From de26b8e8f2ffbed23eee9c3e07ebd4ea5f3b2c33 Mon Sep 17 00:00:00 2001
From: Francis Rowe
It is extremely unlikely that any post-2008 Intel hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern Intel hardware. If you have an Intel based system affected by the problems described below, then you should get rid of it as soon as possible. The main issues are as follows:
-Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the @@ -256,7 +256,7 @@ Platform Embedded Security Technology Revealed describes in great detail the ME's hardware architecture and firmware application modules.
-On all recent Intel systems, coreboot support has revolved around integrating a blob (for each system) called the FSP (firmware support package), which handles all of the hardware initialization, including @@ -269,7 +269,7 @@ perform a number of attacks on the user (the list is endless). Any Intel system that has the proprietary FSP blob cannot be trusted at all. In fact, several SMM rootkits have been demonstrated in the wild (use a search engine to find them).
-All modern x86 CPUs (from Intel and AMD) use what is called microcode. CPUs are extremely complex, and difficult to get right, so the circuitry is designed in a very generic way, where only basic instructions @@ -295,7 +295,7 @@ you had the source code. If you try to upload your own modified updates, the CPU will reject them. In other words, the microcode updates are tivoized.
-For years, coreboot has been struggling against Intel. Intel has been shown to be extremely uncooperative in general. Many coreboot developers, and companies, have tried to get Intel to cooperate; namely, releasing source code @@ -324,7 +324,7 @@ Back to top of page
-Probably not. There are several privacy, security and freedom issues with these laptops, due to the Intel chipsets that they use. See #intel. There are signed proprietary blobs which cannot be replaced @@ -347,7 +347,7 @@ Back to top of page
-The latest ThinkPad generation supported in libreboot are the ones using the GM45 (ICH9) chipsets, such as the ThinkPad X200 or T400. @@ -364,7 +364,7 @@ Back to top of page
-A common issue with desktop hardware is the Video BIOS. Libreboot has to initialize the graphics chipset, but most graphics cards lack a free Video BIOS for this purpose. Some desktop motherboards supported in @@ -387,7 +387,7 @@ Back to top of page
-Most likely not. First, you must consult coreboot's own hardware compatibility list at http://www.coreboot.org/Supported_Motherboards and, @@ -410,14 +410,14 @@ Back to top of page
-TODO
-Libreboot has support for some AMD platforms, with more on the horizon. See ../docs/hcl/index.html. @@ -433,7 +433,7 @@
See ../docs/install/index.html
@@ -441,7 +441,7 @@ Back to top of page -The RPi can be used to install libreboot onto a system that uses SPI flash, but libreboot intentionally doesn't document it. Why? Blobs. The RPi requires a blob for the integrated video chipset, in order to boot. This was true of the original RPi, and @@ -455,7 +455,7 @@ Back to top of page
-If you are using the GRUB payload, you can add a username and password (salted, hashed) to your GRUB configuration that resides inside the flash chip. The following guides (which @@ -466,7 +466,7 @@ Back to top of page
-By default, there is no write-protection on a libreboot system. This is for usability reasons, because most people do not have easy access to an external programmer for re-flashing their firmware, @@ -487,7 +487,7 @@
-Libreboot actually uses the GRUB payload. More information about payloads can be found at coreboot.org/Payloads. @@ -507,7 +507,7 @@
-Libreboot integrates the GRUB bootloader already, as a payload. This means that the GRUB bootloader is actually flashed, as part of the boot firmware (libreboot). This means that you do @@ -522,7 +522,7 @@
-Not anymore. Recent versions of libreboot (using the GRUB payload) will automatically switch to a GRUB configuration on the HDD or SSD, if it exists. You can also load a different @@ -538,7 +538,7 @@
The main freedom issue on any system, is the boot firmware (usually referred to as a BIOS or UEFI). Libreboot replaces the boot firmware @@ -554,12 +554,12 @@ Dealing with these problems will most likely be handled by a separate project.
-Most (all?) laptops have this. The EC (embedded controller) is a small, separate processor that basically processes inputs/outputs that are specific to laptops. For example:
-HDDs and SSDs have firmware in them, intended to handle the internal workings of the device while exposing a simple, standard interface (such as AHCI/SATA) that the OS software can use, generically. This firmware is transparent to the user @@ -662,7 +662,7 @@
Other links:
-@@ -670,7 +670,7 @@ online, that allow you to connect SATA HDDs via USB. Libreboot documents how to install several GNU/Linux distributions with full disk encryption. You can adapt these for use with USB drives:
-Ethernet NICs will typically run firmware inside, which is responsible for initializing the device internally. Theoretically, it could be configured to drop packets, or even modify them. @@ -698,7 +698,7 @@ Back to top of page
-Implements an instruction set. See #microcode for a brief description. Here we mean microcode built in to the CPU. We are not talking about the updates supplied by the boot firmware @@ -718,7 +718,7 @@ Back to top of page
-Sound hardware (integrated or discrete) typically has firmware on it (DSP) for processing input/output. Again, a USB DAC is a good workaround. @@ -727,7 +727,7 @@ Back to top of page
-Webcams have firmware integrated into them that process the image input into the camera; adjusting focus, white balancing and so on. Can use USB webcam hardware, to work around potential DMA issues; integrated webcams @@ -737,7 +737,7 @@ Back to top of page
-Doesn't really apply to current libreboot systems (none of them have USB 3.0 at the moment), but USB 3.0 host controllers typically rely on firmware to implement the XHCI specification. Some newer @@ -753,7 +753,7 @@
-Some laptops might have a simcard reader in them, with a card for handling WWAN, connecting to a 3g/4g (e.g. GSM) network. This is the same technology used in mobile phones, for remote network access (e.g. internet). @@ -786,7 +786,7 @@
Absolutely! GNU/Linux is well-tested in libreboot, and highly recommended. See installing GNU/Linux and booting GNU/Linux. @@ -803,7 +803,7 @@ Back to top of page
-Unknown. Probably not. Feel free to try it, and report your findings.
@@ -819,7 +819,7 @@ Back to top of page -Potentially. It may be possible to boot most BSD systems if you use the SeaBIOS payload. @@ -839,7 +839,7 @@ Back to top of page
-Windows is incompatible with libreboot, and will probably remain so. Never use Windows.
@@ -847,7 +847,7 @@ Back to top of page -Unknown. Probably not.
-- cgit v0.9.1