unified internal dell latitude flashing guide
Signed-off-by: Leah Rowe <info@minifree.org>master
Leah Rowe
parent
82120ac94e
commit
d2e8cda2d1
|
|
@ -0,0 +1,91 @@
|
|||
---
|
||||
title: Internally flash Dell Latitude laptops
|
||||
x-toc-enable: true
|
||||
...
|
||||
|
||||
Make sure SecureBoot is disabled, if you're running a UEFI-based Latitude.
|
||||
Other steps also required, described on this page and in the `README.md`
|
||||
file included with `dell-flash-unlock`.
|
||||
|
||||
Internal flashing
|
||||
=================
|
||||
|
||||
You can simply boot Linux/BSD, on the Dell Latitude you wish to flash, and
|
||||
run `flashprog` from there, for Libreboot installation. Certain other steps
|
||||
are also required, documented in the steps below:
|
||||
|
||||
Flashing from BSD
|
||||
-----------------
|
||||
|
||||
Basically identical to Linux, except that you must
|
||||
set `kern.securelevel` to -1 on boot, which is equivalent to `iomem=relaxed`
|
||||
under Linux, for this purpose.
|
||||
|
||||
The `dell-flash-unlock` utility will compile and run just fine. It has been
|
||||
tested on OpenBSD, NetBSD and FreeBSD. With this in mind, simply follow the
|
||||
Linux instrucctions but adapt accordingly.
|
||||
|
||||
If unsure, just boot a live Linux distro via USB and run it all there.
|
||||
|
||||
Flashing from Linux
|
||||
-------------------
|
||||
|
||||
MAKE SURE you boot with this Linux kernel parameter: `iomem=relaxed` - this
|
||||
disables memory protections, permitting `/dev/mem` access needed by flashprog.
|
||||
The flash is memory mapped and flashprog accesses it via `/dev/mem`.
|
||||
|
||||
You can flash Libreboot directly from the vendor (Dell) BIOS, without taking
|
||||
the machine apart. It can be done entirely from Linux. It will probably also
|
||||
work on BSD systems, but it has only been testing on Linux thus far.
|
||||
|
||||
**NOTE (15 October 2023): The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
|
||||
Check `util/dell-flash-unlock` in the `lbmk.git` repository, or in release
|
||||
archives for Libreboot releases from 20230423 onwards.
|
||||
|
||||
Go in there:
|
||||
|
||||
cd util/dell-flash-unlock
|
||||
make
|
||||
|
||||
**With this program, you can unlock the flash in such a way where everything
|
||||
is writeable. Information about how to use it is in the `README.md` file which
|
||||
is included in that program's directory, or you can read it online here:**
|
||||
|
||||
**<https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/README.md>**
|
||||
|
||||
**Please make sure that you do fully read the README, because it contains
|
||||
useful information.**
|
||||
|
||||
Literally just run that program, and do what it says. You run it once, and shut
|
||||
down, and when you do, the system brings itself back up automatically; on some
|
||||
systems, you have to boot the machine back up manually, after power down. Then
|
||||
you run it and flash it unlocked. Then you run it again. The source code is
|
||||
intuitive enough that you can easily get the gist of it; it's writing some EC
|
||||
commands and changing some chipset config bits. The EC on this machine is
|
||||
hooked up to the `GPIO33` signal, sometimes called `HDA_DOCK_EN`, which sets
|
||||
the flash descriptor override thus disabling any flash protection by the IFD.
|
||||
It also bypasses the SMM BIOS lock protection by disabling SMIs, and Dell's
|
||||
BIOS doesn't set any other type of protection either such as writing to
|
||||
Protected Range registers.
|
||||
|
||||
MAKE SURE to back up the original firmware image first:
|
||||
|
||||
flashprog -p internal -r factory.rom
|
||||
|
||||
When you flash it, you can use this command:
|
||||
|
||||
flashprog -p internal -w libreboot.rom
|
||||
|
||||
Where `libreboot.rom` is your Dell Latitude ROM. *Make sure* it's the right
|
||||
one. If flashprog complains about multiple flash chips detected, just pick one of them (doesn't matter which one). On *most* Dell machines, the most correct
|
||||
would probably be this option in flashprog: `-c MX25L3205D/MX25L3208D`.
|
||||
|
||||
So:
|
||||
|
||||
flashprog -p internal -w libreboot.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
When you see flashprog say `VERIFIED` at the end, that means the flash was
|
||||
successful. If you don't see that, or you're unsure, please [contact the
|
||||
Libreboot project via IRC](../../contact.md).
|
||||
|
|
@ -70,8 +70,16 @@ Use this to find out:
|
|||
|
||||
flashprog -p internal
|
||||
|
||||
We believe most/all are 4MB (32Mb) flash sizes, but larger ROM images are
|
||||
provided for people who wish to upgrade.
