2023-06-25 22:40:38 +00:00
% Libreboot 20230625 released!
% Leah Rowe
% 25 June 2023
Introduction
============
Libreboot provides boot firmware for supported x86/ARM machines, starting a
bootloader that then loads your operating system. It replaces proprietary
BIOS/UEFI firmware on x86 machines, and provides an *improved* configuration
2023-06-26 18:03:27 +00:00
on [ARM-based chromebooks ](../docs/install/chromebooks.html ) supported
(U-Boot bootloader, instead of Google's depthcharge bootloader). On x86
machines, the GRUB and SeaBIOS coreboot
2023-06-25 22:40:38 +00:00
payloads are officially supported, provided in varying configurations per
2023-06-26 18:03:27 +00:00
machine. It provides an [automated build system ](../docs/maintain/ ) for the
[configuration ](../docs/build/ ) and [installation ](../docs/install/ ) of coreboot
ROM images, making coreboot easier to use for non-technical people. You can find
the [list of supported hardware ](../docs/hardware/ ) in Libreboot documentation.
2023-06-25 22:40:38 +00:00
2023-06-26 18:06:21 +00:00
Libreboot's main benefit is *higher boot speed* ,
[better ](../docs/linux/encryption.md )
[security ](../docs/linux/grub_hardening.md ) and more
customisation options compared to most proprietary firmware. As a
[libre ](policy.md ) software project, the code can be audited, and coreboot does
regularly audit code. The other main benefit is [*freedom* to study, adapt and
share the code](https://writefreesoftware.org/), a freedom denied by most boot
firmware, but not Libreboot! Booting Linux/BSD is also [well ](../docs/linux/ )
[supported ](../docs/bsd/ ).
2023-06-26 17:58:41 +00:00
2023-06-25 22:40:38 +00:00
*This* new release, Libreboot 20230625, released today 25 June 2023, is
a new *stable* release of Libreboot. The previous stable release was
2023-06-25 22:54:52 +00:00
Libreboot 20220710, released on 10 July 2022.
2023-06-25 22:40:38 +00:00
A note about the changelog
--------------------------
The changes listed here are relative to Libreboot *20230423* , *not* 20220710.
Therefore, to get a full list of changes since 20220710 (the previous stable
release, where releases in-between then and now were *testing* ), you should read
the [20221214 ](libreboot20221214.md ), [20230319 ](libreboot20230319.md ),
[20230413 ](libreboot20230413.md ) and [20230423 ](libreboot20230423.md )
announcements before reading the *20230625* change log, in order to get
a complete picture.
Build from source
-----------------
*This* release was build-tested on Debian *Sid* , as of 25 June 2023. Your
mileage may vary, with other distros. Refer to Libreboot documentation.
Work done since last release
============================
New mainboards now supported:
-----------------------------
These boards were added to Libreboot:
2023-06-29 17:21:16 +00:00
* Laptop: HP EliteBook 2570p (courtesy Riku Viitanen and Johan Ehnberg
`johan@molnix.com` )
2023-06-25 22:40:38 +00:00
* Desktop: HP 8300 USDT (courtesy Riku Viitanen, who *also* ported this
to coreboot)
* Desktop: Gigabyte GA-G41M-ES2L was *re-added* , having been previously
deleted from Libreboot.
The focus has been on stability, auditing the build system and fixing bugs,
thus hardware support is not greatly improved since the last release. Moving
forward, the next Libreboot release will be a *testing* release and *will*
focus on hardware support in addition to payloads (linux boot, UEFI etc).
No-microcode ROMs available
---------------------------
Since Libreboot 20221214 and up, CPU microcode is
included by default on all applicable x86 mainboards. However,
Libreboot provided (and still provides) documentation for how
to manually remove it.
Such removal is still possible, but *this* release now provides
two sets of ROM images for each x86 mainboard: one set of ROMs
will *contain* CPU microcode, and another set *excludes* them.
2023-06-25 23:29:43 +00:00
For more context, see [Binary Blob Reduction Policy ](policy.md )
and [Freedom Status ](../freedom-status.md ).
2023-06-25 22:40:38 +00:00
An earlier article was written about this, [here ](microcode.md )
Massive build system audit
--------------------------
The full change log below will list all build system changes,
but may not provide the overall picture, so to be clear: the
Libreboot build system has undergone an intense audit since the
last release. Over half of it has been re-written, or heavily
re-factored. The logic is much cleaner now (better coding style,
based on the OpenBSD coding style) and many bugs are fixed.
An earlier article was written about this, [here ](audit.md )
Full list of build system changes
--------------------
Certain build system changes will not be listed here in detail, if they
pertain to general code style cleanup/re-factoring, as already alluded to
in the section above. However, specific *bug fixes* will be listed here,
some of which are *also* referenced in the article linked above.
Newest changes first, oldest changes last:
* Coreboot utilities: build them and place them under `cbutils/` from the main
lbmk directory. Use these binaries during build (ROM images, for example).
this makes handling of coreboot more robust, where we can now
run `make distclean` without worrying about utilities. This also fixes the
bug where utilities were being needlessly re-compiled, slowing down the build
of multiple ROM images.
* Boot logo size reduced to ~3KB, down from ~12KB. Courtesy Riku Viitanen. This
was done, without loss of image quality.
* `cros` : Disable coreboot-related BL31 features. This fixes poweroff on gru
chromebooks. Patch courtesy of Alper Nebi Yasak.
* `u-boot` : Increase EFI variable buffer size. This fixes an error where
Debian's signed shim allocates too many EFI variables to fit in the space
provided, breaking the boot process in Debian. Patch courtesy Alper Nebi Yasak
* Re-added Gigabyte GA-G41M-ES2L mainboard. It actually does boot, but we have
always known that raminit is quite experimental on this board. You just have
to cycle through RAM until you find modules that work.
* `nyan` chromebooks: Removed for now (not yet stable) - this release only
contains `gru` chromebooks, where ARM-based chromebooks are concerned.
* `blobutil/download` : Exit with zero status (success) immediately, when
no board configs exist for a specified target. This fixes
the `./build boot roms all` command, when the relevant script encounters
certain targets defined under `resources/coreboot` , where previously the
command would fail due to implicit references to such files.
* Main `lbmk` script: Exit non-zero if a called script fails, explicitly. The
script previously relied on `-e` which isn't always completely reliable.
The new handling also explicitly prints `lbmk error` on stdout, to let the
operator know that an error did in fact occur.
* Board target `t440p_12mb` renamed to `t440plibremrc_12mb`
* `build/boot/roms` : No-microcode ROM images provided, alongside the default
ROMs that include microcode by default. This change is also alluded to in
the sections above.
* `blobutil/download` : Cache downloads based on checksum, to avoid needlessly
re-downloading files per mainboard. This is useful when compiling multiple
ROM images, for multiple mainboards. Patch courtesy Riku Viitanen.
* Dell Latitude E6400 (board): Fix SD cards (SD cards now work fine). Patch
courtesy Nicholas Chin.
* `util/nvmutil` : Vastly more efficient code (part of the audit, referenced in
above).
* `util/nvmutil` : [unveil ](https://man.openbsd.org/unveil.2 ) now used, in
addition to pledge when compiled on OpenBSD.
* `util/nvmutil` : Hardened pledge calls, when compiled on OpenBSD.
* utils: Properly detect OpenBSD, to test whether pledge should be used.
* board `hp8200sff` : Add 4MB ROM configs, for internal flashing, patch courtesy
2023-06-25 23:33:52 +00:00
of Riku Viitanen.
2023-06-25 22:40:38 +00:00
* Unified *all* scripts in the main directory of lbmk (build system). All core
logic is now a *single* script, removing needless code repetition.
* `download/coreboot` fix: Do not needlessly re-download a given coreboot
tree, if it was already downloaded.
* Removed help text in certain scripts (unnecessary, can just read docs)
* `build/release/roms` : Fix error handling inside subshells.
* `build/release/src` : Fix error handling, previously not handled inside
subshells.
* `build/ich9utils` : Fix error handling (subshells)
* `build/descriptors` : Fixed error handling (certain errors weren't handled)
* `build/grub` : Actually handle errors. Logic was handled in subshells, where
greater care is required for error handling. Exit with non-zero status upon
any error.
* `gitclone` : Only delete the old project directory *if* the new download has
succeeded, to avoid, for example, complete purging of files when your internet
is down. In such cases, it's better that the script simply fails and no action
is taken. This fix implements such caution.
* `blobutil` fix: Actually exit with non-zero status (fail) when a called script
fails. This previously wasn't done at all.
* `.gitcheck` (script): Another bug fix, actually *do* clean coreboot git
credentials, when temporary ones were set, per coreboot tree. This previously
was not handled at all. (this script removes the need to manually set git
name/email, by setting a temporary one which makes the coreboot build system
happy when building ROM images)
* `.gitcheck` (script): Actually *run* gitcheck-clean. It wasn't being executed
at all, which screwed up the user's git credentials in some cases (after
running lbmk, you would sometimes commit a patch and find that your name is
now *lbmkplaceholder* ).
