From 8b2219bfa2da36e7809588ef723a10483a6e137f Mon Sep 17 00:00:00 2001 From: Francis Rowe Date: Thu, 6 Nov 2014 01:52:36 +0000 Subject: Documentation: *major* cleanup. Cleanup was long overdue. Old structure was messy and inefficient. --- docs/archive_old.html | 90 +- docs/css/main.css | 46 + docs/future/dumps/kernel312_irc | 12 +- docs/future/index.html | 18 +- docs/future/old.html | 14 +- docs/git/index.html | 503 ++++++++ docs/gnulinux/cbfstool_libreboot5_strace | 48 + docs/gnulinux/configuring_parabola.html | 776 ++++++++++++ docs/gnulinux/encrypted_parabola.html | 569 +++++++++ docs/gnulinux/encrypted_trisquel.html | 308 +++++ docs/gnulinux/grub_boot_installer.html | 137 ++ docs/gnulinux/grub_cbfs.html | 400 ++++++ docs/gnulinux/index.html | 51 + docs/grub/index.html | 123 ++ docs/hardware/index.html | 45 + docs/hardware/t60_heatsink.html | 128 ++ docs/hardware/t60_lcd_15.html | 89 ++ docs/hardware/x60_heatsink.html | 144 +++ docs/hardware/x60_lcd_change.html | 49 + docs/hcl/index.html | 593 +++++++++ docs/howtos/cbfstool_libreboot5_strace | 48 - docs/howtos/configuring_parabola.html | 784 ------------ docs/howtos/dock.html | 163 --- docs/howtos/encrypted_parabola.html | 577 --------- docs/howtos/encrypted_trisquel.html | 316 ----- docs/howtos/grub_boot_installer.html | 142 --- docs/howtos/grub_cbfs.html | 408 ------ docs/howtos/t60_dev/.htaccess | 2 - docs/howtos/t60_dev/0001.JPG | Bin 29286 -> 0 bytes docs/howtos/t60_dev/0002.JPG | Bin 18438 -> 0 bytes docs/howtos/t60_dev/0003.JPG | Bin 25880 -> 0 bytes docs/howtos/t60_dev/0004.JPG | Bin 29980 -> 0 bytes docs/howtos/t60_dev/0005.JPG | Bin 34349 -> 0 bytes docs/howtos/t60_dev/0006.JPG | Bin 32029 -> 0 bytes docs/howtos/t60_dev/0007.JPG | Bin 21920 -> 0 bytes docs/howtos/t60_dev/0008.JPG | Bin 27410 -> 0 bytes docs/howtos/t60_dev/0009.JPG | Bin 28007 -> 0 bytes docs/howtos/t60_dev/0010.JPG | Bin 26159 -> 0 bytes docs/howtos/t60_dev/0011.JPG | Bin 29595 -> 0 bytes docs/howtos/t60_dev/0012.JPG | Bin 33949 -> 0 bytes docs/howtos/t60_dev/0013.JPG | Bin 36311 -> 0 bytes docs/howtos/t60_dev/0014.JPG | Bin 24707 -> 0 bytes docs/howtos/t60_dev/0015.JPG | Bin 39588 -> 0 bytes docs/howtos/t60_dev/0016.JPG | Bin 27100 -> 0 bytes docs/howtos/t60_dev/0017.JPG | Bin 28726 -> 0 bytes docs/howtos/t60_dev/0018.JPG | Bin 29222 -> 0 bytes docs/howtos/t60_dev/0019.JPG | Bin 25665 -> 0 bytes docs/howtos/t60_dev/0020.JPG | Bin 25546 -> 0 bytes docs/howtos/t60_dev/0021.JPG | Bin 31706 -> 0 bytes docs/howtos/t60_dev/0022.JPG | Bin 31204 -> 0 bytes docs/howtos/t60_dev/0023.JPG | Bin 24873 -> 0 bytes docs/howtos/t60_dev/0024.JPG | Bin 23202 -> 0 bytes docs/howtos/t60_dev/0025.JPG | Bin 30328 -> 0 bytes docs/howtos/t60_dev/0026.JPG | Bin 31226 -> 0 bytes docs/howtos/t60_dev/0027.JPG | Bin 46231 -> 0 bytes docs/howtos/t60_dev/0028.JPG | Bin 23612 -> 0 bytes docs/howtos/t60_dev/0029.JPG | Bin 25268 -> 0 bytes docs/howtos/t60_dev/0030.JPG | Bin 30434 -> 0 bytes docs/howtos/t60_dev/0031.JPG | Bin 23611 -> 0 bytes docs/howtos/t60_dev/0032.JPG | Bin 40278 -> 0 bytes docs/howtos/t60_dev/0033.JPG | Bin 27035 -> 0 bytes docs/howtos/t60_dev/0034.JPG | Bin 31013 -> 0 bytes docs/howtos/t60_dev/0035.JPG | Bin 21980 -> 0 bytes docs/howtos/t60_dev/0036.JPG | Bin 25031 -> 0 bytes docs/howtos/t60_dev/0037.JPG | Bin 26085 -> 0 bytes docs/howtos/t60_dev/0038.JPG | Bin 29137 -> 0 bytes docs/howtos/t60_dev/0039.JPG | Bin 26270 -> 0 bytes docs/howtos/t60_dev/0040.JPG | Bin 18541 -> 0 bytes docs/howtos/t60_dev/0041.JPG | Bin 21721 -> 0 bytes docs/howtos/t60_dev/0042.JPG | Bin 20235 -> 0 bytes docs/howtos/t60_dev/0043.JPG | Bin 23633 -> 0 bytes docs/howtos/t60_dev/0044.JPG | Bin 19500 -> 0 bytes docs/howtos/t60_dev/0045.JPG | Bin 27856 -> 0 bytes docs/howtos/t60_dev/0046.JPG | Bin 20677 -> 0 bytes docs/howtos/t60_dev/0047.JPG | Bin 27700 -> 0 bytes docs/howtos/t60_dev/0048.JPG | Bin 28463 -> 0 bytes docs/howtos/t60_dev/0049.JPG | Bin 24666 -> 0 bytes docs/howtos/t60_dev/0050.JPG | Bin 22518 -> 0 bytes docs/howtos/t60_dev/0051.JPG | Bin 26041 -> 0 bytes docs/howtos/t60_dev/0052.JPG | Bin 30542 -> 0 bytes docs/howtos/t60_dev/0053.JPG | Bin 24306 -> 0 bytes docs/howtos/t60_dev/0054.JPG | Bin 25897 -> 0 bytes docs/howtos/t60_dev/0055.JPG | Bin 26165 -> 0 bytes docs/howtos/t60_dev/0056.JPG | Bin 26494 -> 0 bytes docs/howtos/t60_dev/0057.JPG | Bin 23831 -> 0 bytes docs/howtos/t60_dev/0058.JPG | Bin 25265 -> 0 bytes docs/howtos/t60_dev/0059.JPG | Bin 23332 -> 0 bytes docs/howtos/t60_dev/0060.JPG | Bin 23005 -> 0 bytes docs/howtos/t60_dev/0061.JPG | Bin 27218 -> 0 bytes docs/howtos/t60_dev/0062.JPG | Bin 25952 -> 0 bytes docs/howtos/t60_dev/0063.JPG | Bin 24230 -> 0 bytes docs/howtos/t60_dev/0064.JPG | Bin 22184 -> 0 bytes docs/howtos/t60_dev/0065.JPG | Bin 24711 -> 0 bytes docs/howtos/t60_dev/0066.JPG | Bin 28270 -> 0 bytes docs/howtos/t60_dev/0068.JPG | Bin 20900 -> 0 bytes docs/howtos/t60_dev/0069.JPG | Bin 22345 -> 0 bytes docs/howtos/t60_dev/0070.JPG | Bin 22149 -> 0 bytes docs/howtos/t60_dev/0071.JPG | Bin 48759 -> 0 bytes docs/howtos/t60_dev/0072.JPG | Bin 42778 -> 0 bytes docs/howtos/t60_dev/0073.JPG | Bin 49383 -> 0 bytes docs/howtos/t60_dev/0074.JPG | Bin 42206 -> 0 bytes docs/howtos/t60_dev/t60_unbrick.jpg | Bin 61220 -> 0 bytes docs/howtos/t60_heatsink.html | 133 -- docs/howtos/t60_lcd_15.html | 94 -- docs/howtos/t60_security.html | 445 ------- docs/howtos/t60_unbrick.html | 319 ----- docs/howtos/x60_heatsink.html | 149 --- docs/howtos/x60_heatsink/0000.jpg | Bin 53772 -> 0 bytes docs/howtos/x60_heatsink/0001.jpg | Bin 38997 -> 0 bytes docs/howtos/x60_heatsink/0002.jpg | Bin 31435 -> 0 bytes docs/howtos/x60_heatsink/0003.jpg | Bin 29815 -> 0 bytes docs/howtos/x60_heatsink/0004.jpg | Bin 42084 -> 0 bytes docs/howtos/x60_heatsink/0005.jpg | Bin 42715 -> 0 bytes docs/howtos/x60_heatsink/0006.jpg | Bin 33748 -> 0 bytes docs/howtos/x60_heatsink/0007.jpg | Bin 45537 -> 0 bytes docs/howtos/x60_heatsink/0008.jpg | Bin 46045 -> 0 bytes docs/howtos/x60_heatsink/0009.jpg | Bin 34013 -> 0 bytes docs/howtos/x60_heatsink/0010.jpg | Bin 30985 -> 0 bytes docs/howtos/x60_heatsink/0011.jpg | Bin 45500 -> 0 bytes docs/howtos/x60_heatsink/0012.jpg | Bin 39202 -> 0 bytes docs/howtos/x60_heatsink/0013.jpg | Bin 45481 -> 0 bytes docs/howtos/x60_heatsink/0014.jpg | Bin 40388 -> 0 bytes docs/howtos/x60_heatsink/0015.jpg | Bin 38045 -> 0 bytes docs/howtos/x60_heatsink/0016.jpg | Bin 125147 -> 0 bytes docs/howtos/x60_heatsink/0017.jpg | Bin 143009 -> 0 bytes docs/howtos/x60_heatsink/0018.jpg | Bin 175369 -> 0 bytes docs/howtos/x60_lcd_change.html | 54 - docs/howtos/x60_lcd_change/0001.JPG | Bin 80828 -> 0 bytes docs/howtos/x60_lcd_change/0002.JPG | Bin 72986 -> 0 bytes docs/howtos/x60_lcd_change/0003.JPG | Bin 81777 -> 0 bytes docs/howtos/x60_lcd_change/0004.JPG | Bin 87164 -> 0 bytes docs/howtos/x60_lcd_change/0005.JPG | Bin 66652 -> 0 bytes docs/howtos/x60_lcd_change/0006.JPG | Bin 57127 -> 0 bytes docs/howtos/x60_lcd_change/0007.JPG | Bin 31729 -> 0 bytes docs/howtos/x60_security.html | 306 ----- docs/howtos/x60_security/0000.jpg | Bin 53772 -> 0 bytes docs/howtos/x60_security/0000_bluetooth.jpg | Bin 120337 -> 0 bytes docs/howtos/x60_security/0000_bluetooth0.jpg | Bin 19558 -> 0 bytes docs/howtos/x60_security/0000_simcard0.jpg | Bin 105696 -> 0 bytes docs/howtos/x60_security/0000_simcard1.jpg | Bin 129884 -> 0 bytes docs/howtos/x60_security/0001.jpg | Bin 38997 -> 0 bytes docs/howtos/x60_security/0001_microphone.jpg | Bin 128637 -> 0 bytes docs/howtos/x60_security/0001_modem.jpg | Bin 124855 -> 0 bytes docs/howtos/x60_security/0001_overview.jpg | Bin 200563 -> 0 bytes docs/howtos/x60_security/0001_speaker.jpg | Bin 121336 -> 0 bytes docs/howtos/x60_security/0001_wlan_wwan.jpg | Bin 151989 -> 0 bytes docs/howtos/x60_security/0002.jpg | Bin 31435 -> 0 bytes docs/howtos/x60_security/0003.jpg | Bin 29815 -> 0 bytes docs/howtos/x60_security/0004.jpg | Bin 42084 -> 0 bytes docs/howtos/x60_unbrick.html | 310 ----- docs/howtos/x60_unbrick/0000.jpg | Bin 53772 -> 0 bytes docs/howtos/x60_unbrick/0001.jpg | Bin 38997 -> 0 bytes docs/howtos/x60_unbrick/0002.jpg | Bin 31435 -> 0 bytes docs/howtos/x60_unbrick/0003.jpg | Bin 29815 -> 0 bytes docs/howtos/x60_unbrick/0004.jpg | Bin 42084 -> 0 bytes docs/howtos/x60_unbrick/0005.jpg | Bin 42715 -> 0 bytes docs/howtos/x60_unbrick/0006.jpg | Bin 33748 -> 0 bytes docs/howtos/x60_unbrick/0007.jpg | Bin 45537 -> 0 bytes docs/howtos/x60_unbrick/0008.jpg | Bin 46045 -> 0 bytes docs/howtos/x60_unbrick/0009.jpg | Bin 34013 -> 0 bytes docs/howtos/x60_unbrick/0010.jpg | Bin 30985 -> 0 bytes docs/howtos/x60_unbrick/0011.jpg | Bin 38650 -> 0 bytes docs/howtos/x60_unbrick/0012.jpg | Bin 39202 -> 0 bytes docs/howtos/x60_unbrick/0013.jpg | Bin 45481 -> 0 bytes docs/howtos/x60_unbrick/0014.jpg | Bin 40388 -> 0 bytes docs/howtos/x60_unbrick/0015.jpg | Bin 38045 -> 0 bytes docs/howtos/x60_unbrick/0016.jpg | Bin 32380 -> 0 bytes docs/howtos/x60_unbrick/0017.jpg | Bin 36115 -> 0 bytes docs/howtos/x60_unbrick/0018.jpg | Bin 37295 -> 0 bytes docs/howtos/x60_unbrick/0019.jpg | Bin 33700 -> 0 bytes docs/howtos/x60_unbrick/0020.jpg | Bin 26069 -> 0 bytes docs/howtos/x60_unbrick/0021.jpg | Bin 33441 -> 0 bytes docs/howtos/x60_unbrick/0022.jpg | Bin 36356 -> 0 bytes docs/howtos/x60_unbrick/0023.jpg | Bin 34821 -> 0 bytes docs/howtos/x60_unbrick/0024.jpg | Bin 32001 -> 0 bytes docs/howtos/x60_unbrick/0025.jpg | Bin 31621 -> 0 bytes docs/howtos/x60_unbrick/0026.jpg | Bin 39855 -> 0 bytes docs/howtos/x60_unbrick/0027.jpg | Bin 37302 -> 0 bytes docs/howtos/x60_unbrick/0028.jpg | Bin 39501 -> 0 bytes docs/howtos/x60_unbrick/0029.jpg | Bin 37530 -> 0 bytes docs/howtos/x60_unbrick/0030.jpg | Bin 43484 -> 0 bytes docs/howtos/x60_unbrick/0031.jpg | Bin 38022 -> 0 bytes docs/howtos/x60_unbrick/0032.jpg | Bin 44860 -> 0 bytes docs/howtos/x60_unbrick/0033.jpg | Bin 30821 -> 0 bytes docs/howtos/x60_unbrick/0034.jpg | Bin 37249 -> 0 bytes docs/howtos/x60_unbrick/0035.jpg | Bin 38429 -> 0 bytes docs/howtos/x60_unbrick/0036.jpg | Bin 41042 -> 0 bytes docs/howtos/x60_unbrick/0037.jpg | Bin 33911 -> 0 bytes docs/howtos/x60_unbrick/0038.jpg | Bin 38246 -> 0 bytes docs/howtos/x60_unbrick/0039.jpg | Bin 45794 -> 0 bytes docs/howtos/x60_unbrick/0040.jpg | Bin 40020 -> 0 bytes docs/howtos/x60_unbrick/0041.jpg | Bin 37564 -> 0 bytes docs/howtos/x60_unbrick/0042.jpg | Bin 35915 -> 0 bytes docs/howtos/x60_unbrick/0043.jpg | Bin 36692 -> 0 bytes docs/howtos/x60_unbrick/0044.jpg | Bin 37146 -> 0 bytes docs/howtos/x60_unbrick/0045.jpg | Bin 39062 -> 0 bytes docs/howtos/x60_unbrick/0046.jpg | Bin 35431 -> 0 bytes docs/howtos/x60_unbrick/0047.jpg | Bin 37275 -> 0 bytes docs/howtos/x60_unbrick/0048.jpg | Bin 39975 -> 0 bytes docs/howtos/x60_unbrick/0049.jpg | Bin 42058 -> 0 bytes docs/howtos/x60t_unbrick/.htaccess | 2 - docs/howtos/x60t_unbrick/0000.JPG | Bin 127355 -> 0 bytes docs/howtos/x60t_unbrick/0001.JPG | Bin 132522 -> 0 bytes docs/howtos/x60t_unbrick/0002.JPG | Bin 110933 -> 0 bytes docs/howtos/x60t_unbrick/0003.JPG | Bin 137253 -> 0 bytes docs/howtos/x60t_unbrick/0004.JPG | Bin 125196 -> 0 bytes docs/howtos/x60t_unbrick/0005.JPG | Bin 144601 -> 0 bytes docs/howtos/x60t_unbrick/0006.JPG | Bin 153727 -> 0 bytes docs/howtos/x60t_unbrick/0007.JPG | Bin 158552 -> 0 bytes docs/howtos/x60t_unbrick/0008.JPG | Bin 140421 -> 0 bytes docs/howtos/x60t_unbrick/0009.JPG | Bin 109582 -> 0 bytes docs/howtos/x60t_unbrick/0010.JPG | Bin 159827 -> 0 bytes docs/howtos/x60t_unbrick/0011.JPG | Bin 162493 -> 0 bytes docs/howtos/x60tablet_unbrick.html | 219 ---- docs/images/t60_dev/.htaccess | 2 + docs/images/t60_dev/0001.JPG | Bin 0 -> 29286 bytes docs/images/t60_dev/0002.JPG | Bin 0 -> 18438 bytes docs/images/t60_dev/0003.JPG | Bin 0 -> 25880 bytes docs/images/t60_dev/0004.JPG | Bin 0 -> 29980 bytes docs/images/t60_dev/0005.JPG | Bin 0 -> 34349 bytes docs/images/t60_dev/0006.JPG | Bin 0 -> 32029 bytes docs/images/t60_dev/0007.JPG | Bin 0 -> 21920 bytes docs/images/t60_dev/0008.JPG | Bin 0 -> 27410 bytes docs/images/t60_dev/0009.JPG | Bin 0 -> 28007 bytes docs/images/t60_dev/0010.JPG | Bin 0 -> 26159 bytes docs/images/t60_dev/0011.JPG | Bin 0 -> 29595 bytes docs/images/t60_dev/0012.JPG | Bin 0 -> 33949 bytes docs/images/t60_dev/0013.JPG | Bin 0 -> 36311 bytes docs/images/t60_dev/0014.JPG | Bin 0 -> 24707 bytes docs/images/t60_dev/0015.JPG | Bin 0 -> 39588 bytes docs/images/t60_dev/0016.JPG | Bin 0 -> 27100 bytes docs/images/t60_dev/0017.JPG | Bin 0 -> 28726 bytes docs/images/t60_dev/0018.JPG | Bin 0 -> 29222 bytes docs/images/t60_dev/0019.JPG | Bin 0 -> 25665 bytes docs/images/t60_dev/0020.JPG | Bin 0 -> 25546 bytes docs/images/t60_dev/0021.JPG | Bin 0 -> 31706 bytes docs/images/t60_dev/0022.JPG | Bin 0 -> 31204 bytes docs/images/t60_dev/0023.JPG | Bin 0 -> 24873 bytes docs/images/t60_dev/0024.JPG | Bin 0 -> 23202 bytes docs/images/t60_dev/0025.JPG | Bin 0 -> 30328 bytes docs/images/t60_dev/0026.JPG | Bin 0 -> 31226 bytes docs/images/t60_dev/0027.JPG | Bin 0 -> 46231 bytes docs/images/t60_dev/0028.JPG | Bin 0 -> 23612 bytes docs/images/t60_dev/0029.JPG | Bin 0 -> 25268 bytes docs/images/t60_dev/0030.JPG | Bin 0 -> 30434 bytes docs/images/t60_dev/0031.JPG | Bin 0 -> 23611 bytes docs/images/t60_dev/0032.JPG | Bin 0 -> 40278 bytes docs/images/t60_dev/0033.JPG | Bin 0 -> 27035 bytes docs/images/t60_dev/0034.JPG | Bin 0 -> 31013 bytes docs/images/t60_dev/0035.JPG | Bin 0 -> 21980 bytes docs/images/t60_dev/0036.JPG | Bin 0 -> 25031 bytes docs/images/t60_dev/0037.JPG | Bin 0 -> 26085 bytes docs/images/t60_dev/0038.JPG | Bin 0 -> 29137 bytes docs/images/t60_dev/0039.JPG | Bin 0 -> 26270 bytes docs/images/t60_dev/0040.JPG | Bin 0 -> 18541 bytes docs/images/t60_dev/0041.JPG | Bin 0 -> 21721 bytes docs/images/t60_dev/0042.JPG | Bin 0 -> 20235 bytes docs/images/t60_dev/0043.JPG | Bin 0 -> 23633 bytes docs/images/t60_dev/0044.JPG | Bin 0 -> 19500 bytes docs/images/t60_dev/0045.JPG | Bin 0 -> 27856 bytes docs/images/t60_dev/0046.JPG | Bin 0 -> 20677 bytes docs/images/t60_dev/0047.JPG | Bin 0 -> 27700 bytes docs/images/t60_dev/0048.JPG | Bin 0 -> 28463 bytes docs/images/t60_dev/0049.JPG | Bin 0 -> 24666 bytes docs/images/t60_dev/0050.JPG | Bin 0 -> 22518 bytes docs/images/t60_dev/0051.JPG | Bin 0 -> 26041 bytes docs/images/t60_dev/0052.JPG | Bin 0 -> 30542 bytes docs/images/t60_dev/0053.JPG | Bin 0 -> 24306 bytes docs/images/t60_dev/0054.JPG | Bin 0 -> 25897 bytes docs/images/t60_dev/0055.JPG | Bin 0 -> 26165 bytes docs/images/t60_dev/0056.JPG | Bin 0 -> 26494 bytes docs/images/t60_dev/0057.JPG | Bin 0 -> 23831 bytes docs/images/t60_dev/0058.JPG | Bin 0 -> 25265 bytes docs/images/t60_dev/0059.JPG | Bin 0 -> 23332 bytes docs/images/t60_dev/0060.JPG | Bin 0 -> 23005 bytes docs/images/t60_dev/0061.JPG | Bin 0 -> 27218 bytes docs/images/t60_dev/0062.JPG | Bin 0 -> 25952 bytes docs/images/t60_dev/0063.JPG | Bin 0 -> 24230 bytes docs/images/t60_dev/0064.JPG | Bin 0 -> 22184 bytes docs/images/t60_dev/0065.JPG | Bin 0 -> 24711 bytes docs/images/t60_dev/0066.JPG | Bin 0 -> 28270 bytes docs/images/t60_dev/0068.JPG | Bin 0 -> 20900 bytes docs/images/t60_dev/0069.JPG | Bin 0 -> 22345 bytes docs/images/t60_dev/0070.JPG | Bin 0 -> 22149 bytes docs/images/t60_dev/0071.JPG | Bin 0 -> 48759 bytes docs/images/t60_dev/0072.JPG | Bin 0 -> 42778 bytes docs/images/t60_dev/0073.JPG | Bin 0 -> 49383 bytes docs/images/t60_dev/0074.JPG | Bin 0 -> 42206 bytes docs/images/t60_dev/t60_unbrick.jpg | Bin 0 -> 61220 bytes docs/images/x60_heatsink/0000.jpg | Bin 0 -> 53772 bytes docs/images/x60_heatsink/0001.jpg | Bin 0 -> 38997 bytes docs/images/x60_heatsink/0002.jpg | Bin 0 -> 31435 bytes docs/images/x60_heatsink/0003.jpg | Bin 0 -> 29815 bytes docs/images/x60_heatsink/0004.jpg | Bin 0 -> 42084 bytes docs/images/x60_heatsink/0005.jpg | Bin 0 -> 42715 bytes docs/images/x60_heatsink/0006.jpg | Bin 0 -> 33748 bytes docs/images/x60_heatsink/0007.jpg | Bin 0 -> 45537 bytes docs/images/x60_heatsink/0008.jpg | Bin 0 -> 46045 bytes docs/images/x60_heatsink/0009.jpg | Bin 0 -> 34013 bytes docs/images/x60_heatsink/0010.jpg | Bin 0 -> 30985 bytes docs/images/x60_heatsink/0011.jpg | Bin 0 -> 45500 bytes docs/images/x60_heatsink/0012.jpg | Bin 0 -> 39202 bytes docs/images/x60_heatsink/0013.jpg | Bin 0 -> 45481 bytes docs/images/x60_heatsink/0014.jpg | Bin 0 -> 40388 bytes docs/images/x60_heatsink/0015.jpg | Bin 0 -> 38045 bytes docs/images/x60_heatsink/0016.jpg | Bin 0 -> 125147 bytes docs/images/x60_heatsink/0017.jpg | Bin 0 -> 143009 bytes docs/images/x60_heatsink/0018.jpg | Bin 0 -> 175369 bytes docs/images/x60_lcd_change/0001.JPG | Bin 0 -> 80828 bytes docs/images/x60_lcd_change/0002.JPG | Bin 0 -> 72986 bytes docs/images/x60_lcd_change/0003.JPG | Bin 0 -> 81777 bytes docs/images/x60_lcd_change/0004.JPG | Bin 0 -> 87164 bytes docs/images/x60_lcd_change/0005.JPG | Bin 0 -> 66652 bytes docs/images/x60_lcd_change/0006.JPG | Bin 0 -> 57127 bytes docs/images/x60_lcd_change/0007.JPG | Bin 0 -> 31729 bytes docs/images/x60_security/0000.jpg | Bin 0 -> 53772 bytes docs/images/x60_security/0000_bluetooth.jpg | Bin 0 -> 120337 bytes docs/images/x60_security/0000_bluetooth0.jpg | Bin 0 -> 19558 bytes docs/images/x60_security/0000_simcard0.jpg | Bin 0 -> 105696 bytes docs/images/x60_security/0000_simcard1.jpg | Bin 0 -> 129884 bytes docs/images/x60_security/0001.jpg | Bin 0 -> 38997 bytes docs/images/x60_security/0001_microphone.jpg | Bin 0 -> 128637 bytes docs/images/x60_security/0001_modem.jpg | Bin 0 -> 124855 bytes docs/images/x60_security/0001_overview.jpg | Bin 0 -> 200563 bytes docs/images/x60_security/0001_speaker.jpg | Bin 0 -> 121336 bytes docs/images/x60_security/0001_wlan_wwan.jpg | Bin 0 -> 151989 bytes docs/images/x60_security/0002.jpg | Bin 0 -> 31435 bytes docs/images/x60_security/0003.jpg | Bin 0 -> 29815 bytes docs/images/x60_security/0004.jpg | Bin 0 -> 42084 bytes docs/images/x60_unbrick/0000.jpg | Bin 0 -> 53772 bytes docs/images/x60_unbrick/0001.jpg | Bin 0 -> 38997 bytes docs/images/x60_unbrick/0002.jpg | Bin 0 -> 31435 bytes docs/images/x60_unbrick/0003.jpg | Bin 0 -> 29815 bytes docs/images/x60_unbrick/0004.jpg | Bin 0 -> 42084 bytes docs/images/x60_unbrick/0005.jpg | Bin 0 -> 42715 bytes docs/images/x60_unbrick/0006.jpg | Bin 0 -> 33748 bytes docs/images/x60_unbrick/0007.jpg | Bin 0 -> 45537 bytes docs/images/x60_unbrick/0008.jpg | Bin 0 -> 46045 bytes docs/images/x60_unbrick/0009.jpg | Bin 0 -> 34013 bytes docs/images/x60_unbrick/0010.jpg | Bin 0 -> 30985 bytes docs/images/x60_unbrick/0011.jpg | Bin 0 -> 38650 bytes docs/images/x60_unbrick/0012.jpg | Bin 0 -> 39202 bytes docs/images/x60_unbrick/0013.jpg | Bin 0 -> 45481 bytes docs/images/x60_unbrick/0014.jpg | Bin 0 -> 40388 bytes docs/images/x60_unbrick/0015.jpg | Bin 0 -> 38045 bytes docs/images/x60_unbrick/0016.jpg | Bin 0 -> 34554 bytes docs/images/x60_unbrick/0017.jpg | Bin 0 -> 36115 bytes docs/images/x60_unbrick/0019.jpg | Bin 0 -> 39446 bytes docs/images/x60_unbrick/0020.jpg | Bin 0 -> 26069 bytes docs/images/x60_unbrick/0022.jpg | Bin 0 -> 38531 bytes docs/images/x60_unbrick/0024.jpg | Bin 0 -> 32001 bytes docs/images/x60_unbrick/0025.jpg | Bin 0 -> 31621 bytes docs/images/x60_unbrick/0026.jpg | Bin 0 -> 39855 bytes docs/images/x60_unbrick/0027.jpg | Bin 0 -> 37302 bytes docs/images/x60_unbrick/0028.jpg | Bin 0 -> 39501 bytes docs/images/x60_unbrick/0029.jpg | Bin 0 -> 37530 bytes docs/images/x60_unbrick/0030.jpg | Bin 0 -> 43484 bytes docs/images/x60_unbrick/0031.jpg | Bin 0 -> 38022 bytes docs/images/x60_unbrick/0032.jpg | Bin 0 -> 44860 bytes docs/images/x60_unbrick/0033.jpg | Bin 0 -> 30821 bytes docs/images/x60_unbrick/0034.jpg | Bin 0 -> 37249 bytes docs/images/x60_unbrick/0035.jpg | Bin 0 -> 38429 bytes docs/images/x60_unbrick/0036.jpg | Bin 0 -> 41042 bytes docs/images/x60_unbrick/0037.jpg | Bin 0 -> 33911 bytes docs/images/x60_unbrick/0038.jpg | Bin 0 -> 38246 bytes docs/images/x60_unbrick/0039.jpg | Bin 0 -> 45794 bytes docs/images/x60_unbrick/0040.jpg | Bin 0 -> 40020 bytes docs/images/x60_unbrick/0041.jpg | Bin 0 -> 37564 bytes docs/images/x60_unbrick/0042.jpg | Bin 0 -> 35915 bytes docs/images/x60_unbrick/0043.jpg | Bin 0 -> 36692 bytes docs/images/x60_unbrick/0044.jpg | Bin 0 -> 37146 bytes docs/images/x60_unbrick/0045.jpg | Bin 0 -> 39062 bytes docs/images/x60_unbrick/0046.jpg | Bin 0 -> 35431 bytes docs/images/x60_unbrick/0047.jpg | Bin 0 -> 37275 bytes docs/images/x60_unbrick/0048.jpg | Bin 0 -> 39975 bytes docs/images/x60_unbrick/0049.jpg | Bin 0 -> 42058 bytes docs/images/x60t_unbrick/.htaccess | 2 + docs/images/x60t_unbrick/0000.JPG | Bin 0 -> 127355 bytes docs/images/x60t_unbrick/0001.JPG | Bin 0 -> 132522 bytes docs/images/x60t_unbrick/0002.JPG | Bin 0 -> 110933 bytes docs/images/x60t_unbrick/0003.JPG | Bin 0 -> 137253 bytes docs/images/x60t_unbrick/0004.JPG | Bin 0 -> 125196 bytes docs/images/x60t_unbrick/0005.JPG | Bin 0 -> 144601 bytes docs/images/x60t_unbrick/0006.JPG | Bin 0 -> 153727 bytes docs/images/x60t_unbrick/0007.JPG | Bin 0 -> 158552 bytes docs/images/x60t_unbrick/0008.JPG | Bin 0 -> 140421 bytes docs/images/x60t_unbrick/0009.JPG | Bin 0 -> 109582 bytes docs/images/x60t_unbrick/0010.JPG | Bin 0 -> 159827 bytes docs/images/x60t_unbrick/0011.JPG | Bin 0 -> 162493 bytes docs/index.html | 1751 ++------------------------ docs/install/index.html | 405 ++++++ docs/install/t60_unbrick.html | 316 +++++ docs/install/x60_unbrick.html | 301 +++++ docs/install/x60tablet_unbrick.html | 209 +++ docs/misc/index.html | 184 +++ docs/misc/patch.html | 163 +++ docs/patch.html | 168 --- docs/release.html | 34 +- docs/security/dock.html | 154 +++ docs/security/index.html | 40 + docs/security/t60_security.html | 440 +++++++ docs/security/x60_security.html | 301 +++++ 402 files changed, 6672 insertions(+), 6412 deletions(-) create mode 100644 docs/css/main.css create mode 100644 docs/git/index.html create mode 100644 docs/gnulinux/cbfstool_libreboot5_strace create mode 100644 docs/gnulinux/configuring_parabola.html create mode 100644 docs/gnulinux/encrypted_parabola.html create mode 100644 docs/gnulinux/encrypted_trisquel.html create mode 100644 docs/gnulinux/grub_boot_installer.html create mode 100644 docs/gnulinux/grub_cbfs.html create mode 100644 docs/gnulinux/index.html create mode 100644 docs/grub/index.html create mode 100644 docs/hardware/index.html create mode 100644 docs/hardware/t60_heatsink.html create mode 100644 docs/hardware/t60_lcd_15.html create mode 100644 docs/hardware/x60_heatsink.html create mode 100644 docs/hardware/x60_lcd_change.html create mode 100644 docs/hcl/index.html delete mode 100644 docs/howtos/cbfstool_libreboot5_strace delete mode 100644 docs/howtos/configuring_parabola.html delete mode 100644 docs/howtos/dock.html delete mode 100644 docs/howtos/encrypted_parabola.html delete mode 100644 docs/howtos/encrypted_trisquel.html delete mode 100644 docs/howtos/grub_boot_installer.html delete mode 100644 docs/howtos/grub_cbfs.html delete mode 100644 docs/howtos/t60_dev/.htaccess delete mode 100644 docs/howtos/t60_dev/0001.JPG delete mode 100644 docs/howtos/t60_dev/0002.JPG delete mode 100644 docs/howtos/t60_dev/0003.JPG delete mode 100644 docs/howtos/t60_dev/0004.JPG delete mode 100644 docs/howtos/t60_dev/0005.JPG delete mode 100644 docs/howtos/t60_dev/0006.JPG delete mode 100644 docs/howtos/t60_dev/0007.JPG delete mode 100644 docs/howtos/t60_dev/0008.JPG delete mode 100644 docs/howtos/t60_dev/0009.JPG delete mode 100644 docs/howtos/t60_dev/0010.JPG delete mode 100644 docs/howtos/t60_dev/0011.JPG delete mode 100644 docs/howtos/t60_dev/0012.JPG delete mode 100644 docs/howtos/t60_dev/0013.JPG delete mode 100644 docs/howtos/t60_dev/0014.JPG delete mode 100644 docs/howtos/t60_dev/0015.JPG delete mode 100644 docs/howtos/t60_dev/0016.JPG delete mode 100644 docs/howtos/t60_dev/0017.JPG delete mode 100644 docs/howtos/t60_dev/0018.JPG delete mode 100644 docs/howtos/t60_dev/0019.JPG delete mode 100644 docs/howtos/t60_dev/0020.JPG delete mode 100644 docs/howtos/t60_dev/0021.JPG delete mode 100644 docs/howtos/t60_dev/0022.JPG delete mode 100644 docs/howtos/t60_dev/0023.JPG delete mode 100644 docs/howtos/t60_dev/0024.JPG delete mode 100644 docs/howtos/t60_dev/0025.JPG delete mode 100644 docs/howtos/t60_dev/0026.JPG delete mode 100644 docs/howtos/t60_dev/0027.JPG delete mode 100644 docs/howtos/t60_dev/0028.JPG delete mode 100644 docs/howtos/t60_dev/0029.JPG delete mode 100644 docs/howtos/t60_dev/0030.JPG delete mode 100644 docs/howtos/t60_dev/0031.JPG delete mode 100644 docs/howtos/t60_dev/0032.JPG delete mode 100644 docs/howtos/t60_dev/0033.JPG delete mode 100644 docs/howtos/t60_dev/0034.JPG delete mode 100644 docs/howtos/t60_dev/0035.JPG delete mode 100644 docs/howtos/t60_dev/0036.JPG delete mode 100644 docs/howtos/t60_dev/0037.JPG delete mode 100644 docs/howtos/t60_dev/0038.JPG delete mode 100644 docs/howtos/t60_dev/0039.JPG delete mode 100644 docs/howtos/t60_dev/0040.JPG delete mode 100644 docs/howtos/t60_dev/0041.JPG delete mode 100644 docs/howtos/t60_dev/0042.JPG delete mode 100644 docs/howtos/t60_dev/0043.JPG delete mode 100644 docs/howtos/t60_dev/0044.JPG delete mode 100644 docs/howtos/t60_dev/0045.JPG delete mode 100644 docs/howtos/t60_dev/0046.JPG delete mode 100644 docs/howtos/t60_dev/0047.JPG delete mode 100644 docs/howtos/t60_dev/0048.JPG delete mode 100644 docs/howtos/t60_dev/0049.JPG delete mode 100644 docs/howtos/t60_dev/0050.JPG delete mode 100644 docs/howtos/t60_dev/0051.JPG delete mode 100644 docs/howtos/t60_dev/0052.JPG delete mode 100644 docs/howtos/t60_dev/0053.JPG delete mode 100644 docs/howtos/t60_dev/0054.JPG delete mode 100644 docs/howtos/t60_dev/0055.JPG delete mode 100644 docs/howtos/t60_dev/0056.JPG delete mode 100644 docs/howtos/t60_dev/0057.JPG delete mode 100644 docs/howtos/t60_dev/0058.JPG delete mode 100644 docs/howtos/t60_dev/0059.JPG delete mode 100644 docs/howtos/t60_dev/0060.JPG delete mode 100644 docs/howtos/t60_dev/0061.JPG delete mode 100644 docs/howtos/t60_dev/0062.JPG delete mode 100644 docs/howtos/t60_dev/0063.JPG delete mode 100644 docs/howtos/t60_dev/0064.JPG delete mode 100644 docs/howtos/t60_dev/0065.JPG delete mode 100644 docs/howtos/t60_dev/0066.JPG delete mode 100644 docs/howtos/t60_dev/0068.JPG delete mode 100644 docs/howtos/t60_dev/0069.JPG delete mode 100644 docs/howtos/t60_dev/0070.JPG delete mode 100644 docs/howtos/t60_dev/0071.JPG delete mode 100644 docs/howtos/t60_dev/0072.JPG delete mode 100644 docs/howtos/t60_dev/0073.JPG delete mode 100644 docs/howtos/t60_dev/0074.JPG delete mode 100644 docs/howtos/t60_dev/t60_unbrick.jpg delete mode 100644 docs/howtos/t60_heatsink.html delete mode 100644 docs/howtos/t60_lcd_15.html delete mode 100644 docs/howtos/t60_security.html delete mode 100644 docs/howtos/t60_unbrick.html delete mode 100644 docs/howtos/x60_heatsink.html delete mode 100644 docs/howtos/x60_heatsink/0000.jpg delete mode 100644 docs/howtos/x60_heatsink/0001.jpg delete mode 100644 docs/howtos/x60_heatsink/0002.jpg delete mode 100644 docs/howtos/x60_heatsink/0003.jpg delete mode 100644 docs/howtos/x60_heatsink/0004.jpg delete mode 100644 docs/howtos/x60_heatsink/0005.jpg delete mode 100644 docs/howtos/x60_heatsink/0006.jpg delete mode 100644 docs/howtos/x60_heatsink/0007.jpg delete mode 100644 docs/howtos/x60_heatsink/0008.jpg delete mode 100644 docs/howtos/x60_heatsink/0009.jpg delete mode 100644 docs/howtos/x60_heatsink/0010.jpg delete mode 100644 docs/howtos/x60_heatsink/0011.jpg delete mode 100644 docs/howtos/x60_heatsink/0012.jpg delete mode 100644 docs/howtos/x60_heatsink/0013.jpg delete mode 100644 docs/howtos/x60_heatsink/0014.jpg delete mode 100644 docs/howtos/x60_heatsink/0015.jpg delete mode 100644 docs/howtos/x60_heatsink/0016.jpg delete mode 100644 docs/howtos/x60_heatsink/0017.jpg delete mode 100644 docs/howtos/x60_heatsink/0018.jpg delete mode 100644 docs/howtos/x60_lcd_change.html delete mode 100755 docs/howtos/x60_lcd_change/0001.JPG delete mode 100755 docs/howtos/x60_lcd_change/0002.JPG delete mode 100755 docs/howtos/x60_lcd_change/0003.JPG delete mode 100755 docs/howtos/x60_lcd_change/0004.JPG delete mode 100755 docs/howtos/x60_lcd_change/0005.JPG delete mode 100755 docs/howtos/x60_lcd_change/0006.JPG delete mode 100755 docs/howtos/x60_lcd_change/0007.JPG delete mode 100644 docs/howtos/x60_security.html delete mode 100644 docs/howtos/x60_security/0000.jpg delete mode 100644 docs/howtos/x60_security/0000_bluetooth.jpg delete mode 100644 docs/howtos/x60_security/0000_bluetooth0.jpg delete mode 100644 docs/howtos/x60_security/0000_simcard0.jpg delete mode 100644 docs/howtos/x60_security/0000_simcard1.jpg delete mode 100644 docs/howtos/x60_security/0001.jpg delete mode 100644 docs/howtos/x60_security/0001_microphone.jpg delete mode 100644 docs/howtos/x60_security/0001_modem.jpg delete mode 100644 docs/howtos/x60_security/0001_overview.jpg delete mode 100644 docs/howtos/x60_security/0001_speaker.jpg delete mode 100644 docs/howtos/x60_security/0001_wlan_wwan.jpg delete mode 100644 docs/howtos/x60_security/0002.jpg delete mode 100644 docs/howtos/x60_security/0003.jpg delete mode 100644 docs/howtos/x60_security/0004.jpg delete mode 100644 docs/howtos/x60_unbrick.html delete mode 100644 docs/howtos/x60_unbrick/0000.jpg delete mode 100644 docs/howtos/x60_unbrick/0001.jpg delete mode 100644 docs/howtos/x60_unbrick/0002.jpg delete mode 100644 docs/howtos/x60_unbrick/0003.jpg delete mode 100644 docs/howtos/x60_unbrick/0004.jpg delete mode 100644 docs/howtos/x60_unbrick/0005.jpg delete mode 100644 docs/howtos/x60_unbrick/0006.jpg delete mode 100644 docs/howtos/x60_unbrick/0007.jpg delete mode 100644 docs/howtos/x60_unbrick/0008.jpg delete mode 100644 docs/howtos/x60_unbrick/0009.jpg delete mode 100644 docs/howtos/x60_unbrick/0010.jpg delete mode 100644 docs/howtos/x60_unbrick/0011.jpg delete mode 100644 docs/howtos/x60_unbrick/0012.jpg delete mode 100644 docs/howtos/x60_unbrick/0013.jpg delete mode 100644 docs/howtos/x60_unbrick/0014.jpg delete mode 100644 docs/howtos/x60_unbrick/0015.jpg delete mode 100644 docs/howtos/x60_unbrick/0016.jpg delete mode 100644 docs/howtos/x60_unbrick/0017.jpg delete mode 100644 docs/howtos/x60_unbrick/0018.jpg delete mode 100644 docs/howtos/x60_unbrick/0019.jpg delete mode 100644 docs/howtos/x60_unbrick/0020.jpg delete mode 100644 docs/howtos/x60_unbrick/0021.jpg delete mode 100644 docs/howtos/x60_unbrick/0022.jpg delete mode 100644 docs/howtos/x60_unbrick/0023.jpg delete mode 100644 docs/howtos/x60_unbrick/0024.jpg delete mode 100644 docs/howtos/x60_unbrick/0025.jpg delete mode 100644 docs/howtos/x60_unbrick/0026.jpg delete mode 100644 docs/howtos/x60_unbrick/0027.jpg delete mode 100644 docs/howtos/x60_unbrick/0028.jpg delete mode 100644 docs/howtos/x60_unbrick/0029.jpg delete mode 100644 docs/howtos/x60_unbrick/0030.jpg delete mode 100644 docs/howtos/x60_unbrick/0031.jpg delete mode 100644 docs/howtos/x60_unbrick/0032.jpg delete mode 100644 docs/howtos/x60_unbrick/0033.jpg delete mode 100644 docs/howtos/x60_unbrick/0034.jpg delete mode 100644 docs/howtos/x60_unbrick/0035.jpg delete mode 100644 docs/howtos/x60_unbrick/0036.jpg delete mode 100644 docs/howtos/x60_unbrick/0037.jpg delete mode 100644 docs/howtos/x60_unbrick/0038.jpg delete mode 100644 docs/howtos/x60_unbrick/0039.jpg delete mode 100644 docs/howtos/x60_unbrick/0040.jpg delete mode 100644 docs/howtos/x60_unbrick/0041.jpg delete mode 100644 docs/howtos/x60_unbrick/0042.jpg delete mode 100644 docs/howtos/x60_unbrick/0043.jpg delete mode 100644 docs/howtos/x60_unbrick/0044.jpg delete mode 100644 docs/howtos/x60_unbrick/0045.jpg delete mode 100644 docs/howtos/x60_unbrick/0046.jpg delete mode 100644 docs/howtos/x60_unbrick/0047.jpg delete mode 100644 docs/howtos/x60_unbrick/0048.jpg delete mode 100644 docs/howtos/x60_unbrick/0049.jpg delete mode 100644 docs/howtos/x60t_unbrick/.htaccess delete mode 100644 docs/howtos/x60t_unbrick/0000.JPG delete mode 100644 docs/howtos/x60t_unbrick/0001.JPG delete mode 100644 docs/howtos/x60t_unbrick/0002.JPG delete mode 100644 docs/howtos/x60t_unbrick/0003.JPG delete mode 100644 docs/howtos/x60t_unbrick/0004.JPG delete mode 100644 docs/howtos/x60t_unbrick/0005.JPG delete mode 100644 docs/howtos/x60t_unbrick/0006.JPG delete mode 100644 docs/howtos/x60t_unbrick/0007.JPG delete mode 100644 docs/howtos/x60t_unbrick/0008.JPG delete mode 100644 docs/howtos/x60t_unbrick/0009.JPG delete mode 100644 docs/howtos/x60t_unbrick/0010.JPG delete mode 100644 docs/howtos/x60t_unbrick/0011.JPG delete mode 100644 docs/howtos/x60tablet_unbrick.html create mode 100644 docs/images/t60_dev/.htaccess create mode 100644 docs/images/t60_dev/0001.JPG create mode 100644 docs/images/t60_dev/0002.JPG create mode 100644 docs/images/t60_dev/0003.JPG create mode 100644 docs/images/t60_dev/0004.JPG create mode 100644 docs/images/t60_dev/0005.JPG create mode 100644 docs/images/t60_dev/0006.JPG create mode 100644 docs/images/t60_dev/0007.JPG create mode 100644 docs/images/t60_dev/0008.JPG create mode 100644 docs/images/t60_dev/0009.JPG create mode 100644 docs/images/t60_dev/0010.JPG create mode 100644 docs/images/t60_dev/0011.JPG create mode 100644 docs/images/t60_dev/0012.JPG create mode 100644 docs/images/t60_dev/0013.JPG create mode 100644 docs/images/t60_dev/0014.JPG create mode 100644 docs/images/t60_dev/0015.JPG create mode 100644 docs/images/t60_dev/0016.JPG create mode 100644 docs/images/t60_dev/0017.JPG create mode 100644 docs/images/t60_dev/0018.JPG create mode 100644 docs/images/t60_dev/0019.JPG create mode 100644 docs/images/t60_dev/0020.JPG create mode 100644 docs/images/t60_dev/0021.JPG create mode 100644 docs/images/t60_dev/0022.JPG create mode 100644 docs/images/t60_dev/0023.JPG create mode 100644 docs/images/t60_dev/0024.JPG create mode 100644 docs/images/t60_dev/0025.JPG create mode 100644 docs/images/t60_dev/0026.JPG create mode 100644 docs/images/t60_dev/0027.JPG create mode 100644 docs/images/t60_dev/0028.JPG create mode 100644 docs/images/t60_dev/0029.JPG create mode 100644 docs/images/t60_dev/0030.JPG create mode 100644 docs/images/t60_dev/0031.JPG create mode 100644 docs/images/t60_dev/0032.JPG create mode 100644 docs/images/t60_dev/0033.JPG create mode 100644 docs/images/t60_dev/0034.JPG create mode 100644 docs/images/t60_dev/0035.JPG create mode 100644 docs/images/t60_dev/0036.JPG create mode 100644 docs/images/t60_dev/0037.JPG create mode 100644 docs/images/t60_dev/0038.JPG create mode 100644 docs/images/t60_dev/0039.JPG create mode 100644 docs/images/t60_dev/0040.JPG create mode 100644 docs/images/t60_dev/0041.JPG create mode 100644 docs/images/t60_dev/0042.JPG create mode 100644 docs/images/t60_dev/0043.JPG create mode 100644 docs/images/t60_dev/0044.JPG create mode 100644 docs/images/t60_dev/0045.JPG create mode 100644 docs/images/t60_dev/0046.JPG create mode 100644 docs/images/t60_dev/0047.JPG create mode 100644 docs/images/t60_dev/0048.JPG create mode 100644 docs/images/t60_dev/0049.JPG create mode 100644 docs/images/t60_dev/0050.JPG create mode 100644 docs/images/t60_dev/0051.JPG create mode 100644 docs/images/t60_dev/0052.JPG create mode 100644 docs/images/t60_dev/0053.JPG create mode 100644 docs/images/t60_dev/0054.JPG create mode 100644 docs/images/t60_dev/0055.JPG create mode 100644 docs/images/t60_dev/0056.JPG create mode 100644 docs/images/t60_dev/0057.JPG create mode 100644 docs/images/t60_dev/0058.JPG create mode 100644 docs/images/t60_dev/0059.JPG create mode 100644 docs/images/t60_dev/0060.JPG create mode 100644 docs/images/t60_dev/0061.JPG create mode 100644 docs/images/t60_dev/0062.JPG create mode 100644 docs/images/t60_dev/0063.JPG create mode 100644 docs/images/t60_dev/0064.JPG create mode 100644 docs/images/t60_dev/0065.JPG create mode 100644 docs/images/t60_dev/0066.JPG create mode 100644 docs/images/t60_dev/0068.JPG create mode 100644 docs/images/t60_dev/0069.JPG create mode 100644 docs/images/t60_dev/0070.JPG create mode 100644 docs/images/t60_dev/0071.JPG create mode 100644 docs/images/t60_dev/0072.JPG create mode 100644 docs/images/t60_dev/0073.JPG create mode 100644 docs/images/t60_dev/0074.JPG create mode 100644 docs/images/t60_dev/t60_unbrick.jpg create mode 100644 docs/images/x60_heatsink/0000.jpg create mode 100644 docs/images/x60_heatsink/0001.jpg create mode 100644 docs/images/x60_heatsink/0002.jpg create mode 100644 docs/images/x60_heatsink/0003.jpg create mode 100644 docs/images/x60_heatsink/0004.jpg create mode 100644 docs/images/x60_heatsink/0005.jpg create mode 100644 docs/images/x60_heatsink/0006.jpg create mode 100644 docs/images/x60_heatsink/0007.jpg create mode 100644 docs/images/x60_heatsink/0008.jpg create mode 100644 docs/images/x60_heatsink/0009.jpg create mode 100644 docs/images/x60_heatsink/0010.jpg create mode 100644 docs/images/x60_heatsink/0011.jpg create mode 100644 docs/images/x60_heatsink/0012.jpg create mode 100644 docs/images/x60_heatsink/0013.jpg create mode 100644 docs/images/x60_heatsink/0014.jpg create mode 100644 docs/images/x60_heatsink/0015.jpg create mode 100644 docs/images/x60_heatsink/0016.jpg create mode 100644 docs/images/x60_heatsink/0017.jpg create mode 100644 docs/images/x60_heatsink/0018.jpg create mode 100755 docs/images/x60_lcd_change/0001.JPG create mode 100755 docs/images/x60_lcd_change/0002.JPG create mode 100755 docs/images/x60_lcd_change/0003.JPG create mode 100755 docs/images/x60_lcd_change/0004.JPG create mode 100755 docs/images/x60_lcd_change/0005.JPG create mode 100755 docs/images/x60_lcd_change/0006.JPG create mode 100755 docs/images/x60_lcd_change/0007.JPG create mode 100644 docs/images/x60_security/0000.jpg create mode 100644 docs/images/x60_security/0000_bluetooth.jpg create mode 100644 docs/images/x60_security/0000_bluetooth0.jpg create mode 100644 docs/images/x60_security/0000_simcard0.jpg create mode 100644 docs/images/x60_security/0000_simcard1.jpg create mode 100644 docs/images/x60_security/0001.jpg create mode 100644 docs/images/x60_security/0001_microphone.jpg create mode 100644 docs/images/x60_security/0001_modem.jpg create mode 100644 docs/images/x60_security/0001_overview.jpg create mode 100644 docs/images/x60_security/0001_speaker.jpg create mode 100644 docs/images/x60_security/0001_wlan_wwan.jpg create mode 100644 docs/images/x60_security/0002.jpg create mode 100644 docs/images/x60_security/0003.jpg create mode 100644 docs/images/x60_security/0004.jpg create mode 100644 docs/images/x60_unbrick/0000.jpg create mode 100644 docs/images/x60_unbrick/0001.jpg create mode 100644 docs/images/x60_unbrick/0002.jpg create mode 100644 docs/images/x60_unbrick/0003.jpg create mode 100644 docs/images/x60_unbrick/0004.jpg create mode 100644 docs/images/x60_unbrick/0005.jpg create mode 100644 docs/images/x60_unbrick/0006.jpg create mode 100644 docs/images/x60_unbrick/0007.jpg create mode 100644 docs/images/x60_unbrick/0008.jpg create mode 100644 docs/images/x60_unbrick/0009.jpg create mode 100644 docs/images/x60_unbrick/0010.jpg create mode 100644 docs/images/x60_unbrick/0011.jpg create mode 100644 docs/images/x60_unbrick/0012.jpg create mode 100644 docs/images/x60_unbrick/0013.jpg create mode 100644 docs/images/x60_unbrick/0014.jpg create mode 100644 docs/images/x60_unbrick/0015.jpg create mode 100644 docs/images/x60_unbrick/0016.jpg create mode 100644 docs/images/x60_unbrick/0017.jpg create mode 100644 docs/images/x60_unbrick/0019.jpg create mode 100644 docs/images/x60_unbrick/0020.jpg create mode 100644 docs/images/x60_unbrick/0022.jpg create mode 100644 docs/images/x60_unbrick/0024.jpg create mode 100644 docs/images/x60_unbrick/0025.jpg create mode 100644 docs/images/x60_unbrick/0026.jpg create mode 100644 docs/images/x60_unbrick/0027.jpg create mode 100644 docs/images/x60_unbrick/0028.jpg create mode 100644 docs/images/x60_unbrick/0029.jpg create mode 100644 docs/images/x60_unbrick/0030.jpg create mode 100644 docs/images/x60_unbrick/0031.jpg create mode 100644 docs/images/x60_unbrick/0032.jpg create mode 100644 docs/images/x60_unbrick/0033.jpg create mode 100644 docs/images/x60_unbrick/0034.jpg create mode 100644 docs/images/x60_unbrick/0035.jpg create mode 100644 docs/images/x60_unbrick/0036.jpg create mode 100644 docs/images/x60_unbrick/0037.jpg create mode 100644 docs/images/x60_unbrick/0038.jpg create mode 100644 docs/images/x60_unbrick/0039.jpg create mode 100644 docs/images/x60_unbrick/0040.jpg create mode 100644 docs/images/x60_unbrick/0041.jpg create mode 100644 docs/images/x60_unbrick/0042.jpg create mode 100644 docs/images/x60_unbrick/0043.jpg create mode 100644 docs/images/x60_unbrick/0044.jpg create mode 100644 docs/images/x60_unbrick/0045.jpg create mode 100644 docs/images/x60_unbrick/0046.jpg create mode 100644 docs/images/x60_unbrick/0047.jpg create mode 100644 docs/images/x60_unbrick/0048.jpg create mode 100644 docs/images/x60_unbrick/0049.jpg create mode 100644 docs/images/x60t_unbrick/.htaccess create mode 100644 docs/images/x60t_unbrick/0000.JPG create mode 100644 docs/images/x60t_unbrick/0001.JPG create mode 100644 docs/images/x60t_unbrick/0002.JPG create mode 100644 docs/images/x60t_unbrick/0003.JPG create mode 100644 docs/images/x60t_unbrick/0004.JPG create mode 100644 docs/images/x60t_unbrick/0005.JPG create mode 100644 docs/images/x60t_unbrick/0006.JPG create mode 100644 docs/images/x60t_unbrick/0007.JPG create mode 100644 docs/images/x60t_unbrick/0008.JPG create mode 100644 docs/images/x60t_unbrick/0009.JPG create mode 100644 docs/images/x60t_unbrick/0010.JPG create mode 100644 docs/images/x60t_unbrick/0011.JPG create mode 100644 docs/install/index.html create mode 100644 docs/install/t60_unbrick.html create mode 100644 docs/install/x60_unbrick.html create mode 100644 docs/install/x60tablet_unbrick.html create mode 100644 docs/misc/index.html create mode 100644 docs/misc/patch.html delete mode 100644 docs/patch.html create mode 100644 docs/security/dock.html create mode 100644 docs/security/index.html create mode 100644 docs/security/t60_security.html create mode 100644 docs/security/x60_security.html diff --git a/docs/archive_old.html b/docs/archive_old.html index 9ceb6c3..1b28817 100644 --- a/docs/archive_old.html +++ b/docs/archive_old.html @@ -5,21 +5,7 @@ Libreboot release information (old) @@ -27,7 +13,7 @@

