Libreboot doesn't work!

FYI this user came to #libreboot IRC regularly as "bob123" and we had to ban him, because:

He repeatedly refused to follow instructions or even listen to advice, and kept asking noob questions all the time. Going his own way, thinking he knows best, failing, and then asking us to do his work for him - but then not even copying/pasting literal spoon-fed commands we gave him.

The context then was this: he wanted to boot a Parabola machine with fully encrypted /boot using argon2 and luks2. I guided him and my instructions were correct, but we wouldn't have any of it. He later went to a bunch of other IRC channels including #coreboot and got banned too.

Rude, obnoxious person.

And now, I will challenge him:

sam-d16: the target you're building is "t440pmrc_12mb", which no longer exists in the build system; the mrc target used a blob for raminit. We don't ship that blob anymore! Instead, libre raminit is used, exclusively. I say this, based on the screenshot; the screenshot is hard to see but I clicked view image and saw it in full resolution, and I see exactly what you're doing wrong, as described.

Build this target: t440plibremrc_12mb

Or inject on that target, using the 20240612 release image archive; the 20230625 archive only contained the blob version of raminit, that's why it doesn't work now.

If you can successfully use this information in conjunction with the build instructions without cursing at me rudely, I will forgive your past mistakes. Build instructions:

https://libreboot.org/docs/build/

Also, Libreboot 20230625 is ancient, please use Libreboot 20240612 instead (from 12 June 2024).

TO SUMMARISE, and remember this is a test:

Use the Libreboot 20240612 release archive for t440plibremrc_12mb; you already seem to be using current lbmk.git

I'll make it easier: Libreboot 20240612 and current lbmk.git revisions as of today are all that exist. You are to disregard everything else. Got it?

There are different situations, people have different opinions, so unfortunately a positive conversation does not always work out... even if people initially wanted it... different languages, different ages, experience, culture, emotional mood at the moment, etc. We are not robots but living people...

I definitely do NOT think I’m smarter than you or other developers, it was stupid to think so))

As for the installation, I used the documentation on your site here

https://libreboot.org/docs/build/

https://libreboot.org/docs/install/t440p_external.html


$ git clone https://codeberg.org/libreboot/lbmk
$ cd lbmk



$ sudo ./build dependencies debian



$ git config --global user.name "John Doe"
$ git config --global user.email "name at domain"



$ ./build roms t440pmrc_12mb


or


$ ./vendor inject -r t440p_libreboot.rom -b t440p_12mb



$ ./cbfstool grub_t440pmrc_12mb_libgfxinit_corebootfb_ukqwerty.rom print



FMAP REGION: COREBOOT
Name Offset Type Size Comp
cbfs_master_header 0x0 cbfs header 32 none
fallback/romstage 0x80 stage 45464 none
cpu_microcode_blob.bin 0xb2c0 microcode 63488 none
intel_fit 0x1ab00 (unknown) 112 none
fallback/ramstage 0x1abc0 stage 115811 LZMA (241176 decompressed)
config 0x37080 raw 3008 LZMA (9738 decompressed)
revision 0x37c80 raw 705 none
build_info 0x37f80 raw 90 none
fallback/dsdt.aml 0x38000 raw 14002 none
vbt.bin 0x3b700 raw 1410 LZMA (4608 decompressed)
cmos.default 0x3bcc0 cmos_default 256 none
cmos_layout.bin 0x3be00 cmos_layout 1296 none
fallback/postcar 0x3c340 stage 20940 none
img/memtest 0x41580 simple elf 58104 none
seabios.elf 0x4f8c0 simple elf 64092 none
etc/ps2-keyboard-spinup 0x5f340 raw 8 none
etc/pci-optionrom-exec 0x5f380 raw 8 none
etc/optionroms-checksum 0x5f3c0 raw 8 none
vgaroms/seavgabios.bin 0x5f400 raw 26112 none
fallback/payload 0x65a40 simple elf 533608 none
background.png 0xe7f00 raw 3451 none
scan.cfg 0xe8cc0 raw 26 none
keymap.cfg 0xe8d00 raw 16 none
(empty) 0xe8d40 null 6975588 none
mrc.bin 0x78fdc0 mrc 190180 none
(empty) 0x7be500 null 186212 none
bootblock 0x7ebc80 bootblock 16704 none


This was a year ago, I successfully installed everything and fully encrypted the disk with argon2id, the only thing is that I used the tet version and not the stable one. Everything worked great!