* `util/spkmodem_recv` : Also: DEBUG define no longer used. It is now an argument
namely `-d` , which can be passed to the program. The code for debug is now
present in any build. Usage: `spkmodem-recv -d`
* New util: `util/spkmodem_recv` - imported from coreboot, which in turn forked
it originally from GNU GRUB. This is a receiving client for *spkmodem* , a type
of serial console provided via pulses over PC speaker. Libreboot's version
greatly improves the error handling, and it has been re-factored for OpenBSD
coding style, to replace the (very horrible) GNU coding style.
It is also [pledged ](https://man.openbsd.org/pledge.2 ) in
Libreboot's version. For reference,
[here ](https://git.savannah.gnu.org/cgit/grub.git/plain/util/spkmodem-recv.c?id=822b726b33b8dc07dd01b257a2dfcc7b07d12e2f )
is the GNU version, and
[here ](https://raw.githubusercontent.com/coreboot/coreboot/8febc91b3041a1d027bf0d36d30ccb119496524f/util/spkmodem_recv/spkmodem-recv.c ) is coreboot's version of it. And now to blow your mind,
[here ](https://browse.libreboot.org/lbmk.git/tree/util/spkmodem_recv/spkmodem-recv.c?id=b508245451b71b3443fa3202f3863a6de731e9c8 )
is the Libreboot version present in release 20230625. A very much GNU program,
but you wouldn't know it by looking! This fork was mostly done for fun, very
much a *because we can* affair. BONUS: BSD-style error handling (`err.h`)
* download/coreboot: Run `extra.sh` directly from the directory for the given
coreboot tree, if the script exists. No board in Libreboot has ever included
an `extra.sh` script, but it can be used to extend the default functionality
of lbmk where lots of custom logic is needed for a given board. For example,
if you needed to apply lots of patches from gerrit in a specific order, in a
way that could not be generalised for other mainboards where it's really
only applicable to that mainboard, you might use `extra.sh` . This was briefly
used in the erstwhile osboot project, on a few boards.
* download/coreboot: Use the `gitclone` script for actually cloning coreboot,
while still using the main script for handling trees/revisions and such.
(this is one of the scripts that got re-written during the audit, mentioned
in the previous section above)
* build/payload/seabios: *Much* stricter error handling, exit with non-zero
status (fail) on more error conditions, should they occur.
* download/mrc (script): *Much* stricter error handling, exit with non-zero
status (fail) on more error conditions, should they occur.
* gitclone (script): Check whether a given patch exists before applying. Works
around a quirk in most shells where `*` will error out if no files exist.
* download/grub (script): If downloading `gnulib` fails, scrap the *grub*
download aswell, and exit with non-zero status (fail). This is done because
gnulib is a dependency of GRUB.
* blobutil/inject (script): When inserting `gbe.bin` , check that the file
actually exists, and exit with non-zero status (fail) otherwise.
* blobutil/inject (script): When inserting `me.bin` , check that the given
path is defined and exit with non-zero status (fail) otherwise.
* blobutil/inject (script): Use x86 top-aligned MRC offset, when
inserting `mrc.bin` on Haswell ROM images (ThinkPad T440p/W541). Previously,
lbmk would insert them based on the offset as per ROM image file size, but
it is possible (and more reliable) to have cbfstool calculate that position
within the file based on where the ROM image would be loaded into memory.
The result is identical in practise (same checksum for the file), but this is
more robust for a future scenario where, for example, Libreboot might provide
different sized images. For example, if the flash were upgraded to 16MB rather
than 12MB on a T440p (Libreboot still only provides 12MB images for T440p).
* Coreboot build system: patch it to no longer warn about lack of payload
when building (patch courtesy of Nicholas Chin). Libreboot's build system is
designed to build ROM images without a payload, and then compile/add payloads
itself, as opposed to using the *coreboot* build system for payloads.
* Don't patch the build system for python2 anymore. Prefer python3, and use
it exclusively. No more python2 code was needed anymore, in lbmk's
dependencies.
* build/boot/roms (script): Fix faulty variable expansion for list of keymaps.
This fixes keymap handling when generating GRUB payloads for each keymap.
* The entire build system: massive code cleanup as alluded to above.
