docs/install: document CONFIG_X86_IOPL_IOPERM

Signed-off-by: Leah Rowe <leah@libreboot.org>

site/docs/install/index.md

@@ -5,11 +5,47 @@ x-toc-enable: true
 
 This section relates to installing Canoeboot on supported targets.
 
+FLASH ERRORS (and workarounds)
++=======================
+
+Right out of the gate, some users may experience errors with flashrom when
+using the internal programmer. They are:
+
+/dev/mem access error
+---------------------
+
 NOTE: if running `flashrom -p internal` for software based flashing, and you
 get an error related to `/dev/mem` access, you should reboot with
 `iomem=relaxed` kernel parameter before running flashrom, or use a kernel that
 has `CONFIG_STRICT_DEVMEM` not enabled.
 
+ERROR: Could not get I/O privileges
+------------------------------------
+
+Error message: `ERROR: Could not get I/O privileges (Function not implemented)`
+
+If you get this while running `flashrom -p internal -w filename.rom` (or any
+internal flash operation), note: flashrom heavily uses ioperm/iopl functions
+to operate the internal flasher, at least on x86 machines.
+
+See: <https://lwn.net/Articles/804143/>
+
+Yeah, just enable `CONFIG_X86_IOPL_IOPERM` in your Linux kernel. This is
+a *build-time* option, so you must re-compile your kernel, or find a build that
+has this option enabled (IOPL emulation).
+
+Here's a handy-dandy guide for building a kernel from source:
+<https://www.cyberciti.biz/tips/compiling-linux-kernel-26.html>
+
+**BSD users:** On OpenBSD and NetBSD if you get similar errors, note that it
+should work here, but you need to boot with `kern.securelevel=-1`.
+See: [NetBSD securelevel manual](https://wiki.netbsd.org/tutorials/kernel_secure_levels/)
+and [OpenBSD securelevel manpage](https://man.openbsd.org/securelevel).
+
+Otherwise, if you get such errors, it may just be that you're not root. You
+must run flashrom as root, at least to use the internal flasher (using external
+USB flashing dongles doesn't normally require root).
+
 PRECAUTIONS
 ===========