Libreboot release information (old)

- +
@@ -51,12 +37,12 @@

Releases

"Release" means that a new coreboot git revision with substantially different code has been adapted for libreboot. @@ -110,29 +96,28 @@

  • Lenovo ThinkPad X60 Tablet (1024x768 and 1400x1050) with digitizer support
  • - Lenovo ThinkPad T60 (Intel GPU) (there are issues; see below) + Lenovo ThinkPad T60 (Intel GPU) (there are issues; see below)
  • Apple MacBook1,1 (MA255LL/A, MA254LL/A, MA472LL/A)
  • Apple MacBook2,1 (MA699LL/A, MA701LL/A, MB061LL/A, MA700LL/A, MB063LL/A, MB062LL/A)
  • @@ -168,9 +153,9 @@
  • Added modified builddeb* scripts for Parabola GNU/Linux-libre: buildpac, buildpac-flashrom, buildpac-bucts (courtesy of Noah Vesely)
  • Documentation: updated all relevant areas to mention use of buildpac* scripts for Parabola users.
  • Documentation: added information showing how to enable or disable bluetooth on the X60
  • -
  • MacBook1,1 tested! See index.html#macbook11"
  • +
  • MacBook1,1 tested! See hcl/index.html#macbook11
  • Documentation: fixed typo in index.html#get_edid_panelname (get-edit changed to get-edid)
  • -
  • Documentation: added howtos/x60_lcd_change/ (pics only for now)
  • +
  • Documentation: added images/x60_lcd_change/ (pics only for now)
  • Added gcry_serpent and gcry_whirlpool to the GRUB module list in the 'build' script (for luks users)
  • Libreboot is now based on a new coreboot version from August 23rd, 2014:
    @@ -274,7 +259,7 @@
  • Documentation: removed all parts talking about build dependencies, replaced them with links to index.html#build_dependencies
  • Documentation: emphasized more strongly on the documentation, the need to re-build bucts and/or flashrom before flashing a ROM image.
  • build-release: flashrom, nvramtool, cbfstool and bucts are no longer provided pre-compiled in binary archives, and are now in source form only. (to maximize distro compatibility).
  • -
  • Documentation: added howtos/encrypted_trisquel.html showing how to setup a fully encrypted Trisquel installation (including /boot) and boot it from the GRUB payload.
  • +
  • Documentation: added gnulinux/encrypted_trisquel.html showing how to setup a fully encrypted Trisquel installation (including /boot) and boot it from the GRUB payload.
  • 'build' script: replaced grub.elf assembly instructons, it's now handled by a utility added under resources/utilities/grub-assemble
  • Moved resources/grub/keymap to resources/utilities/grub-assemble/keymap, and updated that utility to use it
  • Documentation: removed useless links to pictures of keyboard layouts and unmodified layouts.
  • @@ -308,10 +293,10 @@
  • Documentation: added note about 'fb=false' workaround for text-mode debian-installer (Trisquel net install) to - howtos/grub_boot_installer.html + gnulinux/grub_boot_installer.html
  • - Documentation: updated howtos/grub_cbfs.html to make it safer (and easier) to follow. + Documentation: updated gnulinux/grub_cbfs.html to make it safer (and easier) to follow.
  • @@ -330,11 +315,11 @@
  • build: added 'luks', 'lvm', 'cmosdump' and 'cmostest' to the list of modules for grub.elf
  • Documentation: added pics showing T60 unbricking (still need to write a tutorial)
  • build: include cmos.layout (coreboot/src/mainboard/manufacturer/model/cmos.layout) files in libreboot_bin
  • -
  • Documentation: added howtos/x60tablet_unbrick.html
  • -
  • Documentation: added howtos/t60_unbrick.html
  • -
  • Documentation: added howtos/t60_lcd_15.html
  • -
  • Documentation: added howtos/t60_security.html
  • -
  • Documentation: added howtos/t60_heatsink.html
  • +
  • Documentation: added install/x60tablet_unbrick.html
  • +
  • Documentation: added install/t60_unbrick.html
  • +
  • Documentation: added install/t60_lcd_15.html
  • +
  • Documentation: added install/t60_security.html
  • +
  • Documentation: added install/t60_heatsink.html
  • Documentation: Renamed RELEASE.html to release.html
  • Documentation: removed pcmcia reference in x60_security.html (it's cardbus)
  • Documentation: added preliminary information about randomized seal (for physical intrusion detection) in x60_security.html and t60_security.html
  • @@ -358,7 +343,7 @@ Revisions for 4th beta (2014 July 29th)
      -
    • Documentation: improved (more explanations, background info) in docs/howtos/x60_security.html (courtesy of Denis Carikli)
    • +
    • Documentation: improved (more explanations, background info) in docs/security/x60_security.html (courtesy of Denis Carikli)
    • MacBook2,1 tested (confirmed)
    • macbook21: Added script 'macbook21_firstflash' for flashing libreboot while Apple EFI firmware is running.
    • Documentation: macbook21: added software-based flashing instructions for flashing libreboot while Apple EFI firmware is running.
    • @@ -398,7 +383,7 @@ Documentation: added (preliminary) details about (rare) buggy CPU's on the ThinkPad T60 that were found to fail (instability, kernel panics, etc) without the microcode updates. -
    • Documentation: added docs/howtos/x60_heatsink.html for showing how to change the heatsink on the Thinkpad X60
    • +
    • Documentation: added docs/hardware/x60_heatsink.html for showing how to change the heatsink on the Thinkpad X60
    • Added ROM images for Azerty (French) keyboard layout in GRUB (courtesy of Olivier Mondoloni)
    • Tidied up some scripts: @@ -428,7 +413,7 @@
  • - Documentation: added docs/howtos/x60_security.html (security hardening for X60) + Documentation: added docs/security/x60_security.html (security hardening for X60)
  • @@ -599,7 +584,7 @@
  • Documentation: added notes about cbfstool (standalone) in libreboot_bin
  • -
  • Documentation: made docs/howtos/grub_cbfs.html slightly easier to follow.
  • +
  • Documentation: made docs/gnulinux/grub_cbfs.html slightly easier to follow.
  • Annotate the 'build*' scripts with 'echo' commands, to help the user understand what it actually happening during the build process.
  • Documentation: added information about how 'dmidecode' data was put in the coreboot configs @@ -680,7 +665,8 @@
  • sha512: a773462fd60b529f20e14a82281f962985579bd523c3e6c9ab8639f7a12da8f1ccb44a56c648b19de914a15d4490366222d0bbc80552e91419f2afecbddc10ae
  • - (gluglug.org.uk/X60/release/4/X60_source.tar.gz and gluglug.org.uk/X60/release/4/X60_binary.tar.gz were the old links) + (gluglug.org.uk/X60/release/4/X60_source.tar.gz and gluglug.org.uk/X60/release/4/X60_binary.tar.gz were the old links, + but they no longer exist)

    Development notes

    @@ -810,12 +796,12 @@

    Binaries (for flashing)

    Source code (for hacking)

    Development notes

    @@ -870,12 +856,12 @@

    Binaries (for flashing)

    Source code (for hacking)

    Development notes

    @@ -902,12 +888,12 @@

    Binaries (for flashing)

    Source code (for hacking)

    Development notes

    @@ -936,12 +922,12 @@

    Binaries (for flashing)

    Source code (for hacking)

    Development notes

    diff --git a/docs/css/main.css b/docs/css/main.css new file mode 100644 index 0000000..11a0773 --- /dev/null +++ b/docs/css/main.css @@ -0,0 +1,46 @@ +/* + + Main CSS stylesheet for libreboot.org (documentation section) + + Copyright (C) 2014 Francis Rowe + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +body { + background:#fff; + color:#000; + font-family:100% sans-serif; + font-size:0.875em; +} +p, aside { + margin: 0.33em 0px 0.6em; +} +h1,h2,h3 { + margin-bottom:0.2em; + margin-top:0.2em; +} +img { + max-width:100%; + height:auto; +} +p.lenovobios { + font-weight:bold; color:#f00; font-style:italic; font-size:1.2em; +} +p.lenovobios:hover { + color: #000; +} +div.important, pre { + background-color:#ccc; +} diff --git a/docs/future/dumps/kernel312_irc b/docs/future/dumps/kernel312_irc index c04a00c..3089642 100644 --- a/docs/future/dumps/kernel312_irc +++ b/docs/future/dumps/kernel312_irc @@ -38,7 +38,7 @@ Back then we had no idea that GTT address was incorrect, and we had no idea what Note: see this fix for the initial fix that was found. not working yet -http://review.coreboot.org/#/c/5885/ +http://review.coreboot.org/#/c/5885/ untested. will test this. checkout 5320. cherry pick 5345 on top. @@ -131,13 +131,13 @@ http://lists.freedesktop.org/archives/intel-gfx/2014-May/046310.html
     Note: see this fix for the initial fix that was found.
     
    -see: http://www.coreboot.org/Board:lenovo/x60#Problems_in_native_graphics_code_exposed_by_recent_kernels
    -see: http://www.coreboot.org/Lenovo_x60x_vgainit_todos
    +see: http://www.coreboot.org/Board:lenovo/x60#Problems_in_native_graphics_code_exposed_by_recent_kernels
    +see: http://www.coreboot.org/Lenovo_x60x_vgainit_todos
     
     Non-coreboot (not even i945) platforms also have issues with 3.12+
    -see: https://bugs.freedesktop.org/show_bug.cgi?id=76520
    +see: https://bugs.freedesktop.org/show_bug.cgi?id=76520
     
    -Is this relevant?: http://lists.freedesktop.org/archives/intel-gfx/2014-February/040771.html
    +Is this relevant?: http://lists.freedesktop.org/archives/intel-gfx/2014-February/040771.html
     
     
     
    @@ -244,7 +244,7 @@ fchmmr: samnob we think it might be classed under linux "no regression" policy
     fchmmr: PaulePanter's idea
     samnob: can't hurt to try :)
     
    -Here is the debugging results then: coreboot_native_3.12_bug.tar.gz
    +Here is the debugging results then: coreboot_native_3.12_bug.tar.gz
     
     ---
     
    diff --git a/docs/future/index.html b/docs/future/index.html
    index 52f1ec8..5b86139 100644
    --- a/docs/future/index.html
    +++ b/docs/future/index.html
    @@ -5,13 +5,7 @@
     	libreboot tutorials
     
     	
     
     	
    @@ -28,7 +22,7 @@
     	
     
     	

    - Or go back to main document index. + Or go back to main document index.


    @@ -131,7 +125,7 @@

    LCD panels on i945 - fix incompatible panels

    - Fix T60 issues (see incompatible panels listed at ../index.html#supported_t60_list). + Fix T60 issues (see incompatible panels listed at ../hcl/index.html#supported_t60_list).

    @@ -304,7 +298,7 @@

    Here is an example of how VBT was implemented on the ThinkPad X230: - http://review.coreboot.org/#/c/5396. + http://review.coreboot.org/#/c/5396.

    @@ -323,12 +317,12 @@ Now dump a copy of the running VGA BIOS: $ sudo dd if=/dev/mem bs=64k of=runningvga.bin skip=12 count=1
    Then do (and record the output):
    - $ ./intelvbttool runningvga.bin > intelvbttool_out + $ ./intelvbttool runningvga.bin > intelvbttool_out

    Backup both files (runningvga.bin and intelvbttool_out), renaming them to match the machine and LCD panel used. - ../index.html#get_edid_panelname will show you how to get the name (model) of the LCD panel used. + ../misc/index.html#get_edid_panelname will show you how to get the name (model) of the LCD panel used.

    Test results (# means untested and all had docks, unless noted).

    diff --git a/docs/future/old.html b/docs/future/old.html index 7d72ec7..eeaa96e 100644 --- a/docs/future/old.html +++ b/docs/future/old.html @@ -5,13 +5,7 @@ libreboot tutorials @@ -126,16 +120,16 @@ Add backlight controls: in src/mainboard/lenovo/t60/devicetree.cb, change gpu_backlight to 0x58BF58BE

    - Hold on! Check ../index.html#get_edid_panelname to know what LCD panel you have. This is important for the next step! + Hold on! Check ../misc/index.html#get_edid_panelname to know what LCD panel you have. This is important for the next step!

    Supported panels

    - ../index.html#supported_t60_list. + ../hcl/index.html#supported_t60_list.

    - See #lcd_i945_incompatibility. + See index.html#lcd_i945_incompatibility.

    Back to top of page

    diff --git a/docs/git/index.html b/docs/git/index.html new file mode 100644 index 0000000..a2596c3 --- /dev/null +++ b/docs/git/index.html @@ -0,0 +1,503 @@ + + + + + + + + + Developing libreboot + + + + +

    Developing libreboot

    +

    + This section relates to building libreboot from source, and + working with the git repository. +

    +

    + Or Back to main index. +

    + + +
    + +

    Install build dependencies

    + +

    + Before doing anything, you need the dependencies first. +

    +
      +
    • deps-trisquel script installs dependencies for Trisquel 6 (also tested in Trisquel 7).
    • +
    • deps-parabola script installs dependencies for Parabola
    • +
    + +

    + For all other GNU/Linux distributions, you may have to adapt these scripts. By all means send patches! +

    + +

    Back to top of page

    + +
    + +

    Get the full source code from metadata (git clone)

    + +

    + If you downloaded libreboot from git, then there are some steps to download and patch + the source code for all relevant dependencies. The archive in the git repository used to be + available as a tarball called 'libreboot_meta.tar.gz'. It contains 'metadata' (scripts) + which define how the source was created (where it came from). +

    + +

    + You can use the scripts included to download everything. +

    + +

    + First, install the build dependencies. +

    + +

    + After that, run the get script:
    + $ ./getall +

    + +

    + What this did was download everything (grub, coreboot, memtest86+, bucts, flashrom) + at the versions last tested for this release, and patch them. Read the script + in a text editor to learn more. +

    + +

    + To build the ROM's, see #build. +

    + +

    Back to top of page.

    + +
    + +

    How to build "bucts" (for LenovoBIOS X60/X60S/X60T/T60)

    + +

    + This is for Lenovo BIOS users on the ThinkPad X60/X60S, X60 Tablet and T60. If you have coreboot or libreboot running already, ignore this. +

    + +

    + Bucts is needed when flashing in software the X60/X60S/X60T/T60 ROM while Lenovo BIOS is running; + external flashing will be safe regardless. + Each ROM contains identical data inside the two final 64K region in the file. + This corresponds to the final two 64K regions in the flash chip. Lenovo BIOS will prevent you from writing the + final one, so running "bucts 1" will set the machine to boot from the other block instead (which + is writeable along with everything beneath it when using a patched flashrom. see #build_flashrom). + After shutting down and booting up after the first flash, + the final 64K block is writeable so you flash the ROM again with an unpatched flashrom and run "bucts 0" to + make the machine boot from the normal (highest) block again. +

    + +

    + BUC.TS utility is included in libreboot_src.tar.xz and libreboot_bin.tar.xz.
    + If you downloaded from git, follow #build_meta before you proceed. +

    + +

    + "BUC" means "Backup Control" (it's a register) and "TS" means "Top Swap" + (it's a status bit). Hence "bucts" (BUC.TS). TS 1 and TS 0 corresponds to bucts 1 and bucts 0. +

    + +

    + First, install the build dependencies. +

    + +

    + To build bucts, do this in the main directory:
    + $ ./builddeps-bucts +

    + +

    + The "builddeps" script in libreboot_src also makes use of builddeps-bucts. +

    + +

    Back to top of page.

    + +
    + +

    How to build "flashrom"

    + +

    + Flashrom is the utility for flashing/dumping ROM's. This is what you will use to install libreboot. +

    + +

    + Flashrom source code is included in libreboot_src.tar.gz and libreboot_bin.tar.gz.
    + If you downloaded from git, follow #build_meta before you proceed. +

    + +

    + First, install the build dependencies. +

    + +

    + To build it, do that in the main directory:
    + $ ./builddeps-flashrom +

    + +

    + After you've done that, under ./flashrom/ you will find the following executables: +

    +
      +
    • + flashrom +
        +
      • For flashing while coreboot or libreboot is running.
      • +
      +
    • +
    • + flashrom_lenovobios_sst +
        +
      • This is patched for flashing while Lenovo BIOS is running on an X60 or T60 with the SST25VF016B (SST) flash chip.
      • +
      +
    • +
    • + flashrom_lenovobios_macronix +
        +
      • This is patched for flashing while Lenovo BIOS is running on an X60 or T60 with the MX25L1605D (Macronix) flash chip.
      • +
      +
    • +
    + +

    + The "builddeps" script in libreboot_src also makes use of builddeps-flashrom. +

    + +

    Back to top of page.

    + +
    + +

    Configuring libreboot

    + +

    + Before building a ROM in libreboot (or coreboot, for that matter), you need to configure it. + This is done using the following inside the source tree:
    + $ make menuconfig +

    + +

    + If you've already built a kernel before, you know how to use this interface. +

    + +

    + Configurations are then saved as files called ".config". Copies of each configuration used + for each machine type by the libreboot build scripts are stored in resources/libreboot/config/ +

    + +

    + dmidecode +

    +

    + There is certain information that can be useful to enter in particular: +

    +
      +
    • Local version string
    • +
    • SMBIOS Serial Number
    • +
    • SMBIOS Manufacturer
    • +
    • SMBIOS Version
    • +
    • SMBIOS Product name
    • +
    +

    + This information can be obtained using:
    + $ sudo dmidecode
    + # dmidecode +

    +

    + Specifically, it's good practise to enter the same information for libreboot that you found when running this + with the original BIOS or firmware. libreboot has already done this for you. This information is for reference, + in the hope that it will be useful. +

    + +

    + ThinkPad X60 configuration (file: resources/libreboot/config/x60/config) +

    +
      +
    • General setup / Expert mode = enable
    • +
    • General setup / Local version string = 7BETC7WW (2.08 )
    • +
    • Mainboard / Mainboard vendor = Lenovo
    • +
    • Mainboard / Mainboard model = ThinkPad X60 / X60s / X60t
    • +
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • +
    • Mainboard / SMBIOS Serial Number = L3BH242
    • +
    • Mainboard / SMBIOS Version Number = ThinkPad X60s
    • +
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • +
    • Mainboard / SMBIOS Product name = 1702L8G
    • +
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • +
    • Devices / Use native graphics initialization = enable
    • +
    • + Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) +
        +
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time + to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • +
      +
    • +
    • Generic Drivers / Digitizer = Autodetect
    • +
    • Console / Send console output to a CBMEM buffer = enable
    • +
    • Payload / Add a payload = An ELF executable payload
    • +
    • Payload / Payload path and filename = grub.elf
    • +
    +

    + Now go back into Devices: +

    +
      +
    • Devices / Run VGA Option ROMs = disable
    • +
    • Devices / Run Option ROMs on PCI devices = disable
    • +
    +

    + The resulting .config file was saved as resources/libreboot/config/x60/config and is used by the build + scripts for this machine. +

    +

    + This is based on an X60S with the Core 2 Duo L7400 processor. +

    +

    + SMBIOS Version Number is ThinkPad X60 on the X60, but it is believed that the X60 and X60s both have identical + motherboards where the only difference is the CPU. This same configuration is used on the X60 and X60s. +

    + +

    + ThinkPad X60 Tablet configuration (file: resources/libreboot/config/x60t/config) +

    +
      +
    • General setup / Expert mode = enable
    • +
    • General setup / Local version string = 7JET23WW (1.08 )
    • +
    • Mainboard / Mainboard vendor = Lenovo
    • +
    • Mainboard / Mainboard model = ThinkPad X60 / X60s / X60t
    • +
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • +
    • Mainboard / SMBIOS Serial Number = L3B8281
    • +
    • Mainboard / SMBIOS Version Number = ThinkPad X60 Tablet
    • +
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • +
    • Mainboard / SMBIOS Product name = 6364WJ1
    • +
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • +
    • Devices / Use native graphics initialization = enable
    • +
    • + Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) +
        +
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time + to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • +
      +
    • +
    • Generic Drivers / Digitizer = Present
    • +
    • Console / Send console output to a CBMEM buffer = enable
    • +
    • Payload / Add a payload = An ELF executable payload
    • +
    • Payload / Payload path and filename = grub.elf
    • +
    +

    + Now go back into Devices: +

    +
      +
    • Devices / Run VGA Option ROMs = disable
    • +
    • Devices / Run Option ROMs on PCI devices = disable
    • +
    +

    + The resulting .config file was saved as resources/libreboot/config/x60t/config and is used by the build + scripts for this machine. +

    +

    + This is based on an X60T with the Core 2 Duo L7400 processor. +

    + +

    + ThinkPad T60 configuration (file: resources/libreboot/config/t60/config) +

    +
      +
    • General setup / Expert mode = enable
    • +
    • General setup / Local version string = 79ETE7WW (2.27 )
    • +
    • Mainboard / Mainboard vendor = Lenovo
    • +
    • Mainboard / Mainboard model = ThinkPad T60 / T60p
    • +
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • +
    • Mainboard / SMBIOS Serial Number = L3DKE06
    • +
    • Mainboard / SMBIOS Version Number = ThinkPad T60
    • +
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • +
    • Mainboard / SMBIOS Product name = 1951FEG
    • +
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • +
    • Devices / Use native graphics initialization = enable
    • +
    • + Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) +
        +
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time + to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • +
      +
    • +
    • Console / Send console output to a CBMEM buffer = enable
    • +
    • Payload / Add a payload = An ELF executable payload
    • +
    • Payload / Payload path and filename = grub.elf
    • +
    +

    + Go back into Devices: +

    +
      +
    • Devices / Run VGA Option ROMs = disable
    • +
    • Devices / Run Option ROMs on PCI devices = disable
    • +
    +

    + The resulting .config file was saved as resources/libreboot/config/t60/config and is used by the build + scripts for this machine. +

    +

    + It is believed that the motherboards on 14.1" and 15.1" T60's are the same, so the same configuration is used + on both the 14.1" and 15.1" T60's. +

    + +

    + MacBook2,1 configuration (file: resources/libreboot/config/macbook21/config) +

    +
      +
    • General / Expert mode = enable
    • +
    • General / Local version string = "    MB21.88Z.00A5.B07.0706270922" (without the quotes)
    • +
    • Mainboard / Mainboard vendor = Apple
    • +
    • Mainboard / Mainboard model = Macbook2,1 ICH7 TESTING
    • +
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • +
    • Mainboard / SMBIOS Serial Number = W8724XXXXXX
    • +
    • Mainboard / SMBIOS Version Number = 1.0
    • +
    • Mainboard / SMBIOS Manufacturer = Apple Inc.
    • +
    • Mainboard / SMBIOS Product Name = MacBook2,1
    • +
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • +
    • Devices / Use native graphics initialization = enable
    • +
    • + Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) +
        +
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time + to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • +
      +
    • +
    • Console / Send console output to a CBMEM buffer = enable
    • +
    • Payload / Add a payload = An ELF executable payload
    • +
    • Payload / Payload path and filename = grub.elf
    • +
    +

    + Go back and disable option ROM's: +

    +
      +
    • Devices / Run VGA Option ROMs = disable
    • +
    • Devices / Run Option ROMs on PCI devices = disable
    • +
    +

    + The resulting .config file was saved as resources/libreboot/config/macbook21/config and is used by the build + scripts for this machine. This config is also used for the MacBook1,1. +

    + +

    Back to top of page.

    + +
    + +

    How to build the ROM's!

    + +

    You don't need to do much, as there are scripts already written for you that can build everything automatically.

    + +

    + First, install the build dependencies. +

    +

    + If you downloaded libreboot from git, refer to #build_meta. +

    + +

    If running for the first time, run this:
    + $ ./buildall (also performs the "./build" step below)
    + Or if you only want to build dependencies (crossgcc, grub and so on):
    + $ ./builddeps

    + +

    If you've already run ./builddeps and/or ./buildall before, you don't need to run them again. + Just run that from now on to build your ROM's:
    + $ ./build

    + +

    To un-build (clean) the build dependencies that you built before, do the following:
    + This also deletes the ROM images under ./bin/:
    + $ ./cleandeps

    + +

    Note: after running 'cleandeps', you will need to run 'builddeps' or 'buildall' again before you can use 'build'.

    + +

    After 'build' or 'buildall' has finished, you'll find the ROM images for each machine under ./bin/

    + +

    Preparing release archives (optional)

    + +

    + Run that script:
    + $ ./build-release +

    + +

    + You'll find that the files libreboot_bin.tar.xz and libreboot_src.tar.xz have been created. +

    + +

    Back to top of page

    + +
    + +

    How to add SeaBIOS to your ROM's

    + +

    + SeaBIOS isn't really needed since libreboot uses the GRUB payload which + is much better (for several reasons), so it is no longer included in the ROM + images by default. Instead, you can add it afterwards. +

    + +

    + In the supplied binary archives, or in your own (if you did 'build-release') you can add SeaBIOS + to the ROM images, along with SeaVGABIOS which is a free/libre Video BIOS implementation that wraps + around the 'native graphics initializitation' code in coreboot, for boards that have support for it. +

    + +

    + First, install the build dependencies. +

    + +

    + Build cbfstool:
    + $ ./builddeps-cbfstool +

    + +

    + Now:
    + $ ./addseabios +

    + +

    + SeaBIOS and SeaVGABIOS (which the build scripts created, and the build-release script put - compiled - + inside the binary archive) have now been added to all of the ROM images under ./bin/. A GRUB menuentry will show + up when you boot your machine, allowing you to use SeaBIOS. +

    + +

    Back to top of page

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/cbfstool_libreboot5_strace b/docs/gnulinux/cbfstool_libreboot5_strace new file mode 100644 index 0000000..7e3794f --- /dev/null +++ b/docs/gnulinux/cbfstool_libreboot5_strace @@ -0,0 +1,48 @@ +# strace ./cbfstool coreboot.rom add -n grub.cfg -f grub.cfg -t raw +execve("./cbfstool", ["./cbfstool", "coreboot.rom", "add", "-n", "grub.cfg", "-f", "grub.cfg", "-t", "raw"], [/* 25 vars */]) = 0 +brk(0) = 0x9577000 +access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) +mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f6000 +access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) +open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 +fstat64(3, {st_mode=S_IFREG|0644, st_size=94605, ...}) = 0 +mmap2(NULL, 94605, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb76de000 +close(3) = 0 +access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) +open("/lib/i386-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 +read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\232\1\0004\0\0\0"..., 512) = 512 +fstat64(3, {st_mode=S_IFREG|0755, st_size=1775080, ...}) = 0 +mmap2(NULL, 1784604, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb752a000 +mmap2(0xb76d8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ae) = 0xb76d8000 +mmap2(0xb76db000, 11036, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb76db000 +close(3) = 0 +mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7529000 +set_thread_area({entry_number:-1 -> 6, base_addr:0xb7529900, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 +mprotect(0xb76d8000, 8192, PROT_READ) = 0 +mprotect(0x8067000, 4096, PROT_READ) = 0 +mprotect(0xb7719000, 4096, PROT_READ) = 0 +munmap(0xb76de000, 94605) = 0 +brk(0) = 0x9577000 +brk(0x9598000) = 0x9598000 +open("grub.cfg", O_RDONLY) = 3 +fstat64(3, {st_mode=S_IFREG|0644, st_size=810, ...}) = 0 +mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f5000 +fstat64(3, {st_mode=S_IFREG|0644, st_size=810, ...}) = 0 +_llseek(3, 0, [0], SEEK_SET) = 0 +read(3, "set default=\"0\"\nset timeout=1\nse"..., 810) = 810 +_llseek(3, 810, [810], SEEK_SET) = 0 +close(3) = 0 +munmap(0xb76f5000, 4096) = 0 +open("coreboot.rom", O_RDONLY) = 3 +fstat64(3, {st_mode=S_IFREG|0644, st_size=2097152, ...}) = 0 +mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f5000 +fstat64(3, {st_mode=S_IFREG|0644, st_size=2097152, ...}) = 0 +_llseek(3, 2097152, [2097152], SEEK_SET) = 0 +_llseek(3, 0, [0], SEEK_SET) = 0 +mmap2(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7328000 +read(3, "LARCHIVE\0\0\6\30\0\0\1\252\0\0\0\0\0\0\0(cmos_lay"..., 2097152) = 2097152 +close(3) = 0 +munmap(0xb76f5000, 4096) = 0 +--- SIGSEGV (Segmentation fault) @ 0 (0) --- ++++ killed by SIGSEGV +++ +Segmentation fault diff --git a/docs/gnulinux/configuring_parabola.html b/docs/gnulinux/configuring_parabola.html new file mode 100644 index 0000000..270d2bb --- /dev/null +++ b/docs/gnulinux/configuring_parabola.html @@ -0,0 +1,776 @@ + + + + + + + + + Configuring Parabola (post-install) + + + +
    +

    Configuring Parabola (post-install)

    + +
    + +
    + +

    Table of Contents

    + + +
    + +

    + While not strictly related to the libreboot project, this guide + is intended to be useful for those interested in installing + Parabola on their libreboot machine. This is also beneficial because development + is now being done on Parabola, where Trisquel is no longer used by the maintainer + at the time of writing. +

    + +

    + It details configuration steps that I took after installing the base system, + as a follow up to encrypted_parabola.html. + This guide is likely to become obsolete at a later date (due to the volatile + 'rolling-release' model that Arch/Parabola both use), but attempts will be made to maintain it. +

    + +

    + + This guide was valid on 2014-09-21. If you see any changes that should to be made at the present date, please get in touch + with the libreboot project! + +

    + +

    + You do not necessarily have to follow this guide word-for-word; parabola is extremely flexible. + The aim here is to provide a common setup that most users will be happy with. While Parabola + can seem daunting at first glance (especially for new GNU/Linux users), with a simple guide it can provide + all of the same usability as Trisquel, without hiding any details from the user. +

    + +

    + Paradoxically, as you get more advanced Parabola can actually become easier to use + when you want to setup your machine in a special way compared to what most distributions provide. + You will find over time that other distributions tend to get in your way. +

    + +

    + + This guide assumes that you already have Parabola installed. If you have not yet installed Parabola, + then this guide is highly recommended! + +

    + +

    + A lot of the steps in this guide will refer to the Arch wiki. Arch is the upstream distribution that Parabola uses. + Most of this guide will also tell you to read wiki articles, other pages, manuals, and so on. In general it tries + to cherry pick the most useful information but nonetheless you are encouraged to learn as much as possible. + It might take you a few days to fully install your system how you like, depending on how much you need to read. Patience is key, + especially for new users. +

    + +

    + The Arch wiki will sometimes use bad language, such as calling the whole system Linux, using the term open-source (or closed-source), + and it will sometimes recommend the use of proprietary software. You need to be careful about this when reading anything on the + Arch wiki. +

    + +

    + Some of these steps require internet access. I'll go into networking later but for now, I just connected + my machine to a switch and did:
    + # systemctl start dhcpcd.service
    + You can stop it later by running:
    + # systemctl stop dhcpcd.service
    + For most people this should be enough, but if you don't have DHCP on your network then you should setup your network connection first:
    + Setup network connection in Parabola +

    + +
    + +

    Configure pacman

    +

    + pacman (package manager) is the name of the package management system in Arch, which Parabola + (as a deblobbed parallel effort) also uses. Like with 'apt-get' on debian-based systems like Trisquel, + this can be used to add/remove and update the software on your computer. +

    +

    + Based on https://wiki.parabolagnulinux.org/Installation_Guide#Configure_pacman + and from reading https://wiki.archlinux.org/index.php/Pacman (make sure to read and understand this, + it's very important) and + https://wiki.parabolagnulinux.org/Official_Repositories +

    +

    + Back to top of page. +

    +

    Updating Parabola

    +

    + In the end, I didn't change my configuration for pacman. When you are updating, resync with the latest package names/versions:
    + # pacman -Syy
    + (according to the wiki, -Syy is better than Sy because it refreshes the package list even if it appears to be up to date, + which can be useful when switching to another mirror).
    + Then, update the system:
    + # pacman -Syu +

    +

    + + Before installing packages with 'pacman -S', always update first, using the notes above. + +

    +

    + Keep an eye out on the output, or read it in /var/log/pacman.log. Sometimes, pacman will show messages + about maintenance steps that you will need to perform with certain files (typically configurations) + after the update. Also, you should check both the Parabola and Arch home pages to see if they mention any issues. + If a new kernel is installed, you should also update to be able to use it (the currently running kernel will + also be fine). It's generally good enough to update Parabola once every week, or maybe twice. As a + rolling release distribution, it's a good idea never to leave your install too outdated; update regularly. This + is simply because of the way the project works; old packages are deleted from the repositories quickly, once they are updated. + A system that hasn't been updated for quite a while will mean potentially more reading of previous posts through the website, + and more maintenance work. +

    +

    + The Arch forum can also be useful, if others have the same issue as you (if you encounter issues, that is). Parabola's + IRC channel (#parabola on freenode) can also help you. +

    +

    + Due to this and the volatile nature of Parabola/Arch, you should only update when you have at least a couple hours of spare time + in case of issues that need to be resolved. You should never update, for example, if you need your system for an important event, + like a presentation or sending an email to an important person before an allocated deadline, and so on. +

    +

    + Relax - packages are well-tested regularly when new updates are made to the repositories. Separate 'testing' repositories + exist for this exact reason. Despite what many people will tell you, Parabola is fairly stable and trouble-free, + so long as you are aware of how to check for issues, and are willing to spend some time fixing issues in + the rare event that they do occur. +

    +

    + Back to top of page. +

    +

    Maintaining Parabola

    +

    + Parabola is a very simple distro, in the sense that you are in full control + and everything is made transparent to you. One consequence is + that you also need to know what you are doing, and what you have done before. In general, keeping notes (such as what I have done + with this page) can be very useful as a reference in the future (if you wanted to re-install it or install the distro + on another computer, for example). +

    +

    + Back to top of page. +

    +

    Cleaning the package cache

    +

    + + The following is very important as you continue to use, update and maintain your Parabola system:
    + https://wiki.archlinux.org/index.php/Pacman#Cleaning_the_package_cache. + Essentially, this guide talks about a directory that has to be cleaned once in a while, to prevent it from growing too big (it's a cache + of old package information, updated automatically when you do anything in pacman). +
    +

    +

    + To clean out all old packages that are cached:
    + # pacman -Sc +

    +

    + The wiki cautions that this should be used with care. For example, since older packages are deleted from the repo, + if you encounter issues and want to revert back to an older package then it's useful to have the caches available. + Only do this if you are sure that you won't need it. +

    +

    + The wiki also mentions this method for removing everything from the cache, including currently installed packages that are cached:
    + # pacman -Scc
    + This is inadvisable, since it means re-downloading the package again if you wanted to quickly re-install it. This should only be used + when disk space is at a premium. +

    +

    + Back to top of page. +

    +

    pacman command equivalents

    +

    + The following table lists other distro package manager commands, and their equivalent in pacman:
    + https://wiki.archlinux.org/index.php/Pacman_Rosetta +

    +

    + Back to top of page. +

    + +

    your-freedom

    +

    + your-freedom is a package specific to Parabola, and it is installed by default. What it does is conflict with packages + from Arch that are known to be non-free (proprietary) software. When migrating from Arch (there is a guide on the Parabola + wiki for migrating - converting - an existing Arch system to a Parabola system), installing + your-freedom will also fail if these packages are installed, citing them as conflicts; the recommended solution + is then to delete the offending packages, and continue installing your-freedom. +

    +

    + Back to top of page. +

    + +
    + +

    Add a user

    +

    + Based on https://wiki.archlinux.org/index.php/Users_and_Groups. +

    +

    + It is important (for security reasons) to create and use a non-root (non-admin) user account for every day use. The default 'root' account is intended + only for critical administrative work, since it has complete access to the entire operating system. +

    +

    + Read the entire document linked to above, and then continue. +

    +

    + Add your user:
    + # useradd -m -G wheel -s /bin/bash yourusername
    + Set a password:
    + # passwd yourusername +

    + +

    Back to top of page

    + +
    + +

    systemd

    +

    + This is the name of the system used for managing services in Parabola. It is a good idea to become familiar with it. + Read https://wiki.archlinux.org/index.php/systemd + and https://wiki.archlinux.org/index.php/systemd#Basic_systemctl_usage + to gain a full understanding. This is very important! Make sure to read them. +

    +

    + An example of a 'service' could be a webserver (such as lighttpd), or sshd (openssh), dhcp, etc. There are countless others. +

    +

    + https://bbs.archlinux.org/viewtopic.php?pid=1149530#p1149530 explains + the background behind the decision by Arch (Parabola's upstream supplier) to use systemd. +

    + +

    + The manpage should also help:
    + # man systemd
    + The section on 'unit types' is especially useful. +

    + +

    + According to the wiki, systemd 'journal' keeps logs of a size up to 10% of the total size your / partition takes up. + on a 60GB root this would mean 6GB. That's not exactly practical, and can have performance implications later when the + log gets too big. Based on instructions from the wiki, I will reduce the total size of the journal to 50MiB (the wiki + recommends 50MiB). +

    +

    + Open /etc/systemd/journald.conf and find the line that says:
    + #SystemMaxUse=
    + Change it to say:
    + SystemMaxUse=50M +

    +

    + The wiki also recommended a method for forwarding journal output to TTY 12 (accessible by pressing ctrl+alt+f12, + and you use ctrl+alt+[F1-F12] to switch between terminals). I decided not to enable it. +

    +

    + Restart journald:
    + # systemctl restart systemd-journald +

    + +

    + The wiki recommends that if the journal gets too large, you can also simply delete (rm -rf) everything inside /var/log/journald/* + but recommends backing it up. This shouldn't be necessary, since you already set the size limit above and systemd will automatically + start to delete older records when the journal size reaches it's limit (according to systemd developers). +

    + +

    + Finally, the wiki mentions 'temporary' files and the utility for managing them.
    + # man systemd-tmpfiles
    + The command for 'clean' is:
    + # systemd-tmpfiles --clean
    + According to the manpage, this "cleans all files and directories with an age parameter". + According to the Arch wiki, this reads information in /etc/tmpfiles.d/ and /usr/lib/tmpfiles.d/ + to know what actions to perform. Therefore, it is a good idea to read what's stored in these locations + to get a better understanding. +

    +

    + I looked in /etc/tmpfiles.d/ and found that it was empty on my system. However, /usr/lib/tmpfiles.d/ contained some files. + The first one was etc.conf, containing information and a reference to this manpage:
    + # man tmpfiles.d
    + Read that manpage, and then continue studying all of the files. +

    +

    + The systemd developers tell me that it usually isn't necessary to touch the systemd-tmpfiles utility manually at all. +

    + +

    Back to top of page

    + +
    + +

    Interesting repositories

    +

    + Parabola wiki at https://wiki.parabolagnulinux.org/Repositories#kernels + mentions about a repository called [kernels] for custom kernels that aren't in the default base. It might be worth looking into what is available + there, depending on your use case. +

    +

    + I enabled it on my system, to see what was in it. Edit /etc/pacman.conf and below the 'extra' section add:
    + + [kernels]
    + Include = /etc/pacman.d/mirrorlist +
    +

    +

    + Now sync with the repository:
    + # pacman -Syy +

    +

    + List all available packages in this repository:
    + # pacman -Sl kernels +

    +

    + In the end, I decided not to install anything from it but I kept the repository enabled regardless. +

    +

    Back to top of page.

    + +
    + +

    Setup a network connection in Parabola

    +

    + Read https://wiki.archlinux.org/index.php/Configuring_Network. +

    +

    + Back to top of page. +

    +

    Set the hostname

    +

    + This should be the same as the hostname that you set in /etc/hostname when installing Parabola. You can also do it with systemd (do so now, if you like):
    + # hostnamectl set-hostname yourhostname
    + This writes the specified hostname to /etc/hostname. More information can be found in these manpages:
    + # man hostname
    + # info hostname
    + # man hostnamectl +

    +

    + Add the same hostname to /etc/hosts, on each line. Example:
    + + 127.0.0.1 localhost.localdomain localhost myhostname
    + ::1 localhost.localdomain localhost myhostname +
    +

    +

    + You'll note that I set both lines; the 2nd line is for IPv6. More and more ISP's are providing this now (mine does) + so it's good to be forward-thinking here. +

    +

    + The hostname utility is part of the inetutils package and is in core/, installed by default (as part of base). +

    +

    + Back to top of page. +

    +

    Network Status

    +

    + According to the Arch wiki, udev should already detect the ethernet chipset + and load the driver for it automatically at boot time. You can check this in the "Ethernet controller" section + when running this command:
    + # lspci -v +

    +

    + Look at the remaining sections 'Kernel driver in use' and 'Kernel modules'. In my case it was as follows:
    + + Kernel driver in use: e1000e
    + Kernel modules: e1000e +
    +

    +

    + Check that the driver was loaded by issuing dmesg | grep module_name. In my case, I did:
    + # dmesg | grep e1000e +

    +

    Network device names

    +

    + According to https://wiki.archlinux.org/index.php/Configuring_Network#Device_names, + it is important to note that the old interface names like eth0, wlan0, wwan0 and so on no longer apply. Instead, systemd + creates device names starting with en (for enternet), wl (for wifi) and ww (for wwan) with a fixed identifier that systemd automatically generates. + An example device name for your ethernet chipset would be enp0s25, where it is never supposed to change. +

    +

    + If you want to enable the old names (eth0, wlan0, wwan0, etc), the Arch wiki recommends + adding net.ifnames=0 to your kernel parameters (in libreboot context, this would be accomplished by following the + instructions in grub_cbfs.html). +

    +

    + For background information, + read Predictable Network Interface Names +

    +

    + Show device names:
    + # ls /sys/class/net +

    +

    + Changing the device names is possible (I chose not to do it):
    + https://wiki.archlinux.org/index.php/Configuring_Network#Change_device_name +

    +

    + Back to top of page. +

    +

    Network setup

    +

    + I actually chose to ignore most of Networking section on the wiki. Instead, I plan to setup LXDE desktop with the graphical + network-manager client. Here is a list of network managers:
    + https://wiki.archlinux.org/index.php/List_of_applications/Internet#Network_managers. + If you need to, set a static IP address (temporarily) using the networking guide an the Arch wiki, or start the dhcpcd service in systemd. + NetworkManager will be setup later, after installing LXDE. +

    +

    + Back to top of page. +

    + +
    + +

    System Maintenance

    +

    + Read https://wiki.archlinux.org/index.php/System_maintenance before continuing. + Also read https://wiki.archlinux.org/index.php/Enhance_system_stability. + This is important, so make sure to read them! +

    +

    + Install smartmontools (can be used to check smart data - note: HDD's use non-free firmware inside, it's transparent to you + but the smart data comes from it. Therefore, don't rely on it too much):
    + # pacman -S smartmontools
    + Read https://wiki.archlinux.org/index.php/S.M.A.R.T. to learn how to use it. +

    +

    + Back to top of page. +

    + +
    + +

    Configuring the desktop

    +

    + Based on steps from + General Recommendations on the Arch wiki. + The plan is to use LXDE and LXDM/LightDM, along with everything else that you would expect on other distributions that provide LXDE + by default. +

    +

    + Back to top of page. +

    + +

    Installing Xorg

    +

    + Based on https://wiki.archlinux.org/index.php/Xorg. +

    +

    + Firstly, install it!
    + # pacman -S xorg-server
    + I also recommend installing this (contains lots of useful tools, including xrandr):
    + # pacman -S xorg-server-utils +

    +

    + Install the driver. For me this was xf86-video-intel on the ThinkPad X60. T60 and macbook11/21 should be the same.
    + # pacman -S xf86-video-intel
    + For other systems you can try:
    + # pacman -Ss xf86-video- | less
    + Combined with looking at your lspci output, you can determine which driver is needed. + By default, Xorg will revert to xf86-video-vesa which is a generic driver and doesn't provide true hardware acceleration. +

    +

    + Other drivers (not just video) can be found by looking at the xorg-drivers group:
    + # pacman -Sg xorg-drivers
    +

    +

    + Mostly you will rely on a display manager, but in case you ever want to start X without one:
    + # pacman -S xorg-xinit +

    +

    + <optional>
    +    Arch wiki recommends installing these, for testing that X works:
    +    # pacman -S xorg-twm xorg-xclock xterm
    +    Refer to https://wiki.archlinux.org/index.php/Xinitrc. + and test X:
    +    # startx
    +    When you are satisfied, type exit in xterm, inside the X session.
    +    Uninstall them (clutter. eww): # pacman -S xorg-xinit xorg-twm xorg-xclock xterm
    + </optional> +

    +

    + Back to top of page. +

    + +

    Xorg keyboard layout

    +

    + Refer to https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg. +

    +

    + Xorg uses a different configuration method for keyboard layouts, so you will notice that the layout you + set in /etc/vconsole.conf earlier might not actually be the same in X. +

    +

    + To see what layout you currently use, try this on a terminal emulator in X:
    + # setxkbmap -print -verbose 10 +

    +

    + In my case, I wanted to use the Dvorak (UK) keyboard which is quite different from Xorg's default Qwerty (US) layout. +

    +

    + I'll just say it now: XkbModel can be pc105 in this case (ThinkPad X60, with a 105-key UK keyboard). + If you use an American keyboard (typically 104 keys) you will want to use pc104. +

    +

    + XkbLayout in my case would be gb, and XkbVariant would be dvorak. +

    +

    + The Arch wiki recommends two different methods for setting the keyboard layout:
    + https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_X_configuration_files and
    + https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_localectl. +

    +

    + In my case, I chose to use the configuration file method:
    + Create the file /etc/X11/xorg.conf.d/10-keyboard.conf and put this inside:
    + + Section "InputClass"
    +         Identifier "system-keyboard"
    +         MatchIsKeyboard "on"
    +         Option "XkbLayout" "gb"
    +         Option "XkbModel" "pc105"
    +         Option "XkbVariant" "dvorak"
    + EndSection +
    +

    +

    + For you, the steps above may differ if you have a different layout. If you use a US Qwerty keyboard, then + you don't even need to do anything (though it might help, for the sake of being explicit). +

    +

    + Back to top of page. +

    + +

    Install LXDE

    +

    + Desktop choice isn't that important to me, so for simplicity I decided to use LXDE. It's lightweight + and does everything that I need. + If you would like to try something different, refer to + https://wiki.archlinux.org/index.php/Desktop_environment +

    +

    + Refer to https://wiki.archlinux.org/index.php/LXDE. +

    +

    + Install it, choosing 'all' when asked for the default package list:
    + # pacman -S lxde obconf +

    +

    + I didn't want the following, so I removed them:
    + # pacman -R lxmusic lxtask +

    +

    + I also lazily installed all fonts:
    + # pacman -S $(pacman -Ssq ttf-) +

    +

    + LXDE comes with a terminal. You probably want a browser to go with that; I choose GNU IceCat, part of the GNU project:
    + # pacman -S icecat
    + And a mail client:
    + # pacman -S icedove +

    +

    + In IceCat, go to Preferences :: Advanced and disable GNU IceCat Health Report. +

    +

    + I also like to install these:
    + # pacman -S xsensors stress htop +

    +

    + Enable LXDM (the default display manager, providing a graphical login):
    + # systemctl enable lxdm.service
    + It will start when you boot up the machine. To start it now, do:
    + # systemctl start lxdm.service +

    +

    + Log in with your standard (non-root) user that you created earlier. + It is advisable to also create an xinitrc rule in case you ever want to start lxde without lxdm. + Read https://wiki.archlinux.org/index.php/Xinitrc. +

    +

    + Open LXterminal:
    + $ cp /etc/skel/.xinitrc ~
    + Open .xinitrc and add the following plus a line break at the bottom of the file.
    + + # Probably not needed. The same locale info that we set before
    + # Based on advice from the LXDE wiki + export LC_ALL=en_GB.UTF-8
    + export LANGUAGE=en_GB.UTF-8
    + export LANG=en_GB.UTF-8
    +
    + # Start lxde desktop
    + exec startlxde
    +
    + Now make sure that it is executable:
    + $ chmod +x .xinitrc +

    +

    + Back to top of page. +

    + +

    LXDE - clock

    +

    + In Digital Clock Settings (right click the clock) I set the Clock Format to %Y/%m/%d %H:%M:%S +

    +

    + Back to top of page. +

    + +

    LXDE - font

    +

    + NOTE TO SELF: come back to this later. +

    +

    + Back to top of page. +

    + +

    LXDE - screenlock

    +

    + Arch wiki recommends to use xscreensaver:
    + # pacman -S xscreensaver +

    +

    + Under Preferences :: Screensaver in the LXDE menu, I chose Mode: Blank Screen Only, + setting Blank After, Cycle After and Lock Screen After (checked) to 10 minutes. +

    +

    + You can now lock the screen with Logout :: Lock Screen in the LXDE menu. +

    +

    + Back to top of page. +

    + +

    LXDE - automounting

    +

    + Refer to https://wiki.archlinux.org/index.php/File_manager_functionality. +

    +

    + I chose to ignore this for now. NOTE TO SELF: come back to this later. +

    +

    + Back to top of page. +

    +

    LXDE - disable suspend

    +

    + When closing the laptop lid, the machine suspends. This is annoying at least to me. + NOTE TO SELF: disable it, then document the steps here. +

    +

    + Back to top of page. +

    +

    LXDE - battery monitor

    +

    + Right click lxde panel and Add/Remove Panel Items. Click Add and select Battery Monitor, then click Add. + Close and then right-click the applet and go to Battery Monitor Settings, check the box that says Show Extended Information. + Now click Close. When you hover the cursor over it, it'll show information about the battery. +

    +

    + Back to top of page. +

    +

    LXDE - Network Manager

    +

    + Refer to https://wiki.archlinux.org/index.php/LXDE#Network_Management. + Then I read: https://wiki.archlinux.org/index.php/NetworkManager. +

    +

    + Install Network Manager:
    + # pacman -S networkmanager +

    +

    + You will also want the graphical applet:
    + # pacman -S network-manager-applet
    + Arch wiki says that an autostart rule will be written at /etc/xdg/autostart/nm-applet.desktop +

    +

    + I want to be able to use a VPN at some point, so the wiki tells me to do:
    + # pacman -S networkmanager-openvpn +

    +

    + LXDE uses openbox, so I refer to:
    + https://wiki.archlinux.org/index.php/NetworkManager#Openbox. +

    +

    + It tells me for the applet I need:
    + # pacman -S xfce4-notifyd gnome-icon-theme
    + Also, for storing authentication details (wifi) I need:
    + # pacman -S gnome-keyring +

    +

    + I wanted to quickly enable networkmanager:
    + # systemctl stop dhcpcd
    + # systemctl start NetworkManager
    + Enable NetworkManager at boot time:
    + # systemctl enable NetworkManager +

    +

    + Restart LXDE (log out, and then log back in). +

    +

    + I added the volume control applet to the panel (right click panel, and add a new applet). + I also later changed the icons to use the gnome icon theme, in lxappearance. +

    +

    + Back to top of page. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/encrypted_parabola.html b/docs/gnulinux/encrypted_parabola.html new file mode 100644 index 0000000..ce49cbc --- /dev/null +++ b/docs/gnulinux/encrypted_parabola.html @@ -0,0 +1,569 @@ + + + + + + + + + Installing Parabola GNU/Linux with full disk encryption (including /boot) + + + +
    +

    Installing Parabola GNU/Linux with full disk encryption (including /boot)

    + +
    + +

    + Libreboot uses the GRUB payload + by default, which means that the GRUB configuration file + (where your GRUB menu comes from) is stored directly alongside libreboot + and it's GRUB payload executable, inside + the flash chip. In context, this means that installing distributions and managing them + is handled slightly differently compared to traditional BIOS systems. +

    + +

    + On most systems, the /boot partition has to be left unencrypted while the others are encrypted. + This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware + can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a + payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical + access to the machine. +

    + +

    + Boot Parabola's install environment. How to boot a GNU/Linux installer. +

    + +

    + For this guide I used the 2013 09 01 image to boot the live installer and install the system. +

    + +

    + Parabola is much more flexible than Trisquel, but also more involved to setup. Use Parabola. It's 10 million times better than Trisquel. +

    + +

    + Firstly if you use an SSD, beware there are issues with TRIM (not enabled through luks) and security issues if you do enable it. + See this page + for more info. +

    + +

    + If you are using an SSD for this, make sure it's brand-new (or barely used). Or, otherwise, be sure that it never previously + contained plaintext copies of your data. +

    + +

    + Wipe the MBR (if you use MBR):
    + # lsblk
    + Your HDD is probably /dev/sda: + # dd if=/dev/zero of=/dev/sda bs=446 count=1; sync
    + Never use SeaBIOS! The MBR section can easily be changed with malicious code, which SeaBIOS will blindly execute. + This guide is for libreboot with GRUB-as-payload only. +

    + +

    + Securely wipe the drive:
    + # dd if=/dev/urandom of=/dev/sda; sync
    + NOTE: If you have an SSD, only do this the first time. If it was already LUKS-encrypted before, + use the info below to wipe the LUKS header. Also, check online for your SSD what the recommended + erase block size is. For example if it was 2MiB:
    + # dd if=/dev/urandom of=/dev/sda bs=2M; sync +

    +

    + If your drive was already LUKS encrypted (maybe you are re-installing your distro) then + it is already 'wiped'. You should just wipe the LUKS header. + https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/ + showed me how to do this. It recommends to do the first 3MiB. Now, that guide is recommending putting zero there. I'm doing to use urandom. Do this:
    + # head -c 3145728 /dev/urandom > /dev/sda; sync
    + (wiping the LUKS header is important, since it has hashed passphrases and so on. It's 'secure', but 'potentially' a risk). +

    +

    + + If you do plan to use an SSD, make sure to read + https://wiki.archlinux.org/index.php/Solid_State_Drives
    + Edit /etc/fstab later on when chrooted into your install. Also, read the whole article and keep all points in mind, adapting + them for this guide. +
    +