* Coreboot: Patched the coreboot device tree on Dell Latitude E6400, so that
the Nvidia GPU can be initialised properly (patch courtesy Nicholas Chin) -
only Intel GPU variants of E6400 are officially supported in this release.
* SeaBIOS payload: Provide `normal` config for setups where no VGA ROM init
from CBFS is provided, either in SeaBIOS or GRUB(via coreboot). This would
be used, for example, on desktops that lack onboard graphics, where it is
expected that a graphics card would be used.
* Fixed the Makefile to match current commands available in lbmk (use of
the Makefile is still optional, and direct use of lbmk is still recommended)
* Patched util `bios_extract` to work nicely with Dell E6400 update files,
patch courtesy of Nicholas Chin.
* New util: `bios_extract` (used to VGA ROM from Dell updates, for Nvidia GPU
model of Dell Latitude E6400, though this release only officially supports
the Intel GPU variant)
* Fixed unifont package info in Fedora 38 dependencies script
* util/e6400-flash-unlock: Minor code cleanup
* Don't force console mode in GRUB (reverses experimental change made in
the 20230423 release)
Hardware supported in this release
==================================
All of the following are believed to *boot* , but if you have any issues,
please contact the Libreboot project. They are:
Desktops (AMD, Intel, x86)
-----------------------
- [Gigabyte GA-G41M-ES2L motherboard ](../docs/hardware/ga-g41m-es2l.md )
- [Acer G43T-AM3 ](../docs/hardware/acer_g43t-am3.md )
- [Intel D510MO and D410PT motherboards ](../docs/hardware/d510mo.md )
- [Apple iMac 5,2 ](../docs/hardware/imac52.md )
- [HP Elite 8200 SFF/MT ](../docs/hardware/hp8200sff.md ) (HP 6200 Pro Business probably works too)
- [HP Elite 8300 USDT ](../docs/hardware/hp8300usdt.md )
### Laptops (Intel, x86)
2023-06-25 23:09:35 +00:00
- ** [Dell Latitude E6400 ](../docs/hardware/e6400.md ) (easy to flash, no disassembly, similar
2023-06-25 22:40:38 +00:00
hardware to X200/T400)**
- ThinkPad X60 / X60S / X60 Tablet
- ThinkPad T60 (with Intel GPU)
- [Lenovo ThinkPad X200 / X200S / X200 Tablet ](../docs/hardware/x200.md )
- Lenovo ThinkPad X301
- [Lenovo ThinkPad R400 ](../docs/hardware/r400.md )
- [Lenovo ThinkPad T400 / T400S ](../docs/hardware/t400.md )
- [Lenovo ThinkPad T500 ](../docs/hardware/t500.md )
- [Lenovo ThinkPad T530 / W530 ](../docs/install/ivy_has_common.md )
- [Lenovo ThinkPad W500 ](../docs/hardware/t500.md )
- [Lenovo ThinkPad R500 ](../docs/hardware/r500.md )
- [Apple MacBook1,1 and MacBook2,1 ](../docs/hardware/macbook21.md )
- [Lenovo ThinkPad T440p ](../docs/install/t440p_external.md )
- [Lenovo Thinkpad X220 ](../docs/install/ivy_has_common.md )
- [Lenovo Thinkpad X220t ](../docs/install/ivy_has_common.md )
- [Lenovo Thinkpad T420 ](../docs/install/ivy_has_common.md )
- [Lenovo ThinkPad T420S ](../docs/install/ivy_has_common.md )
- [Lenovo ThinkPad T430 ](../docs/install/ivy_has_common.md )
- [Lenovo Thinkpad X230 ](../docs/install/x230_external.md )
- [Lenovo Thinkpad X230t ](../docs/install/x230_external.md )
- [Lenovo ThinkPad W541 ](../docs/install/ivy_has_common.md )
- [HP EliteBook 2560p ](../docs/hardware/hp2560p.md )
- [HP EliteBook 2570p ](../docs/hardware/hp2570p.md )
- [HP EliteBook Folio 9470m ](../docs/hardware/hp9470m.md )
### Laptops (ARM, with U-Boot payload)
- [ASUS Chromebook Flip C101 (gru-bob) ](../docs/install/chromebooks.md )
- [Samsung Chromebook Plus (v1) (gru-kevin) ](../docs/install/chromebooks.md )
Downloads
=========
You can find this release on the downloads page. At the time of this
announcement, some of the rsync mirrors may not have it yet, so please check
another one if your favourite one doesn't have it.