use it is in the `README.md` file which
|
||||
is included in that program's directory, or you can read it online here:**
|
||||
|
||||
**<https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/README.md>**
|
||||
|
||||
**Please make sure that you do fully read the README, because it contains
|
||||
useful information.**
|
||||
|
||||
Literally just run that program, and do what it says. You run it once, and shut
|
||||
down, and when you do, the system brings itself back up automatically; on some
|
||||
systems, you have to boot the machine back up manually, after power down. Then
|
||||
you run it and flash it unlocked. Then you run it again. The source code is
|
||||
intuitive enough that you can easily get the gist of it; it's writing some EC
|
||||
commands and changing some chipset config bits. The EC on this machine is
|
||||
hooked up to the `GPIO33` signal, sometimes called `HDA_DOCK_EN`, which sets
|
||||
the flash descriptor override thus disabling any flash protection by the IFD.
|
||||
It also bypasses the SMM BIOS lock protection by disabling SMIs, and Dell's
|
||||
BIOS doesn't set any other type of protection either such as writing to
|
||||
Protected Range registers.
|
||||
|
||||
MAKE SURE to back up the original firmware image first:
|
||||
|
||||
flashprog -p internal -r factory.rom
|
||||
|
||||
When you flash it, you can use this command:
|
||||
|
||||
flashprog -p internal -w canoeboot.rom
|
||||
|
||||
Where `canoeboot.rom` is your Dell Latitude ROM. *Make sure* it's the right
|
||||
one. If flashprog complains about multiple flash chips detected, just pick one of them (doesn't matter which one). On *most* Dell machines, the most correct
|
||||
would probably be this option in flashprog: `-c MX25L3205D/MX25L3208D`.
|
||||
|
||||
So:
|
||||
|
||||
flashprog -p internal -w canoeboot.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
When you see flashprog say `VERIFIED` at the end, that means the flash was
|
||||
successful. If you don't see that, or you're unsure, please [contact the
|
||||
Canoeboot project via IRC](../../contact.md).
|
||||
|
|
@ -31,8 +31,16 @@ Use this to find out:
|
|||
|
||||
flashprog -p internal
|
||||
|
||||
We believe most/all are 4MB (32Mb) flash sizes, but larger ROM images are
|
||||
provided for people who wish to upgrade.
|
||||
We believe most/all are 4MB (32Mb) flash sizes. The schematics hint that
|
||||
some boards may have 6MB flash (4MB and 2MB, dual chip), but we've only ever
|
||||
seen 4MB setups in the wild. You can still flash the 4MB image on 6MB setups,
|
||||
if it's encountered, by just leaving the higher 2MB part unflashed, because
|
||||
the flash descriptor (in Libreboot) configures everything so that the BIOS
|
||||
region ends just before the 4MB mark, in flash; the BIOS region is the final
|
||||
region, in the higher part of flash as defined *by the descriptor*, regardless
|
||||
of whether that is the actual end of the flash.
|
||||
|
||||
Libreboot does currently provide 6MB images on this board, for these reasons.
|
||||
|
||||
MAC address {#macaddress}
|
||||
===========
|
||||
|
|
@ -78,77 +86,13 @@ higher pixel clock.
|
|||
How to flash internally (no diassembly)
|
||||
=======================================
|
||||
|
||||
Flashing from GNU+Linux
|
||||
-------------------
|
||||
Please read the article:
|
||||
|
||||
MAKE SURE you boot with this Linux kernel parameter: `iomem=relaxed` - this
|
||||
disables memory protections, permitting `/dev/mem` access needed by flashprog.
|
||||
The flash is memory mapped and flashprog accesses it via `/dev/mem`.
|
||||
[Internally flash Dell Latitude laptops](dell_internal.md)
|
||||
|
||||
You can flash Canoeboot directly from the vendor (Dell) BIOS, without taking
|
||||
the machine apart. It can be done entirely from GNU+Linux. It will probably also
|
||||
work on BSD systems, but it has only been testing on GNU+Linux thus far.
|
||||
|
||||
**NOTE: The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
|
||||
Check `util/dell-flash-unlock` in the `cbmk.git` repository, or in release
|
||||
archives for Canoeboot releases from 20231026 onward.
|
||||
|
||||
Go in there:
|
||||
|
||||
cd util/dell-flash-unlock
|
||||
make
|
||||
|
||||
With this program, you can unlock the flash in such a way where everything
|
||||
is writeable. Information about how to use it is in the `README.md` file which
|
||||
is included in that program's directory, or you can read it online here:
|
||||
|
||||
<https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/README.md>
|
||||
|
||||
Literally just run that program, and do what it says. You run it once, and shut
|
||||
down, and when you do, the system brings itself back up automatically. Then
|
||||
you run it and flash it unlocked. Then you run it again. The source code is
|
||||
intuitive enough that you can easily get the gist of it; it's writing some EC
|
||||
commands and changing some chipset config bits. The EC on this machine is
|
||||
hooked up to the `GPIO33` signal, sometimes called `HDA_DOCK_EN`, which sets
|
||||
the flash descriptor override thus disabling any flash protection by the IFD.
|
||||
It also bypasses the SMM BIOS lock protection by disabling SMIs, and Dell's
|
||||
BIOS doesn't set any other type of protection either such as writing to
|
||||
Protected Range registers.
|
||||
|
||||
When you flash it, you can use this command:
|
||||
|
||||
flashprog -p internal -w canoeboot.rom
|
||||
|
||||
Where `canoeboot.rom` is your E6400 ROM. *Make sure* it's the right one.
|
||||
If flashprog complains about multiple flash chips detected, just pick one of
|
||||
them (doesn't matter which one). On *most* Dell machines, the most correct
|
||||
would probably be this option in flashprog: `-c MX25L3205D/MX25L3208D`.
|
||||
|
||||
So:
|
||||
|
||||
flashprog -p internal -w canoeboot.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
When you see flashprog say `VERIFIED` at the end, that means the flash was
|
||||
successful. If you don't see that, or you're unsure, please [contact the
|
||||
Canoeboot project via IRC](../../contact.md).
|
||||
|
||||
BACK UP THE FACTORY BIOS
|
||||
========================
|
||||
|
||||
The `-w` option flashes `canoeboot.rom`. You may consider *backing up* the
|
||||
original Dell BIOS first, using the -r option:
|
||||
|
||||
flashprog -p internal -r backup.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
Do this while in a flashable state, after the 2nd run of `dell-flash-unlock`.
|
||||
|
||||
Make sure the `backup.rom` file gets backed up to an external storage media,
|
||||
not the E6400 itself.
|
||||
|
||||
With this method, you can probably flash it within 5 minutes. Again, zero
|
||||
disassembly required!
|
||||
Dell's original BIOS/UEFI firmware typically prevents write access, but it
|
||||
has bugs which can be exploited, to enable Libreboot installation very easily.
|
||||
You do not have to disassemble the machine.
|
||||
|
||||
How to flash externally
|
||||
=========================
|
||||
|
|
|
|||
Loading…
Reference in New Issue