    + +

    + This guide will go through the installation steps taken at the time of writing, which may or may not change due to + the volatile nature of Parabola (it changes all the time). In general most of it should remain the same. If you spot mistakes, + please say so! This guide will be ported to the Parabola wiki at a later date. For up to date Parabola install guide, go to + the Parabola wiki. This guide essentially cherry picks the useful information (valid at the time of writing: 2014-09-15). +

    + +

    + Change keyboard layout +

    +

    + Parabola live shell assumes US Qwerty. If you have something different, use:
    + # loadkeys LAYOUT
    + For me, LAYOUT would have been dvorak-uk. +

    + +

    Getting started

    +

    + The beginning is based on https://wiki.parabolagnulinux.org/Installation_Guide. + Then I referred to https://wiki.archlinux.org/index.php/Partitioning at first. +

    + +

    dm-mod

    +

    + device-mapper will be used - a lot. Make sure that the kernel module is loaded:
    + # modprobe dm-mod +

    + +

    Create LUKS partition

    +

    + I am using MBR partitioning, so I use cfdisk:
    + # cfdisk /dev/sda +

    +

    + I create a single large sda1 filling the whole drive, leaving it as the default type 'Linux' (83). +

    +

    + Now I refer to https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning:
    + I am then directed to https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption. +

    +

    + Parabola forces you to RTFM. +

    +

    + It tells me to run:
    + # cryptsetup benchmark (for making sure the list below is populated)
    + Then:
    + # cat /proc/crypto
    + This gives me crypto options that I can use. It also provides a representation of the best way to setup LUKS (in this case, security is a priority; speed, a distant second). + To gain a better understanding, I am also reading:
    + # man cryptsetup +

    +

    + Following that page, based on my requirements, I do the following based on + based on https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode. + Reading through, it seems like Serpent (encryption) and Whirlpool (hash) is the best option. +

    +

    + I am initializing LUKS with the following:
    + # cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool --use-random --verify-passphrase luksFormat /dev/sda1 + -- choose a secure passphrase here. Ideally lots of lowercase/uppercase numbers, letters, symbols etc all in a random pattern. The password + length should be as long as you are able to handle without writing it down or storing it anywhere. Ideally, 100 characters or more. + It might take you a while to memorize a long passphrase before beginning this step. +

    + +

    Create LVM

    +

    + Now I refer to https://wiki.archlinux.org/index.php/LVM. +

    +

    + Open the LUKS partition:
    + # cryptsetup open --type luks /dev/sda1 lvm
    + (it will be available at /dev/mapper/lvm)
    + I'm told that the above is old syntax, which is what I did anyway. You could also try:
    + # cryptsetup luksOpen /dev/sda1 lvm +

    +

    + Create LVM partition:
    + # pvcreate /dev/mapper/lvm
    + Show that you just created it:
    + # pvdisplay +

    +

    + Now I create the volume group, inside of which the logical volumes will be created:
    + # vgcreate matrix /dev/mapper/lvm (volume group name is 'matrix')
    + Show that you created it:
    + # vgdisplay +

    +

    + Now create the logical volumes:
    + # lvcreate -L 2G matrix -n swapvol (2G swap partition, named swapvol)
    + # lvcreate -l +100%FREE matrix -n rootvol (single large partition in the rest of the space, named rootvol)
    + You can also be flexible here, for example you can specify a /boot, a /, a /home, a /var, a /usr, etc. For example, + if you will be running a web/mail server then you want /var in it's own partition (so that if it fills up with logs, it won't crash your system). + For a home/laptop system (typical use case), a root and a swap will do (really). +

    +

    + Verify that the logical volumes were created, using the following command:
    + # lvdisplay +

    + +

    Create / and swap partitions

    +

    + For the swapvol LV I use:
    + # mkswap /dev/mapper/matrix-swapvol +

    +

    + For the rootvol LV I use:
    + # mkfs.ext4 /dev/mapper/matrix-rootvol +

    + +

    Continue with Parabola installation

    +

    + Mount the root (/) partition:
    + # mount /dev/matrix/rootvol /mnt
    +

    +

    + This guide is really about GRUB, Parabola and cryptomount. I have to show how to install Parabola + so that the guide can continue. +

    +

    + Now I am following the rest of https://wiki.parabolagnulinux.org/Installation_Guide. + I also also cross referencing https://wiki.archlinux.org/index.php/Installation_guide. +

    +

    + Create /home and /boot on rootvol mountpoint:
    + # mkdir /mnt/home
    + # mkdir /mnt/boot +

    +

    + The wiki says to enable the swap so that it can be detected by 'genfstab':
    + # swapon /dev/matrix/swapvol +

    +

    + DHCP was already working for me, so I had internet during the install. Therefore, I ignore the 'Connect to the Internet' section of the install guide. + I also ignore wifi, since I can set that up after the install. For now, I am just using ethernet. + Otherwise, refer to https://wiki.archlinux.org/index.php/Configuring_Network. + You can test to see if internet is already working by pinging a few domains. +

    + +

    + I commented out all lines except the Server line for the UK Parabola server (main server) in /etc/pacman.d/mirrorlist and then did:
    + # pacman -Syy
    + # pacman -Syu
    + # pacman -Sy pacman (and then I did the other 2 steps above, again)
    + In my case I did the steps in the next paragraph, and followed the steps in this paragraph again. +

    +

    + <troubleshooting>
    +    The following is based on 'Verification of package signatures' in the Parabola install guide.
    +    Check there first to see if steps differ by now.
    +    Now you have to update the default Parabola keyring. This is used for signing and verifying packages:
    +    # pacman -Sy parabola-keyring
    +    It says that you you get GPG errors, it's probably an expired key so do:
    +    # pacman-key --populate parabola
    +    # pacman-key --refresh-keys
    +    # pacman -Sy parabola-keyring
    +    To be honest, you should do the above anyway. Parabola has a lot of maintainers, and a lot of keys. Really!
    +    Also, it says that if the clock is set incorrectly then you have to manually set the correct time
    +    (if keys are listed as expired because of it):
    +    # date MMDDhhmm[[CC]YY][.ss]
    +    I also had to install:
    +    # pacman -S archlinux-keyring
    +    # pacman-key --populate archlinux
    +    In my case I saw some conflicting files reported in pacman, stopping me from using it.
    +    I deleted the files that it mentioned + and then it worked. Specifically, I had this error:
    +    licenses: /usr/share/licenses/common/MPS exists in filesystem
    +    I rm -rf'd the file and then pacman worked. I'm told that the following would have also made it work:
    +    # pacman -Sf licenses
    + </troubleshooting>
    +

    +

    + I also like to install other packages (base-devel, compilers and so on) and wpa_supplicant/dialog are needed for wireless after the install:
    + # pacstrap /mnt base base-devel wpa_supplicant dialog +

    + +

    Configure the system

    +

    + From the Parabola installation guide (Arch's one was identical):
    + # genfstab -p /mnt >> /mnt/etc/fstab +

    +

    + Chroot into new system:
    + # arch-chroot /mnt +

    +

    + It's a good idea to have this installed:
    + # pacman -S linux-libre-lts +

    +

    + It was also suggested that you should install this kernel (read up on what GRSEC is):
    + # pacman -S linux-libre-grsec +

    +

    + This is another kernel that sits inside /boot, which you can use. LTS means 'long-term support'. These are so-called 'stable' kernels + that can be used as a fallback during updates, if a bad kernel causes issues for you. +

    +

    + Parabola does not have wget. This is sinister. Install it:
    + # pacman -S wget +

    +
      +
    • Write your hostname to /etc/hostname
    • +
    • + Symlink /etc/localtime to /usr/share/zoneinfo/Zone/SubZone. Replace Zone and Subzone to your liking. For example: +
        +
      • # ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
      • +
      +
    • +
    • + Set locale preferences in /etc/locale.conf. In my case, I did:
      + + LANG="en_GB.UTF-8"
      + # Keep the default sort order (e.g. files starting with a '.'
      + # should appear at the start of a directory listing.)
      + LC_COLLATE="C"
      + # Set the short date to YYYY-MM-DD (test with "date +%c")
      + LC_TIME="en_GB.UTF-8" +
      +
    • +
    • + Add console keymap and font preferences in /etc/vconsole.conf. In my case:
      + + KEYMAP=dvorak-uk
      + FONT=Lat2-Terminus16 +
      +
    • +
    • + Uncomment the selected locale (same as what you specified in /etc/locale.conf) in /etc/locale.gen and generate it with: +
        +
      • # locale-gen
      • +
      +
    • +
    • + Configure /etc/mkinitcpio.conf as needed (see mkinitcpio) + Specifically, for this use case:
      +
        +
      • + add i915 to the MODULES array (forces the driver to load earlier, so that the consolefont isn't wiped out after getting to login).
        + add encrypt and lvm2 in that order, before the 'filesystems' entry in the HOOKS array.
        + add keymap, consolefont and shutdown to the end of the HOOKS array in that order.
        + move keyboard, keymap and consolefont in that order, to go before 'encrypt' in the HOOKS array.
        + At the end your HOOKS array will look like this:
        + HOOKS="base udev autodetect modconf block keyboard keymap consolefont encrypt lvm2 filesystems fsck shutdown" +
          +
        • keymap adds to initramfs the keymap that you specified in /etc/vconsole.conf
        • +
        • consolefont adds to initramfs the font that you specified in /etc/vconsole.conf
        • +
        • encrypt adds LUKS support to the initramfs - needed to unlock your disks at boot time
        • +
        • lvm2 adds LVM support to the initramfs - needed to mount the LVM partitions at boot time
        • +
        • shutdown is needed according to Parabola wiki for unmounting devices (such as LUKS/LVM) during shutdown
        • +
        • + Runtime modules can be found in /usr/lib/initcpio/hooks, and build hooks can be found in + /usr/lib/initcpio/install. +
        • +
        • mkinitcpio -H hookname gives information about each hook.
        • +
        +
      • +
      +
    • +
    • + Now using mkinitcpio, you can create the kernel and ramdisk for booting with (note, this is different than Arch, specifying linux-libre instead of linux):
      + # mkinitcpio -p linux-libre
      + Also do it for linux-libre-lts:
      + # mkinitcpio -p linux-libre-lts
      + Also do it for linux-libre-grsec:
      + # mkinitcpio -p linux-libre-grsec +
    • +
    + +

    Set a root password

    +

    + At the time of writing, Parabola used SHA512 by default for it's password hashing. +

    +

    + I referred to https://wiki.archlinux.org/index.php/SHA_password_hashes. +

    +

    + Open /etc/pam.d/passwd and add rounds=65536 at the end of the uncommented 'password' line. +

    +

    + # passwd root
    + Make sure to set a secure password! Also, it must never be the same as your LUKS password. +

    + +

    Extra security tweaks

    +

    + Based on https://wiki.archlinux.org/index.php/Security. +

    +

    + Restrict access to important directories:
    + # chmod 700 /boot /etc/{iptables,arptables} +

    +

    + Lockout user after three failed login attempts:
    + Edit the file /etc/pam.d/system-login and comment out that line:
    + # auth required pam_tally.so onerr=succeed file=/var/log/faillog
    + Or just delete it. Above it, put:
    + auth required pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
    + To unlock a user manually (if a password attempt is failed 3 times), do:
    + # pam_tally --user theusername --reset + What the above configuration does is lock the user out for 10 minutes, if they make 3 failed login attempts. +

    +

    + Configure sudo - not covered here. Will be covered post-installation in another tutorial, at a later date. + If this is a single-user system, you don't really need sudo. +

    + +

    Unmount, reboot!

    +

    + Exit from chroot:
    + # exit +

    +

    + unmount:
    + # umount /mnt
    + # swapoff -a +

    +

    + deactivate the lvm lv's:
    + # lvchange -an /dev/matrix/rootvol
    + # lvchange -an /dev/matrix/swapvol
    +

    +

    + Lock the encrypted partition (close it):
    + # cryptsetup luksClose lvm +

    +

    + # shutdown -h now
    + Then boot up again. +

    + +

    Booting from GRUB

    +

    + Initially you will have to boot manually. Press C to get to the GRUB command line. The underlined parts are optional + (using those 2 underlines will boot lts kernel instead of normal). +

    +

    + grub> cryptomount -a (ahci0,msdos1)
    + grub> set root='lvm/matrix-rootvol'
    + grub> linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
    + grub> initrd /boot/initramfs-linux-libre-lts.img
    + grub> boot
    +

    +

    + You could also make it load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img +

    + +
    + +

    Modify grub.cfg inside the ROM

    + +

    + Now you need to modify the ROM, so that Parabola can boot automatically with this configuration. + grub_cbfs.html shows you how. Follow that guide, using the configuration details below. +

    +

    + Inside the 'Load Operating System' menu entry, change the contents to:
    + + cryptomount -a (ahci0,msdos1)
    + set root='lvm/matrix-rootvol'
    + linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
    + initrd /boot/initramfs-linux-libre-lts.img +
    +

    + +

    + Note: the underlined parts above (-lts) can also be removed, to boot the latest kernel instead of LTS (long-term support) kernels. + You could also copy the menu entry and in one have -lts, and without in the other menuentry. + You could also create a menu entry to load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img +

    + +

    + Personally, I opted to have the entry for linux-libre-grsec at the top, so that it would load by default. +

    + +

    + Above the 'Load Operating System' menu entry you should also add a GRUB password, like so: +

    +
    set superusers="root"
    +password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711
    +
    + +

    + Note that the above entry specifies user 'root'; this is just a username for GRUB. You don't even need to use root. + Change root on both of those 2 lines to whatever you want. +

    + +

    + Start dhcp on ethernet:
    + # systemctl start dhcpcd.service + This is just for the step below. I won't cover network configuration here. That is for another Parabola article. +

    + +

    + The password hash (it's password, by the way) after 'password_pbkdf2 root' should be changed and is created by the grub-mkpasswd-pbkdf2 utility, which you need to install or otherwise compile, + like so:
    + # pacman -S grub +

    + +

    + GRUB isn't needed for booting, since it's already included as a payload in libreboot. This is only so that the utility needed becomes available. Get your hash + by entering your chosen password at the prompt, when running this command:
    + # grub-mkpasswd-pbkdf2 +

    + +

    + It will output the hash for the password that you entered. Make sure to specify a password that is different from both your LUKS *and* your root/user password. + Use it to replace the default hash mentioned above. +

    + +

    + With this setup, you will have to enter a password at boot time, in GRUB, before being able to use any of the menu entries or switch to the terminal. + This protects your system from an attacker simply booting a live usb distro and re-flashing the boot firmware. +

    + +

    + You probably only need base-devel (compilers and so on) to build and use cbfstool. It was already installed if you followed this tutorial, but here it is:
    + # pacman -S base-devel +

    + +

    + For flashing the modified ROM, I just used flashrom from the Parabola repo's:
    + # pacman -S flashrom
    + I also installed dmidecode:
    + # pacman -S dmidecode +

    + +

    + When done, deleted GRUB (remember, we only needed it for the grub-mkpasswd-pbkdf2 utility; + GRUB is already part of libreboot, flashed alongside it as a payload):
    + # pacman -R grub +

    + +
    + +

    + If you followed all that correctly, you should now have a fully encrypted Parabola installation. + This is a very barebones Parabola install (the default one). Refer to the wiki for how to do the rest + (desktop, etc). +

    + +
    + +

    Further security tips

    +

    + https://wiki.archlinux.org/index.php/Security.
    + https://wiki.parabolagnulinux.org/User:GNUtoo/laptop +

    + +
    + +

    Follow-up tutorial: configuring Parabola

    +

    + configuring_parabola.html shows my own notes post-installation. Using these, you can get a basic + system similar to the one that I chose for myself. You can also cherry pick useful notes and come up with your own system. + Parabola is user-centric, which means that you are in control. For more information, read The Arch Way + (Parabola also follows it). +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/encrypted_trisquel.html b/docs/gnulinux/encrypted_trisquel.html new file mode 100644 index 0000000..5becddc --- /dev/null +++ b/docs/gnulinux/encrypted_trisquel.html @@ -0,0 +1,308 @@ + + + + + + + + + Installing Trisquel GNU/Linux with full disk encryption (including /boot) + + + +
    +

    Installing Trisquel GNU/Linux with full disk encryption (including /boot)

    + +
    + +

    + Libreboot uses the GRUB payload + by default, which means that the GRUB configuration file + (where your GRUB menu comes from) is stored directly alongside libreboot + and it's GRUB payload executable, inside + the flash chip. In context, this means that installing distributions and managing them + is handled slightly differently compared to traditional BIOS systems. +

    + +

    + On most systems, the /boot partition has to be left unencrypted while the others are encrypted. + This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware + can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a + payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical + access to the machine. +

    + +

    + This works in Trisquel 7, and probably Trisquel 6. Boot the 'net installer' (Install Trisquel in Text Mode). How to boot a GNU/Linux installer. +

    + +

    + Set a strong user password (ideally above 40 characters, of lowercase/uppercase, numbers and symbols). +

    + +

    + when the installer asks you to setup + encryption (ecryptfs) for your home directory, select 'Yes' if you want to: LUKS is already secure and performs well. Having ecryptfs on top of it + will add noticeable performance penalty, for little security gain in most use cases. This is therefore optional, and not recommended. + Choose 'no'. +

    + +

    + + Your user password should be different than the LUKS password which you will set later on. + Your LUKS password should, like the user password, be secure. + +

    + +

    Partitioning

    + +

    Choose 'Manual' partitioning:

    +
      +
    • Select drive and create new partition table
    • +
    • + Single large partition. The following are mostly defaults: +
        +
      • Use as: physical volume for encryption
      • +
      • Encryption: aes
      • +
      • key size: 256
      • +
      • IV algorithm: xts-plain64
      • +
      • Encryption key: passphrase
      • +
      • erase data: Yes (only choose 'No' if it's a new drive that doesn't contain your private data)
      • +
      +
    • +
    • + Select 'configure encrypted volumes' +
        +
      • Create encrypted volumes
      • +
      • Select your partition
      • +
      • Finish
      • +
      • Really erase: Yes
      • +
      • (erase will take a long time. be patient)
      • +
      • (if your old system was encrypted, just let this run for about a minute to + make sure that the LUKS header is wiped out)
      • +
      +
    • +
    • + Select encrypted space: +
        +
      • use as: physical volume for LVM
      • +
      • Choose 'done setting up the partition'
      • +
      +
    • +
    • + Configure the logical volume manager: +
        +
      • Keep settings: Yes
      • +
      +
    • +
    • + Create volume group: +
        +
      • Name: buzz (you can use whatever you want here, this is just an example)
      • +
      • Select crypto partition
      • +
      +
    • +
    • + Create logical volume +
        +
      • select buzz (or whatever you named it before)
      • +
      • name: distro (you can use whatever you want here, this is just an example)
      • +
      • size: default, minus 2048 MB
      • +
      +
    • +
    • + Create logical volume +
        +
      • select buzz (or whatever you named it before)
      • +
      • name: swap (you can use whatever you want here, this is just an example)
      • +
      • size: press enter
      • +
      +
    • +
    + +

    Further partitioning

    + +

    + Now you are back at the main partitioning screen. You will simply set mountpoints and filesystems to use. +

    +
      +
    • + LVM LV distro +
        +
      • use as: ext4
      • +
      • mount point: /
      • +
      • done setting up partition
      • +
      +
    • +
    • + LVM LV swap +
        +
      • use as: swap area
      • +
      • done setting up partition
      • +
      +
    • +
    • Now you select 'Finished partitioning and write changes to disk'.
    • +
    + +

    Kernel

    + +

    + Installation will ask what kernel you want to use. linux-generic is fine. +

    + +

    Tasksel

    + +

    + Choose "Trisquel Desktop Environment" if you want GNOME, + "Trisquel-mini Desktop Environment" if you + want LXDE or "Triskel Desktop Environment" if you want KDE. + If you want to have no desktop (just a basic shell) + when you boot or if you want to create your own custom setup, then choose nothing here (don't select anything). + You might also want to choose some of the other package groups; it's up to you. +

    + +

    Postfix configuration

    + +

    + If asked, choose "No Configuration" here (or maybe you want to select something else. It's up to you.) +

    + +

    Install the GRUB boot loader to the master boot record

    + +

    + Choose 'Yes'. It will fail, but don't worry. Then at the main menu, choose 'Continue without a bootloader'. + You could also choose 'No'. Choice is irrelevant here. +

    + +

    + You do not need to install GRUB at all, since in libreboot you are using the GRUB payload (for libreboot) to boot your system directly. +

    + +

    Clock UTC

    + +

    + Just say 'Yes'. +

    + +

    + Booting your system +

    + +

    + At this point, you will have finished the installation. At your GRUB payload, press C to get to the command line. +

    + +

    + Do that:
    + grub> cryptomount -a (ahci0,msdos1)
    + grub> set root='lvm/buzz-distro'
    + grub> linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root
    + grub> initrd /initrd.img
    + grub> boot +

    + +

    + ecryptfs +

    + +

    + If you didn't encrypted your home directory, then you can safely ignore this section. +

    + +

    + Immediately after logging in, do that:
    + $ sudo ecryptfs-unwrap-passphrase +

    + +

    + This will be needed in the future if you ever need to recover your home directory from another system, so write it down and keep the note + somewhere secret. Ideally, you should memorize it and then burn the note (or not even write it down, and memorize it still)> +

    + +

    + Modify grub.cfg (CBFS) +

    + +

    + Now you need to set it up so that the system will automatically boot, without having to type a bunch of commands. +

    + +

    + Modify your grub.cfg (in the firmware) using this tutorial; + just change the default menu entry 'Load Operating System' to say this inside: +

    + +

    + cryptomount -a (ahci0,msdos1)
    + set root='lvm/buzz-distro'
    + linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root
    + initrd /initrd.img +

    + +

    + Additionally, you should set a GRUB password. This is not your LUKS password, but it's a password that you have to enter to see + GRUB. This protects your system from an attacker simply booting a live USB and re-flashing your firmware. This should be different than your LUKS passphrase and user password. +

    + +

    + The GRUB utility can be used like so:
    + $ grub-mkpasswd-pbkdf2 +

    + +

    + Give it a password (remember, it has to be secure) and it'll output something like:
    + grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711 +

    + +

    + Put that in the grub.cfg (the one for CBFS inside the ROM) before the 'Load Operating System' menu entry like so (example):
    +

    +
    +set superusers="root"
    +password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711
    +		
    + +

    + Obviously, replace it with the correct hash that you actually got for the password that you entered. Meaning, not the hash that you see above! +

    + +

    + After this, you will have a modified ROM with the menu entry for cryptomount, and the entry before that for the GRUB password. Flash the modified ROM + using this tutorial. +

    + +

    + Update Trisquel +

    + +

    + $ sudo apt-get update
    + $ sudo apt-get upgrade +

    + +

    + Conclusion +

    + +

    + If you followed all that correctly, you should now have a fully encrypted system. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/grub_boot_installer.html b/docs/gnulinux/grub_boot_installer.html new file mode 100644 index 0000000..6853680 --- /dev/null +++ b/docs/gnulinux/grub_boot_installer.html @@ -0,0 +1,137 @@ + + + + + + + + + Libreboot documentation: installing GNU/Linux + + + +
    +

    Boot a GNU/Linux installer on USB

    + +
    + +

    Prepare the USB drive (in GNU/Linux)

    + +

    + Connect the USB drive. Check dmesg:
    + $ dmesg
    + + Check lsblk to confirm which drive it is:
    + $ lsblk +

    + +

    + Check that it wasn't automatically mounted. If it was, unmount it. For example:
    + $ sudo umount /dev/sdb*
    + # umount /dev/sdb* +

    + +

    + dmesg told you what device it is. Overwrite the drive, writing your distro ISO to it with dd. For example:
    + $ sudo dd if=gnulinux.iso of=/dev/sdb bs=8M; sync
    + # dd if=gnulinux.iso of=/dev/sdb bs=8M; sync +

    + +

    Booting the USB drive (in GRUB)

    + +

    + Boot it in GRUB using the Parse ISOLINUX config (USB) option (it's in default libreboot grub.cfg, at least). + + A new menu should appear in GRUB, showing the boot options for that distro; this is a GRUB menu, converted from the usual + ISOLINUX menu provided by that distro. +

    + +

    + If the ISOLINUX parser won't work, then press C to get to GRUB command line.
    + grub> ls
    + + Get the device from above output, eg (usb0). Example:
    + grub> cat (usb0)/isolinux/isolinux.cfg
    + + Either this will show the ISOLINUX menuentries for that ISO, or link to other .cfg files, for example /isolinux/foo.cfg.
    + + If it did that, then you do:
    + grub> cat (usb0)/isolinux/foo.cfg
    + + And so on, until you find the correct menuentries for ISOLINUX. +

    + +

    + Now look at the ISOLINUX menuentry. It'll look like:
    + + kernel /path/to/kernel
    + append PARAMETERS initrd=/path/to/initrd MAYBE_MORE_PARAMETERS
    +
    + + GRUB works the same way, but in it's own way. Example GRUB commands:
    + grub> linux (usb0)/path/to/kernel PARAMETERS MAYBE_MORE_PARAMETERS
    + grub> initrd (usb0)/path/to/initrd
    + grub> boot
    + + Of course this will vary from distro to distro. If you did all that correctly, it should now be booting the ISO + the way you specified. +

    + +

    Troubleshooting

    + +

    + Most of these issues occur when using libreboot with coreboot's 'text mode' instead of the coreboot framebuffer. + This mode is useful for booting payloads like memtest86+ which expect text-mode, but for GNU/Linux distributions + it can be problematic when they are trying to switch to a framebuffer because it doesn't exist. +

    + +

    + In most cases, you should use the vesafb ROM's. Example filename: libreboot_ukdvorak_vesafb.rom. +

    + +

    parabola won't boot in text-mode

    + +

    + Use one of the ROM images with vesafb in the filename (uses coreboot framebuffer instead of text-mode). +

    + +

    debian-installer (trisquel net install) graphical corruption in text-mode

    +

    + When using the ROM images that use coreboot's "text mode" instead of the coreboot framebuffer, + booting the Trisquel net installer results in graphical corruption because it is trying to switch to a framebuffer which doesn't + exist. Use that kernel parameter on the 'linux' line when booting it:
    + vga=normal fb=false +

    + +

    + Tested in Trisquel 6 (and 7). This forces debian-installer to start in text-mode, instead of trying to switch to a framebuffer. +

    + +

    + If selecting text-mode from a GRUB menu created using the ISOLINUX parser, you can press E on the menu entry to add this. + Or, if you are booting manually (from GRUB terminal) then just add the parameters. +

    + +

    + This workaround was found on the page: https://www.debian.org/releases/stable/i386/ch05s04.html. + It should also work for gNewSense, Debian and any other apt-get distro that provides debian-installer (text mode) net install method. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/grub_cbfs.html b/docs/gnulinux/grub_cbfs.html new file mode 100644 index 0000000..c9a0f45 --- /dev/null +++ b/docs/gnulinux/grub_cbfs.html @@ -0,0 +1,400 @@ + + + + + + + + + Libreboot documentation: GRUB menu + + + +
    +

    How to change your default GRUB menu

    + +
    + +

    + Libreboot uses the GRUB payload + by default, which means that the GRUB configuration file + (where your GRUB menu comes from) is stored directly alongside libreboot + and it's GRUB payload executable, inside + the flash chip. In context, this means that installing distributions and managing them + is handled slightly differently compared to traditional BIOS systems. +

    + +

    + A libreboot (or coreboot) ROM image is not simply "flat"; there is an actual + filesystem inside called CBFS (coreboot filesystem). A utility called 'cbfstool' + allows you to change the contents of the ROM image. In this case, libreboot is configured + such that the 'grub.cfg' and 'grubtest.cfg' files exists directly inside CBFS instead of + inside the GRUB payload's 'memdisk' (which is itself stored in CBFS). +

    + +

    + Here is an excellent writeup about CBFS (coreboot filesystem): + http://lennartb.home.xs4all.nl/coreboot/col5.html. +

    + +
    + +

    Table of Contents

    + + + +
    + +

    Getting started

    + +

    + Download the latest release from + http://libreboot.org/ +
    If you downloaded from git, refer to + ../git/index.html#build_meta before continuing. +

    + +

    + Install the build dependencies. +

    + +

    + Back to top of page. +

    + +
    + +

    Build 'cbfstool' from source

    + +

    + If you are working with libreboot_src, then you can run make command in + libreboot_src/coreboot/util/cbfstool to build the cbfstool and rmodtool + executable. +

    +

    + Alternatively if you are working with libreboot_bin, then you can run ./builddeps-cbfstool + command inside libreboot_bin/; a cbfstool and rmodtool + executable will appear under libreboot_bin/ +

    + +

    + Back to top of page. +

    + +
    + +

    Which ROM image should I use?

    + +

    + You can work directly with one of the ROM's already included in the libreboot ROM archives. For the purpose of + this tutorial it is assumed that your ROM is named libreboot.rom so please make sure to adapt. +

    + +

    + If you want to re-use the ROM that you currently have flashed (and running) then see + ../git/index.html#build_flashrom + and then run:
    + $ sudo ./flashrom -p internal -r libreboot.rom
    + Notice that this is using "-r" (read) instead of "-w" (write). + This will create a dump (copy) of your current firmware and name it libreboot.rom. + You need to take ownership of the file. For example:
    + $ sudo chown yourusername:yourusername libreboot.rom
    + # chown yourusername:yourusername libreboot.rom +

    + +

    + If you currently have flashed a ROM image from an older version, it is recommended to update first: + basically, modify one of the latest ROM's and then flash it. +

    + +

    + Back to top of page. +

    + +
    + +

    Extract grubtest.cfg from the ROM image

    + +

    + Display contents of ROM:
    + $ ./cbfstool libreboot.rom print +

    + +

    + The libreboot.rom file contains your grub.cfg and grubtest.cfg files. + You should extract, modify and re-insert the copy first. grub.cfg will load first, + but it has a menu entry for switching to the copy (grubtest.cfg). + This reduces your chance of making a mistake that could make your machine unbootable (or very hard to boot). +

    + +

    + Extract grubtest.cfg from the ROM image:
    + $ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg +

    + +

    + Now you have a grubtest.cfg in cbfstool directory. Edit it however you wish. +

    + +

    + Back to top of page. +

    + +
    + +
    + +

    Example modifications for grubtest.cfg

    + +

    + These are some common examples of ways in which the grubtest.cfg file can be modified. +

    + +

    Trisquel GNU/Linux-libre

    + +

    + As an example, on my test system in /boot/grub/grub.cfg (on the HDD/SSD) I see for the main menu entry: +

    +
      +
    • linux /boot/vmlinuz-3.15.1-gnu.nonpae root=UUID=3a008e14-4871-497b-95e5-fb180f277951 ro crashkernel=384M-2G:64M,2G-:128M quiet splash $vt_handoff
    • +
    • initrd /boot/initrd.img-3.15.1-gnu.nonpae
    • +
    + +

    + ro, quiet, splash, crashkernel=384M-2G:64M,2G-:128M and + $vt_handoff can be safely ignored. +

    + +

    + I use this to get my partition layout:
    + $ lsblk +

    + +

    + In my case, I have no /boot partition, instead /boot is on the same partition as / on sda1. + Yours might be different. In GRUB terms, sda means ahci0. 1 means msdos1, or gpt1, depending + on whether I am using MBR or GPT partitioning. Thus, /dev/sda1 is GRUB is (ahci0,msdos1) or + (ahci0,gpt1). In my case, I use MBR partitioning so it's (ahci0,msdos1). + 'msdos' is GRUB's name simply because this partitioning type is traditionally used by MS-DOS. + It doesn't mean you have a proprietary OS. +

    + +

    + Trisquel doesn't keep the filenames of kernels consistent, instead it keeps old kernels and + new kernel updates are provided with the version in the filename. This can make GRUB payload + a bit tricky. Fortunately, there are symlinks /vmlinuz and /initrd.img + so if your /boot and / are on the same partition, you can set GRUB to boot from that. + These are also updated automatically when installing kernel updates from your distributions + apt-get repositories. + + Note: when using jxself kernel releases, + these are not updated at all and you have to update them manually. + +

    + +

    + For the GRUB payload's grubtest.cfg (in the 'Load Operating System' menu entry), we therefore have (in this example):
    + set root='ahci0,msdos1'
    + linux /vmlinuz root=UUID=3a008e14-4871-497b-95e5-fb180f277951
    + initrd /initrd.img +

    + +

    + Optionally, you can convert the UUID to it's real device name, for example /dev/sda1 in this case. + sdX naming isn't very reliable, though, which is why UUID is used for most distributions. +

    + +

    + Alternatively, if your /boot is on a separate partition then you cannot rely on the /vmlinuz and /initrd.img symlinks. + Instead, go into /boot and create your own symlinks (update them manually when you install a new kernel update).
    + $ sudo -s
    + # cd /boot/
    + # rm -rf vmlinuz initrd.img
    + # ln -s kernel ksym
    + # ln -s initrd isym
    + # exit +

    + +

    + Replace the underlined kernel and initrd filenames above with the actual filenames, of course. +

    + +

    + Then your grubtest.cfg menu entry (for payload) becomes like that, for example if / was on sda2 and /boot was on sda1:
    + set root='ahci0,msdos1'
    + linux /ksym root=/dev/sda2
    + initrd /isym +

    + +

    + There are lots of possible variations so please try to adapt. +

    + +

    Parabola GNU/Linux-libre

    + +

    + You can basically adapt the above. Note however that Parabola does not keep old kernels still installed, and the file names + are always consistent, so you don't need to boot from symlinks, you can just use the real thing directly. +

    + +
    + +

    + Back to top of page. +

    + +
    + +

    Re-insert the modified grubtest.cfg into the ROM image

    + +

    + Delete the grubtest.cfg that remained inside the ROM:
    + $ ./cbfstool libreboot.rom remove -n grubtest.cfg +

    + +

    + Display ROM contents and now you see grubtest.cfg no longer exists there:
    + $ ./cbfstool libreboot.rom print +

    + +

    + Add the modified version that you just made:
    + $ ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t raw +

    + +

    + Now display ROM contents again and see that it exists again:
    + $ ./cbfstool libreboot.rom print +

    + +

    + Back to top of page. +

    + +
    + +

    Test it!

    + +

    + + Now you have a modified ROM. Refer back to ../install/index.html#flashrom for information + on how to flash it. Once you have done that, shut down and then boot up with your new test configuration. + +

    + +

    + Choose (in GRUB) the menu entry that switches to grubtest.cfg. If it works, then your config is safe and you can continue below. +

    + +

    + + If it does not work like you want it to, if you are unsure or sceptical in any way, + then re-do the steps above until you get it right! Do *not* proceed past this point + unless you are 100% sure that your new configuration is safe (or desirable) to use. + +

    + +

    + Back to top of page. +

    + +
    + +

    Final steps

    + +

    + Create a copy of grubtest.cfg, called grub.cfg, which is the same except for one difference: + change the menuentry 'Switch to grub.cfg' to 'Switch to grubtest.cfg' and inside it, + change all instances of grub.cfg to grubtest.cfg. This is so that the main config still + links (in the menu) to grubtest.cfg, so that you don't have to manually switch to it, in + case you ever want to follow this guide again in the future (modifying the already modified config)
    + $ sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg
    +

    + +

    + Delete the grub.cfg that remained inside the ROM:
    + $ ./cbfstool libreboot.rom remove -n grub.cfg +

    + +

    + Display ROM contents and now you see grub.cfg no longer exists there:
    + $ ./cbfstool libreboot.rom print +

    + +

    + Add the modified version that you just made:
    + $ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw +

    + +

    + Now display ROM contents again and see that it exists again:
    + $ ./cbfstool libreboot.rom print +

    + +

    + + Now you have a modified ROM. Refer back to ../install/index.html#flashrom for information + on how to flash it. Once you have done that, shut down and then boot up with your new configuration. + +

    + +

    + Back to top of page. +

    + +
    + +

    Troubleshooting

    + +

    + A user reported that segmentation faults occur with cbfstool + when using this procedure depending on the size of the grub.cfg being re-insterted. + In his case, a minimum size of 857 bytes was required. This could (at the time of + this release) be a bug in cbfstool that should be investigated with the coreboot + community. If cbfstool segfaults, then keep this in mind. 'strace' (or gdb? clang?) + could be used for debugging. This was in libreboot 5th release (based on coreboot + from late 2013), and I'm not sure if the issue perists in the current releases. + I have not been able to reproduce it. strace (from that user) is here: + cbfstool_libreboot5_strace. + The issue has been reported by a few users, so it does not happen all the time: + this bug (if it still exists) could (should) be reproduced. +

    + +

    + Back to top of page. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/gnulinux/index.html b/docs/gnulinux/index.html new file mode 100644 index 0000000..c384575 --- /dev/null +++ b/docs/gnulinux/index.html @@ -0,0 +1,51 @@ + + + + + + + + + GNU/Linux distributions + + + + +

    GNU/Linux distributions

    +

    + This section relates to dealing with GNU/Linux distributions: preparing bootable USB drives, + changing the default GRUB menu and so on. +

    +

    + Or Back to main index. +

    + + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/grub/index.html b/docs/grub/index.html new file mode 100644 index 0000000..f2d554a --- /dev/null +++ b/docs/grub/index.html @@ -0,0 +1,123 @@ + + + + + + + + + GRUB payload + + + + +

    GRUB payload

    +

    + This section relates to the GRUB payload used in libreboot. +

    +

    + Or Back to main index. +

    + + +
    + +

    Setting font in GRUB (for reference)

    + +

    You don't need to do this unless you would like to change the default font yourself. + (this is just for reference. It has already been done for you)

    + +

    The old font used was Unifont, and this had some missing characters: for instance, the border showed ??? characters instead of lines.

