coreboot/libreboot

[mia]

Hello lads, I was wondering what you guys think about open source firmware
Do any of you use coreboot/libreboot? If so, how's you experience with it?
Do you prefer using a more conservative payload like SeaBIOS or a full OS like Tianocore/EDK2?
Are you using it on a blob-free platform (like a core 2 duo), a not-so-old platform like Ivy Bridge/Haswell with a neutralized ME firmware or a modern platform on a chromebook, for example?
Do you prefer flashing already built images from libreboot's website or compile it yourself?
Do you find it stable?

[qualia]

I use libreboot with the SeaBIOS payload on my thinkpad. It's a not-so-old model with ME neutralized. I frankly do not remember whether I had compiled it by myself, I did it a long time ago. I've had no real issues with it so far, i guess once or twice it did error out during boot for some reason but worked fine after rebooting, so its a minor thing.

Also, worth mentioning that libreboot includes some non-libre firmware these days, the fully free version is canoeboot (maintained by the same person)

[LoadingXML]

DELETED BY USER.

[mia2ndpassword]

I use libreboot with the SeaBIOS payload on my thinkpad. It's a not-so-old model with ME neutralized. I frankly do not remember whether I had compiled it by myself, I did it a long time ago. I've had no real issues with it so far, i guess once or twice it did error out during boot for some reason but worked fine after rebooting, so its a minor thing.

Also, worth mentioning that libreboot includes some non-libre firmware these days, the fully free version is canoeboot (maintained by the same person)

I personally use a similar setup, but I think i am running the most up-to-dated version on long mode (64-bit) and it's a gigabyte ga b75m d3h i bought and compiled coreboot for it, It boots extremely fast too, the only blob I need is an neutralized 92kb me image

less then a sec on cold boot

31 entries total:

0:1st timestamp 2,349 (0)
11:start of bootblock 20,169 (17,819)
12:end of bootblock 25,997 (5,827)
13:starting to load romstage 25,997 (0)
14:finished loading romstage 26,111 (113)
1:start of romstage 26,407 (296)
2:before RAM initialization 32,666 (6,258)
3:after RAM initialization 47,782 (15,116)
4:end of romstage 54,832 (7,050)
100:start of postcar 56,235 (1,402)
101:end of postcar 56,235 (0)
8:starting to load ramstage 56,235 (0)
17:starting LZ4 decompress (ignore for x86) 56,238 (2)
18:finished LZ4 decompress (ignore for x86) 117,664 (61,426)
9:finished loading ramstage 117,766 (101)
10:start of ramstage 119,260 (1,494)
30:early chipset initialization 119,269 (8)
31:device enumeration 119,272 (3)
40:device configuration 121,365 (2,093)
50:device enable 123,869 (2,503)
60:device initialization 124,397 (528)
65:Option ROM initialization 132,025 (7,627)
66:Option ROM copy done 149,454 (17,429)
67:Option ROM run done 151,033 (1,579)
70:device setup done 214,475 (63,441)
75:cbmem post 214,478 (2)
80:write tables 214,480 (2)
85:finalize chips 217,374 (2,893)
90:starting to load payload 217,378 (3)
15:starting LZMA decompress (ignore for x86) 217,463 (84)
16:finished LZMA decompress (ignore for x86) 239,288 (21,825)
99:selfboot jump 240,235 (946)

Total Time: 237,870

no issues so far too

[anonymous_]

The biggest issue with Coreboot and co is the lack of broad support, especially on desktops. There's like what, 2 modern boards?
Even of the thinkpads, it's kinda limited.
Good news is you don't need Coreboot to disable the management engine.
Not sure if there's any other types of mitigations you can do on the hardware level to <insert generic computer>?????
Block it all with a firewall? Hope the firewall isn't backdoored also to allow through nefarious glowing packets?
Are we to be restricted only to memepads? You should be able to go on ebay and buy whatever the best deal is, and mitigate, not this "oh it's gotta be this model with this configuration otherwise it will brick or boot loop or some stupid shit". Like, WTF
At least me_cleaner is pretty universal, there's even a fork that let's it work on newer firmware.

[mia2ndpassword]

The biggest issue with Coreboot and co is the lack of broad support, especially on desktops. There's like what, 2 modern boards?
Even of the thinkpads, it's kinda limited.

If you have a motherboard that has a supported chipset and superio, It will take you a week to port coreboot to it, trust me, I'm speaking from experience

Good news is you don't need Coreboot to disable the management engine.

Why would you still trust AMI?

Not sure if there's any other types of mitigations you can do on the hardware level to <insert generic computer>?????

porting it yourself

Are we to be restricted only to memepads?

I saw a lot of cheap ivy bridge gigabyte motherboards that officially support coreboot on marketplaces, like mine, there's also Hp laptops like the elitebook 8460/70p, but I'd sill recommend you go with a gigabyte motherboard cuz they got dual bioses and you can flash it internally without a external programmer out of the box

You should be able to go on ebay and buy whatever the best deal is, and mitigate, not this "oh it's gotta be this model with this configuration otherwise it will brick or boot loop or some stupid shit". Like, WTF

You can blame that on the OEM making weird implementations of UFEI, If you have a normal bios, you will be able to cripple ME without it bricking

At least me_cleaner is pretty universal, there's even a fork that let's it work on newer firmware.

the newer fork only sets a bit to signal ME "could you stop working, pwease ><", so you're still trusting ME to not be harmful

[anonymous_]

the newer fork only sets a bit to signal ME "could you stop working, pwease ><", so you're still trusting ME to not be harmful

Do you have any suggestions other than "use old hardware"?
At least ME is semi-documented and it has a switch. We don't even really know what AMD or ARM gets up to.
There's RISC-V but those options are few and far between,

[mia2ndpassword]

Do you have any suggestions other than "use old hardware"?
At least ME is semi-documented and it has a switch. We don't even really know what AMD or ARM gets up to.
There's RISC-V but those options are few and far between,

better late than never right?

We don't know much about ME from post-1151 systems besides the HAP bit. the earlier versions (< 2014) that ran threadx (i think?) are the only ones that people cared to thinker with, anything after that is pretty much a blackbox

I wouldn't buy a risc-v SBC cuz they seem slower than (lower-end) 10yo+ hardware and the platform isn't mature enough
i saw a guy on odysee who bought a risc-v board and the only way to install a operating system was using android adb's fastboot utility, yeah, i (personally) don't like how this sounds like
there's also the raptor blackbird systems, but they are very pricey, and the board construction seem very cheap for such price tag
and of course, although they might have experimental support for other operating systems, they will only work properly on Linux.

[anonymous_]

Do you have any suggestions other than "use old hardware"?
At least ME is semi-documented and it has a switch. We don't even really know what AMD or ARM gets up to.
There's RISC-V but those options are few and far between,

better late than never right?

We don't know much about ME from post-1151 systems besides the HAP bit. the earlier versions (< 2014) that ran threadx (i think?) are the only ones that people cared to thinker with, anything after that is pretty much a blackbox

I wouldn't buy a risc-v SBC cuz they seem slower than (lower-end) 10yo+ hardware and the platform isn't mature enough
i saw a guy on odysee who bought a risc-v board and the only way to install a operating system was using android adb's fastboot utility, yeah, i (personally) don't like how this sounds like
there's also the raptor blackbird systems, but they are very pricey, and the board construction seem very cheap for such price tag
and of course, although they might have experimental support for other operating systems, they will only work properly on Linux.

Sounds like a total shit sandwich. AFAIK all the HAP bit is is asking it nicely to turn off, it's just with combining coreboot on some older boards you can remove the ME also.

And we still have no info on AMD, VIA etc? Also somewhere far out there is SPARC and OpenSPARC lol.
There's probably also some other really niche systems out there, but I do not know them.


There were also these MSI boards with coreboot. Seems they do not sell this system anymore, but the specs are there.
https://www.tuxedocomputers.com/en/TUXE ... wer.tuxedo

[mia2ndpassword]

Do you have any suggestions other than "use old hardware"?
At least ME is semi-documented and it has a switch. We don't even really know what AMD or ARM gets up to.
There's RISC-V but those options are few and far between,

better late than never right?

We don't know much about ME from post-1151 systems besides the HAP bit. the earlier versions (< 2014) that ran threadx (i think?) are the only ones that people cared to thinker with, anything after that is pretty much a blackbox

I wouldn't buy a risc-v SBC cuz they seem slower than (lower-end) 10yo+ hardware and the platform isn't mature enough
i saw a guy on odysee who bought a risc-v board and the only way to install a operating system was using android adb's fastboot utility, yeah, i (personally) don't like how this sounds like
there's also the raptor blackbird systems, but they are very pricey, and the board construction seem very cheap for such price tag
and of course, although they might have experimental support for other operating systems, they will only work properly on Linux.

Sounds like a total shit sandwich. AFAIK all the HAP bit is is asking it nicely to turn off, it's just with combining coreboot on some older boards you can remove the ME also.

And we still have no info on AMD, VIA etc? Also somewhere far out there is SPARC and OpenSPARC lol.
There's probably also some other really niche systems out there, but I do not know them.


There were also these MSI boards with coreboot. Seems they do not sell this system anymore, but the specs are there.
https://www.tuxedocomputers.com/en/TUXE ... wer.tuxedo

we don't even have open source drivers for via's chrome[1-9] bs igpus and the last platform they made chipsets for was 775, and nobody cares about sparc, it's just a legacy thing now