From 21aec25c8d9dcbf28f58d1592def9fe4bdbc09a2 Mon Sep 17 00:00:00 2001 From: Leah Rowe Date: Fri, 6 Dec 2024 20:25:36 +0000 Subject: [PATCH] made the t480 guide a bit less hazardous i repeated some info intentionally, and made some things clearer Signed-off-by: Leah Rowe --- site/docs/install/t480.md | 48 +++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/site/docs/install/t480.md b/site/docs/install/t480.md index d0c128d..c801fc2 100644 --- a/site/docs/install/t480.md +++ b/site/docs/install/t480.md @@ -123,11 +123,11 @@ choose one of the above build targets accordingly.** Installation ============ -Insert binary files +**Insert binary files (DO THIS FIRST)** ------------------- -If you're using a release ROM, please ensure that you've inserted extra firmware -required refer to the [guide](../install/ivy_has_common.md) for that. **(failure +**If you're using a release ROM**, please ensure that you've inserted extra firmware +required. Refer to the [guide](../install/ivy_has_common.md) for that. **(failure to adhere to this advice will result in a BRICKED machine)** Libreboot's build system automatically downloads and processes these files if @@ -135,6 +135,18 @@ you build Libreboot from source, but the same logic that it uses must be re-run if you're using a release image. This is to bypass certain restrictions on direct distribution, for files such as the Intel Management Engine firmware. +The pre-compiled images do not contain an Intel ME, so you must first insert it +using the above guide. Libreboot's build system automatically grabs it, disables +it after boot with `me_cleaner`, and configures it with [deguard](deguard.md) +to disable the Intel Boot Guard - this automation is either applied at build +time, or you can use it on release images. + +Again: + +If you're [building from source](../build/) via Libreboot's build system, these +files are inserted during build. You only need to manually insert them, using +the above linked guide, on the pre-compiled release images! + Absolutely unsigned Intel ME! ----------------------------- @@ -218,16 +230,34 @@ flash IC. AGAIN: This is not the Libreboot flash IC. This is separate to the system flash. Read on to know how to reprogram the main system flash! -Flash a ROM image ------------------ - -**MAKE SURE** to update the Lenovo UEFI firmware before installing Libreboot. -You must also make a dump of the NOR flash, before updating Lenovo's firmware, -and once again before flashing Libreboot, being sure you have good dumps. +Flash a ROM image (software) +----------------------- If you're already running Libreboot, and you don't have flash protection turned on, [internal flashing](../install/) is possible. +The default Libreboot setup removes all flash restrictions, allowing you to +flash internally, from a Linux or BSD systems running on the T480/T480. You must +also [disable /dev/mem protections](devmem.md) for internal flashing to work. + +Flash a ROM image (hardware) +----------------- + +**First, please assimilate all knowledge in +the [25XX NOR flashing guide](spi.md) - it shows how to program these flash +chips, using a dedicated flash programmer, which is something that you will +physically connect to the flash chip.** + +Again: this is only necessary if you have Lenovo BIOS, or if you enabled [flash +write protections](../linux/grub_hardening.md) on an existing Libreboot setup. + +**MAKE SURE to update the Lenovo UEFI firmware before installing Libreboot. +You must also make a dump of the NOR flash, before updating Lenovo's firmware, +and once again before flashing Libreboot, being sure you have good dumps.** + +Please ensure also that you've already dealt with the Thunderbolt issue, which +is described above. + Find videos online of how to disassemble this, and/or find Lenovo's own service manual online. Otherwise, observe: