Libreboot

[Arnold Gilgen]

TheLibreboot project provides free, open source (libre) boot firmware based on coreboot, replacing proprietary BIOS/UEFI firmware on specific Intel/AMD x86 and ARM based motherboards, including laptop and desktop computers. It initialises the hardware (e.g. memory controller, CPU, peripherals) and starts a bootloader for your operating system. Linux and BSD are well-supported. Help is available via #libreboot on Libera IRC. The tasks page lists what we are working on (contributions are welcome, if you want to work on some of them yourself).

You can also buy Libreboot preinstalled from Minifree Ltd, on select hardware, aswell as send your compatible hardware for Libreboot preinstallation. The founder and lead developer of Libreboot, Leah Rowe, also owns and operates Minifree; sales provide funding for Libreboot.

We believe the freedom to study, share, modify and use software, without any restriction, is one of the fundamental human rights that everyone must have. In this context, software freedom matters. Your freedom matters. Education matters. Right to repair matters; Libreboot lets you continue to use your hardware, with continued firmware updates. All of this is why Libreboot exists.

Libreboot provides coreboot for machine initialisation, which then jumps to a payload in the boot flash; coreboot works with many programs, but Libreboot specifically provides SeaBIOS, GNU GRUB and U-Boot as options. Memtest86+ is also provided in flash, on some mainboards. The payload is the program in flash that provides the early user interface, for booting an operating system. This payload infrastructure means you can run whatever you want (even Linux!) from the boot flash.

Libreboot is specifically a coreboot distribution, in the same way that Debian is a Linux distribution. Libreboot makes coreboot easy to use for non-technical users, by providing a fully automated build system, automated build process and user-friendly installation instructions, in addition to regular binary releases that provide pre-compiled ROM images for installation on supported hardware. Without automation such as that provided by Libreboot, coreboot would be inaccessible for most users; you can also still reconfigure Libreboot however you wish.

Libreboot is more reliable than proprietary firmware. Many people use proprietary (non-libre) boot firmware, even if they use a libre OS. Proprietary firmware often contains backdoors, and can be buggy. The Libreboot project was founded in December 2013, with the express purpose of making coreboot firmware accessible for non-technical users.

In the same way that Alpine Linux is a Linux distribution, Libreboot is a coreboot distribution. If you want to build a ROM image from scratch, you otherwise have to perform expert-level configuration of coreboot, GRUB and whatever other software you need, to prepare the ROM image. With Libreboot, you can literally download from Git or a source archive, and run a simple script, and it will build entire ROM images. An automated build system, named lbmk (Libreboot MaKe), builds these ROM images automatically, without any user input or intervention required. Configuration has already been performed in advance.

Regular binary releases of Libreboot provide these ROM images pre-compiled, and you can simply install them, with no special knowledge or skill except the ability to follow simplified instructions, written for non-technical users.

The single biggest way you can help is to add new mainboards in Libreboot, by submitting a config. Anything coreboot supports can be integrated in Libreboot, with ROM images provided in releases. See:

If you spot a bug and have a fix, here are instructions for how to send patches, and you can also report it. Also, this entire website is written in Markdown and hosted in a separate repository where you can send patches.

This is a step I probably should have taken before ordering the computer. Not that it would have stopped me from doing this, but it probably would have given me a better idea of what I should expect from this process. First of all, I found out that to flash the chip, disassembly and soldering would be required. The firmware has to be programmed directly. Anytime something like this is done, bricking the device is a real possibility. At least I would only be out $65.

When writing a technical procedure document, either include *absolutely everything* a person coming to it cold needs to know, or link to other resources and make certain those resources together have absolutely everything required.

Hi Galane

You can do this to a Orange?

I have a lot of them. Because I liked the price.

And they just barely do what I want them to do.

Do you think you could add some links to get me started.

or if anyone else that would be great. Im going to start looking now.

But the more info the better. And besides I would trust some more on H.A.D. then the web.

You could have definitely also used a Raspberry Pi, or even a simple FTDI-based USB-Serial dongle to flash the chip. The libreboot tutorial uses flashrom, which runs on any Linux and supports (among others) the following programmers: _hardware#USB_Devices

Thats not protecting you at all. Intel me lives in the hardware deep. It can be alive when you system is off. It can access all your memory, regardless of os amd protection. It can extract all the keys.