    + +

    I tried DeJavu Sans Mono from this website: + dejavu-fonts.org

    + +

    Specifically, the version that I chose was the latest at the time of writing (Saturday 21 June 2014): + this one

    + +

    This is a free font that is also contained in GNU/Linux distributions like Trisquel or Parabola.

    + +

    $ cd libreboot_src/grub
    + compile grub ('build' script has the info on how to do this)
    + come back out into libreboot_src/resources/grub:
    + $ cd ../libreboot_src/resources/grub/font

    + +

    I took Dejavu Sans Mono from dejavu (included in this version of libreboot) and did:
    + $ ../../../grub/grub-mkfont -o dejavusansmono.pf2 ../../../dejavu-fonts-ttf-2.34/ttf/DejaVuSansMono.ttf

    + +

    I then added the instructions to 'build' script to include resources/grub/dejavusansmono.pf2 in all of the ROM's in root of cbfs.
    + I then added that instructions to the grub.cfg files (to load the font):
    + loadfont (cbfsdisk)/dejavusansmono.pf2

    + +

    Back to top of page

    + +
    + +

    GRUB keyboard layouts (for reference)

    + +

    Custom keyboard layout in GRUB (for reference)

    + +

    + Keymaps are stored in resources/utilities/grub-assemble/keymap/. +

    + +

    + Example (French Azerty):
    + $ ckbcomp fr > frazerty

    + Go in grub directory:
    + cat frazerty | ./grub/grub-mklayout -o frazerty.gkb +

    + +

    + You must make sure that the files are named keymap and keymap.gkb (where 'keymap' can be whatever you want). +

    + +

    + Then from the above example, you would put frazerty in resources/utilities/grub-assemble/keymap/original/ and + the frazerty.gkb file goes under resources/utilities/grub-assemble/keymap/ +

    + +

    + The scripts build and buildrom-withgrub will automatically see this, and automatically build + ROM's with your custom layout (given the name) and include them under bin. Example: libreboot_frazerty.rom. +

    + +

    Back to top of page

    + +

    UK Dvorak keyboard layout in GRUB (for reference)

    + +

    + ukdvorak had to be created manually, based on usdvorak. diff them (under resources/utilities/grub-assemble/keymap/original) + to see how ukdvorak file was created +

    + +

    $ cat ukdvorak | ./grub/grub-mklayout -o ukdvorak.gkb

    + +

    Back to top of page

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hardware/index.html b/docs/hardware/index.html new file mode 100644 index 0000000..7a09e6f --- /dev/null +++ b/docs/hardware/index.html @@ -0,0 +1,45 @@ + + + + + + + + + Hardware maintenance + + + + +

    Hardware maintenance

    +

    + This section relates to hardware maintenance on supported targets. +

    +

    + Or Back to main index. +

    + + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hardware/t60_heatsink.html b/docs/hardware/t60_heatsink.html new file mode 100644 index 0000000..c4b68d5 --- /dev/null +++ b/docs/hardware/t60_heatsink.html @@ -0,0 +1,128 @@ + + + + + + + + + Libreboot documentation: Unbricking the ThinkPad T60 + + + + +
    +

    Changing heatsink (or CPU) on the ThinkPad T60

    + +
    + +

    Or go back to main index

    + +

    Hardware requirements

    +
      +
    • rubbing a***hol (misspelling intentional. halal internet) and thermal compound for changing CPU heatsink (procedure involves removing heatsink)
    • +
    • thermal compound/paste (Arctic Silver 5 is good. Others are also good.)
    • +
    + +

    Software requirements

    +
      +
    • xsensors
    • +
    • stress
    • +
    + +

    Disassembly

    + +

    + Remove those screws and remove the HDD:
    + +

    + +

    + Lift off the palm rest:
    + +

    + +

    + Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    + +

    + +

    + Gently wedge both sides loose:
    + +

    + +

    + Remove that cable from the position:
    + +

    + +

    + Remove the bezel (sorry forgot to take pics). +

    + +

    + On the CPU (and there is another chip south-east to it, sorry forgot to take pic) + clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) + you should also clean the heatsink the same way
    + +

    + +

    + This is also an opportunity to change the CPU to another one. For example if you had a Core Duo T2400, you can upgrade it to a better processor + (higher speed, 64-bit support). A Core 2 Duo T7600 was installed here. +

    + +

    + Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    + +

    + +

    + Reinstall that upper bezel:
    + +

    + +

    + Do that:
    + +

    + +

    + Attach keyboard:
    + +

    + +

    + Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    + +

    + +

    + It lives!
    + +

    + +

    + Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    + +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hardware/t60_lcd_15.html b/docs/hardware/t60_lcd_15.html new file mode 100644 index 0000000..b1293c1 --- /dev/null +++ b/docs/hardware/t60_lcd_15.html @@ -0,0 +1,89 @@ + + + + + + + + + Changing LCD panel on 15.1 inch T60 + + + + +
    +

    Changing the LCD panel on a 15.1" T60

    + +
    + +

    Or go back to main index

    + +

    Disassembly

    + +

    + Remove those covers and unscrew:
    + +

    + +

    + Gently pry off the front bezel. +

    + +

    + Remove inverter board:
    + +

    + +

    + Disconnect LCD cable:
    + +

    + +

    + Remove the panel:
    + +

    + +

    + Move the rails (left and right side) from the old panel to the new one and then attach LCD cable:
    + +

    + +

    + Insert panel (this one is an LG-Philips LP150E05-A2K1, and there are others. See ../hcl/index.html#supported_t60_list):
    + +

    + +

    + Insert new inverter board (see ../hcl/index.html#supported_t60_list for what is recommended on your LCD panel):
    + +

    + +

    + Now re-attach the front bezel and put all the screws in. +

    + +

    + It lives!
    + +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hardware/x60_heatsink.html b/docs/hardware/x60_heatsink.html new file mode 100644 index 0000000..1e14f96 --- /dev/null +++ b/docs/hardware/x60_heatsink.html @@ -0,0 +1,144 @@ + + + + + + + + + Libreboot documentation: Switch heatsink on ThinkPad X60 + + + + +
    +

    Changing the fan/heatsink on the ThinkPad X60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • isopropyl alcholal (sometimes called rubbing alchole) (cleaning material. DoNotIngest) (typo is intentional, due to fii1illterii1iiing für wörten von Großbritannien und oder nationale iintturnett)
    • +
    • your new fan and/or heatsink
    • +
    • CPU thermal compound (some say Arctic Silver 5 or IC Diamond 7 are good, others are also 'ok')
    • +
    • Something to spread the paste with
    • +
    + +

    Software requirements (for CPU stress testing)

    +
      +
    • xsensors utility
    • +
    • stress utility
    • +
    + +

    Disassembly

    +

    + Remove those screws:
    + +

    +

    + Push the keyboard forward (carefully):
    + +

    +

    + Lift the keyboard up and disconnect it from the board:
    + +

    +

    + Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    + +

    +

    + You should now have this:
    + +

    +

    + Disconnect the wifi antenna cables, the modem cable and the speaker:
    + +

    +

    + Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem + cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand + side:
    + +

    +

    + Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape + that holds it into place:
    + +

    +

    + Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:
    + +

    +

    + Remove those screws:
    + +

    +

    + Remove those screws:
    + +

    +

    + Carefully remove the plate, like so:
    + +

    +

    + Remove the SATA connector:
    + +

    +

    + Now remove the motherboard (gently) and cast the lcd/chassis aside:
    + +

    +

    + Look at that black tape above the heatsink, remove it:
    + +

    +

    + Now you have removed it:
    + +

    + +

    + Disconnect the fan and remove all the screws, heatsink will easily come off:
    + +

    + +

    + Remove the old paste with a cloth (from the CPU and heatsink) and then clean both of them with the alcholeel (to remove remaining residue. typo is intentional). + Apply a pea-sized amount of paste to the both chipsets that the heatsink covered and spread it evenly (uniformally). + Finally reinstall the heatsink, reversing previous steps. +

    + +

    + stress -c 2 command can be used to push the CPU to 100%, and xsensors (or watch sensors command) can be used to monitor heat. + Below 90C is ok. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hardware/x60_lcd_change.html b/docs/hardware/x60_lcd_change.html new file mode 100644 index 0000000..261814a --- /dev/null +++ b/docs/hardware/x60_lcd_change.html @@ -0,0 +1,49 @@ + + + + + + + + + Libreboot documentation: Unbricking the ThinkPad T60 + + + + +
    +

    Changing the LCD panel on X60

    +
    + +

    Or go back to main index

    + +

    This tutorial is incomplete, and only pictures for now.

    + +

    + + + + + + + +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/hcl/index.html b/docs/hcl/index.html new file mode 100644 index 0000000..3ffaea8 --- /dev/null +++ b/docs/hcl/index.html @@ -0,0 +1,593 @@ + + + + + + + + + Hardware compatibility list + + + + +

    Hardware compatibility list

    +

    + This sections relates to known hardware compatibility in libreboot. +

    +

    + Or back to main index. +

    + + +
    + +

    List of supported hardware

    + +

    + Libreboot supports the following machines in this release: +

    + + +

    + 'Supported' means that the build scripts know how to build ROM's for these machines, + and that the machines have been tested (confirmed working). There may be exceptions; + in other words, this is a list of 'officially' supported machines. +

    + +

    + It is also possible to build ROM images (from source) for other machines (and virtual machines, e.g. QEMU). +

    + +

    Back to top of page

    + +
    + +

    Recommended wifi chipsets

    +

    + The following are known to work well: +

    + + +

    Back to top of page

    + +
    + +

    List of supported ThinkPad X60's

    + +

    + Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM + ('Video BIOS' or 'VBIOS'), + all known LCD panels are currently compatible: +

    + +

    + To find what LCD panel you have, see: ../misc/index.html#get_edid_panelname. +

    + +
      +
    • TMD-Toshiba LTD121ECHB: #
    • +
    • CMO N121X5-L06: #
    • +
    • Samsung LTN121XJ-L07: #
    • +
    • BOE-Hydis HT121X01-101: #
    • +
    + +

    + You can remove an X61/X61s motherboard from the chassis and install an X60/X60s motherboard in it's place (for flashing libreboot). The chassis is mostly identical + and the motherboards are the same shape/size. +

    + +

    + The X60 typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running + the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; + just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. +

    + +

    Back to top of page.

    + +
    + +

    List of supported ThinkPad X60 Tablets

    + +

    + Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM + ('Video BIOS' or 'VBIOS'). +

    + +

    + To find what LCD panel you have, see: ../misc/index.html#get_edid_panelname. +

    + +

    + There are 5 known LCD panels for the X60 Tablet: +

    +
      +
    • + X60T XGA (1024x768): +
        +
      • BOE-Hydis HV121X03-100 (works)
      • +
      • Samsung LTN121XP01 (does not work. blank screen)
      • +
      • BOE-Hydis HT12X21-351 (does not work. blank screen)
      • +
      +
    • +
    • + X60T SXGA+ (1400x1050): +
        +
      • BOE-Hydis HV121P01-100 (works)
      • +
      • BOE-Hydis HV121P01-101 (works)
      • +
      +
    • +
    + +

    + Most X60T's only have digitizer (pen), but some have finger (touch) aswell as pen; finger/multitouch doesn't work, only digitizer (pen) does. +

    + +

    + You can remove an X61/X61s motherboard from the chassis and install an X60/X60s motherboard in it's place (for flashing libreboot). The chassis is mostly identical + and the motherboards are the same shape/size. It is unknown if the same applies between the X60 Tablet and the X61 Tablet. +

    + +

    + The X60 Tablet typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running + the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; + just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. +

    + +

    + A user with a X60T that has digitizer+finger support, reported that they could get finger input working. They + used linuxwacom at git tag 0.25.99.2 and had the following in their xorg.conf: +

    + +
    +# Now, for some reason (probably a bug in linuxwacom),
    +# the 'Touch=on' directive gets reset to 'off'.
    +# So you'll need to do
    +# $ xsetwacom --set WTouch Touch on
    +#
    +# tested with linuxwacom git 42a42b2a8636abc9e105559e5dea467163499de7
    +
    +Section "Monitor"
    +    Identifier             "<default monitor>"
    +    DisplaySize     245 184
    +EndSection
    +
    +Section "Screen"
    +    Identifier "Default Screen Section"
    +    Monitor    "<default monitor<"
    +EndSection
    +
    +Section "InputDevice"
    +    Identifier  "WTouch"
    +    Driver      "wacom"
    +    Option      "Device" "/dev/ttyS0"
    +#    Option      "DebugLevel" "12"
    +    Option      "BaudRate" "38400"
    +    Option      "Type" "touch"
    +    Option      "Touch" "on"
    +    Option      "Gesture" "on"
    +    Option      "ForceDevice" "ISDV4"
    +#    Option      "KeepShape" "on"
    +    Option      "Mode" "Absolute"
    +    Option      "RawSample" "2"
    +#    Option      "TPCButton" "off"
    +    Option      "TopX" "17"
    +    Option      "TopY" "53"
    +    Option      "BottomX" "961"
    +    Option      "BottomY" "985"
    +EndSection
    +
    +Section "ServerLayout"
    +  Identifier    "Default Layout"
    +  Screen        "Default Screen Section"
    +  InputDevice   "WTouch" "SendCoreEvents"
    +EndSection
    +
    +
    + +

    Back to top of page.

    + +
    + +

    Supported T60 list

    + +

    + Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM + ('Video BIOS' or 'VBIOS'). +

    + +

    + To find what LCD panel you have, see: ../misc/index.html#get_edid_panelname. +

    + +

    + + Some T60's have ATI GPU's, and all T60p's have ATI GPU's These are incompatible! See #t60_ati_intel for how to remedy this. + +

    + +

    + How to dump the EDID:
    + +

    + +

    + Tested LCD panels: working(compatible) +

    +
      +
    • TMD-Toshiba LTD141EN9B (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • +
    • Samsung LTN141P4-L02 (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • +
    • LG-Philips LP150E05-A2K1 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • Samsung LTN150P4-L01 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board) (not a T60 screen afaik, but it works)
    • +
    • BOE-Hydis HV150UX1-100 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • IDtech IAQX10N (15.1" 2048x1536) (GRUB doesn't display at the moment, but GNU/Linux works) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    + +
    + +

    + Tested LCD panels: not working yet (incompatible; see ../future/index.html#lcd_i945_incompatibility) +

    +
      +
    • Samsung LTN141XA-L01 (14.1" 1024x768)
    • +
    • LG-Philips LP150X09 (15.1" 1024x768)
    • +
    • Samsung LTN150XG (15.1" 1024x768) - EDID dump (taken using sudo i2cdump -y 5 0x50)
    • +
    • LG-Philips LP150E06-A5K4 (15.1" 1400x1050) (also, not an official T60 screen)
    • +
    • Samsung LTN154X3-L0A (15.4" 1280x800)
    • +
    + +

    + The following LCD panels are UNTESTED. If you have one of these panels + then please submit a report!: +

    +
      +
    • CMO(IDtech?) N141XC (14.1" 1024x768)
    • +
    • BOE-Hydis HT14X14 (14.1" 1024x768)
    • +
    • TMD-Toshiba LTD141ECMB (14.1" 1024x768)
    • +
    • Boe-Hydis HT14P12 (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • +
    • CMO (IDtech?) 13N7068 (15.1" 1024x768)
    • +
    • CMO (IDtech?) 13N7069 (15.1" 1024x768)
    • +
    • BOE-Hydis HV150P01-100 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • IDtech N150U3-L01 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • BOE-Hydis HV150UX1-102 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • IDtech IAQX10S (15.1" 2048x1536) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • +
    • Samsung LTN154P2-L05 (42X4641 42T0329) (15.4" 1680x1050)
    • +
    • LG-Philips LP154W02-TL10 (13N7020 42T0423) (15.4" 1680x1050)
    • +
    • LG-Philips LP154WU1-TLB1 (42T0361) (15.4" 1920x1200) (for T61p but it might work in T60. Unknown!)
    • +
    • Samsung LTN154U2-L05 (42T0408 42T0574) (15.4" 1920x1200) (for T61p but it might work in T60. Unknown!)
    • +
    + +

    + It is unknown whether the 1680x1050 (15.4") and 1920x1200 (15.4") panels use a different inverter board than the 1280x800 panels. +

    + +

    + The T60 typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running + the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; + just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. +

    + +
    + +

    Back to top of page.

    + +
    + +

    ThinkPad T60 (ATI GPU) and ThinkPad T60 (Intel GPU) differences.

    + +

    + If your T60 is a 14.1" or 15.1" model with an ATI GPU, it won't work with libreboot by default but + you can replace the motherboard with another T60 motherboard that has an Intel GPU, and then libreboot should work. +

    + +

    + As far as I know, 14.1" (Intel GPU) and 15.1" (Intel GPU) T60 motherboards are the same, where + 'spacers' are used on the 15.1" T60. In any case, it makes sense to find one that is guaranteed to fit in your chassis. +

    + +

    + There is also a 15.4" T60 with Intel GPU. +

    + +

    + Note: the T60p laptops all have ATI graphics. + The T60p laptops cannot be used with libreboot under any circumstances. +

    + +

    + The following T60 motherboard (see area highlighted in white) shows an empty space where the ATI GPU would be (this particular motherboard has an Intel GPU):
    + +

    + +

    + The reason that the ATI GPU on T60 is unsupported is due to the VBIOS (Video BIOS) which is non-free. + The VBIOS for the Intel GPU on X60/T60 has been reverse engineered, and replaced with Free Software and + so will work in libreboot. +

    + +

    + The 'Video BIOS' is what initializes graphics. +

    + +

    + See: https://en.wikipedia.org/wiki/Video_BIOS.
    + In fact, lack of free VBIOS in general is a big problem in coreboot, and is one reason (among others) why many ports for coreboot are + unsuitable for libreboot's purpose. +

    + +

    + Theoretically, the ThinkPad T60 with ATI GPU can work with libreboot and have ROM's compiled for it, however + in practise it would not be usable as a laptop because there would be no visual display at all. That being said, + such a configuration is acceptable for use in a 'headless' server setup (with serial and/or ssh console as the display). +

    + +

    Back to top of page.

    + +
    + +

    Information about the macbook1,1

    + +

    + There is an Apple laptop called the macbook1,1 from 2006 which uses the same i945 chipset as the ThinkPad X60/T60. + A developer ported the MacBook2,1 to coreboot, the ROM images also work on the macbook1,1. +

    + +

    + You can refer to #macbook21 for most of this. Macbook2,1 laptops come with Core 2 Duo processors + which support 64-bit operating systems (and 32-bit). The MacBook1,1 uses Core Duo processors (supports 32-bit OS but not 64-bit), + and it is believed that this is the only difference. +

    + +

    + It is believed that all models are compatible, listed here: +

    + + +

    + Compatible models +

    +

    + Specifically (Order No. / Model No. / CPU): +

    +
      +
    • MA255LL/A / A1181 (EMC 2092) / Core Duo T2500 (tested - working)
    • +
    • MA254LL/A / A1181 (EMC 2092) / Core Duo T2400 (untested)
    • +
    • MA472LL/A / A1181 (EMC 2092) / Core Duo T2500 (untested)
    • +
    + +

    + Also of interest: ../git/index.html#config_macbook21. +

    + +

    + Unbricking: this page shows disassembly guides and mono's page (see #macbook21) + shows the location of the SPI flash chip on the motherboard. How to remove the motherboard. +

    + +

    + No method is yet known for flashing in GNU/Linux while the Apple firmware is running. You will need to disassemble the machine and flash externally. + Reading from flash seems to work. Bus Pirate recommended for external flashing (there are others) and needed tools: clip (eg Pomona 5250), mini usb cable, + bus pirate cable (for connecting Pomona to the bus pirate). +

    + +

    Back to top of page.

    + +
    + +

    Information about the macbook2,1

    + +

    + There is an Apple laptop called the macbook2,1 from late 2006 or early 2007 that uses the same i945 chipset + as the ThinkPad X60 and ThinkPad T60. A developer ported coreboot to his macbook2,1, and now libreboot can run on it. +

    +

    + Mono Moosbart is the person who wrote the port for macbook2,1. Referenced below are copies (up to date at the time of writing, 20140630) + of the pages he wrote when porting coreboot to the macbook2,1. They are included here in case the main site goes down for + whatever reason, since they include a lot of useful information. +

    +

    + Backups created using wget:
    + $ wget -m -p -E -k -K -np http://macbook.donderklumpen.de/
    + $ wget -m -p -E -k -K -np http://macbook.donderklumpen.de/coreboot/
    + Use -e robots=off if using this trick for other sites and the site restricts using robots.txt +

    + +

    + Links to wget backups (and the backups themselves) of Mono's pages (see above) removed temporarily. Mono has given me permission to distribute them, but I need to ask + him to tell me what license these works fall under first. Otherwise, the above URL's should be fine. NOTE TO SELF: REMOVE THIS WHEN DONE +

    + +

    + Installing GNU/Linux distributions (on Apple EFI firmware) +

    + +

    + How to boot an ISO: burn it to a CD (like you would normally) and hold down the Alt/Control key while booting. + The bootloader will detect the GNU/Linux CD as 'Windows' (because Apple doesn't think GNU/Linux exists). Install it like you normally would. + When you boot up again, hold Alt/Control once more. The installation (on the HDD) will once again be seen as 'Windows'. (it's not actually Windows, + but Apple likes to think that Apple and Microsoft are all that exist.) + Now to install libreboot, follow ../install/index.html#flashrom_macbook21. +

    + +

    + Information about coreboot +

    + + +

    + coreboot wiki page +

    + + +

    + Compatible models +

    +

    + It is believed that all models are compatible, listed here: +

    + +

    + Specifically (Order No. / Model No. / CPU): +

    +
      +
    • MA699LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T5600 (tested - working)
    • +
    • MA701LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 (tested - working)
    • +
    • MB061LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7200 (untested)
    • +
    • MA700LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 (tested - working)
    • +
    • MB063LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 (untested)
    • +
    • MB062LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 (tested - working)
    • +
    + +

    + Also of interest: ../git/index.html#config_macbook21. +

    + +

    + Unbricking: this page shows disassembly guides and mono's page (see above) + shows the location of the SPI flash chip on the motherboard. How to remove the motherboard. +

    + +

    + Bus Pirate recommended for external flashing (there are others) and needed tools: clip (eg Pomona 5250), mini usb cable, + bus pirate cable (for connecting Pomona to the bus pirate). +

    + +

    + You need to replace OS X with GNU/Linux before flashing libreboot. (OSX won't run at all in libreboot). +

    + +

    + There are some issues with this machine (compared to other computers that libreboot supports): +

    + +

    + This is an apple laptop, so it comes with OS X: it has an Apple keyboard, which means that certain keys you expect are missing: + insert, del, home, end, pgup, pgdown. There is also one mouse button only. Battery life is poor compared to X60/T60 (for now). + It also has other issues: for example, the Apple logo on the back is a hole, exposing the backlight, which means that it glows. You should cover it up. +

    + +

    + The macbook21 gets extremely hot under GNU/Linux and libreboot; Macfanctld (mac fan control daemon) I'm told is a programme (GPLv3 license) that can help with this. +

    + +

    + Debugging the heating issues (initial work):
    + Distro: Trisquel 7. kernel(linux-libre): 3.13.0-32
    + CPU temperatures:
    + 52C(idle)/81C(stress) on factory.bin
    + 70C(idle)/80C(stress) on coreboot(with microcode updates). libreboot results (without microcode updates) were the same.
    + (libreboot and coreboot rom's were both built from the same code, just with or without microcode included in the rom)
    + battery life was higher on original firmware, lower on coreboot/libreboot.
    + microcode patches included [y/n] makes no difference.
    + libreboot: 1hr18min left on idle (99% battery), 42mins left on stress (82% battery)
    + factory.bin: 2 hours left on idle (99% battery), 48mins left on stress (82% battery) +

    +

    + Todo: see what the non-free firmware has in it's ACPI tables using acpidump and iasl -d. Try to implement cstate support in coreboot + (this will allow for lower temperatures). +

    + +

    + + The MacBook2,1 comes with a webcam, which does not work without proprietary software. Also, webcams are a security risk; cover it up! Or remove it. + +

    + +

    + A user reported that they could get better response from the touchpad with the following in their xorg.conf: +

    + +
    +Section "InputClass"
    + Identifier "Synaptics Touchpad"
    + Driver "synaptics"
    + MatchIsTouchpad "on"
    + MatchDevicePath "/dev/input/event*"
    + Driver "synaptics"
    +# The next two values determine how much pressure one needs
    +# for tapping, moving the cursor and other events.
    + Option "FingerLow" "10"
    + Option "FingerHigh" "15"
    +# Do not emulate mouse buttons in the touchpad corners.
    + Option "RTCornerButton" "0"
    + Option "RBCornerButton" "0"
    + Option "LTCornerButton" "0"
    + Option "LBCornerButton" "0"
    +# One finger tap = left-click
    + Option "TapButton1" "1"
    +# Two fingers tap = right-click
    + Option "TapButton2" "3"
    +# Three fingers tap = middle-mouse
    + Option "TapButton3" "2"
    +# Try to not count the palm of the hand landing on the touchpad
    +# as a tap. Not sure if helps.
    + Option "PalmDetect" "1"
    +# The following modifies how long and how fast scrolling continues
    +# after lifting the finger when scrolling
    + Option "CoastingSpeed" "20"
    + Option "CoastingFriction" "200"
    +# Smaller number means that the finger has to travel less distance
    +# for it to count as cursor movement. Larger number prevents cursor
    +# shaking.
    + Option "HorizHysteresis" "10"
    + Option "VertHysteresis" "10"
    +# Prevent two-finger scrolling. Very jerky movement
    + Option "HorizTwoFingerScroll" "0"
    + Option "VertTwoFingerScroll" "0"
    +# Use edge scrolling
    + Option "HorizEdgeScroll" "1"
    + Option "VertEdgeScroll" "1"
    +EndSection
    +
    + +

    Back to top of page.

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../../license.txt for more information. +

    + + + diff --git a/docs/howtos/cbfstool_libreboot5_strace b/docs/howtos/cbfstool_libreboot5_strace deleted file mode 100644 index 7e3794f..0000000 --- a/docs/howtos/cbfstool_libreboot5_strace +++ /dev/null @@ -1,48 +0,0 @@ -# strace ./cbfstool coreboot.rom add -n grub.cfg -f grub.cfg -t raw -execve("./cbfstool", ["./cbfstool", "coreboot.rom", "add", "-n", "grub.cfg", "-f", "grub.cfg", "-t", "raw"], [/* 25 vars */]) = 0 -brk(0) = 0x9577000 -access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) -mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f6000 -access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) -open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 -fstat64(3, {st_mode=S_IFREG|0644, st_size=94605, ...}) = 0 -mmap2(NULL, 94605, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb76de000 -close(3) = 0 -access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) -open("/lib/i386-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 -read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\232\1\0004\0\0\0"..., 512) = 512 -fstat64(3, {st_mode=S_IFREG|0755, st_size=1775080, ...}) = 0 -mmap2(NULL, 1784604, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb752a000 -mmap2(0xb76d8000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ae) = 0xb76d8000 -mmap2(0xb76db000, 11036, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb76db000 -close(3) = 0 -mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7529000 -set_thread_area({entry_number:-1 -> 6, base_addr:0xb7529900, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 -mprotect(0xb76d8000, 8192, PROT_READ) = 0 -mprotect(0x8067000, 4096, PROT_READ) = 0 -mprotect(0xb7719000, 4096, PROT_READ) = 0 -munmap(0xb76de000, 94605) = 0 -brk(0) = 0x9577000 -brk(0x9598000) = 0x9598000 -open("grub.cfg", O_RDONLY) = 3 -fstat64(3, {st_mode=S_IFREG|0644, st_size=810, ...}) = 0 -mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f5000 -fstat64(3, {st_mode=S_IFREG|0644, st_size=810, ...}) = 0 -_llseek(3, 0, [0], SEEK_SET) = 0 -read(3, "set default=\"0\"\nset timeout=1\nse"..., 810) = 810 -_llseek(3, 810, [810], SEEK_SET) = 0 -close(3) = 0 -munmap(0xb76f5000, 4096) = 0 -open("coreboot.rom", O_RDONLY) = 3 -fstat64(3, {st_mode=S_IFREG|0644, st_size=2097152, ...}) = 0 -mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76f5000 -fstat64(3, {st_mode=S_IFREG|0644, st_size=2097152, ...}) = 0 -_llseek(3, 2097152, [2097152], SEEK_SET) = 0 -_llseek(3, 0, [0], SEEK_SET) = 0 -mmap2(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7328000 -read(3, "LARCHIVE\0\0\6\30\0\0\1\252\0\0\0\0\0\0\0(cmos_lay"..., 2097152) = 2097152 -close(3) = 0 -munmap(0xb76f5000, 4096) = 0 ---- SIGSEGV (Segmentation fault) @ 0 (0) --- -+++ killed by SIGSEGV +++ -Segmentation fault diff --git a/docs/howtos/configuring_parabola.html b/docs/howtos/configuring_parabola.html deleted file mode 100644 index 56c5420..0000000 --- a/docs/howtos/configuring_parabola.html +++ /dev/null @@ -1,784 +0,0 @@ - - - - - - - - - Configuring Parabola (post-install) - - - -
    -

    Configuring Parabola (post-install)

    - -
    - -
    - -

    Table of Contents

    - - -
    - -

    - While not strictly related to the libreboot project, this guide - is intended to be useful for those interested in installing - Parabola on their libreboot machine. This is also beneficial because development - is now being done on Parabola, where Trisquel is no longer used by the maintainer - at the time of writing. -

    - -

    - It details configuration steps that I took after installing the base system, - as a follow up to encrypted_parabola.html. - This guide is likely to become obsolete at a later date (due to the volatile - 'rolling-release' model that Arch/Parabola both use), but attempts will be made to maintain it. -

    - -

    - - This guide was valid on 2014-09-21. If you see any changes that should to be made at the present date, please get in touch - with the libreboot project! - -

    - -

    - You do not necessarily have to follow this guide word-for-word; parabola is extremely flexible. - The aim here is to provide a common setup that most users will be happy with. While Parabola - can seem daunting at first glance (especially for new GNU/Linux users), with a simple guide it can provide - all of the same usability as Trisquel, without hiding any details from the user. -

    - -

    - Paradoxically, as you get more advanced Parabola can actually become easier to use - when you want to setup your machine in a special way compared to what most distributions provide. - You will find over time that other distributions tend to get in your way. -

    - -

    - - This guide assumes that you already have Parabola installed. If you have not yet installed Parabola, - then this guide is highly recommended! - -

    - -

    - A lot of the steps in this guide will refer to the Arch wiki. Arch is the upstream distribution that Parabola uses. - Most of this guide will also tell you to read wiki articles, other pages, manuals, and so on. In general it tries - to cherry pick the most useful information but nonetheless you are encouraged to learn as much as possible. - It might take you a few days to fully install your system how you like, depending on how much you need to read. Patience is key, - especially for new users. -

    - -

    - The Arch wiki will sometimes use bad language, such as calling the whole system Linux, using the term open-source (or closed-source), - and it will sometimes recommend the use of proprietary software. You need to be careful about this when reading anything on the - Arch wiki. -

    - -

    - Some of these steps require internet access. I'll go into networking later but for now, I just connected - my machine to a switch and did:
    - # systemctl start dhcpcd.service
    - You can stop it later by running:
    - # systemctl stop dhcpcd.service
    - For most people this should be enough, but if you don't have DHCP on your network then you should setup your network connection first:
    - Setup network connection in Parabola -

    - -
    - -

    Configure pacman

    -

    - pacman (package manager) is the name of the package management system in Arch, which Parabola - (as a deblobbed parallel effort) also uses. Like with 'apt-get' on debian-based systems like Trisquel, - this can be used to add/remove and update the software on your computer. -

    -

    - Based on https://wiki.parabolagnulinux.org/Installation_Guide#Configure_pacman - and from reading https://wiki.archlinux.org/index.php/Pacman (make sure to read and understand this, - it's very important) and - https://wiki.parabolagnulinux.org/Official_Repositories -

    -

    - Back to top of page. -

    -

    Updating Parabola

    -

    - In the end, I didn't change my configuration for pacman. When you are updating, resync with the latest package names/versions:
    - # pacman -Syy
    - (according to the wiki, -Syy is better than Sy because it refreshes the package list even if it appears to be up to date, - which can be useful when switching to another mirror).
    - Then, update the system:
    - # pacman -Syu -

    -

    - - Before installing packages with 'pacman -S', always update first, using the notes above. - -

    -

    - Keep an eye out on the output, or read it in /var/log/pacman.log. Sometimes, pacman will show messages - about maintenance steps that you will need to perform with certain files (typically configurations) - after the update. Also, you should check both the Parabola and Arch home pages to see if they mention any issues. - If a new kernel is installed, you should also update to be able to use it (the currently running kernel will - also be fine). It's generally good enough to update Parabola once every week, or maybe twice. As a - rolling release distribution, it's a good idea never to leave your install too outdated; update regularly. This - is simply because of the way the project works; old packages are deleted from the repositories quickly, once they are updated. - A system that hasn't been updated for quite a while will mean potentially more reading of previous posts through the website, - and more maintenance work. -

    -

    - The Arch forum can also be useful, if others have the same issue as you (if you encounter issues, that is). Parabola's - IRC channel (#parabola on freenode) can also help you. -

    -

    - Due to this and the volatile nature of Parabola/Arch, you should only update when you have at least a couple hours of spare time - in case of issues that need to be resolved. You should never update, for example, if you need your system for an important event, - like a presentation or sending an email to an important person before an allocated deadline, and so on. -

    -

    - Relax - packages are well-tested regularly when new updates are made to the repositories. Separate 'testing' repositories - exist for this exact reason. Despite what many people will tell you, Parabola is fairly stable and trouble-free, - so long as you are aware of how to check for issues, and are willing to spend some time fixing issues in - the rare event that they do occur. -

    -

    - Back to top of page. -

    -

    Maintaining Parabola

    -

    - Parabola is a very simple distro, in the sense that you are in full control - and everything is made transparent to you. One consequence is - that you also need to know what you are doing, and what you have done before. In general, keeping notes (such as what I have done - with this page) can be very useful as a reference in the future (if you wanted to re-install it or install the distro - on another computer, for example). -

    -

    - Back to top of page. -

    -

    Cleaning the package cache

    -

    - - The following is very important as you continue to use, update and maintain your Parabola system:
    - https://wiki.archlinux.org/index.php/Pacman#Cleaning_the_package_cache. - Essentially, this guide talks about a directory that has to be cleaned once in a while, to prevent it from growing too big (it's a cache - of old package information, updated automatically when you do anything in pacman). -
    -

    -

    - To clean out all old packages that are cached:
    - # pacman -Sc -

    -

    - The wiki cautions that this should be used with care. For example, since older packages are deleted from the repo, - if you encounter issues and want to revert back to an older package then it's useful to have the caches available. - Only do this if you are sure that you won't need it. -

    -

    - The wiki also mentions this method for removing everything from the cache, including currently installed packages that are cached:
    - # pacman -Scc
    - This is inadvisable, since it means re-downloading the package again if you wanted to quickly re-install it. This should only be used - when disk space is at a premium. -

    -

    - Back to top of page. -

    -

    pacman command equivalents

    -

    - The following table lists other distro package manager commands, and their equivalent in pacman:
    - https://wiki.archlinux.org/index.php/Pacman_Rosetta -

    -

    - Back to top of page. -

    - -

    your-freedom

    -

    - your-freedom is a package specific to Parabola, and it is installed by default. What it does is conflict with packages - from Arch that are known to be non-free (proprietary) software. When migrating from Arch (there is a guide on the Parabola - wiki for migrating - converting - an existing Arch system to a Parabola system), installing - your-freedom will also fail if these packages are installed, citing them as conflicts; the recommended solution - is then to delete the offending packages, and continue installing your-freedom. -

    -

    - Back to top of page. -

    - -
    - -

    Add a user

    -

    - Based on https://wiki.archlinux.org/index.php/Users_and_Groups. -

    -

    - It is important (for security reasons) to create and use a non-root (non-admin) user account for every day use. The default 'root' account is intended - only for critical administrative work, since it has complete access to the entire operating system. -

    -

    - Read the entire document linked to above, and then continue. -

    -

    - Add your user:
    - # useradd -m -G wheel -s /bin/bash yourusername
    - Set a password:
    - # passwd yourusername -

    - -

    Back to top of page

    - -
    - -

    systemd

    -

    - This is the name of the system used for managing services in Parabola. It is a good idea to become familiar with it. - Read https://wiki.archlinux.org/index.php/systemd - and https://wiki.archlinux.org/index.php/systemd#Basic_systemctl_usage - to gain a full understanding. This is very important! Make sure to read them. -

    -

    - An example of a 'service' could be a webserver (such as lighttpd), or sshd (openssh), dhcp, etc. There are countless others. -

    -

    - https://bbs.archlinux.org/viewtopic.php?pid=1149530#p1149530 explains - the background behind the decision by Arch (Parabola's upstream supplier) to use systemd. -

    - -

    - The manpage should also help:
    - # man systemd
    - The section on 'unit types' is especially useful. -

    - -

    - According to the wiki, systemd 'journal' keeps logs of a size up to 10% of the total size your / partition takes up. - on a 60GB root this would mean 6GB. That's not exactly practical, and can have performance implications later when the - log gets too big. Based on instructions from the wiki, I will reduce the total size of the journal to 50MiB (the wiki - recommends 50MiB). -

    -

    - Open /etc/systemd/journald.conf and find the line that says:
    - #SystemMaxUse=
    - Change it to say:
    - SystemMaxUse=50M -

    -

    - The wiki also recommended a method for forwarding journal output to TTY 12 (accessible by pressing ctrl+alt+f12, - and you use ctrl+alt+[F1-F12] to switch between terminals). I decided not to enable it. -

    -

    - Restart journald:
    - # systemctl restart systemd-journald -

    - -

    - The wiki recommends that if the journal gets too large, you can also simply delete (rm -rf) everything inside /var/log/journald/* - but recommends backing it up. This shouldn't be necessary, since you already set the size limit above and systemd will automatically - start to delete older records when the journal size reaches it's limit (according to systemd developers). -

    - -

    - Finally, the wiki mentions 'temporary' files and the utility for managing them.
    - # man systemd-tmpfiles
    - The command for 'clean' is:
    - # systemd-tmpfiles --clean
    - According to the manpage, this "cleans all files and directories with an age parameter". - According to the Arch wiki, this reads information in /etc/tmpfiles.d/ and /usr/lib/tmpfiles.d/ - to know what actions to perform. Therefore, it is a good idea to read what's stored in these locations - to get a better understanding. -

    -

    - I looked in /etc/tmpfiles.d/ and found that it was empty on my system. However, /usr/lib/tmpfiles.d/ contained some files. - The first one was etc.conf, containing information and a reference to this manpage:
    - # man tmpfiles.d
    - Read that manpage, and then continue studying all of the files. -

    -

    - The systemd developers tell me that it usually isn't necessary to touch the systemd-tmpfiles utility manually at all. -

    - -

    Back to top of page

    - -
    - -

    Interesting repositories

    -

    - Parabola wiki at https://wiki.parabolagnulinux.org/Repositories#kernels - mentions about a repository called [kernels] for custom kernels that aren't in the default base. It might be worth looking into what is available - there, depending on your use case. -

    -

    - I enabled it on my system, to see what was in it. Edit /etc/pacman.conf and below the 'extra' section add:
    - - [kernels]
    - Include = /etc/pacman.d/mirrorlist -
    -

    -

    - Now sync with the repository:
    - # pacman -Syy -

    -

    - List all available packages in this repository:
    - # pacman -Sl kernels -

    -

    - In the end, I decided not to install anything from it but I kept the repository enabled regardless. -

    -

    Back to top of page.

    - -
    - -

    Setup a network connection in Parabola

    -

    - Read https://wiki.archlinux.org/index.php/Configuring_Network. -

    -

    - Back to top of page. -

    -

    Set the hostname

    -

    - This should be the same as the hostname that you set in /etc/hostname when installing Parabola. You can also do it with systemd (do so now, if you like):
    - # hostnamectl set-hostname yourhostname
    - This writes the specified hostname to /etc/hostname. More information can be found in these manpages:
    - # man hostname
    - # info hostname
    - # man hostnamectl -

    -

    - Add the same hostname to /etc/hosts, on each line. Example:
    - - 127.0.0.1 localhost.localdomain localhost myhostname
    - ::1 localhost.localdomain localhost myhostname -
    -

    -

    - You'll note that I set both lines; the 2nd line is for IPv6. More and more ISP's are providing this now (mine does) - so it's good to be forward-thinking here. -

    -

    - The hostname utility is part of the inetutils package and is in core/, installed by default (as part of base). -

    -

    - Back to top of page. -

    -

    Network Status

    -

    - According to the Arch wiki, udev should already detect the ethernet chipset - and load the driver for it automatically at boot time. You can check this in the "Ethernet controller" section - when running this command:
    - # lspci -v -

    -

    - Look at the remaining sections 'Kernel driver in use' and 'Kernel modules'. In my case it was as follows:
    - - Kernel driver in use: e1000e
    - Kernel modules: e1000e -
    -

    -

    - Check that the driver was loaded by issuing dmesg | grep module_name. In my case, I did:
    - # dmesg | grep e1000e -

    -

    Network device names

    -

    - According to https://wiki.archlinux.org/index.php/Configuring_Network#Device_names, - it is important to note that the old interface names like eth0, wlan0, wwan0 and so on no longer apply. Instead, systemd - creates device names starting with en (for enternet), wl (for wifi) and ww (for wwan) with a fixed identifier that systemd automatically generates. - An example device name for your ethernet chipset would be enp0s25, where it is never supposed to change. -

    -

    - If you want to enable the old names (eth0, wlan0, wwan0, etc), the Arch wiki recommends - adding net.ifnames=0 to your kernel parameters (in libreboot context, this would be accomplished by following the - instructions in grub_cbfs.html). -

    -

    - For background information, - read Predictable Network Interface Names -

    -

    - Show device names:
    - # ls /sys/class/net -

    -

    - Changing the device names is possible (I chose not to do it):
    - https://wiki.archlinux.org/index.php/Configuring_Network#Change_device_name -

    -

    - Back to top of page. -

    -

    Network setup

    -

    - I actually chose to ignore most of Networking section on the wiki. Instead, I plan to setup LXDE desktop with the graphical - network-manager client. Here is a list of network managers:
    - https://wiki.archlinux.org/index.php/List_of_applications/Internet#Network_managers. - If you need to, set a static IP address (temporarily) using the networking guide an the Arch wiki, or start the dhcpcd service in systemd. - NetworkManager will be setup later, after installing LXDE. -

    -

    - Back to top of page. -

    - -
    - -

    System Maintenance

    -

    - Read https://wiki.archlinux.org/index.php/System_maintenance before continuing. - Also read https://wiki.archlinux.org/index.php/Enhance_system_stability. - This is important, so make sure to read them! -

    -

    - Install smartmontools (can be used to check smart data - note: HDD's use non-free firmware inside, it's transparent to you - but the smart data comes from it. Therefore, don't rely on it too much):
    - # pacman -S smartmontools
    - Read https://wiki.archlinux.org/index.php/S.M.A.R.T. to learn how to use it. -

    -

    - Back to top of page. -

    - -
    - -

    Configuring the desktop

    -

    - Based on steps from - General Recommendations on the Arch wiki. - The plan is to use LXDE and LXDM/LightDM, along with everything else that you would expect on other distributions that provide LXDE - by default. -

    -

    - Back to top of page. -

    - -

    Installing Xorg

    -

    - Based on https://wiki.archlinux.org/index.php/Xorg. -

    -

    - Firstly, install it!
    - # pacman -S xorg-server
    - I also recommend installing this (contains lots of useful tools, including xrandr):
    - # pacman -S xorg-server-utils -

    -

    - Install the driver. For me this was xf86-video-intel on the ThinkPad X60. T60 and macbook11/21 should be the same.
    - # pacman -S xf86-video-intel
    - For other systems you can try:
    - # pacman -Ss xf86-video- | less
    - Combined with looking at your lspci output, you can determine which driver is needed. - By default, Xorg will revert to xf86-video-vesa which is a generic driver and doesn't provide true hardware acceleration. -

    -

    - Other drivers (not just video) can be found by looking at the xorg-drivers group:
    - # pacman -Sg xorg-drivers
    -

    -

    - Mostly you will rely on a display manager, but in case you ever want to start X without one:
    - # pacman -S xorg-xinit -

    -

    - <optional>
    -    Arch wiki recommends installing these, for testing that X works:
    -    # pacman -S xorg-twm xorg-xclock xterm
    -    Refer to https://wiki.archlinux.org/index.php/Xinitrc. - and test X:
    -    # startx
    -    When you are satisfied, type exit in xterm, inside the X session.
    -    Uninstall them (clutter. eww): # pacman -S xorg-xinit xorg-twm xorg-xclock xterm
    - </optional> -

    -

    - Back to top of page. -

    - -

    Xorg keyboard layout

    -

    - Refer to https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg. -

    -

    - Xorg uses a different configuration method for keyboard layouts, so you will notice that the layout you - set in /etc/vconsole.conf earlier might not actually be the same in X. -

    -

    - To see what layout you currently use, try this on a terminal emulator in X:
    - # setxkbmap -print -verbose 10 -

    -

    - In my case, I wanted to use the Dvorak (UK) keyboard which is quite different from Xorg's default Qwerty (US) layout. -

    -

    - I'll just say it now: XkbModel can be pc105 in this case (ThinkPad X60, with a 105-key UK keyboard). - If you use an American keyboard (typically 104 keys) you will want to use pc104. -

    -

    - XkbLayout in my case would be gb, and XkbVariant would be dvorak. -

    -

    - The Arch wiki recommends two different methods for setting the keyboard layout:
    - https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_X_configuration_files and
    - https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_localectl. -

    -

    - In my case, I chose to use the configuration file method:
    - Create the file /etc/X11/xorg.conf.d/10-keyboard.conf and put this inside:
    - - Section "InputClass"
    -         Identifier "system-keyboard"
    -         MatchIsKeyboard "on"
    -         Option "XkbLayout" "gb"
    -         Option "XkbModel" "pc105"
    -         Option "XkbVariant" "dvorak"
    - EndSection -
    -

    -

    - For you, the steps above may differ if you have a different layout. If you use a US Qwerty keyboard, then - you don't even need to do anything (though it might help, for the sake of being explicit). -

    -

    - Back to top of page. -

    - -

    Install LXDE

    -

    - Desktop choice isn't that important to me, so for simplicity I decided to use LXDE. It's lightweight - and does everything that I need. - If you would like to try something different, refer to - https://wiki.archlinux.org/index.php/Desktop_environment -

    -

    - Refer to https://wiki.archlinux.org/index.php/LXDE. -

    -

    - Install it, choosing 'all' when asked for the default package list:
    - # pacman -S lxde obconf -

    -

    - I didn't want the following, so I removed them:
    - # pacman -R lxmusic lxtask -

    -

    - I also lazily installed all fonts:
    - # pacman -S $(pacman -Ssq ttf-) -

    -

    - LXDE comes with a terminal. You probably want a browser to go with that; I choose GNU IceCat, part of the GNU project:
    - # pacman -S icecat
    - And a mail client:
    - # pacman -S icedove -

    -

    - In IceCat, go to Preferences :: Advanced and disable GNU IceCat Health Report. -

    -

    - I also like to install these:
    - # pacman -S xsensors stress htop -

    -

    - Enable LXDM (the default display manager, providing a graphical login):
    - # systemctl enable lxdm.service
    - It will start when you boot up the machine. To start it now, do:
    - # systemctl start lxdm.service -

    -

    - Log in with your standard (non-root) user that you created earlier. - It is advisable to also create an xinitrc rule in case you ever want to start lxde without lxdm. - Read https://wiki.archlinux.org/index.php/Xinitrc. -

    -

    - Open LXterminal:
    - $ cp /etc/skel/.xinitrc ~
    - Open .xinitrc and add the following plus a line break at the bottom of the file.
    - - # Probably not needed. The same locale info that we set before
    - # Based on advice from the LXDE wiki - export LC_ALL=en_GB.UTF-8
    - export LANGUAGE=en_GB.UTF-8
    - export LANG=en_GB.UTF-8
    -
    - # Start lxde desktop
    - exec startlxde
    -
    - Now make sure that it is executable:
    - $ chmod +x .xinitrc -

    -

    - Back to top of page. -

    - -

    LXDE - clock

    -

    - In Digital Clock Settings (right click the clock) I set the Clock Format to %Y/%m/%d %H:%M:%S -

    -

    - Back to top of page. -

    - -

    LXDE - font

    -

    - NOTE TO SELF: come back to this later. -

    -

    - Back to top of page. -

    - -

    LXDE - screenlock

    -

    - Arch wiki recommends to use xscreensaver:
    - # pacman -S xscreensaver -

    -

    - Under Preferences :: Screensaver in the LXDE menu, I chose Mode: Blank Screen Only, - setting Blank After, Cycle After and Lock Screen After (checked) to 10 minutes. -

    -

    - You can now lock the screen with Logout :: Lock Screen in the LXDE menu. -

    -

    - Back to top of page. -

    - -

    LXDE - automounting

    -

    - Refer to https://wiki.archlinux.org/index.php/File_manager_functionality. -

    -

    - I chose to ignore this for now. NOTE TO SELF: come back to this later. -

    -

    - Back to top of page. -

    -

    LXDE - disable suspend

    -

    - When closing the laptop lid, the machine suspends. This is annoying at least to me. - NOTE TO SELF: disable it, then document the steps here. -

    -

    - Back to top of page. -

    -

    LXDE - battery monitor

    -

    - Right click lxde panel and Add/Remove Panel Items. Click Add and select Battery Monitor, then click Add. - Close and then right-click the applet and go to Battery Monitor Settings, check the box that says Show Extended Information. - Now click Close. When you hover the cursor over it, it'll show information about the battery. -

    -

    - Back to top of page. -

    -

    LXDE - Network Manager

    -

    - Refer to https://wiki.archlinux.org/index.php/LXDE#Network_Management. - Then I read: https://wiki.archlinux.org/index.php/NetworkManager. -

    -

    - Install Network Manager:
    - # pacman -S networkmanager -

    -

    - You will also want the graphical applet:
    - # pacman -S network-manager-applet
    - Arch wiki says that an autostart rule will be written at /etc/xdg/autostart/nm-applet.desktop -

    -

    - I want to be able to use a VPN at some point, so the wiki tells me to do:
    - # pacman -S networkmanager-openvpn -

    -

    - LXDE uses openbox, so I refer to:
    - https://wiki.archlinux.org/index.php/NetworkManager#Openbox. -

    -

    - It tells me for the applet I need:
    - # pacman -S xfce4-notifyd gnome-icon-theme
    - Also, for storing authentication details (wifi) I need:
    - # pacman -S gnome-keyring -

    -

    - I wanted to quickly enable networkmanager:
    - # systemctl stop dhcpcd
    - # systemctl start NetworkManager
    - Enable NetworkManager at boot time:
    - # systemctl enable NetworkManager -

    -

    - Restart LXDE (log out, and then log back in). -

    -

    - I added the volume control applet to the panel (right click panel, and add a new applet). - I also later changed the icons to use the gnome icon theme, in lxappearance. -

    -

    - Back to top of page. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/dock.html b/docs/howtos/dock.html deleted file mode 100644 index ef62e83..0000000 --- a/docs/howtos/dock.html +++ /dev/null @@ -1,163 +0,0 @@ - - - - - - - - - Notes about DMA and the docking station (X60/T60) - - - -
    -

    Notes about DMA and the docking station (X60/T60)

    - -
    - -
    -
    -Use case:
    ----------
    -Usually when people do full disk encryption, it's not really full disk,
    -instead they still have a /boot in clear.
    -
    -So an evil maid attack can still be done, in two passes:
    -1) Clone the hdd, Infect the initramfs or the kernel.
    -2) Wait for the user to enter its password, recover the password,
    -luksOpen the hdd image.
    -
    -I wanted a real full-disk encryption so I've put grub in flash and I
    -have the following: The HDD has a LUKS rootfs(containing /boot) on an
    -lvm partition, so no partition is in clear.
    -
    -So when the computer boots it executes coreboot, then grub as a payload.
    -Grub then opens the LUKS partition and loads the kernel and initramfs
    -from there.
    -
    -To prevent hardware level tempering(like reflashing), I used nail
    -polish with a lot of gilder, that acts like a seal. Then a high
    -resolution picture of it is taken, to be able to tell the difference.
    -
    -The problem:
    -------------
    -But then comes the docking port issue: Some LPC pins are exported
    -there, such as the CLKRUN and LDRQ#.
    -
    -LDRQ# is "Encoded DMA/Bus Master Request": "Only needed by
    -peripherals that need DMA or bus mastering. Requires an
    -individual signal per peripheral. Peripherals may not share
    -an LDRQ# signal."
    -
    -So now DMA access is possible trough the dock connector.
    -So I want to be able to turn that off.
    -
    -If I got it right, the X60 has 2 superio, one is in the dock, and the
    -other one is in the laptop, so we have:
    -                            ________________
    - _________________         |                |
    -|                 |        | Dock connector:|
    -|Dock: NSC pc87982|<--LPC--->D_LPC_DREQ0    |
    -|_________________|        |_______^________|
    -                                   |
    -                                   |
    -                                   |
    -                                   |
    -                ___________________|____
    -               |                   v    |
    -               | SuperIO:        DLDRQ# |
    -               | NSC pc87382     LDRQ#  |
    -               |___________________^____|
    -                                   |
    -                                   |
    -                                   |
    -                                   |
    -                ___________________|___
    -               |                   v   |
    -               | Southbridge:    LDRQ0 |
    -               | ICH7                  |
    -               |_______________________|
    -
    -
    -The code:
    ----------
    -Now if I look at the existing code, there is some superio drivers, like
    -pc87382 in src/superio/nsc, the code is very small. 
    -The only interesting part is the pnp_info pnp_dev_info struct.
    -
    -Now if I look inside src/mainboard/lenovo/x60 there is some more
    -complete dock driver:
    -
    -Inside dock.c I see some dock_connect and dock_disconnect functions.
    -
    -Such functions are called during the initialisation (romstage.c) and
    -from the x60's SMI handler (smihandler.c).
    -
    -Questions:
    -----------
    -1) Would the following be sufficent to prevent DMA access from the
    -outside:
    -> int dock_connect(void)
    -> {
    ->          int timeout = 1000;
    -> +        int val;
    -> +        
    -> +        if (get_option(&val, "dock") != CB_SUCCESS)
    -> +                val = 1;
    -> +        if (val == 0)
    -> +                return 0;
    ->          [...]
    -> }
    ->
    -> void dock_disconnect(void) {
    -> +        if (dock_present())
    -> +                return;
    ->          [...]
    -> }
    -2) Would an nvram option be ok for that? Should a Kconfig option be
    -added too?
    -
    -> config DOCK_AUTODETECT
    ->         bool "Autodetect"
    ->         help
    ->           The dock is autodetected. If unsure select this option.
    ->
    -> config DOCK_DISABLED
    ->         bool "Disabled"
    ->         help
    ->           The dock is always disabled.
    ->
    -> config DOCK_NVRAM_ENABLE
    ->         bool "Nvram"
    ->         help
    ->           The dock autodetection is tried only if it is also enabled
    -> trough nvram.
    -
    -
    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt - - - diff --git a/docs/howtos/encrypted_parabola.html b/docs/howtos/encrypted_parabola.html deleted file mode 100644 index 3a1a75d..0000000 --- a/docs/howtos/encrypted_parabola.html +++ /dev/null @@ -1,577 +0,0 @@ - - - - - - - - - Installing Parabola GNU/Linux with full disk encryption (including /boot) - - - -

    -

    Installing Parabola GNU/Linux with full disk encryption (including /boot)

    -
    -
    - -

    - Libreboot uses the GRUB payload - by default, which means that the GRUB configuration file - (where your GRUB menu comes from) is stored directly alongside libreboot - and it's GRUB payload executable, inside - the flash chip. In context, this means that installing distributions and managing them - is handled slightly differently compared to traditional BIOS systems. -

    - -

    - On most systems, the /boot partition has to be left unencrypted while the others are encrypted. - This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware - can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a - payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical - access to the machine. -

    - -

    - Boot Parabola's install environment. How to boot a GNU/Linux installer. -

    - -

    - For this guide I used the 2013 09 01 image to boot the live installer and install the system. -

    - -

    - Parabola is much more flexible than Trisquel, but also more involved to setup. Use Parabola. It's 10 million times better than Trisquel. -

    - -

    - Firstly if you use an SSD, beware there are issues with TRIM (not enabled through luks) and security issues if you do enable it. - See this page - for more info. -

    - -

    - If you are using an SSD for this, make sure it's brand-new (or barely used). Or, otherwise, be sure that it never previously - contained plaintext copies of your data. -

    - -

    - Wipe the MBR (if you use MBR):
    - # lsblk
    - Your HDD is probably /dev/sda: - # dd if=/dev/zero of=/dev/sda bs=446 count=1; sync
    - Never use SeaBIOS! The MBR section can easily be changed with malicious code, which SeaBIOS will blindly execute. - This guide is for libreboot with GRUB-as-payload only. -

    - -

    - Securely wipe the drive:
    - # dd if=/dev/urandom of=/dev/sda; sync
    - NOTE: If you have an SSD, only do this the first time. If it was already LUKS-encrypted before, - use the info below to wipe the LUKS header. Also, check online for your SSD what the recommended - erase block size is. For example if it was 2MiB:
    - # dd if=/dev/urandom of=/dev/sda bs=2M; sync -

    -

    - If your drive was already LUKS encrypted (maybe you are re-installing your distro) then - it is already 'wiped'. You should just wipe the LUKS header. - https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/ - showed me how to do this. It recommends to do the first 3MiB. Now, that guide is recommending putting zero there. I'm doing to use urandom. Do this:
    - # head -c 3145728 /dev/urandom > /dev/sda; sync
    - (wiping the LUKS header is important, since it has hashed passphrases and so on. It's 'secure', but 'potentially' a risk). -

    -

    - - If you do plan to use an SSD, make sure to read - https://wiki.archlinux.org/index.php/Solid_State_Drives
    - Edit /etc/fstab later on when chrooted into your install. Also, read the whole article and keep all points in mind, adapting - them for this guide. -
    -

    - -

    - This guide will go through the installation steps taken at the time of writing, which may or may not change due to - the volatile nature of Parabola (it changes all the time). In general most of it should remain the same. If you spot mistakes, - please say so! This guide will be ported to the Parabola wiki at a later date. For up to date Parabola install guide, go to - the Parabola wiki. This guide essentially cherry picks the useful information (valid at the time of writing: 2014-09-15). -

    - -

    - Change keyboard layout -

    -

    - Parabola live shell assumes US Qwerty. If you have something different, use:
    - # loadkeys LAYOUT
    - For me, LAYOUT would have been dvorak-uk. -

    - -

    Getting started

    -

    - The beginning is based on https://wiki.parabolagnulinux.org/Installation_Guide. - Then I referred to https://wiki.archlinux.org/index.php/Partitioning at first. -

    - -

    dm-mod

    -

    - device-mapper will be used - a lot. Make sure that the kernel module is loaded:
    - # modprobe dm-mod -

    - -

    Create LUKS partition

    -

    - I am using MBR partitioning, so I use cfdisk:
    - # cfdisk /dev/sda -

    -

    - I create a single large sda1 filling the whole drive, leaving it as the default type 'Linux' (83). -

    -

    - Now I refer to https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning:
    - I am then directed to https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption. -

    -

    - Parabola forces you to RTFM. -

    -

    - It tells me to run:
    - # cryptsetup benchmark (for making sure the list below is populated)
    - Then:
    - # cat /proc/crypto
    - This gives me crypto options that I can use. It also provides a representation of the best way to setup LUKS (in this case, security is a priority; speed, a distant second). - To gain a better understanding, I am also reading:
    - # man cryptsetup -

    -

    - Following that page, based on my requirements, I do the following based on - based on https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode. - Reading through, it seems like Serpent (encryption) and Whirlpool (hash) is the best option. -

    -

    - I am initializing LUKS with the following:
    - # cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool --use-random --verify-passphrase luksFormat /dev/sda1 - -- choose a secure passphrase here. Ideally lots of lowercase/uppercase numbers, letters, symbols etc all in a random pattern. The password - length should be as long as you are able to handle without writing it down or storing it anywhere. Ideally, 100 characters or more. - It might take you a while to memorize a long passphrase before beginning this step. -

    - -

    Create LVM

    -

    - Now I refer to https://wiki.archlinux.org/index.php/LVM. -

    -

    - Open the LUKS partition:
    - # cryptsetup open --type luks /dev/sda1 lvm
    - (it will be available at /dev/mapper/lvm)
    - I'm told that the above is old syntax, which is what I did anyway. You could also try:
    - # cryptsetup luksOpen /dev/sda1 lvm -

    -

    - Create LVM partition:
    - # pvcreate /dev/mapper/lvm
    - Show that you just created it:
    - # pvdisplay -

    -

    - Now I create the volume group, inside of which the logical volumes will be created:
    - # vgcreate matrix /dev/mapper/lvm (volume group name is 'matrix')
    - Show that you created it:
    - # vgdisplay -

    -

    - Now create the logical volumes:
    - # lvcreate -L 2G matrix -n swapvol (2G swap partition, named swapvol)
    - # lvcreate -l +100%FREE matrix -n rootvol (single large partition in the rest of the space, named rootvol)
    - You can also be flexible here, for example you can specify a /boot, a /, a /home, a /var, a /usr, etc. For example, - if you will be running a web/mail server then you want /var in it's own partition (so that if it fills up with logs, it won't crash your system). - For a home/laptop system (typical use case), a root and a swap will do (really). -

    -

    - Verify that the logical volumes were created, using the following command:
    - # lvdisplay -

    - -

    Create / and swap partitions

    -

    - For the swapvol LV I use:
    - # mkswap /dev/mapper/matrix-swapvol -

    -

    - For the rootvol LV I use:
    - # mkfs.ext4 /dev/mapper/matrix-rootvol -

    - -

    Continue with Parabola installation

    -

    - Mount the root (/) partition:
    - # mount /dev/matrix/rootvol /mnt
    -

    -

    - This guide is really about GRUB, Parabola and cryptomount. I have to show how to install Parabola - so that the guide can continue. -

    -

    - Now I am following the rest of https://wiki.parabolagnulinux.org/Installation_Guide. - I also also cross referencing https://wiki.archlinux.org/index.php/Installation_guide. -

    -

    - Create /home and /boot on rootvol mountpoint:
    - # mkdir /mnt/home
    - # mkdir /mnt/boot -

    -

    - The wiki says to enable the swap so that it can be detected by 'genfstab':
    - # swapon /dev/matrix/swapvol -

    -

    - DHCP was already working for me, so I had internet during the install. Therefore, I ignore the 'Connect to the Internet' section of the install guide. - I also ignore wifi, since I can set that up after the install. For now, I am just using ethernet. - Otherwise, refer to https://wiki.archlinux.org/index.php/Configuring_Network. - You can test to see if internet is already working by pinging a few domains. -

    - -

    - I commented out all lines except the Server line for the UK Parabola server (main server) in /etc/pacman.d/mirrorlist and then did:
    - # pacman -Syy
    - # pacman -Syu
    - # pacman -Sy pacman (and then I did the other 2 steps above, again)
    - In my case I did the steps in the next paragraph, and followed the steps in this paragraph again. -

    -

    - <troubleshooting>
    -    The following is based on 'Verification of package signatures' in the Parabola install guide.
    -    Check there first to see if steps differ by now.
    -    Now you have to update the default Parabola keyring. This is used for signing and verifying packages:
    -    # pacman -Sy parabola-keyring
    -    It says that you you get GPG errors, it's probably an expired key so do:
    -    # pacman-key --populate parabola
    -    # pacman-key --refresh-keys
    -    # pacman -Sy parabola-keyring
    -    To be honest, you should do the above anyway. Parabola has a lot of maintainers, and a lot of keys. Really!
    -    Also, it says that if the clock is set incorrectly then you have to manually set the correct time
    -    (if keys are listed as expired because of it):
    -    # date MMDDhhmm[[CC]YY][.ss]
    -    I also had to install:
    -    # pacman -S archlinux-keyring
    -    # pacman-key --populate archlinux
    -    In my case I saw some conflicting files reported in pacman, stopping me from using it.
    -    I deleted the files that it mentioned - and then it worked. Specifically, I had this error:
    -    licenses: /usr/share/licenses/common/MPS exists in filesystem
    -    I rm -rf'd the file and then pacman worked. I'm told that the following would have also made it work:
    -    # pacman -Sf licenses
    - </troubleshooting>
    -

    -

    - I also like to install other packages (base-devel, compilers and so on) and wpa_supplicant/dialog are needed for wireless after the install:
    - # pacstrap /mnt base base-devel wpa_supplicant dialog -

    - -

    Configure the system

    -

    - From the Parabola installation guide (Arch's one was identical):
    - # genfstab -p /mnt >> /mnt/etc/fstab -

    -

    - Chroot into new system:
    - # arch-chroot /mnt -

    -

    - It's a good idea to have this installed:
    - # pacman -S linux-libre-lts -

    -

    - It was also suggested that you should install this kernel (read up on what GRSEC is):
    - # pacman -S linux-libre-grsec -

    -

    - This is another kernel that sits inside /boot, which you can use. LTS means 'long-term support'. These are so-called 'stable' kernels - that can be used as a fallback during updates, if a bad kernel causes issues for you. -

    -

    - Parabola does not have wget. This is sinister. Install it:
    - # pacman -S wget -

    -
      -
    • Write your hostname to /etc/hostname
    • -
    • - Symlink /etc/localtime to /usr/share/zoneinfo/Zone/SubZone. Replace Zone and Subzone to your liking. For example: -
        -
      • # ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
      • -
      -
    • -
    • - Set locale preferences in /etc/locale.conf. In my case, I did:
      - - LANG="en_GB.UTF-8"
      - # Keep the default sort order (e.g. files starting with a '.'
      - # should appear at the start of a directory listing.)
      - LC_COLLATE="C"
      - # Set the short date to YYYY-MM-DD (test with "date +%c")
      - LC_TIME="en_GB.UTF-8" -
      -
    • -
    • - Add console keymap and font preferences in /etc/vconsole.conf. In my case:
      - - KEYMAP=dvorak-uk
      - FONT=Lat2-Terminus16 -
      -
    • -
    • - Uncomment the selected locale (same as what you specified in /etc/locale.conf) in /etc/locale.gen and generate it with: -
        -
      • # locale-gen
      • -
      -
    • -
    • - Configure /etc/mkinitcpio.conf as needed (see mkinitcpio) - Specifically, for this use case:
      -
        -
      • - add i915 to the MODULES array (forces the driver to load earlier, so that the consolefont isn't wiped out after getting to login).
        - add encrypt and lvm2 in that order, before the 'filesystems' entry in the HOOKS array.
        - add keymap, consolefont and shutdown to the end of the HOOKS array in that order.
        - move keyboard, keymap and consolefont in that order, to go before 'encrypt' in the HOOKS array.
        - At the end your HOOKS array will look like this:
        - HOOKS="base udev autodetect modconf block keyboard keymap consolefont encrypt lvm2 filesystems fsck shutdown" -
          -
        • keymap adds to initramfs the keymap that you specified in /etc/vconsole.conf
        • -
        • consolefont adds to initramfs the font that you specified in /etc/vconsole.conf
        • -
        • encrypt adds LUKS support to the initramfs - needed to unlock your disks at boot time
        • -
        • lvm2 adds LVM support to the initramfs - needed to mount the LVM partitions at boot time
        • -
        • shutdown is needed according to Parabola wiki for unmounting devices (such as LUKS/LVM) during shutdown
        • -
        • - Runtime modules can be found in /usr/lib/initcpio/hooks, and build hooks can be found in - /usr/lib/initcpio/install. -
        • -
        • mkinitcpio -H hookname gives information about each hook.
        • -
        -
      • -
      -
    • -
    • - Now using mkinitcpio, you can create the kernel and ramdisk for booting with (note, this is different than Arch, specifying linux-libre instead of linux):
      - # mkinitcpio -p linux-libre
      - Also do it for linux-libre-lts:
      - # mkinitcpio -p linux-libre-lts
      - Also do it for linux-libre-grsec:
      - # mkinitcpio -p linux-libre-grsec -
    • -
    - -

    Set a root password

    -

    - At the time of writing, Parabola used SHA512 by default for it's password hashing. -

    -

    - I referred to https://wiki.archlinux.org/index.php/SHA_password_hashes. -

    -

    - Open /etc/pam.d/passwd and add rounds=65536 at the end of the uncommented 'password' line. -

    -

    - # passwd root
    - Make sure to set a secure password! Also, it must never be the same as your LUKS password. -

    - -

    Extra security tweaks

    -

    - Based on https://wiki.archlinux.org/index.php/Security. -

    -

    - Restrict access to important directories:
    - # chmod 700 /boot /etc/{iptables,arptables} -

    -

    - Lockout user after three failed login attempts:
    - Edit the file /etc/pam.d/system-login and comment out that line:
    - # auth required pam_tally.so onerr=succeed file=/var/log/faillog
    - Or just delete it. Above it, put:
    - auth required pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
    - To unlock a user manually (if a password attempt is failed 3 times), do:
    - # pam_tally --user theusername --reset - What the above configuration does is lock the user out for 10 minutes, if they make 3 failed login attempts. -

    -

    - Configure sudo - not covered here. Will be covered post-installation in another tutorial, at a later date. - If this is a single-user system, you don't really need sudo. -

    - -

    Unmount, reboot!

    -

    - Exit from chroot:
    - # exit -

    -

    - unmount:
    - # umount /mnt
    - # swapoff -a -

    -

    - deactivate the lvm lv's:
    - # lvchange -an /dev/matrix/rootvol
    - # lvchange -an /dev/matrix/swapvol
    -

    -

    - Lock the encrypted partition (close it):
    - # cryptsetup luksClose lvm -

    -

    - # shutdown -h now
    - Then boot up again. -

    - -

    Booting from GRUB

    -

    - Initially you will have to boot manually. Press C to get to the GRUB command line. The underlined parts are optional - (using those 2 underlines will boot lts kernel instead of normal). -

    -

    - grub> cryptomount -a (ahci0,msdos1)
    - grub> set root='lvm/matrix-rootvol'
    - grub> linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
    - grub> initrd /boot/initramfs-linux-libre-lts.img
    - grub> boot
    -

    -

    - You could also make it load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img -

    - -
    - -

    Modify grub.cfg inside the ROM

    - -

    - Now you need to modify the ROM, so that Parabola can boot automatically with this configuration. - grub_cbfs.html shows you how. Follow that guide, using the configuration details below. -

    -

    - Inside the 'Load Operating System' menu entry, change the contents to:
    - - cryptomount -a (ahci0,msdos1)
    - set root='lvm/matrix-rootvol'
    - linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
    - initrd /boot/initramfs-linux-libre-lts.img -
    -

    - -

    - Note: the underlined parts above (-lts) can also be removed, to boot the latest kernel instead of LTS (long-term support) kernels. - You could also copy the menu entry and in one have -lts, and without in the other menuentry. - You could also create a menu entry to load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img -

    - -

    - Personally, I opted to have the entry for linux-libre-grsec at the top, so that it would load by default. -

    - -

    - Above the 'Load Operating System' menu entry you should also add a GRUB password, like so: -

    -
    set superusers="root"
    -password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711
    -
    - -

    - Note that the above entry specifies user 'root'; this is just a username for GRUB. You don't even need to use root. - Change root on both of those 2 lines to whatever you want. -

    - -

    - Start dhcp on ethernet:
    - # systemctl start dhcpcd.service - This is just for the step below. I won't cover network configuration here. That is for another Parabola article. -

    - -

    - The password hash (it's password, by the way) after 'password_pbkdf2 root' should be changed and is created by the grub-mkpasswd-pbkdf2 utility, which you need to install or otherwise compile, - like so:
    - # pacman -S grub -

    - -

    - GRUB isn't needed for booting, since it's already included as a payload in libreboot. This is only so that the utility needed becomes available. Get your hash - by entering your chosen password at the prompt, when running this command:
    - # grub-mkpasswd-pbkdf2 -

    - -

    - It will output the hash for the password that you entered. Make sure to specify a password that is different from both your LUKS *and* your root/user password. - Use it to replace the default hash mentioned above. -

    - -

    - With this setup, you will have to enter a password at boot time, in GRUB, before being able to use any of the menu entries or switch to the terminal. - This protects your system from an attacker simply booting a live usb distro and re-flashing the boot firmware. -

    - -

    - You probably only need base-devel (compilers and so on) to build and use cbfstool. It was already installed if you followed this tutorial, but here it is:
    - # pacman -S base-devel -

    - -

    - For flashing the modified ROM, I just used flashrom from the Parabola repo's:
    - # pacman -S flashrom
    - I also installed dmidecode:
    - # pacman -S dmidecode -

    - -

    - When done, deleted GRUB (remember, we only needed it for the grub-mkpasswd-pbkdf2 utility; - GRUB is already part of libreboot, flashed alongside it as a payload):
    - # pacman -R grub -

    - -
    - -

    - If you followed all that correctly, you should now have a fully encrypted Parabola installation. - This is a very barebones Parabola install (the default one). Refer to the wiki for how to do the rest - (desktop, etc). -

    - -
    - -

    Further security tips

    -

    - https://wiki.archlinux.org/index.php/Security.
    - https://wiki.parabolagnulinux.org/User:GNUtoo/laptop -

    - -
    - -

    Follow-up tutorial: configuring Parabola

    -

    - configuring_parabola.html shows my own notes post-installation. Using these, you can get a basic - system similar to the one that I chose for myself. You can also cherry pick useful notes and come up with your own system. - Parabola is user-centric, which means that you are in control. For more information, read The Arch Way - (Parabola also follows it). -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/encrypted_trisquel.html b/docs/howtos/encrypted_trisquel.html deleted file mode 100644 index 7599e02..0000000 --- a/docs/howtos/encrypted_trisquel.html +++ /dev/null @@ -1,316 +0,0 @@ - - - - - - - - - Installing Trisquel GNU/Linux with full disk encryption (including /boot) - - - -
    -

    Installing Trisquel GNU/Linux with full disk encryption (including /boot)

    - -
    - -

    - Libreboot uses the GRUB payload - by default, which means that the GRUB configuration file - (where your GRUB menu comes from) is stored directly alongside libreboot - and it's GRUB payload executable, inside - the flash chip. In context, this means that installing distributions and managing them - is handled slightly differently compared to traditional BIOS systems. -

    - -

    - On most systems, the /boot partition has to be left unencrypted while the others are encrypted. - This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware - can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a - payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical - access to the machine. -

    - -

    - This works in Trisquel 7, and probably Trisquel 6. Boot the 'net installer' (Install Trisquel in Text Mode). How to boot a GNU/Linux installer. -

    - -

    - Set a strong user password (ideally above 40 characters, of lowercase/uppercase, numbers and symbols). -

    - -

    - when the installer asks you to setup - encryption (ecryptfs) for your home directory, select 'Yes' if you want to: LUKS is already secure and performs well. Having ecryptfs on top of it - will add noticeable performance penalty, for little security gain in most use cases. This is therefore optional, and not recommended. - Choose 'no'. -

    - -

    - - Your user password should be different than the LUKS password which you will set later on. - Your LUKS password should, like the user password, be secure. - -

    - -

    Partitioning

    - -

    Choose 'Manual' partitioning:

    -
      -
    • Select drive and create new partition table
    • -
    • - Single large partition. The following are mostly defaults: -
        -
      • Use as: physical volume for encryption
      • -
      • Encryption: aes
      • -
      • key size: 256
      • -
      • IV algorithm: xts-plain64
      • -
      • Encryption key: passphrase
      • -
      • erase data: Yes (only choose 'No' if it's a new drive that doesn't contain your private data)
      • -
      -
    • -
    • - Select 'configure encrypted volumes' -
        -
      • Create encrypted volumes
      • -
      • Select your partition
      • -
      • Finish
      • -
      • Really erase: Yes
      • -
      • (erase will take a long time. be patient)
      • -
      • (if your old system was encrypted, just let this run for about a minute to - make sure that the LUKS header is wiped out)
      • -
      -
    • -
    • - Select encrypted space: -
        -
      • use as: physical volume for LVM
      • -
      • Choose 'done setting up the partition'
      • -
      -
    • -
    • - Configure the logical volume manager: -
        -
      • Keep settings: Yes
      • -
      -
    • -
    • - Create volume group: -
        -
      • Name: buzz (you can use whatever you want here, this is just an example)
      • -
      • Select crypto partition
      • -
      -
    • -
    • - Create logical volume -
        -
      • select buzz (or whatever you named it before)
      • -
      • name: distro (you can use whatever you want here, this is just an example)
      • -
      • size: default, minus 2048 MB
      • -
      -
    • -
    • - Create logical volume -
        -
      • select buzz (or whatever you named it before)
      • -
      • name: swap (you can use whatever you want here, this is just an example)
      • -
      • size: press enter
      • -
      -
    • -
    - -

    Further partitioning

    - -

    - Now you are back at the main partitioning screen. You will simply set mountpoints and filesystems to use. -

    -
      -
    • - LVM LV distro -
        -
      • use as: ext4
      • -
      • mount point: /
      • -
      • done setting up partition
      • -
      -
    • -
    • - LVM LV swap -
        -
      • use as: swap area
      • -
      • done setting up partition
      • -
      -
    • -
    • Now you select 'Finished partitioning and write changes to disk'.
    • -
    - -

    Kernel

    - -

    - Installation will ask what kernel you want to use. linux-generic is fine. -

    - -

    Tasksel

    - -

    - Choose "Trisquel Desktop Environment" if you want GNOME, - "Trisquel-mini Desktop Environment" if you - want LXDE or "Triskel Desktop Environment" if you want KDE. - If you want to have no desktop (just a basic shell) - when you boot or if you want to create your own custom setup, then choose nothing here (don't select anything). - You might also want to choose some of the other package groups; it's up to you. -

    - -

    Postfix configuration

    - -

    - If asked, choose "No Configuration" here (or maybe you want to select something else. It's up to you.) -

    - -

    Install the GRUB boot loader to the master boot record

    - -

    - Choose 'Yes'. It will fail, but don't worry. Then at the main menu, choose 'Continue without a bootloader'. - You could also choose 'No'. Choice is irrelevant here. -

    - -

    - You do not need to install GRUB at all, since in libreboot you are using the GRUB payload (for libreboot) to boot your system directly. -

    - -

    Clock UTC

    - -

    - Just say 'Yes'. -

    - -

    - Booting your system -

    - -

    - At this point, you will have finished the installation. At your GRUB payload, press C to get to the command line. -

    - -

    - Do that:
    - grub> cryptomount -a (ahci0,msdos1)
    - grub> set root='lvm/buzz-distro'
    - grub> linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root
    - grub> initrd /initrd.img
    - grub> boot -

    - -

    - ecryptfs -

    - -

    - If you didn't encrypted your home directory, then you can safely ignore this section. -

    - -

    - Immediately after logging in, do that:
    - $ sudo ecryptfs-unwrap-passphrase -

    - -

    - This will be needed in the future if you ever need to recover your home directory from another system, so write it down and keep the note - somewhere secret. Ideally, you should memorize it and then burn the note (or not even write it down, and memorize it still)> -

    - -

    - Modify grub.cfg (CBFS) -

    - -

    - Now you need to set it up so that the system will automatically boot, without having to type a bunch of commands. -

    - -

    - Modify your grub.cfg (in the firmware) using this tutorial; - just change the default menu entry 'Load Operating System' to say this inside: -

    - -

    - cryptomount -a (ahci0,msdos1)
    - set root='lvm/buzz-distro'
    - linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root
    - initrd /initrd.img -

    - -

    - Additionally, you should set a GRUB password. This is not your LUKS password, but it's a password that you have to enter to see - GRUB. This protects your system from an attacker simply booting a live USB and re-flashing your firmware. This should be different than your LUKS passphrase and user password. -

    - -

    - The GRUB utility can be used like so:
    - $ grub-mkpasswd-pbkdf2 -

    - -

    - Give it a password (remember, it has to be secure) and it'll output something like:
    - grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711 -

    - -

    - Put that in the grub.cfg (the one for CBFS inside the ROM) before the 'Load Operating System' menu entry like so (example):
    -

    -
    -set superusers="root"
    -password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711
    -		
    - -

    - Obviously, replace it with the correct hash that you actually got for the password that you entered. Meaning, not the hash that you see above! -

    - -

    - After this, you will have a modified ROM with the menu entry for cryptomount, and the entry before that for the GRUB password. Flash the modified ROM - using this tutorial. -

    - -

    - Update Trisquel -

    - -

    - $ sudo apt-get update
    - $ sudo apt-get upgrade -

    - -

    - Conclusion -

    - -

    - If you followed all that correctly, you should now have a fully encrypted system. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/grub_boot_installer.html b/docs/howtos/grub_boot_installer.html deleted file mode 100644 index 757b48f..0000000 --- a/docs/howtos/grub_boot_installer.html +++ /dev/null @@ -1,142 +0,0 @@ - - - - - - - - - Libreboot documentation: installing GNU/Linux - - - -
    -

    Boot a GNU/Linux installer on USB

    - -
    - -

    Prepare the USB drive (in GNU/Linux)

    - -

    - Connect the USB drive. Check dmesg:
    - $ dmesg
    - - Check lsblk to confirm which drive it is:
    - $ lsblk -

    - -

    - Check that it wasn't automatically mounted. If it was, unmount it. For example:
    - $ sudo umount /dev/sdb*
    - # umount /dev/sdb* -

    - -

    - dmesg told you what device it is. Overwrite the drive, writing your distro ISO to it with dd. For example:
    - $ sudo dd if=gnulinux.iso of=/dev/sdb bs=8M; sync
    - # dd if=gnulinux.iso of=/dev/sdb bs=8M; sync -

    - -

    Booting the USB drive (in GRUB)

    - -

    - Boot it in GRUB using the Parse ISOLINUX config (USB) option (it's in default libreboot grub.cfg, at least). - - A new menu should appear in GRUB, showing the boot options for that distro; this is a GRUB menu, converted from the usual - ISOLINUX menu provided by that distro. -

    - -

    - If the ISOLINUX parser won't work, then press C to get to GRUB command line.
    - grub> ls
    - - Get the device from above output, eg (usb0). Example:
    - grub> cat (usb0)/isolinux/isolinux.cfg
    - - Either this will show the ISOLINUX menuentries for that ISO, or link to other .cfg files, for example /isolinux/foo.cfg.
    - - If it did that, then you do:
    - grub> cat (usb0)/isolinux/foo.cfg
    - - And so on, until you find the correct menuentries for ISOLINUX. -

    - -

    - Now look at the ISOLINUX menuentry. It'll look like:
    - - kernel /path/to/kernel
    - append PARAMETERS initrd=/path/to/initrd MAYBE_MORE_PARAMETERS
    -
    - - GRUB works the same way, but in it's own way. Example GRUB commands:
    - grub> linux (usb0)/path/to/kernel PARAMETERS MAYBE_MORE_PARAMETERS
    - grub> initrd (usb0)/path/to/initrd
    - grub> boot
    - - Of course this will vary from distro to distro. If you did all that correctly, it should now be booting the ISO - the way you specified. -

    - -

    Troubleshooting

    - -

    - Most of these issues occur when using libreboot with coreboot's 'text mode' instead of the coreboot framebuffer. - This mode is useful for booting payloads like memtest86+ which expect text-mode, but for GNU/Linux distributions - it can be problematic when they are trying to switch to a framebuffer because it doesn't exist. -

    - -

    - In most cases, you should use the vesafb ROM's. Example filename: libreboot_ukdvorak_vesafb.rom. -

    - -

    parabola won't boot in text-mode

    - -

    - Use one of the ROM images with vesafb in the filename (uses coreboot framebuffer instead of text-mode). -

    - -

    debian-installer (trisquel net install) graphical corruption in text-mode

    -

    - When using the ROM images that use coreboot's "text mode" instead of the coreboot framebuffer, - booting the Trisquel net installer results in graphical corruption because it is trying to switch to a framebuffer which doesn't - exist. Use that kernel parameter on the 'linux' line when booting it:
    - vga=normal fb=false -

    - -

    - Tested in Trisquel 6 (and 7). This forces debian-installer to start in text-mode, instead of trying to switch to a framebuffer. -

    - -

    - If selecting text-mode from a GRUB menu created using the ISOLINUX parser, you can press E on the menu entry to add this. - Or, if you are booting manually (from GRUB terminal) then just add the parameters. -

    - -

    - This workaround was found on the page: https://www.debian.org/releases/stable/i386/ch05s04.html. - It should also work for gNewSense, Debian and any other apt-get distro that provides debian-installer (text mode) net install method. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/grub_cbfs.html b/docs/howtos/grub_cbfs.html deleted file mode 100644 index e603247..0000000 --- a/docs/howtos/grub_cbfs.html +++ /dev/null @@ -1,408 +0,0 @@ - - - - - - - - - Libreboot documentation: GRUB menu - - - -
    -

    How to change your default GRUB menu

    - -
    - -

    - Libreboot uses the GRUB payload - by default, which means that the GRUB configuration file - (where your GRUB menu comes from) is stored directly alongside libreboot - and it's GRUB payload executable, inside - the flash chip. In context, this means that installing distributions and managing them - is handled slightly differently compared to traditional BIOS systems. -

    - -

    - A libreboot (or coreboot) ROM image is not simply "flat"; there is an actual - filesystem inside called CBFS (coreboot filesystem). A utility called 'cbfstool' - allows you to change the contents of the ROM image. In this case, libreboot is configured - such that the 'grub.cfg' and 'grubtest.cfg' files exists directly inside CBFS instead of - inside the GRUB payload's 'memdisk' (which is itself stored in CBFS). -

    - -

    - Here is an excellent writeup about CBFS (coreboot filesystem): - http://lennartb.home.xs4all.nl/coreboot/col5.html. -

    - -
    - -

    Table of Contents

    - - - -
    - -

    Getting started

    - -

    - Download the latest release from - http://libreboot.org/ -
    If you downloaded from git, refer to - ../index.html#build_meta before continuing. -

    - -

    - Install the build dependencies. -

    - -

    - Back to top of page. -

    - -
    - -

    Build 'cbfstool' from source

    - -

    - If you are working with libreboot_src, then you can run make command in - libreboot_src/coreboot/util/cbfstool to build the cbfstool and rmodtool - executable. -

    -

    - Alternatively if you are working with libreboot_bin, then you can run ./builddeps-cbfstool - command inside libreboot_bin/; a cbfstool and rmodtool - executable will appear under libreboot_bin/ -

    - -

    - Back to top of page. -

    - -
    - -

    Which ROM image should I use?

    - -

    - You can work directly with one of the ROM's already included in the libreboot ROM archives. For the purpose of - this tutorial it is assumed that your ROM is named libreboot.rom so please make sure to adapt. -

    - -

    - If you want to re-use the ROM that you currently have flashed (and running) then see - ../index.html#build_flashrom - and then run:
    - $ sudo ./flashrom -p internal -r libreboot.rom
    - Notice that this is using "-r" (read) instead of "-w" (write). - This will create a dump (copy) of your current firmware and name it libreboot.rom. - You need to take ownership of the file. For example:
    - $ sudo chown yourusername:yourusername libreboot.rom
    - # chown yourusername:yourusername libreboot.rom -

    - -

    - If you currently have flashed a ROM image from an older version, it is recommended to update first: - basically, modify one of the latest ROM's and then flash it. -

    - -

    - Back to top of page. -

    - -
    - -

    Extract grubtest.cfg from the ROM image

    - -

    - Display contents of ROM:
    - $ ./cbfstool libreboot.rom print -

    - -

    - The libreboot.rom file contains your grub.cfg and grubtest.cfg files. - You should extract, modify and re-insert the copy first. grub.cfg will load first, - but it has a menu entry for switching to the copy (grubtest.cfg). - This reduces your chance of making a mistake that could make your machine unbootable (or very hard to boot). -

    - -

    - Extract grubtest.cfg from the ROM image:
    - $ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg -

    - -

    - Now you have a grubtest.cfg in cbfstool directory. Edit it however you wish. -

    - -

    - Back to top of page. -

    - -
    - -
    - -

    Example modifications for grubtest.cfg

    - -

    - These are some common examples of ways in which the grubtest.cfg file can be modified. -

    - -

    Trisquel GNU/Linux-libre

    - -

    - As an example, on my test system in /boot/grub/grub.cfg (on the HDD/SSD) I see for the main menu entry: -

    -
      -
    • linux /boot/vmlinuz-3.15.1-gnu.nonpae root=UUID=3a008e14-4871-497b-95e5-fb180f277951 ro crashkernel=384M-2G:64M,2G-:128M quiet splash $vt_handoff
    • -
    • initrd /boot/initrd.img-3.15.1-gnu.nonpae
    • -
    - -

    - ro, quiet, splash, crashkernel=384M-2G:64M,2G-:128M and - $vt_handoff can be safely ignored. -

    - -

    - I use this to get my partition layout:
    - $ lsblk -

    - -

    - In my case, I have no /boot partition, instead /boot is on the same partition as / on sda1. - Yours might be different. In GRUB terms, sda means ahci0. 1 means msdos1, or gpt1, depending - on whether I am using MBR or GPT partitioning. Thus, /dev/sda1 is GRUB is (ahci0,msdos1) or - (ahci0,gpt1). In my case, I use MBR partitioning so it's (ahci0,msdos1). - 'msdos' is GRUB's name simply because this partitioning type is traditionally used by MS-DOS. - It doesn't mean you have a proprietary OS. -

    - -

    - Trisquel doesn't keep the filenames of kernels consistent, instead it keeps old kernels and - new kernel updates are provided with the version in the filename. This can make GRUB payload - a bit tricky. Fortunately, there are symlinks /vmlinuz and /initrd.img - so if your /boot and / are on the same partition, you can set GRUB to boot from that. - These are also updated automatically when installing kernel updates from your distributions - apt-get repositories. - - Note: when using jxself kernel releases, - these are not updated at all and you have to update them manually. - -

    - -

    - For the GRUB payload's grubtest.cfg (in the 'Load Operating System' menu entry), we therefore have (in this example):
    - set root='ahci0,msdos1'
    - linux /vmlinuz root=UUID=3a008e14-4871-497b-95e5-fb180f277951
    - initrd /initrd.img -

    - -

    - Optionally, you can convert the UUID to it's real device name, for example /dev/sda1 in this case. - sdX naming isn't very reliable, though, which is why UUID is used for most distributions. -

    - -

    - Alternatively, if your /boot is on a separate partition then you cannot rely on the /vmlinuz and /initrd.img symlinks. - Instead, go into /boot and create your own symlinks (update them manually when you install a new kernel update).
    - $ sudo -s
    - # cd /boot/
    - # rm -rf vmlinuz initrd.img
    - # ln -s kernel ksym
    - # ln -s initrd isym
    - # exit -

    - -

    - Replace the underlined kernel and initrd filenames above with the actual filenames, of course. -

    - -

    - Then your grubtest.cfg menu entry (for payload) becomes like that, for example if / was on sda2 and /boot was on sda1:
    - set root='ahci0,msdos1'
    - linux /ksym root=/dev/sda2
    - initrd /isym -

    - -

    - There are lots of possible variations so please try to adapt. -

    - -

    Parabola GNU/Linux-libre

    - -

    - You can basically adapt the above. Note however that Parabola does not keep old kernels still installed, and the file names - are always consistent, so you don't need to boot from symlinks, you can just use the real thing directly. -

    - -
    - -

    - Back to top of page. -

    - -
    - -

    Re-insert the modified grubtest.cfg into the ROM image

    - -

    - Delete the grubtest.cfg that remained inside the ROM:
    - $ ./cbfstool libreboot.rom remove -n grubtest.cfg -

    - -

    - Display ROM contents and now you see grubtest.cfg no longer exists there:
    - $ ./cbfstool libreboot.rom print -

    - -

    - Add the modified version that you just made:
    - $ ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t raw -

    - -

    - Now display ROM contents again and see that it exists again:
    - $ ./cbfstool libreboot.rom print -

    - -

    - Back to top of page. -

    - -
    - -

    Test it!

    - -

    - - Now you have a modified ROM. Refer back to ../index.html#flashrom for information - on how to flash it. Once you have done that, shut down and then boot up with your new test configuration. - -

    - -

    - Choose (in GRUB) the menu entry that switches to grubtest.cfg. If it works, then your config is safe and you can continue below. -

    - -

    - - If it does not work like you want it to, if you are unsure or sceptical in any way, - then re-do the steps above until you get it right! Do *not* proceed past this point - unless you are 100% sure that your new configuration is safe (or desirable) to use. - -

    - -

    - Back to top of page. -

    - -
    - -

    Final steps

    - -

    - Create a copy of grubtest.cfg, called grub.cfg, which is the same except for one difference: - change the menuentry 'Switch to grub.cfg' to 'Switch to grubtest.cfg' and inside it, - change all instances of grub.cfg to grubtest.cfg. This is so that the main config still - links (in the menu) to grubtest.cfg, so that you don't have to manually switch to it, in - case you ever want to follow this guide again in the future (modifying the already modified config)
    - $ sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg
    -

    - -

    - Delete the grub.cfg that remained inside the ROM:
    - $ ./cbfstool libreboot.rom remove -n grub.cfg -

    - -

    - Display ROM contents and now you see grub.cfg no longer exists there:
    - $ ./cbfstool libreboot.rom print -

    - -

    - Add the modified version that you just made:
    - $ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw -

    - -

    - Now display ROM contents again and see that it exists again:
    - $ ./cbfstool libreboot.rom print -

    - -

    - - Now you have a modified ROM. Refer back to ../index.html#flashrom for information - on how to flash it. Once you have done that, shut down and then boot up with your new configuration. - -

    - -

    - Back to top of page. -

    - -
    - -

    Troubleshooting

    - -

    - A user reported that segmentation faults occur with cbfstool - when using this procedure depending on the size of the grub.cfg being re-insterted. - In his case, a minimum size of 857 bytes was required. This could (at the time of - this release) be a bug in cbfstool that should be investigated with the coreboot - community. If cbfstool segfaults, then keep this in mind. 'strace' (or gdb? clang?) - could be used for debugging. This was in libreboot 5th release (based on coreboot - from late 2013), and I'm not sure if the issue perists in the current releases. - I have not been able to reproduce it. strace (from that user) is here: - cbfstool_libreboot5_strace. - The issue has been reported by a few users, so it does not happen all the time: - this bug (if it still exists) could (should) be reproduced. -

    - -

    - Back to top of page. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/t60_dev/.htaccess b/docs/howtos/t60_dev/.htaccess deleted file mode 100644 index 75da674..0000000 --- a/docs/howtos/t60_dev/.htaccess +++ /dev/null @@ -1,2 +0,0 @@ -Options +Indexes -IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* diff --git a/docs/howtos/t60_dev/0001.JPG b/docs/howtos/t60_dev/0001.JPG deleted file mode 100644 index 84d2f4f..0000000 Binary files a/docs/howtos/t60_dev/0001.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0002.JPG b/docs/howtos/t60_dev/0002.JPG deleted file mode 100644 index 5f8ead5..0000000 Binary files a/docs/howtos/t60_dev/0002.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0003.JPG b/docs/howtos/t60_dev/0003.JPG deleted file mode 100644 index 4b0826f..0000000 Binary files a/docs/howtos/t60_dev/0003.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0004.JPG b/docs/howtos/t60_dev/0004.JPG deleted file mode 100644 index 42d9086..0000000 Binary files a/docs/howtos/t60_dev/0004.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0005.JPG b/docs/howtos/t60_dev/0005.JPG deleted file mode 100644 index 8e9bce3..0000000 Binary files a/docs/howtos/t60_dev/0005.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0006.JPG b/docs/howtos/t60_dev/0006.JPG deleted file mode 100644 index 6371b46..0000000 Binary files a/docs/howtos/t60_dev/0006.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0007.JPG b/docs/howtos/t60_dev/0007.JPG deleted file mode 100644 index cedc9d9..0000000 Binary files a/docs/howtos/t60_dev/0007.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0008.JPG b/docs/howtos/t60_dev/0008.JPG deleted file mode 100644 index bec57a1..0000000 Binary files a/docs/howtos/t60_dev/0008.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0009.JPG b/docs/howtos/t60_dev/0009.JPG deleted file mode 100644 index aeeda57..0000000 Binary files a/docs/howtos/t60_dev/0009.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0010.JPG b/docs/howtos/t60_dev/0010.JPG deleted file mode 100644 index c776171..0000000 Binary files a/docs/howtos/t60_dev/0010.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0011.JPG b/docs/howtos/t60_dev/0011.JPG deleted file mode 100644 index 24cb443..0000000 Binary files a/docs/howtos/t60_dev/0011.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0012.JPG b/docs/howtos/t60_dev/0012.JPG deleted file mode 100644 index c719958..0000000 Binary files a/docs/howtos/t60_dev/0012.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0013.JPG b/docs/howtos/t60_dev/0013.JPG deleted file mode 100644 index b8ed7ee..0000000 Binary files a/docs/howtos/t60_dev/0013.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0014.JPG b/docs/howtos/t60_dev/0014.JPG deleted file mode 100644 index 5160dc3..0000000 Binary files a/docs/howtos/t60_dev/0014.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0015.JPG b/docs/howtos/t60_dev/0015.JPG deleted file mode 100644 index 0c1fd18..0000000 Binary files a/docs/howtos/t60_dev/0015.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0016.JPG b/docs/howtos/t60_dev/0016.JPG deleted file mode 100644 index c698be2..0000000 Binary files a/docs/howtos/t60_dev/0016.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0017.JPG b/docs/howtos/t60_dev/0017.JPG deleted file mode 100644 index 652a66e..0000000 Binary files a/docs/howtos/t60_dev/0017.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0018.JPG b/docs/howtos/t60_dev/0018.JPG deleted file mode 100644 index cf43067..0000000 Binary files a/docs/howtos/t60_dev/0018.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0019.JPG b/docs/howtos/t60_dev/0019.JPG deleted file mode 100644 index a75f68a..0000000 Binary files a/docs/howtos/t60_dev/0019.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0020.JPG b/docs/howtos/t60_dev/0020.JPG deleted file mode 100644 index 0c4f7db..0000000 Binary files a/docs/howtos/t60_dev/0020.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0021.JPG b/docs/howtos/t60_dev/0021.JPG deleted file mode 100644 index c7d5757..0000000 Binary files a/docs/howtos/t60_dev/0021.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0022.JPG b/docs/howtos/t60_dev/0022.JPG deleted file mode 100644 index 5971da2..0000000 Binary files a/docs/howtos/t60_dev/0022.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0023.JPG b/docs/howtos/t60_dev/0023.JPG deleted file mode 100644 index 99f67c3..0000000 Binary files a/docs/howtos/t60_dev/0023.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0024.JPG b/docs/howtos/t60_dev/0024.JPG deleted file mode 100644 index f89b537..0000000 Binary files a/docs/howtos/t60_dev/0024.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0025.JPG b/docs/howtos/t60_dev/0025.JPG deleted file mode 100644 index d6b180e..0000000 Binary files a/docs/howtos/t60_dev/0025.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0026.JPG b/docs/howtos/t60_dev/0026.JPG deleted file mode 100644 index c8f3299..0000000 Binary files a/docs/howtos/t60_dev/0026.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0027.JPG b/docs/howtos/t60_dev/0027.JPG deleted file mode 100644 index 10ab8e0..0000000 Binary files a/docs/howtos/t60_dev/0027.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0028.JPG b/docs/howtos/t60_dev/0028.JPG deleted file mode 100644 index 64cba1c..0000000 Binary files a/docs/howtos/t60_dev/0028.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0029.JPG b/docs/howtos/t60_dev/0029.JPG deleted file mode 100644 index 960ebdd..0000000 Binary files a/docs/howtos/t60_dev/0029.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0030.JPG b/docs/howtos/t60_dev/0030.JPG deleted file mode 100644 index 046fd00..0000000 Binary files a/docs/howtos/t60_dev/0030.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0031.JPG b/docs/howtos/t60_dev/0031.JPG deleted file mode 100644 index 870f22b..0000000 Binary files a/docs/howtos/t60_dev/0031.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0032.JPG b/docs/howtos/t60_dev/0032.JPG deleted file mode 100644 index 70ff44a..0000000 Binary files a/docs/howtos/t60_dev/0032.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0033.JPG b/docs/howtos/t60_dev/0033.JPG deleted file mode 100644 index 142ca97..0000000 Binary files a/docs/howtos/t60_dev/0033.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0034.JPG b/docs/howtos/t60_dev/0034.JPG deleted file mode 100644 index 907192e..0000000 Binary files a/docs/howtos/t60_dev/0034.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0035.JPG b/docs/howtos/t60_dev/0035.JPG deleted file mode 100644 index bf38c89..0000000 Binary files a/docs/howtos/t60_dev/0035.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0036.JPG b/docs/howtos/t60_dev/0036.JPG deleted file mode 100644 index a7e5bdf..0000000 Binary files a/docs/howtos/t60_dev/0036.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0037.JPG b/docs/howtos/t60_dev/0037.JPG deleted file mode 100644 index ab30c27..0000000 Binary files a/docs/howtos/t60_dev/0037.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0038.JPG b/docs/howtos/t60_dev/0038.JPG deleted file mode 100644 index 362c547..0000000 Binary files a/docs/howtos/t60_dev/0038.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0039.JPG b/docs/howtos/t60_dev/0039.JPG deleted file mode 100644 index 224f72e..0000000 Binary files a/docs/howtos/t60_dev/0039.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0040.JPG b/docs/howtos/t60_dev/0040.JPG deleted file mode 100644 index adcd923..0000000 Binary files a/docs/howtos/t60_dev/0040.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0041.JPG b/docs/howtos/t60_dev/0041.JPG deleted file mode 100644 index 2a04682..0000000 Binary files a/docs/howtos/t60_dev/0041.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0042.JPG b/docs/howtos/t60_dev/0042.JPG deleted file mode 100644 index b5ed8ec..0000000 Binary files a/docs/howtos/t60_dev/0042.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0043.JPG b/docs/howtos/t60_dev/0043.JPG deleted file mode 100644 index 7144a98..0000000 Binary files a/docs/howtos/t60_dev/0043.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0044.JPG b/docs/howtos/t60_dev/0044.JPG deleted file mode 100644 index 27a24c6..0000000 Binary files a/docs/howtos/t60_dev/0044.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0045.JPG b/docs/howtos/t60_dev/0045.JPG deleted file mode 100644 index 997b498..0000000 Binary files a/docs/howtos/t60_dev/0045.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0046.JPG b/docs/howtos/t60_dev/0046.JPG deleted file mode 100644 index 25d6baa..0000000 Binary files a/docs/howtos/t60_dev/0046.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0047.JPG b/docs/howtos/t60_dev/0047.JPG deleted file mode 100644 index 6b57bf3..0000000 Binary files a/docs/howtos/t60_dev/0047.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0048.JPG b/docs/howtos/t60_dev/0048.JPG deleted file mode 100644 index 7339f07..0000000 Binary files a/docs/howtos/t60_dev/0048.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0049.JPG b/docs/howtos/t60_dev/0049.JPG deleted file mode 100644 index cf3a7fd..0000000 Binary files a/docs/howtos/t60_dev/0049.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0050.JPG b/docs/howtos/t60_dev/0050.JPG deleted file mode 100644 index 7de4edd..0000000 Binary files a/docs/howtos/t60_dev/0050.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0051.JPG b/docs/howtos/t60_dev/0051.JPG deleted file mode 100644 index 87c41b3..0000000 Binary files a/docs/howtos/t60_dev/0051.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0052.JPG b/docs/howtos/t60_dev/0052.JPG deleted file mode 100644 index 4a8e443..0000000 Binary files a/docs/howtos/t60_dev/0052.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0053.JPG b/docs/howtos/t60_dev/0053.JPG deleted file mode 100644 index e1044fc..0000000 Binary files a/docs/howtos/t60_dev/0053.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0054.JPG b/docs/howtos/t60_dev/0054.JPG deleted file mode 100644 index c96c020..0000000 Binary files a/docs/howtos/t60_dev/0054.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0055.JPG b/docs/howtos/t60_dev/0055.JPG deleted file mode 100644 index 6da87d5..0000000 Binary files a/docs/howtos/t60_dev/0055.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0056.JPG b/docs/howtos/t60_dev/0056.JPG deleted file mode 100644 index 81a6659..0000000 Binary files a/docs/howtos/t60_dev/0056.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0057.JPG b/docs/howtos/t60_dev/0057.JPG deleted file mode 100644 index 268fede..0000000 Binary files a/docs/howtos/t60_dev/0057.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0058.JPG b/docs/howtos/t60_dev/0058.JPG deleted file mode 100644 index bedfb12..0000000 Binary files a/docs/howtos/t60_dev/0058.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0059.JPG b/docs/howtos/t60_dev/0059.JPG deleted file mode 100644 index 422687c..0000000 Binary files a/docs/howtos/t60_dev/0059.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0060.JPG b/docs/howtos/t60_dev/0060.JPG deleted file mode 100644 index 8743c0d..0000000 Binary files a/docs/howtos/t60_dev/0060.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0061.JPG b/docs/howtos/t60_dev/0061.JPG deleted file mode 100644 index e05f626..0000000 Binary files a/docs/howtos/t60_dev/0061.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0062.JPG b/docs/howtos/t60_dev/0062.JPG deleted file mode 100644 index 1fe77a7..0000000 Binary files a/docs/howtos/t60_dev/0062.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0063.JPG b/docs/howtos/t60_dev/0063.JPG deleted file mode 100644 index 87b7761..0000000 Binary files a/docs/howtos/t60_dev/0063.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0064.JPG b/docs/howtos/t60_dev/0064.JPG deleted file mode 100644 index e80189e..0000000 Binary files a/docs/howtos/t60_dev/0064.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0065.JPG b/docs/howtos/t60_dev/0065.JPG deleted file mode 100644 index 4e77a88..0000000 Binary files a/docs/howtos/t60_dev/0065.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0066.JPG b/docs/howtos/t60_dev/0066.JPG deleted file mode 100644 index 793c0f8..0000000 Binary files a/docs/howtos/t60_dev/0066.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0068.JPG b/docs/howtos/t60_dev/0068.JPG deleted file mode 100644 index 9f9f299..0000000 Binary files a/docs/howtos/t60_dev/0068.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0069.JPG b/docs/howtos/t60_dev/0069.JPG deleted file mode 100644 index 98931e6..0000000 Binary files a/docs/howtos/t60_dev/0069.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0070.JPG b/docs/howtos/t60_dev/0070.JPG deleted file mode 100644 index 09958c3..0000000 Binary files a/docs/howtos/t60_dev/0070.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0071.JPG b/docs/howtos/t60_dev/0071.JPG deleted file mode 100644 index 104d21e..0000000 Binary files a/docs/howtos/t60_dev/0071.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0072.JPG b/docs/howtos/t60_dev/0072.JPG deleted file mode 100644 index 66c8e3b..0000000 Binary files a/docs/howtos/t60_dev/0072.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0073.JPG b/docs/howtos/t60_dev/0073.JPG deleted file mode 100644 index 5d9b9fa..0000000 Binary files a/docs/howtos/t60_dev/0073.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/0074.JPG b/docs/howtos/t60_dev/0074.JPG deleted file mode 100644 index 303264a..0000000 Binary files a/docs/howtos/t60_dev/0074.JPG and /dev/null differ diff --git a/docs/howtos/t60_dev/t60_unbrick.jpg b/docs/howtos/t60_dev/t60_unbrick.jpg deleted file mode 100644 index 820a9b4..0000000 Binary files a/docs/howtos/t60_dev/t60_unbrick.jpg and /dev/null differ diff --git a/docs/howtos/t60_heatsink.html b/docs/howtos/t60_heatsink.html deleted file mode 100644 index f10ea60..0000000 --- a/docs/howtos/t60_heatsink.html +++ /dev/null @@ -1,133 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad T60 - - - - -
    -

    Changing heatsink (or CPU) on the ThinkPad T60

    - -
    - -

    Or go back to main index

    - -

    Hardware requirements

    -
      -
    • rubbing a***hol (misspelling intentional. halal internet) and thermal compound for changing CPU heatsink (procedure involves removing heatsink)
    • -
    • thermal compound/paste (Arctic Silver 5 is good. Others are also good.)
    • -
    - -

    Software requirements

    -
      -
    • xsensors
    • -
    • stress
    • -
    - -

    Disassembly

    - -

    - Remove those screws and remove the HDD:
    - -

    - -

    - Lift off the palm rest:
    - -

    - -

    - Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    - -

    - -

    - Gently wedge both sides loose:
    - -

    - -

    - Remove that cable from the position:
    - -

    - -

    - Remove the bezel (sorry forgot to take pics). -

    - -

    - On the CPU (and there is another chip south-east to it, sorry forgot to take pic) - clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) - you should also clean the heatsink the same way
    - -

    - -

    - This is also an opportunity to change the CPU to another one. For example if you had a Core Duo T2400, you can upgrade it to a better processor - (higher speed, 64-bit support). A Core 2 Duo T7600 was installed here. -

    - -

    - Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    - -

    - -

    - Reinstall that upper bezel:
    - -

    - -

    - Do that:
    - -

    - -

    - Attach keyboard:
    - -

    - -

    - Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    - -

    - -

    - It lives!
    - -

    - -

    - Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    - -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/t60_lcd_15.html b/docs/howtos/t60_lcd_15.html deleted file mode 100644 index 3b382f5..0000000 --- a/docs/howtos/t60_lcd_15.html +++ /dev/null @@ -1,94 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad T60 - - - - -
    -

    Changing the LCD panel on a 15.1" T60

    - -
    - -

    Or go back to main index

    - -

    Disassembly

    - -

    - Remove those covers and unscrew:
    - -

    - -

    - Gently pry off the front bezel. -

    - -

    - Remove inverter board:
    - -

    - -

    - Disconnect LCD cable:
    - -

    - -

    - Remove the panel:
    - -

    - -

    - Move the rails (left and right side) from the old panel to the new one and then attach LCD cable:
    - -

    - -

    - Insert panel (this one is an LG-Philips LP150E05-A2K1, and there are others. See ../index.html#supported_t60_list):
    - -

    - -

    - Insert new inverter board (see ../index.html#supported_t60_list for what is recommended on your LCD panel):
    - -

    - -

    - Now re-attach the front bezel and put all the screws in. -

    - -

    - It lives!
    - -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/t60_security.html b/docs/howtos/t60_security.html deleted file mode 100644 index f39c739..0000000 --- a/docs/howtos/t60_security.html +++ /dev/null @@ -1,445 +0,0 @@ - - - - - - - - - Libreboot documentation: Security on the ThinkPad T60 - - - - -
    -

    Security on the ThinkPad T60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • A T60
    • -
    • screwdriver
    • -
    • (in a later version of this tutorial: soldering iron and scalpel)
    • -
    - -

    Software requirements

    -
      -
    • none (at least in the scope of the article as-is)
    • -
    • You probably want to encrypt your GNU/Linux install using LUKS
    • -
    - -

    - Rationale -

    -

    - Most people think of security on the software side: the hardware is important aswell. - Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. - It is also generally useful to all those that believe security and privacy are inalienable rights. - Security starts with the hardware; crypto and network security come later. -

    -

    - Paradoxically, going this far to increase your security also makes you a bigger target. - At the same time, it protects you in the case that someone does attack your machine. - This paradox only exists while few people take adequate steps to protect yourself: it is your duty - to protect yourself, not only for your benefit but to make strong security normal so - that those who do need protection (and claim it) are a smaller target against the masses. -