Recently I decided to install a stable version for a friend of mine who asked me (I wrote above) and ran into problems which in the screenshot is the lack of the t440pmrc_12mb platform.

If possible I would like to install the stable version 20230625 first even if it is outdated and use flashrom, later I will install Libreboot 20240612 using flashprog.

I used the target t440plibremrc_12mb but when I checked with the command

I discovered that mr,bin is missing from the ROM as it was before, this is what you wrote now, so I did not dare to flash my friend’s laptop so as not to change the BIOS chip to a new one...

I forgot to say that I am interested in the Grub payload and not Seabios which is in the latest version 20240612_Libreboot

Yeah, I only provide support for the following Libreboot releases, at any given time:

* The current stable release
* The current testing release, unless the latest release is a stable release

So: right now, I will only provide help with Libreboot 20240612.

When the next testing release comes out (ETA July 2024), I will support that release and the 20240612 release.

So: I will not provide support for Libreboot 20230625.

That said: there were still some mentions of the MRC that are confusing, so I've corrected the documentation with this patch:

https://codeberg.org/libreboot/lbwww/commit/d8bcd5c7044e28c6e20778ea25f6b907092a7e52

As for SeaBIOS: it is the primary payload now on all machines, but you can use a ROM image with "grubfirst" in the file name and SeaBIOS will execute that first, if available (the SeaBIOS boot select menu is still accessible with ESC if you want to skip GRUB).

This is to mitigate certain stability issues we had with GRUB in the 20240504 release, which were indeed fixed but I decided to play it safe in case of future issues, due to the sheer complexity of GRUB; doing it this way prevents bricks.

ALSO:

If you're using the inject command, you can rest assured:

Insert on the *tarball* e.g.:

./vendor inject libreboot-RELEASE_TARGETNAME.tar.xz

If you do it this way, the script verifies checksums of each ROM image; a checksum list is included in the tarball, which refers to the image with files injected, not the ones without. If the checksum doesn't match, lbmk will throw an error warning you of this. Otherwise, it will say something like "ROM image successfully patched".

This checksum verification is by design, precisely to prevent such brick issues. (so long as you adhere properly to the error message, if you see it, and you will only see it if you're not following the instructions properly)

Thanks for the detailed information.

Regarding support 20240612 I heard you.

Okay, then I have a question, let’s say I now have a test version (not the latest) or stable version 20230625 installed and I want to install (update) Libreboot 20240612, what are my steps?

1. Download, check... https://mirror.cyberbits.eu/libreboot/stable/20240612/roms/

libreboot-20240612_t440plibremrc_12mb.tar.xz 12-Jun-2024 09:28 4M
libreboot-20240612_t440plibremrc_12mb.tar.xz.sh..> 12-Jun-2024 09:28 177
libreboot-20240612_t440plibremrc_12mb.tar.xz.sig 12-Jun-2024 09:54 566

2. Extract the ROM I need, for example for my laptop this is

seabios_withgrub_t440plibremrc_12mb_libgfxinit_corebootfb_ukqwerty_grubfirst

3. Clone Lbmk

$ git clone https://codeberg.org/libreboot/lbmk
$ cd lbmk

4. Injection

$ ./build roms t440plibremrc_12mb

After I make the injection, how can I check that everything is in order and can I flash this ROM and my computer will boot?