|
||||
We believe most/all are 4MB (32Mb) flash sizes. The schematics hint that
|
||||
some boards may have 6MB flash (4MB and 2MB, dual chip), but we've only ever
|
||||
seen 4MB setups in the wild. You can still flash the 4MB image on 6MB setups,
|
||||
if it's encountered, by just leaving the higher 2MB part unflashed, because
|
||||
the flash descriptor (in Libreboot) configures everything so that the BIOS
|
||||
region ends just before the 4MB mark, in flash; the BIOS region is the final
|
||||
region, in the higher part of flash as defined *by the descriptor*, regardless
|
||||
of whether that is the actual end of the flash.
|
||||
|
||||
Libreboot does currently provide 6MB images on this board, for these reasons.
|
||||
|
||||
MAC address {#macaddress}
|
||||
===========
|
||||
|
|
@ -171,77 +179,13 @@ codeberg](https://codeberg.org/libreboot/lbmk/issues/14#issuecomment-907758).
|
|||
How to flash internally (no diassembly)
|
||||
=======================================
|
||||
|
||||
Flashing from Linux
|
||||
-------------------
|
||||
Please read the article:
|
||||
|
||||
MAKE SURE you boot with this Linux kernel parameter: `iomem=relaxed` - this
|
||||
disables memory protections, permitting `/dev/mem` access needed by flashprog.
|
||||
The flash is memory mapped and flashprog accesses it via `/dev/mem`.
|
||||
[Internally flash Dell Latitude laptops](dell_internal.md)
|
||||
|
||||
You can flash Libreboot directly from the vendor (Dell) BIOS, without taking
|
||||
the machine apart. It can be done entirely from Linux. It will probably also
|
||||
work on BSD systems, but it has only been testing on Linux thus far.
|
||||
|
||||
**NOTE (15 October 2023): The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
|
||||
Check `util/dell-flash-unlock` in the `lbmk.git` repository, or in release
|
||||
archives for Libreboot releases from 20230423 onwards.
|
||||
|
||||
Go in there:
|
||||
|
||||
cd util/dell-flash-unlock
|
||||
make
|
||||
|
||||
With this program, you can unlock the flash in such a way where everything
|
||||
is writeable. Information about how to use it is in the `README.md` file which
|
||||
is included in that program's directory, or you can read it online here:
|
||||
|
||||
<https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/README.md>
|
||||
|
||||
Literally just run that program, and do what it says. You run it once, and shut
|
||||
down, and when you do, the system brings itself back up automatically. Then
|
||||
you run it and flash it unlocked. Then you run it again. The source code is
|
||||
intuitive enough that you can easily get the gist of it; it's writing some EC
|
||||
commands and changing some chipset config bits. The EC on this machine is
|
||||
hooked up to the `GPIO33` signal, sometimes called `HDA_DOCK_EN`, which sets
|
||||
the flash descriptor override thus disabling any flash protection by the IFD.
|
||||
It also bypasses the SMM BIOS lock protection by disabling SMIs, and Dell's
|
||||
BIOS doesn't set any other type of protection either such as writing to
|
||||
Protected Range registers.
|
||||
|
||||
When you flash it, you can use this command:
|
||||
|
||||
flashprog -p internal -w libreboot.rom
|
||||
|
||||
Where `libreboot.rom` is your E6400 ROM. *Make sure* it's the right one.
|
||||
If flashprog complains about multiple flash chips detected, just pick one of
|
||||
them (doesn't matter which one). On *most* Dell machines, the most correct
|
||||
would probably be this option in flashprog: `-c MX25L3205D/MX25L3208D`.
|
||||
|
||||
So:
|
||||
|
||||
flashprog -p internal -w libreboot.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
When you see flashprog say `VERIFIED` at the end, that means the flash was
|
||||
successful. If you don't see that, or you're unsure, please [contact the
|
||||
Libreboot project via IRC](../../contact.md).
|
||||
|
||||
BACK UP THE FACTORY BIOS
|
||||
========================
|
||||
|
||||
The `-w` option flashes `libreboot.rom`. You may consider *backing up* the
|
||||
original Dell BIOS first, using the -r option:
|
||||
|
||||
flashprog -p internal -r backup.rom -c MX25L3205D/MX25L3208D
|
||||
|
||||
Do this while in a flashable state, after the 2nd run of `dell-flash-unlock`.
|
||||
|
||||
Make sure the `backup.rom` file gets backed up to an external storage media,
|
||||
not the E6400 itself.
|
||||
|
||||
With this method, you can probably flash it within 5 minutes. Again, zero
|
||||
disassembly required!
|
||||
Dell's original BIOS/UEFI firmware typically prevents write access, but it
|
||||
has bugs which can be exploited, to enable Libreboot installation very easily.
|
||||
You do not have to disassemble the machine.
|
||||
|
||||
How to flash externally
|
||||
=========================
|
||||
|
|
|
|||
|
|
@ -22,10 +22,6 @@ and should be assumed *broken* by default.
|
|||
Flash chip size {#flashchips}
|
||||
===============
|
||||
|
||||
Use this to find out:
|
||||
|
||||
flashprog -p internal
|
||||
|
||||
The internal flash size is 12MiB on this board; physically, an 8MiB and 4MiB
|
||||
chip (two chips) but this distinction only matters for external flashing.