Found some of my answer in the coreboot site.

The thermal table for throttling can be edited in source for coreboot.

Still not sure what overrides in the EC are though and presumably at a higher execution ring than the main BIOS, i.e. System management ring or similar/higher or similar to how the ME firmware would control things?

Holding Shift and FN then typing 15324 enables EC into a kind of debug mode and FN + R or FN + T pauses Ring 0 (OS Kernel, my mental memory is stale about ring levels though) execution and shoves some payload into the memory (SMBIOS? BIOS-reserved?) area to display the thermal debug pages (EC controls all thermal and SMBUS in the laptop)

Systems management mode can be entered via an external pin, but why do you assume that the external controller is injecting code, rather than the functionality being present in the BIOS (which is responsible for setting up the SMM handler in the first place)?

With regards to clock throttling on C2D thinkpads, on some units when plugged into the 65W adapter, will throttle clockspeed when also plugged into a bad battery. Can be forced to full speed with throttlestop, plugging into a 90W adapter instead, getting a good battery, or all three.

Cheers

I have a chromebook xe550c22 with libreboot and linux. upgraded the mSATA / RAM too. Was a pretty simple process, just had to trip the write protect pins on the mobo and it was finished in an hour or two.

The Beagle Bone Black has 3.3v rails already on it, which work fine; you just need a breadboard and your extra wires to share the line. Libreboot project is weird, in that, they instruct you to use an external PSU for those 3.3v lines, while they are already present on your beagle bone. The beagle bone works great for chip flashing though, once you get it set up right.

I've got a librebooted ThinkPad x200 and struggle booting into my fresh installation of Arch. Libreboot comes with its own GRUB (i.e. no need to install GRUB through Arch) and I just can't point the Libreboot GRUB to the Arch install.

I configured Arch to use luks1 (heard that Libreboot doesn't support luks2), lvm and btrfs. I didn't find any info about Libreboot on the ArchWiki, but found a guide for Parabola which I have been following (I know it's not Arch, but better than nothing).

In this post I have documented my efforts to get libreboot running on a pair of Lenovo ThinkPad T420's that I found in Ume Hackerspace.The motivation is that I needed a new laptop, the ThinkPads were there, but they didn't support the SSD in my current laptop.I could of course just go and buy a new laptop, but my precious freedoms!

The following is based on the information on the libreboot website for the Ivybridge and Haswell (and Sandybridge) series of Intel CPUs here, and the general install instructions here.Some inspiration has also been taken from this instructables post.The hardware manual will also be of use.

Whenever you boot a Raspberry Pi for the first time it will ask for things like the WiFi password.It will also attempt to upgrade all packages installed, which in my case didn't work automatically.Instead I had to do it manually, roughly like so:

Use the Raspberry Pi configuration tool to enable SSH and SPI.Make sure you can SSH into the Pi, because having to use a second screen can be annoying.Also make sure the device /dev/spidev0.0 exists. Reboot.

While you have everything disassembled, give things some compressed air blasts to get rid of dust, especially in and around the cooling fan.Don't overdo it though, fans deal poorly with infinite RPMs.

MAKE SURE THE ORIENTATION OF THE TEST CLIP IS CORRECT OR YOU WILL LIKELY FRY THE MOTHERBOARD.The VCC pin is in the upper right corner, opposite the indentation on the package.The indentation indicates pin 1, and IC pins are counted counterclockwise.This is a holdover from the vacuum tube days.Pin 8 is therefore the top-right pin.GND is the bottom-left.

In order for libreboot's lbmk to be able to do its thing you will need to use Debian sid or similar.Since I didn't want to bring my machine to a potentially unstable state I decided to make use of docker instead.

At this point it may be useful to solder some thin wires to the programming header next to the BIOS ROM and making them accessible via the DIMM slot cover.I didn't end up doing this, but readers who plan on flashing many times may want to do so to save on having to disassemble more than once.

Now the only thing left to do is reassemble the T420. Remember to apply new thermal compound, and remember to re-enable the WiFi by sliding the kill switch on the right edge forward.I forgot this last step and was very confused why my WiFi wasn't working ?I also had an issue with the my second 8 GiB DDR3 stick not being detected, but reseating it fixed that issue.

3a8082e126