I saw in the documentation that you are no longer using flashrom, now you are using flashprog

I would also like to clarify how you can install (assemble) flashprog so that I can quickly install it on my PC, for example, how it worked with flashrom, since this program (flashprog) is not in the repositories https://repology.org/projects/?search=flashprog
Example with flashrom https://repology.org/projects/?search=flashrom

$ sudo apt-get install flashrom

or

$ sudo apt-get update

$ sudo apt-get install git -y \
build-essential -y\
libpci-dev -y\
libusb-dev -y\
libusb-1.0-0-dev -y\
libftdi-dev -y

$ sudo apt-get install ca-certificates -y

$ git clone https://github.com/flashrom/flashrom.git

$ cd flashrom-v1.3/
$ make
$ sudo make install

I figured out how to install Flashprog, installed it like this:

$ sudo apt-get install libgpiod
$ $ sudo apt-get install libjaylink
$ git clone https://github.com/SourceArcade/flashprog.git
$ cd flashprog
$ make
$ sudo make install

ok, I’ll write my observations here, maybe it will be useful to other users who will be looking for answers. I think the forum is a better place than the IRC channel, why? Because the answers are dropped here, but not in the IRC channel, and the registration system is also complex, a user with a white IP cannot register, etc.

As for the injection, I waited about three hours for everything to finish and thought why it’s not possible to make ready-made images for the user to download and flash into his laptop.

My observations:

1. Flashrom does not work correctly, which is very strange, when I ran the command:

$ sudo flashrom -p internal

I received an answer that my chip is 8MB instead of 12MB??

But when I compiled flashprog and executed the same command, I received the answer that my chip is 12 MB

Next, I would like to discuss another important point that, as I see it, interests many users when they flash their laptop. Users often encounter the disk search error ahci0

Here is the grub.cfg dump


set prefix=(memdisk)/boot/grub
insmod at_keyboard
insmod usb_keyboard
insmod nativedisk
insmod ehci
insmod ohci
insmod uhci
insmod usb
insmod usbms
insmod regexp
terminal_input --append at_keyboard
terminal_input --append usb_keyboard
terminal_output --append cbmemc
gfxpayload=keep
terminal_output --append gfxterm
if [ -f (cbfsdisk)/background.png ]; then
insmod png
background_image (cbfsdisk)/background.png
elif [ -f (cbfsdisk)/background.jpg ]; then
insmod jpeg
background_image (cbfsdisk)/background.jpg
fi
set default="0"
set timeout=30
set pager=1
set grub_scan_disk="ahci"
keymap ukqwerty
function try_user_config {
set root="${1}"
for dir in boot grub grub2 boot/grub boot/grub2; do
for name in '' osboot_ autoboot_ libreboot_ coreboot_; do
if [ -f /"${dir}"/"${name}"grub.cfg ]; then
unset superusers
configfile /"${dir}"/"${name}"grub.cfg
fi
done
done
}
function search_grub {
echo -n "Attempting to load grub.cfg from '${1}' devices"
for i in 0 1 2 3 4 5 6 7 8 9 10 11; do
for part in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
try_user_config "(${1}${i},${part})"
done
# raw devices e.g. (ahci0) instead of (ahci0,1)
try_user_config "(${1}${i})"
done
echo # Insert newline
}
function try_isolinux_config {
set root="${1}"
for dir in '' /boot; do
if [ -f "${dir}"/isolinux/isolinux.cfg ]; then
syslinux_configfile -i "${dir}"/isolinux/isolinux.cfg
elif [ -f "${dir}"/syslinux/syslinux.cfg ]; then
syslinux_configfile -s "${dir}"/syslinux/syslinux.cfg
fi
done
}
function search_isolinux {
echo "\nAttempting to parse isolinux/syslinux config from '${1}' devices"
for i in 0 1 2 3 4 5 6 7 8 9 10 11; do
for part in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
try_isolinux_config "(${1}${i},${part})"
done
# raw devices e.g. (usb0) instead of (usb0,1)
try_isolinux_config "(${1}${i})"
done
echo # Insert newline
}
menuentry 'Load Operating System (incl. fully encrypted disks) [o]' --hotkey='o' {
if [ "${grub_scan_disk}" != "ata" ]; then
search_grub ahci
fi
if [ "${grub_scan_disk}" != "ahci" ]; then
search_grub ata
fi
# grub device enumeration is very slow, so checks are hardcoded
# TODO: add more strings, based on what distros set up when
# the user select auto-partitioning on those installers
lvmvol="lvm/matrix-bootvol lvm/matrix-rootvol"
raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
# in practise, doing multiple redundant checks is perfectly fast and
# TODO: optimize grub itself, and use */? here for everything
for vol in ${lvmvol} ${raidvol} ; do
try_user_config "${vol}"
done
unset ahcidev
unset atadev
for i in 11 10 9 8 7 6 5 4 3 2 1 0; do
for part in 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1; do
if [ "${grub_scan_disk}" != "ata" ]; then
ahcidev="(ahci${i},${part}) ${ahcidev}"
fi
if [ "${grub_scan_disk}" != "ahci" ]; then
atadev="(ata${i},${part}) ${atadev}"
fi
done
done
set pager=0
echo -n "Attempting to unlock encrypted volumes"
for dev in ${ahcidev} ${atadev} ${lvmvol} ${raidvol}; do
if cryptomount "${dev}" ; then break ; fi
done
set pager=1
echo
# after cryptomount, lvm volumes might be available
for vol in ${lvmvol}; do
try_user_config "${vol}"
done
search_grub crypto
if [ "${grub_scan_disk}" != "ata" ]; then
# Last resort, if all else fails
set root=ahci0,1
for p in / /boot/; do
if [ -f "${p}vmlinuz" ]; then
linux ${p}vmlinuz root=/dev/sda1 rw
if [ -f "${p}initrd.img" ]; then
initrd ${p}initrd.img
fi
fi
done
fi
if [ "${grub_scan_disk}" != "ahci" ]; then
# Last resort (for setups that use IDE instead of SATA)
set root=ata0,1
for p in / /boot/; do
if [ -f "${p}vmlinuz" ]; then
linux ${p}vmlinuz root=/dev/sda1 rw
if [ -f "${p}initrd.img" ]; then
initrd ${p}initrd.img
fi
fi
done
fi
true # Prevent pager requiring to accept each line instead of whole screen
}
menuentry 'Search ISOLINUX menu (AHCI) [a]' --hotkey='a' {
search_isolinux ahci
}
menuentry 'Search ISOLINUX menu (USB) [u]' --hotkey='u' {
search_isolinux usb
}
menuentry 'Search ISOLINUX menu (ATA/IDE) [d]' --hotkey='d' {
search_isolinux ata
}
menuentry 'Load test configuration (grubtest.cfg) inside of CBFS [t]' --hotkey='t' {
set root='(cbfsdisk)'
if [ -f /grubtest.cfg ]; then
configfile /grubtest.cfg
fi
}
menuentry 'Search for GRUB2 configuration on external media [s]' --hotkey='s' {
search_grub usb
}
if [ -f (cbfsdisk)/seabios.elf ]; then
menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /seabios.elf
}
fi
if [ -f (cbfsdisk)/img/grub2 ]; then
menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /fallback/payload
}
fi
menuentry 'Poweroff [p]' --hotkey='p' {
halt
}
menuentry 'Reboot [r]' --hotkey='r' {
reboot
}
if [ -f (cbfsdisk)/img/memtest ]; then
menuentry 'Load MemTest86+ [m]' --hotkey='m' {
set root='cbfsdisk'
chainloader /img/memtest
}
fi


And I placed this in grubtest.cfg so as not to receive this error, everything worked well.

...........
echo # Insert newline
}
menuentry 'Load Trisquel GNU/Linux-Libre (LTS)' {
cryptomount -a
set root='lvm/matrix-rootvol'
linux /boot/vmlinuz-linux-libre-lts root=/dev/mapper/matrix-rootvol cryptdevice=/dev/sda1:lvm
initrd /boot/initramfs-linux-libre-lts.img
}
menuentry 'Load Operating System (incl. fully encrypted disks) [o]' --hotkey='o' {

But when I changed

set timeout=30

on

set timeout=0

It didn't work, after booting I see the Grub menu what shouldn't be there?

I would like to inform you for those who are looking for information.
The installation was successful, but there are problems that you need to pay attention to:

1. Flashrom will not work, you will receive a message that your flash chip is 8Mb instead of 12Mb, so you need to use flashprog as written on the website.

2. Installation lasts 3 hours (my experience)

$ ./build roms t440plibremrc_12mb

since the switch to the libre RAM init code, mrc.bin is not included anymore.
Therefore, you can not worry and flash your laptop, it will turn on.
boot with the iomem-relaxed kernel option
$ sudo flashprog -p internal
$ sudo flashprog -p internal -w
seabios_withgrub_t440plibremrc_12mb_libgfxinit_corebootfb_ukqwerty_grubfirst.rom

4. The cbfstool utility is now located here elf/cbfstool/[TREE]/cbfstool (replace [TREE] with the tree concerened)

5. After installation, you need to edit grub.cfg as you will receive an error related to searching for the disk "ahci1" (I wrote above how this can be done)

6. After installing version 20240612, when I turned it on, I had a very high screen brightness and this happens every time??

I hope this helps someone.

Now it's time to get started with Gnuboot))

Hello . After the command:

$ ./build roms t440plibremrc_12mb

I waited 3 hours while assembly was in progress, etc.

I don’t know what 10 minutes you’re talking about...

Maybe there is another command that will compile a T440p ROM in 10 minutes? Write me and I’ll check it.

The screen brightness is very high after installing the latest stable version, so I will not use the latest stable version, I think this is a bug that needs to be fixed. Using other versions did not cause this problem.

@sam-d16 I was on IRC today and followed my own intelligence and follow the same advice libreleah is giving you and the everything worked smooth as butter.

Hello Plpippen

That is, according to your logic, those who could not install Libreboot they don't have a mind or an intelligence? ))

Maybe Libreboot for selected people with blue eyes and Aryan blood?

I recommend that you study this issue more deeply in all sources where people ask questions about installing Libreboot. You will be very surprised when you find out that most cannot do this, you are this example! They get confused in the documentation and in the IRC chat, at most you will get the answer: go read the documentation! And if someone is in a good mood, maybe they will help you.

Everyone has different abilities in the field of IT technologies, the main reason why users want to install GnuBoot, Libreboot or Coreboot is to get a free BIOS and get rid of the Management Engine, in my opinion, the installation should be as clear as possible even for a child.. one.. two.. three
Thus, a large number of users will do this on their own, and if they can’t do it, they won’t necessarily be persuaded to buy in the store https://minifree.org/

Hi Leah. You did not answer the question of how long it takes to build a ROM after the command:

$ ./build roms t440plibremrc_12mb

It does NOT take me 10 minutes like you wrote!!
What do you do to make it take 10 minutes?

I also wanted to clarify where on your website https://canoeboot.org/docs/gnulinux/ you can find instructions for “Libreboot Full Disk encryption”

As it was before, here is the old link that does not work https://libreboot.org/docs/linux/encrypted_trisquel.html

As for encryption, this will be useful for Gnuboot in the future.

Hello Psion. Thanks for your answer and information.

It took me three hours when I did it all for the first time, I don’t know where Leah got 10 minutes from)) Maybe this is a joke..
When the user does all these commands that I wrote above for the first time, it takes several hours.

In fact, there are many different sources where users archive ready-made ROMs with embedded blobs, of course you need to trust these sources, that is, you can download the ready-made ROM and then simply flash it.