|
||||
|
||||
|
|
@ -72,96 +68,13 @@ that the Nvidia models do not work.
|
|||
How to flash internally (no diassembly)
|
||||
=======================================
|
||||
|
||||
Warning for BSD users
|
||||
---------------------
|
||||
Please read the article:
|
||||
|
||||
**NOTE (15 October 2023): The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
[Internally flash Dell Latitude laptops](dell_internal.md)
|
||||
|
||||
BSD *boots* and works properly on these machines, but take note:
|
||||
|
||||
Nicholas's [dell-flash-unlock](https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/dell_flash_unlock.c)
|
||||
utility has been ported to OpenBSD, but *other* BSDs are assumed unsupported for
|
||||
now.
|
||||
|
||||
NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog)
|
||||
now, as of 27 January 2024, which is a fork of flashrom.
|
||||
|
||||
NOTE: BSD is mentioned above, but the only BSD tested for `dell-flash-unlock`
|
||||
is OpenBSD, as of 15 October 2023.
|
||||
|
||||
Flashing from Linux
|
||||
-------------------
|
||||
|
||||
MAKE SURE you boot with this Linux kernel parameter: `iomem=relaxed` - this
|
||||
disables memory protections, permitting `/dev/mem` access needed by flashprog.
|
||||
The flash is memory mapped and flashprog accesses it via `/dev/mem`.
|
||||
|
||||
You can flash Libreboot directly from the vendor (Dell) BIOS, without taking
|
||||
the machine apart. It can be done entirely from Linux. It will probably also
|
||||
work on BSD systems, but it has only been testing on Linux thus far.
|
||||
|
||||
**NOTE (15 October 2023): The util is now called `dell-flash-unlock`, but it
|
||||
was previously called `e6400-flash-unlock`. Links have been updated.**
|
||||
|
||||
Check `util/dell-flash-unlock` in the `lbmk.git` repository, or in release
|
||||
archives for Libreboot releases from 20230423 onwards.
|
||||
|
||||
Go in there:
|
||||
|
||||
cd util/dell-flash-unlock
|
||||
make
|
||||
|
||||
With this program, you can unlock the flash in such a way where everything
|
||||
is writeable. Information about how to use it is in the `README.md` file which
|
||||
is included in that program's directory, or you can read it online here:
|
||||
|
||||
<https://browse.libreboot.org/lbmk.git/plain/util/dell-flash-unlock/README.md>
|
||||
|
||||
Literally just run that program, and do what it says. You run it once, shut
|
||||
down, and then power on the machine. Then run it again to confirm that the
|
||||
flash is unlocked. The source code is intuitive enough that you can easily get
|
||||
the gist of it; it's writing some EC commands and changing some chipset config
|
||||
bits. The EC on this machine is hooked up to the `HDA_SDO` signal, also known
|
||||
as the Flash Descriptor Override (FDO), which disables any flash protection by
|
||||
the IFD. When booted with the FDO set, the original Dell firmware disables all
|
||||
other BIOS write protections such as SMM BIOS lock bits.
|
||||
|
||||
*Make sure* to make a backup of the original firmware before proceeding to
|
||||
flash; see the instructions below.
|
||||
|
||||
When you flash it, you can use this command:
|
||||
|
||||
flashprog -p internal -w libreboot.rom
|
||||
|
||||
Where `libreboot.rom` is your E6430 ROM. *Make sure* it's the right one.
|
||||
If flashprog complains about multiple flash chips detected, just pick one of
|
||||
them (doesn't matter which one), with the `-C` flag as directed; just pick one,
|
||||
and if it doesn't work, try the next.
|
||||
|
||||
When you see flashprog say `VERIFIED` at the end, that means the flash was
|
||||
successful. If you don't see that, or you're unsure, please [contact the
|
||||
Libreboot project via IRC](../../contact.md).
|
||||
|
||||
BACK UP THE FACTORY BIOS
|
||||
========================
|
||||
|
||||
The `-w` option flashes `libreboot.rom`. You may consider *backing up* the
|
||||
original Dell BIOS first, using the -r option:
|
||||
|
||||
flashprog -p internal -r backup.rom
|
||||
|
||||
AGAIN: make sure to use `-C` accordingly, if you need to pick a chip (where
|
||||
flashprog has detected multiple chip definitions). Just pick one, any of them
|
||||
will probably work, if not try the next.
|
||||
|
||||
Do this while in a flashable state, after the 2nd run of `dell-flash-unlock`.
|
||||
|
||||
Make sure the `backup.rom` file gets backed up to an external storage media,
|
||||
not the E6430 itself.
|
||||
|
||||
With this method, you can probably flash it within 5 minutes. Again, zero
|
||||
disassembly required!
|
||||
Dell's original BIOS/UEFI firmware typically prevents write access, but it
|
||||
has bugs which can be exploited, to enable Libreboot installation very easily.
|
||||
You do not have to disassemble the machine.
|
||||
|
||||
How to flash externally
|
||||
=========================
|
||||
|
|
|
|||
Loading…
Reference in New Issue