made the t480 guide a bit less hazardous

i repeated some info intentionally, and made some things clearer

Signed-off-by: Leah Rowe <info@minifree.org>

site/docs/install/t480.md

@@ -123,11 +123,11 @@ choose one of the above build targets accordingly.**
 Installation
 ============
 
-Insert binary files
+**Insert binary files (DO THIS FIRST)**
 -------------------
 
-If you're using a release ROM, please ensure that you've inserted extra firmware
+**If you're using a release ROM**, please ensure that you've inserted extra firmware
-required refer to the [guide](../install/ivy_has_common.md) for that. **(failure
+required. Refer to the [guide](../install/ivy_has_common.md) for that. **(failure
 to adhere to this advice will result in a BRICKED machine)**
 
 Libreboot's build system automatically downloads and processes these files if
@@ -135,6 +135,18 @@ you build Libreboot from source, but the same logic that it uses must be re-run
 if you're using a release image. This is to bypass certain restrictions on
 direct distribution, for files such as the Intel Management Engine firmware.
 
+The pre-compiled images do not contain an Intel ME, so you must first insert it
+using the above guide. Libreboot's build system automatically grabs it, disables
+it after boot with `me_cleaner`, and configures it with [deguard](deguard.md)
+to disable the Intel Boot Guard - this automation is either applied at build
+time, or you can use it on release images.
+
+Again:
+
+If you're [building from source](../build/) via Libreboot's build system, these
+files are inserted during build. You only need to manually insert them, using
+the above linked guide, on the pre-compiled release images!
+
 Absolutely unsigned Intel ME!
 -----------------------------
 
@@ -218,16 +230,34 @@ flash IC.
 AGAIN: This is not the Libreboot flash IC. This is separate to the system flash.
 Read on to know how to reprogram the main system flash!
 
-Flash a ROM image
+Flash a ROM image (software)
------------------
+-----------------------
-
-**MAKE SURE** to update the Lenovo UEFI firmware before installing Libreboot.
-You must also make a dump of the NOR flash, before updating Lenovo's firmware,
-and once again before flashing Libreboot, being sure you have good dumps.
 
 If you're already running Libreboot, and you don't have flash protection
 turned on, [internal flashing](../install/) is possible.
 
+The default Libreboot setup removes all flash restrictions, allowing you to
+flash internally, from a Linux or BSD systems running on the T480/T480. You must
+also [disable /dev/mem protections](devmem.md) for internal flashing to work.
+
+Flash a ROM image (hardware)
+-----------------
+
+**First, please assimilate all knowledge in
+the [25XX NOR flashing guide](spi.md) - it shows how to program these flash
+chips, using a dedicated flash programmer, which is something that you will
+physically connect to the flash chip.**
+
+Again: this is only necessary if you have Lenovo BIOS, or if you enabled [flash
+write protections](../linux/grub_hardening.md) on an existing Libreboot setup.
+
+**MAKE SURE to update the Lenovo UEFI firmware before installing Libreboot.
+You must also make a dump of the NOR flash, before updating Lenovo's firmware,
+and once again before flashing Libreboot, being sure you have good dumps.**
+
+Please ensure also that you've already dealt with the Thunderbolt issue, which
+is described above.
+
 Find videos online of how to disassemble this, and/or find Lenovo's own
 service manual online. Otherwise, observe: