diff --git a/site/contrib.md b/site/contrib.md index 72151da..abe9e86 100644 --- a/site/contrib.md +++ b/site/contrib.md @@ -9,3 +9,4 @@ and lead developer for *both* projects; Leah maintains both Canoeboot *and* Libreboot. If you have a patch, or beef, talk to Leah. + diff --git a/site/docs/gnulinux/grub_hardening.md b/site/docs/gnulinux/grub_hardening.md index 9393fda..9f93fc2 100644 --- a/site/docs/gnulinux/grub_hardening.md +++ b/site/docs/gnulinux/grub_hardening.md @@ -82,9 +82,16 @@ See: [build from source](../build/) IFD-based flash protection -------------------------- +**NOTE: This CAN cause bricks on a lot of machines. You should use this with +care. The FLILL and/or PRx based methods are more reliable - also SMM methods. +You can reconfigure coreboot and enable the chipset-based flash protection there +which accomplishes the same result, and the benefit is that it can't easily +be overridden by an evel maid attack e.g. can't simply set the service jumper +on desktops.** + The simplest way is to just do this: - ifdtool -x canoeboot.rom -O canoeboot.rom + ifdtool --lock libreboot.rom -O canoeboot.rom If you did the step before, to compile `cbfstool`, you can find ifdtool in the `elf/` directory, e.g. `elf/ifdtool/default/ifdtool`. Use the ifdtool @@ -219,6 +226,26 @@ things like graphics cards. More information is available here: If you're using a graphics card, you *need* VGA option ROMs at least. +GRUBSEA +------- + +Another option is to make it so that GRUB is the primary payload on your board. +In this setup, SeaBIOS and U-Boot are still available. + +For your board's `target.cfg`, add this: + + payload_grubsea="y" + +E.g. `config/coreboot/x200_8mb/target.cfg` + +You should only do this on setups that have native graphics initialisation +e.g. Intel graphics, or where no VGA/GOP ROM is required either on-card or +in the flash (e.g. Intel graphics on Alderlake machines). + +If you can't use GRUB as a primary payload, then you can use SeaGRUB as above +and disable the SeaBIOS menu, making SeaBIOS load only GRUB; SeaGRUB is useful +because GRUB will piggyback off of the VGA setup done by SeaBIOS first. + GPG keys ======== diff --git a/site/docs/install/ga-g41m-es2l.md b/site/docs/install/ga-g41m-es2l.md index 6d3cc29..ac7cd1d 100644 --- a/site/docs/install/ga-g41m-es2l.md +++ b/site/docs/install/ga-g41m-es2l.md @@ -2,10 +2,6 @@ title: Gigabyte GA-G41M-ES2L desktop board ... -<<<<<<< HEAD -This guide is for those who want Canoeboot on their Intel GA-G41M-ES2L -motherboard while they still have the original BIOS present. -=======
GA-G41M-ES2L @@ -103,7 +99,6 @@ Nanya NT2GT64U8HD0BY-AD with 2 GiB of NT5TU128M8DE-AD chips works too. Many other modules will probably work just fine, but raminit is very picky on this board. Your mileage *will* fluctuate, wildly. ->>>>>>> 09844d62 (simplify docs/install and merge docs/hardware) MAC ADDRESS =========== diff --git a/site/docs/install/r400.md b/site/docs/install/r400.md index c832bf9..d74a28f 100644 --- a/site/docs/install/r400.md +++ b/site/docs/install/r400.md @@ -80,8 +80,10 @@ modified descriptor: see [../install/ich9utils.md](../install/ich9utils.md)* Flashing instructions can be found at [../install/\#flashprog](../install/#flashprog) -NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) +**NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) now, as of 27 January 2024, which is a fork of flashrom. +The reason why was explained, in +the [Libreboot 20240225 release](../../news/libreboot20240225.md#flashprog-now-used-instead-of-flashrom)** EC update {#ecupdate} ========= diff --git a/site/docs/install/t400.md b/site/docs/install/t400.md index ab72036..f901173 100644 --- a/site/docs/install/t400.md +++ b/site/docs/install/t400.md @@ -79,8 +79,10 @@ modified descriptor: see [../install/ich9utils.md](../install/ich9utils.md)* Flashing instructions can be found at [../install/\#flashprog](../install/#flashprog) -NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) +**NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) now, as of 27 January 2024, which is a fork of flashrom. +The reason why was explained, in +the [Libreboot 20240225 release](../../news/libreboot20240225.md#flashprog-now-used-instead-of-flashrom)** EC update {#ecupdate} ========= diff --git a/site/docs/install/t500.md b/site/docs/install/t500.md index 7386f53..557e946 100644 --- a/site/docs/install/t500.md +++ b/site/docs/install/t500.md @@ -83,6 +83,8 @@ Flashing instructions can be found at NOTE: Canoeboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) now, as of 27 January 2024, which is a fork of flashrom. +The reason why was explained, in +the [Libreboot 20240225 release](../../news/libreboot20240225.md#flashprog-now-used-instead-of-flashrom)** EC update {#ecupdate} ========= diff --git a/site/docs/install/x60_unbrick.md b/site/docs/install/x60_unbrick.md index 8d499fc..3b7a2be 100644 --- a/site/docs/install/x60_unbrick.md +++ b/site/docs/install/x60_unbrick.md @@ -3,8 +3,10 @@ title: ThinkPad X60 Recovery guide x-toc-enable: true ... -NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) +**NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) now, as of 27 January 2024, which is a fork of flashrom. +The reason why was explained, in +the [Libreboot 20240225 release](../../news/libreboot20240225.md#flashprog-now-used-instead-of-flashrom)** "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the system, making this difficult. In this situation, diff --git a/site/docs/install/x60tablet_unbrick.md b/site/docs/install/x60tablet_unbrick.md index 0f6b0c7..bf1ac60 100644 --- a/site/docs/install/x60tablet_unbrick.md +++ b/site/docs/install/x60tablet_unbrick.md @@ -3,8 +3,10 @@ title: ThinkPad X60 Tablet Recovery guide x-toc-enable: true ... -NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) +**NOTE: Libreboot standardises on [flashprog](https://flashprog.org/wiki/Flashprog) now, as of 27 January 2024, which is a fork of flashrom. +The reason why was explained, in +the [Libreboot 20240225 release](../../news/libreboot20240225.md#flashprog-now-used-instead-of-flashrom)** "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the system, making this difficult. In this situation, diff --git a/site/docs/maintain/index.md b/site/docs/maintain/index.md index 2ca8711..f5cc38d 100644 --- a/site/docs/maintain/index.md +++ b/site/docs/maintain/index.md @@ -566,6 +566,7 @@ as: * `rev="ad983eeec76ecdb2aff4fb47baeee95ade012225"` (example entry) * `xarch="i386-elf"` (example entry) * `payload_grub="y"` (example entry) +* `payload_grubsea="y"` * `payload_seabios="y"` (example entry) * `payload_memtest="y"` (example entry) * `payload_uboot="y"` (example entry) @@ -614,6 +615,18 @@ hence `xarch`. The `payload_grub` entry specifies whether or not GRUB is to be included in ROM images. +The `payload_grubsea` entry specifies that GRUB shall be the primary payload, +instead of SeaBIOS; SeaGRUB is disabled in this setup. You should only use this +where an Intel graphics device is present, or otherwise where native graphics +initialisation is present; it is also feasible on Intel Alderlake platforms, +but only where an Intel GPU is present; where a given system can use other +graphics devices, they must be unplugged or otherwise disabled. For example, you +must remove the graphics card on your desktop machine and only use the Intel +graphics, where it is available. Because of this, `payload_grubsea` is not +currently enabled by default (and SeaBIOS is more stable so it's a nice fallback +in case a bug in GRUB would otherwise brick your machine, because you can +bypass it and use SeaBIOS). + The `payload_seabios` entry specifies whether or not SeaBIOS is to be included in ROM images. If GRUB is also enabled, standalone SeaBIOS images will be created alongside SeaGRUB images. SeaGRUB is where SeaBIOS automatically