    -

    - Even if there are levels of security beyond your ability (technically, financially and so on) - doing at least something (what you are able to do) is extremely important. - If you use the internet and your computer without protection, attacking you is cheap (some say it is - only a few US cents). If everyone (majority of people) use strong security by default, - it makes attacks more costly and time consuming; in effect, making them disappear. -

    -

    - This tutorial deals with reducing the number of devices that have direct memory access that - could communicate with inputs/outputs that could be used to remotely - command the machine (or leak data). -

    - -

    Disassembly

    - -

    - Remove those screws and remove the HDD:
    - -

    - -

    - Lift off the palm rest:
    - -

    - -

    - Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    - -

    - -

    - Gently wedge both sides loose:
    - -

    - -

    - Remove that cable from the position:
    - -

    - -

    - Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
    -
    - Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
    - Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most T60's come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - it's risk-level is very high. -

    - -

    - Remove those screws:
    - -

    - -

    - Disconnect the power jack:
    - -

    - -

    - Remove nvram battery (we will put it back later):
    - -

    - -

    - Disconnect cable (for 56k modem) and disconnect the other cable:
    - -

    - -

    - Disconnect speaker cable:
    - -

    - -

    - Disconnect the other end of the 56k modem cable:
    - -

    - -

    - Make sure you removed it:
    - -

    - -

    - Unscrew those:
    - -

    - -

    - Make sure you removed those:
    - -

    - -

    - Disconnect LCD cable from board:
    - -

    - -

    - Remove those screws then remove the LCD assembly:
    - -

    - -

    - Once again, make sure you removed those:
    - -

    - -

    - Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady - surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the - screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
    - - -

    - -

    - Remove microphone (soldering iron not needed. Just wedge it out gently):
    -
    - Rationale:
    - Another reason to remove the microphone: If your computer gets[1] compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, - the machine could already be compromised from the factory. -

    - -

    - Remove infrared:
    - -

    - -

    - Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):
    -
    - Rationale:
    - It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See - 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 - but the same topics apply to T60. -

    - -

    - Before re-installing the upper chassis, remove the speaker:
    -
    - Reason: combined with the microphone issue, this could be used to leak data.
    - If your computer gets[1] compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone[2].
    - Replacement: headphones/speakers (line-out) or external DAC (USB). -

    - -

    - Remove the wwan:
    -
    - Wwan (3d modem): They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.
    - Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). -

    - -

    - This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery - and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)
    - -

    - -

    - Put those screws back:
    - -

    - -

    - Put it back into lower chassis:
    - -

    - -

    - Attach LCD and insert screws (also, attach the lcd cable to the board):
    - -

    - -

    - Insert those screws:
    - -

    - -

    - On the CPU (and there is another chip south-east to it, sorry forgot to take pic) - clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) - you should also clean the heatsink the same way
    - -

    - -

    - Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    - -

    - -

    - Reinstall that upper bezel:
    - -

    - -

    - Do that:
    - -

    - -

    - Attach keyboard and install nvram battery:
    - -

    - -

    - Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    - -

    - -

    - Remove those covers and unscrew:
    - -

    - -

    - Gently pry off the front bezel (sorry, forgot to take pics). -

    - -

    - Remove bluetooth module:
    - -

    - -

    - Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). -

    - -

    - It lives!
    - -

    - -

    - Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    - -

    - -

    - Not covered yet: -

    -
      -
    • Disable flashing the ethernet firmware
    • -
    • Disable SPI flash writes (can be re-enabled by unsoldering two parts)
    • -
    • Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
    • -
    • Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)
    • -
    -

    - Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html - or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. -

    -

    - A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. -

    - -

    - Also not covered yet: -

    -
      -
    • - Intrusion detection: randomized seal on screws
      - Just put nail polish with lot of glider on the important screws, take - some good pictures. Keep the pictueres and make sure of their integrity. - Compare the nail polish with the pictures before powering on the laptop. -
    • -
    • - Tips about preventing/mitigating risk of cold boot attack. -
        -
      • soldered RAM?
      • -
      • wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
      • -
      • ask gnutoo about fallback patches (counts number of boots)
      • -
      -
    • -
    • - General tips/advice and web links showing how to detect physical intrusions. -
    • -
    • - For example: http://cs.tau.ac.il/~tromer/acoustic/ -
    • -
    • - https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: -
    • -
    - -

    - Extra notes -

    -

    - EC: Cannot be removed but can be mitigated: it contains non-free - non-loadable code, but it has no access to the computer's RAM. - It has access to the on-switch of the wifi, bluetooth, modem and some - other power management features. The issue is that it has access to the - keyboard, however if the software security howto (not yet written) is followed correctly, - it won't be able to leak data to a local attacker. It has no network - access but it may still be able to leak data remotely, but that - requires someone to be nearby to recover the data with the help of an - SDR and some directional antennas[3]. -

    -

    - Intel 82573 Ethernet controller - on the X60 seems safe, according to Denis. -

    - -

    - Risk level -

    -
      -
    • Modem (3g/wwan): highest
    • -
    • Intel wifi: Near highest
    • -
    • Atheros PCI wifi: unknown, but lower than intel wifi.
    • -
    • Microphone: only problematic if the computer gets compromised.
    • -
    • Speakers: only problematic if the computer gets compromised.
    • -
    • EC: can be mitigated if following the guide on software security.
    • -
    - -

    - Further reading material (software security) -

    - - -

    - References -

    -

    [1] physical access

    -

    - Explain that black hats, TAO, and so on might use a 0day to get in, - and explain that in this case it mitigates what the attacker can do. - Also the TAO do some evaluation before launching an attack: they take - the probability of beeing caught into account, along with the kind of - target. A 0day costs a lot of money, I heard that it was from 100000$ - to 400000$, some other websites had prices 10 times lower but that - but it was probably a typo. So if people increase their security it - makes it more risky and more costly to attack people. -

    -

    [2] microphone

    -

    - It's possible to turn headphones into a microphone, you could try - yourself, however they don't record loud at all. Also intel cards have - the capability to change a connector's function, for instance the - microphone jack can now become a headphone plug, that's called - retasking. There is some support for it in GNU/Linux but it's not very - well known. -

    -

    [3] Video (CCC)

    -

    - 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While - their demo is experimental(their hardware also got damaged during the - transport), the spies probably already have that since a long time. - http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/t60_unbrick.html b/docs/howtos/t60_unbrick.html deleted file mode 100644 index 69648e1..0000000 --- a/docs/howtos/t60_unbrick.html +++ /dev/null @@ -1,319 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad T60 - - - - -
    -

    Unbricking the ThinkPad T60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • a 2nd computer (maybe another T60. any computer will do)
    • -
    • external flashrom-compatible programmer (I'm using the "bus pirate") -
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • -
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • -
    • USB mini a to b cable (for buspirate<>computer connection).
    • -
    • rubbing a***hol (misspelling intentional. halal internet) and thermal compound for changing CPU heatsink (procedure involves removing heatsink)
    • -
    - -

    Software requirements

    -
      -
    • GNU/Linux (on the 2nd computer)
    • -
    • flashrom software (on the 2nd computer): http://flashrom.org/ -
    - -

    Brick type 1: bucts not reset.

    -

    - You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and - the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    - - In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    -

    - - *Those dd commands should be applied to all newly compiled T60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    - dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    - dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    - dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    - (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, - using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. - (it says x60, but instructions for t60 are identical) -

    - -

    bad rom (or user error), machine won't boot

    - -

    - In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from - booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. -

    -

    - "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). -

    - -

    - Remove those screws and remove the HDD:
    - -

    - -

    - Lift off the palm rest:
    - -

    - -

    - Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    - -

    - -

    - Gently wedge both sides loose:
    - -

    - -

    - Remove that cable from the position:
    - -

    - -

    - Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
    - -

    - -

    - Remove those screws:
    - -

    - -

    - Disconnect the power jack:
    - -

    - -

    - Remove nvram battery:
    - -

    - -

    - Disconnect cable (for 56k modem) and disconnect the other cable:
    - -

    - -

    - Disconnect speaker cable:
    - -

    - -

    - Disconnect the other end of the 56k modem cable:
    - -

    - -

    - Make sure you removed it:
    - -

    - -

    - Unscrew those:
    - -

    - -

    - Make sure you removed those:
    - -

    - -

    - Disconnect LCD cable from board:
    - -

    - -

    - Remove those screws then remove the LCD assembly:
    - -

    - -

    - Once again, make sure you removed those:
    - -

    - -

    - Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady - surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the - screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
    - - -

    - -

    - At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    - http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    - Correlating with the following information, I was able to wire up my pirate correctly:
    - http://flashrom.org/Bus_Pirate#Connections
    - And by following that advice:
    - http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    - (it says X60 but instructions are virtually the same for the T60, with except to physical differences in how to disassemble the machine)
    - Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    - Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the - AC adapter (without powering on the board).
    - Note: I ignored that advice, and wired up all 8 pins. And it worked.
    - - Here is the pinout (correlate it with your programmer's documentation):
    - -

    - -

    - Connecting the pomona:
    - -

    - -

    - Connect programmer to 2nd computer:
    - -

    - -

    - Programmer has power:
    - -

    - -

    - Now flash the bricked machine using the 2nd computer. in my case I did:
    - flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/t60/libreboot_usqwerty.rom
    - Note: there are also other ROM images for T60
    - Note: this is using buspirate as the programmer, so it is flashing the T60, not the 2nd computer!
    - Here's my terminal window on the 2nd computer (also the programmer is active):
    -
    - So, you should see the following:
    - -- -

    -			flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    -			flashrom is free software, get the source code at http://www.flashrom.org
    -
    -			Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    -			Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    -			Reading old flash chip contents... done.
    -			Erasing and writing flash chip... Erase/write done.
    -			Verifying flash... VERIFIED. 
    -			
    - --
    - At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means - that you can put your T60 back together. So let's do that now. -

    - -

    - Put those screws back:
    - -

    - -

    - Put it back into lower chassis:
    - -

    - -

    - Attach LCD and insert screws (also, attach the lcd cable to the board):
    - -

    - -

    - Insert those screws:
    - -

    - -

    - On the CPU (and there is another chip south-east to it, sorry forgot to take pic) - clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) - you should also clean the heatsink the same way
    - -

    - -

    - Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    - -

    - -

    - Reinstall that upper bezel:
    - -

    - -

    - Do that:
    - -

    - -

    - Re-attach modem, wifi, (wwan?), and all necessary cables. Sorry, forgot to take pics. Look at previous removal steps to see where they go back to. -

    - -

    - Attach keyboard and install nvram battery:
    - -

    - -

    - Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    - -

    - -

    - It lives!
    - -

    - -

    - Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    - -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/x60_heatsink.html b/docs/howtos/x60_heatsink.html deleted file mode 100644 index 22b55e1..0000000 --- a/docs/howtos/x60_heatsink.html +++ /dev/null @@ -1,149 +0,0 @@ - - - - - - - - - Libreboot documentation: Switch heatsink on ThinkPad X60 - - - - -
    -

    Changing the fan/heatsink on the ThinkPad X60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • isopropyl alcholal (sometimes called rubbing alchole) (cleaning material. DoNotIngest) (typo is intentional, due to fii1illterii1iiing für wörten von Großbritannien und oder nationale iintturnett)
    • -
    • your new fan and/or heatsink
    • -
    • CPU thermal compound (some say Arctic Silver 5 or IC Diamond 7 are good, others are also 'ok')
    • -
    • Something to spread the paste with
    • -
    - -

    Software requirements (for CPU stress testing)

    -
      -
    • xsensors utility
    • -
    • stress utility
    • -
    - -

    Disassembly

    -

    - Remove those screws:
    - -

    -

    - Push the keyboard forward (carefully):
    - -

    -

    - Lift the keyboard up and disconnect it from the board:
    - -

    -

    - Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    - -

    -

    - You should now have this:
    - -

    -

    - Disconnect the wifi antenna cables, the modem cable and the speaker:
    - -

    -

    - Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem - cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand - side:
    - -

    -

    - Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape - that holds it into place:
    - -

    -

    - Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:
    - -

    -

    - Remove those screws:
    - -

    -

    - Remove those screws:
    - -

    -

    - Carefully remove the plate, like so:
    - -

    -

    - Remove the SATA connector:
    - -

    -

    - Now remove the motherboard (gently) and cast the lcd/chassis aside:
    - -

    -

    - Look at that black tape above the heatsink, remove it:
    - -

    -

    - Now you have removed it:
    - -

    - -

    - Disconnect the fan and remove all the screws, heatsink will easily come off:
    - -

    - -

    - Remove the old paste with a cloth (from the CPU and heatsink) and then clean both of them with the alcholeel (to remove remaining residue. typo is intentional). - Apply a pea-sized amount of paste to the both chipsets that the heatsink covered and spread it evenly (uniformally). - Finally reinstall the heatsink, reversing previous steps. -

    - -

    - stress -c 2 command can be used to push the CPU to 100%, and xsensors (or watch sensors command) can be used to monitor heat. - Below 90C is ok. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/x60_heatsink/0000.jpg b/docs/howtos/x60_heatsink/0000.jpg deleted file mode 100644 index ce0ec3b..0000000 Binary files a/docs/howtos/x60_heatsink/0000.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0001.jpg b/docs/howtos/x60_heatsink/0001.jpg deleted file mode 100644 index 2bbc0ca..0000000 Binary files a/docs/howtos/x60_heatsink/0001.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0002.jpg b/docs/howtos/x60_heatsink/0002.jpg deleted file mode 100644 index b55db3b..0000000 Binary files a/docs/howtos/x60_heatsink/0002.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0003.jpg b/docs/howtos/x60_heatsink/0003.jpg deleted file mode 100644 index c5799ae..0000000 Binary files a/docs/howtos/x60_heatsink/0003.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0004.jpg b/docs/howtos/x60_heatsink/0004.jpg deleted file mode 100644 index cd47840..0000000 Binary files a/docs/howtos/x60_heatsink/0004.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0005.jpg b/docs/howtos/x60_heatsink/0005.jpg deleted file mode 100644 index 418c9d2..0000000 Binary files a/docs/howtos/x60_heatsink/0005.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0006.jpg b/docs/howtos/x60_heatsink/0006.jpg deleted file mode 100644 index 6d36d93..0000000 Binary files a/docs/howtos/x60_heatsink/0006.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0007.jpg b/docs/howtos/x60_heatsink/0007.jpg deleted file mode 100644 index 971ccdf..0000000 Binary files a/docs/howtos/x60_heatsink/0007.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0008.jpg b/docs/howtos/x60_heatsink/0008.jpg deleted file mode 100644 index 24e6526..0000000 Binary files a/docs/howtos/x60_heatsink/0008.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0009.jpg b/docs/howtos/x60_heatsink/0009.jpg deleted file mode 100644 index d318395..0000000 Binary files a/docs/howtos/x60_heatsink/0009.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0010.jpg b/docs/howtos/x60_heatsink/0010.jpg deleted file mode 100644 index 5e6fdc7..0000000 Binary files a/docs/howtos/x60_heatsink/0010.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0011.jpg b/docs/howtos/x60_heatsink/0011.jpg deleted file mode 100644 index 101cf6a..0000000 Binary files a/docs/howtos/x60_heatsink/0011.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0012.jpg b/docs/howtos/x60_heatsink/0012.jpg deleted file mode 100644 index dbb6669..0000000 Binary files a/docs/howtos/x60_heatsink/0012.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0013.jpg b/docs/howtos/x60_heatsink/0013.jpg deleted file mode 100644 index 2d2b9dd..0000000 Binary files a/docs/howtos/x60_heatsink/0013.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0014.jpg b/docs/howtos/x60_heatsink/0014.jpg deleted file mode 100644 index 733f997..0000000 Binary files a/docs/howtos/x60_heatsink/0014.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0015.jpg b/docs/howtos/x60_heatsink/0015.jpg deleted file mode 100644 index 1e81166..0000000 Binary files a/docs/howtos/x60_heatsink/0015.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0016.jpg b/docs/howtos/x60_heatsink/0016.jpg deleted file mode 100644 index ea418a5..0000000 Binary files a/docs/howtos/x60_heatsink/0016.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0017.jpg b/docs/howtos/x60_heatsink/0017.jpg deleted file mode 100644 index 8a67482..0000000 Binary files a/docs/howtos/x60_heatsink/0017.jpg and /dev/null differ diff --git a/docs/howtos/x60_heatsink/0018.jpg b/docs/howtos/x60_heatsink/0018.jpg deleted file mode 100644 index 98c43ac..0000000 Binary files a/docs/howtos/x60_heatsink/0018.jpg and /dev/null differ diff --git a/docs/howtos/x60_lcd_change.html b/docs/howtos/x60_lcd_change.html deleted file mode 100644 index 3ddeaac..0000000 --- a/docs/howtos/x60_lcd_change.html +++ /dev/null @@ -1,54 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad T60 - - - - -
    -

    Changing the LCD panel on X60

    -
    - -

    Or go back to main index

    - -

    This tutorial is incomplete, and only pictures for now.

    - -

    - - - - - - - -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/x60_lcd_change/0001.JPG b/docs/howtos/x60_lcd_change/0001.JPG deleted file mode 100755 index fd066eb..0000000 Binary files a/docs/howtos/x60_lcd_change/0001.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0002.JPG b/docs/howtos/x60_lcd_change/0002.JPG deleted file mode 100755 index 96949f1..0000000 Binary files a/docs/howtos/x60_lcd_change/0002.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0003.JPG b/docs/howtos/x60_lcd_change/0003.JPG deleted file mode 100755 index 90216aa..0000000 Binary files a/docs/howtos/x60_lcd_change/0003.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0004.JPG b/docs/howtos/x60_lcd_change/0004.JPG deleted file mode 100755 index 3b704a4..0000000 Binary files a/docs/howtos/x60_lcd_change/0004.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0005.JPG b/docs/howtos/x60_lcd_change/0005.JPG deleted file mode 100755 index 823bab9..0000000 Binary files a/docs/howtos/x60_lcd_change/0005.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0006.JPG b/docs/howtos/x60_lcd_change/0006.JPG deleted file mode 100755 index 040f2ca..0000000 Binary files a/docs/howtos/x60_lcd_change/0006.JPG and /dev/null differ diff --git a/docs/howtos/x60_lcd_change/0007.JPG b/docs/howtos/x60_lcd_change/0007.JPG deleted file mode 100755 index 42c2607..0000000 Binary files a/docs/howtos/x60_lcd_change/0007.JPG and /dev/null differ diff --git a/docs/howtos/x60_security.html b/docs/howtos/x60_security.html deleted file mode 100644 index e24ae12..0000000 --- a/docs/howtos/x60_security.html +++ /dev/null @@ -1,306 +0,0 @@ - - - - - - - - - Libreboot documentation: Security on the ThinkPad X60 - - - - -
    -

    Security on the ThinkPad X60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • An X60
    • -
    • screwdriver
    • -
    • (in a later version of this tutorial: soldering iron and scalpel)
    • -
    - -

    Software requirements

    -
      -
    • none (at least in the scope of the article as-is)
    • -
    • You probably want to encrypt your GNU/Linux install using LUKS
    • -
    - -

    - Rationale -

    -

    - Most people think of security on the software side: the hardware is important aswell. - Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. - It is also generally useful to all those that believe security and privacy are inalienable rights. - Security starts with the hardware; crypto and network security come later. -

    -

    - Paradoxically, going this far to increase your security also makes you a bigger target. - At the same time, it protects you in the case that someone does attack your machine. - This paradox only exists while few people take adequate steps to protect yourself: it is your duty - to protect yourself, not only for your benefit but to make strong security normal so - that those who do need protection (and claim it) are a smaller target against the masses. -

    -

    - Even if there are levels of security beyond your ability (technically, financially and so on) - doing at least something (what you are able to do) is extremely important. - If you use the internet and your computer without protection, attacking you is cheap (some say it is - only a few US cents). If everyone (majority of people) use strong security by default, - it makes attacks more costly and time consuming; in effect, making them disappear. -

    -

    - This tutorial deals with reducing the number of devices that have direct memory access that - could communicate with inputs/outputs that could be used to remotely - command the machine (or leak data). -

    - -

    Disassembly

    - -

    - Firstly remove the bluetooth (if your X60 has this):
    - The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
    -
    - Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
    -
    -

    - -

    - If your model was WWAN, remove the simcard (check anyway):
    - Uncover those 2 screws at the bottom:
    -
    - SIM card (not present in the picture) is in the marked location:
    -
    - Replacement: USB dongle. -

    - -

    - Now get into the motherboard. -

    - -

    - Remove those screws:
    - -

    -

    - Push the keyboard forward (carefully):
    - -

    -

    - Lift the keyboard up and disconnect it from the board:
    - -

    -

    - Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    - -

    -

    - You should now have this:
    - -

    - -

    - The following is a summary of what you will remove (already done to this machine):
    -
    - Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want - (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and - also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional -

    - -

    - Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
    -
    - Rationale:
    - Another reason to remove the microphone: If your computer gets[1] compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, - the machine could already be compromised from the factory. -

    - -

    - Remove the modem:
    -
    - (useless, obsolete device) -

    - -

    - Remove the speaker:
    -
    - Reason: combined with the microphone issue, this could be used to leak data.
    - If your computer gets[1] compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone[2].
    - Replacement: headphones/speakers (line-out) or external DAC (USB). -

    - -

    - Remove the wlan (also remove wwan if you have it):
    -
    - Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
    - Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most X60's come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - it's risk-level is very high.
    - Wwan (3d modem): They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.
    - Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). -

    - -

    - Not covered yet: -

    -
      -
    • Disable cardbus (has fast/direct memory access)
    • -
    • Disable firewire (has fast/direct memory access)
    • -
    • Disable flashing the ethernet firmware
    • -
    • Disable SPI flash writes (can be re-enabled by unsoldering two parts)
    • -
    • Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
    • -
    • Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)
    • -
    -

    - Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html - or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. -

    -

    - A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. -

    - -

    - Also not covered yet: -

    -
      -
    • - Intrusion detection: randomized seal on screws
      - Just put nail polish with lot of glider on the important screws, take - some good pictures. Keep the pictueres and make sure of their integrity. - Compare the nail polish with the pictures before powering on the laptop. -
    • -
    • - Tips about preventing/mitigating risk of cold boot attack. -
        -
      • soldered RAM?
      • -
      • seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)
      • -
      • wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
      • -
      • ask gnutoo about fallback patches (counts number of boots)
      • -
      -
    • -
    • - General tips/advice and web links showing how to detect physical intrusions. -
    • -
    • - For example: http://cs.tau.ac.il/~tromer/acoustic/ -
    • -
    • - https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: -
    • -
    - -

    - Extra notes -

    -

    - EC: Cannot be removed but can be mitigated: it contains non-free - non-loadable code, but it has no access to the computer's RAM. - It has access to the on-switch of the wifi, bluetooth, modem and some - other power management features. The issue is that it has access to the - keyboard, however if the software security howto (not yet written) is followed correctly, - it won't be able to leak data to a local attacker. It has no network - access but it may still be able to leak data remotely, but that - requires someone to be nearby to recover the data with the help of an - SDR and some directional antennas[3]. -

    -

    - Intel 82573 Ethernet controller - on the X60 seems safe, according to Denis. -

    - -

    - Risk level -

    -
      -
    • Modem (3g/wwan): highest
    • -
    • Intel wifi: Near highest
    • -
    • Atheros PCI wifi: unknown, but lower than intel wifi.
    • -
    • Microphone: only problematic if the computer gets compromised.
    • -
    • Speakers: only problematic if the computer gets compromised.
    • -
    • EC: can be mitigated if following the guide on software security.
    • -
    - -

    - Further reading material (software security) -

    - - -

    - References -

    -

    [1] physical access

    -

    - Explain that black hats, TAO, and so on might use a 0day to get in, - and explain that in this case it mitigates what the attacker can do. - Also the TAO do some evaluation before launching an attack: they take - the probability of beeing caught into account, along with the kind of - target. A 0day costs a lot of money, I heard that it was from 100000$ - to 400000$, some other websites had prices 10 times lower but that - but it was probably a typo. So if people increase their security it - makes it more risky and more costly to attack people. -

    -

    [2] microphone

    -

    - It's possible to turn headphones into a microphone, you could try - yourself, however they don't record loud at all. Also intel cards have - the capability to change a connector's function, for instance the - microphone jack can now become a headphone plug, that's called - retasking. There is some support for it in GNU/Linux but it's not very - well known. -

    -

    [3] Video (CCC)

    -

    - 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While - their demo is experimental(their hardware also got damaged during the - transport), the spies probably already have that since a long time. - http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/x60_security/0000.jpg b/docs/howtos/x60_security/0000.jpg deleted file mode 100644 index ce0ec3b..0000000 Binary files a/docs/howtos/x60_security/0000.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0000_bluetooth.jpg b/docs/howtos/x60_security/0000_bluetooth.jpg deleted file mode 100644 index 94a255f..0000000 Binary files a/docs/howtos/x60_security/0000_bluetooth.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0000_bluetooth0.jpg b/docs/howtos/x60_security/0000_bluetooth0.jpg deleted file mode 100644 index a750b0c..0000000 Binary files a/docs/howtos/x60_security/0000_bluetooth0.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0000_simcard0.jpg b/docs/howtos/x60_security/0000_simcard0.jpg deleted file mode 100644 index 40837ea..0000000 Binary files a/docs/howtos/x60_security/0000_simcard0.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0000_simcard1.jpg b/docs/howtos/x60_security/0000_simcard1.jpg deleted file mode 100644 index c0a5b35..0000000 Binary files a/docs/howtos/x60_security/0000_simcard1.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001.jpg b/docs/howtos/x60_security/0001.jpg deleted file mode 100644 index 2bbc0ca..0000000 Binary files a/docs/howtos/x60_security/0001.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001_microphone.jpg b/docs/howtos/x60_security/0001_microphone.jpg deleted file mode 100644 index c419060..0000000 Binary files a/docs/howtos/x60_security/0001_microphone.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001_modem.jpg b/docs/howtos/x60_security/0001_modem.jpg deleted file mode 100644 index 6a7a6a0..0000000 Binary files a/docs/howtos/x60_security/0001_modem.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001_overview.jpg b/docs/howtos/x60_security/0001_overview.jpg deleted file mode 100644 index 7268e49..0000000 Binary files a/docs/howtos/x60_security/0001_overview.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001_speaker.jpg b/docs/howtos/x60_security/0001_speaker.jpg deleted file mode 100644 index 28d3ed6..0000000 Binary files a/docs/howtos/x60_security/0001_speaker.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0001_wlan_wwan.jpg b/docs/howtos/x60_security/0001_wlan_wwan.jpg deleted file mode 100644 index 0db858d..0000000 Binary files a/docs/howtos/x60_security/0001_wlan_wwan.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0002.jpg b/docs/howtos/x60_security/0002.jpg deleted file mode 100644 index b55db3b..0000000 Binary files a/docs/howtos/x60_security/0002.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0003.jpg b/docs/howtos/x60_security/0003.jpg deleted file mode 100644 index c5799ae..0000000 Binary files a/docs/howtos/x60_security/0003.jpg and /dev/null differ diff --git a/docs/howtos/x60_security/0004.jpg b/docs/howtos/x60_security/0004.jpg deleted file mode 100644 index cd47840..0000000 Binary files a/docs/howtos/x60_security/0004.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick.html b/docs/howtos/x60_unbrick.html deleted file mode 100644 index 945712d..0000000 --- a/docs/howtos/x60_unbrick.html +++ /dev/null @@ -1,310 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad X60 - - - - -
    -

    Unbricking the ThinkPad X60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • a 2nd computer (maybe another X60. any computer will do)
    • -
    • external flashrom-compatible programmer (I'm using the "bus pirate") -
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • -
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • -
    • USB mini a to b cable (for buspirate<>computer connection).
    • -
    - -

    Software requirements

    -
      -
    • GNU/Linux (on the 2nd computer)
    • -
    • flashrom software (on the 2nd computer): http://flashrom.org/ -
    - -

    Brick type 1: bucts not reset.

    -

    - You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and - the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    - - In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    -

    - - *Those dd commands should be applied to all newly compiled X60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    - dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    - dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    - dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    - (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, - using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. -

    - -

    bad rom (or user error), machine won't boot

    -

    - In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from - booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. -

    -

    - "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). -

    -

    - Remove those screws:
    - -

    -

    - Push the keyboard forward (carefully):
    - -

    -

    - Lift the keyboard up and disconnect it from the board:
    - -

    -

    - Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    - -

    -

    - You should now have this:
    - -

    -

    - Disconnect the wifi antenna cables, the modem cable and the speaker:
    - -

    -

    - Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem - cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand - side:
    - -

    -

    - Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape - that holds it into place:
    - -

    -

    - Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:
    - -

    -

    - Remove the screw that is highlighted (do NOT remove the other one; it holds part of the heatsink (other side) into place):
    - -

    -

    - Remove those screws:
    - -

    -

    - Carefully remove the plate, like so:
    - -

    -

    - Remove the SATA connector:
    - -

    -

    - Now remove the motherboard (gently) and cast the lcd/chassis aside:
    - -

    -

    - Lift back that tape and hold it with something. Highlighted is the SPI flash chip:
    - -

    -

    - At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    - http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    - Correlating with the following information, I was able to wire up my pirate correctly:
    - http://flashrom.org/Bus_Pirate#Connections
    - And by following that advice:
    - http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    - Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    - Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the - AC adapter (without powering on the board).
    - Note: I ignored that advice, and wired up all 8 pins. And it worked.
    - - Here is the pinout (correlate it with your programmer's documentation):
    - -

    - -

    - My programmer, usb cable and clip:
    -
    - My programmer (bus pirate):
    -
    - My clip (pomona 5250):
    -
    - My USB mini a to b cable:
    -
    - Connecting the pomona:
    -
    - Connecting the USB cable from programmer to 2nd(working/non-bricked) computer, my T60:
    -
    - Programmer is now active:
    -
    - Now I install flashrom on the T60 (running Trisquel GNU/Linux) and do this:
    - flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60/libreboot_usqwerty.rom
    - Note: there are also other ROM images for X60
    - Note: this is using buspirate as the programmer, so it is flashing the X60, not the T60!
    - Here's my terminal window on the T60:
    -
    - So, you should see the following:
    - -- -

    -			flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    -			flashrom is free software, get the source code at http://www.flashrom.org
    -
    -			Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    -			Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    -			Reading old flash chip contents... done.
    -			Erasing and writing flash chip... Erase/write done.
    -			Verifying flash... VERIFIED. 
    -			
    - --
    - At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means - that you can put your X60 back together. So let's do that now. -

    -

    - Remove the programmer and put it away somewhere. Put back the tape and press firmly over it:
    - -

    -

    - Your empty chassis:
    - -

    -

    - Put the motherboard back in:
    - -

    -

    - Reconnect SATA:
    - -

    -

    - Put the plate back and re-insert those screws:
    - -

    -

    - Re-route that antenna cable around the fan and apply the tape:
    - -

    -

    - Route the cable here and then (not shown, due to error on my part) reconnect the monitor cable to the motherboard - and re-insert the screws:
    - -

    -

    - Re-insert that screw:
    - -

    -

    - Route the black antenna cable like so:
    - -

    -

    - Tuck it in neatly like so:
    - -

    -

    - Route the modem cable like so:
    - -

    -

    - Connect modem cable to board and tuck it in neatly like so:
    - -

    -

    - Route the power connection and connect it to the board like so:
    - -

    -

    - Route the antenna and modem cables neatly like so:
    - -

    -

    - Connect the wifi antenna cables. At the start of the tutorial, this machine had an Intel wifi chip. Here you see I've replaced it with an - Atheros AR5B95 (supports 802.11n and can be used without blobs):
    - -

    -

    - Connect the modem cable:
    - -

    -

    - Connect the speaker:
    - -

    -

    - You should now have this:
    - -

    -

    - Re-connect the upper chassis:
    - -

    -

    - Re-connect the keyboard:
    - -

    -

    - Re-insert the screws that you removed earlier:
    - -

    -

    - Power on!
    - -

    -

    - Trisquel live USB menu (using GRUB's ISOLINUX parser):
    - -

    -

    - Trisquel live desktop:
    - -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/howtos/x60_unbrick/0000.jpg b/docs/howtos/x60_unbrick/0000.jpg deleted file mode 100644 index ce0ec3b..0000000 Binary files a/docs/howtos/x60_unbrick/0000.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0001.jpg b/docs/howtos/x60_unbrick/0001.jpg deleted file mode 100644 index 2bbc0ca..0000000 Binary files a/docs/howtos/x60_unbrick/0001.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0002.jpg b/docs/howtos/x60_unbrick/0002.jpg deleted file mode 100644 index b55db3b..0000000 Binary files a/docs/howtos/x60_unbrick/0002.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0003.jpg b/docs/howtos/x60_unbrick/0003.jpg deleted file mode 100644 index c5799ae..0000000 Binary files a/docs/howtos/x60_unbrick/0003.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0004.jpg b/docs/howtos/x60_unbrick/0004.jpg deleted file mode 100644 index cd47840..0000000 Binary files a/docs/howtos/x60_unbrick/0004.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0005.jpg b/docs/howtos/x60_unbrick/0005.jpg deleted file mode 100644 index 418c9d2..0000000 Binary files a/docs/howtos/x60_unbrick/0005.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0006.jpg b/docs/howtos/x60_unbrick/0006.jpg deleted file mode 100644 index 6d36d93..0000000 Binary files a/docs/howtos/x60_unbrick/0006.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0007.jpg b/docs/howtos/x60_unbrick/0007.jpg deleted file mode 100644 index 971ccdf..0000000 Binary files a/docs/howtos/x60_unbrick/0007.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0008.jpg b/docs/howtos/x60_unbrick/0008.jpg deleted file mode 100644 index 24e6526..0000000 Binary files a/docs/howtos/x60_unbrick/0008.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0009.jpg b/docs/howtos/x60_unbrick/0009.jpg deleted file mode 100644 index d318395..0000000 Binary files a/docs/howtos/x60_unbrick/0009.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0010.jpg b/docs/howtos/x60_unbrick/0010.jpg deleted file mode 100644 index 5e6fdc7..0000000 Binary files a/docs/howtos/x60_unbrick/0010.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0011.jpg b/docs/howtos/x60_unbrick/0011.jpg deleted file mode 100644 index edc14c7..0000000 Binary files a/docs/howtos/x60_unbrick/0011.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0012.jpg b/docs/howtos/x60_unbrick/0012.jpg deleted file mode 100644 index dbb6669..0000000 Binary files a/docs/howtos/x60_unbrick/0012.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0013.jpg b/docs/howtos/x60_unbrick/0013.jpg deleted file mode 100644 index 2d2b9dd..0000000 Binary files a/docs/howtos/x60_unbrick/0013.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0014.jpg b/docs/howtos/x60_unbrick/0014.jpg deleted file mode 100644 index 733f997..0000000 Binary files a/docs/howtos/x60_unbrick/0014.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0015.jpg b/docs/howtos/x60_unbrick/0015.jpg deleted file mode 100644 index 1e81166..0000000 Binary files a/docs/howtos/x60_unbrick/0015.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0016.jpg b/docs/howtos/x60_unbrick/0016.jpg deleted file mode 100644 index f10ca88..0000000 Binary files a/docs/howtos/x60_unbrick/0016.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0017.jpg b/docs/howtos/x60_unbrick/0017.jpg deleted file mode 100644 index 69b28c0..0000000 Binary files a/docs/howtos/x60_unbrick/0017.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0018.jpg b/docs/howtos/x60_unbrick/0018.jpg deleted file mode 100644 index 7145d9f..0000000 Binary files a/docs/howtos/x60_unbrick/0018.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0019.jpg b/docs/howtos/x60_unbrick/0019.jpg deleted file mode 100644 index 959a6ee..0000000 Binary files a/docs/howtos/x60_unbrick/0019.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0020.jpg b/docs/howtos/x60_unbrick/0020.jpg deleted file mode 100644 index e6b2536..0000000 Binary files a/docs/howtos/x60_unbrick/0020.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0021.jpg b/docs/howtos/x60_unbrick/0021.jpg deleted file mode 100644 index 65bcb60..0000000 Binary files a/docs/howtos/x60_unbrick/0021.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0022.jpg b/docs/howtos/x60_unbrick/0022.jpg deleted file mode 100644 index cfcad6d..0000000 Binary files a/docs/howtos/x60_unbrick/0022.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0023.jpg b/docs/howtos/x60_unbrick/0023.jpg deleted file mode 100644 index 10824fd..0000000 Binary files a/docs/howtos/x60_unbrick/0023.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0024.jpg b/docs/howtos/x60_unbrick/0024.jpg deleted file mode 100644 index 9ce9d45..0000000 Binary files a/docs/howtos/x60_unbrick/0024.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0025.jpg b/docs/howtos/x60_unbrick/0025.jpg deleted file mode 100644 index 7b6da73..0000000 Binary files a/docs/howtos/x60_unbrick/0025.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0026.jpg b/docs/howtos/x60_unbrick/0026.jpg deleted file mode 100644 index 526c11c..0000000 Binary files a/docs/howtos/x60_unbrick/0026.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0027.jpg b/docs/howtos/x60_unbrick/0027.jpg deleted file mode 100644 index 877dc59..0000000 Binary files a/docs/howtos/x60_unbrick/0027.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0028.jpg b/docs/howtos/x60_unbrick/0028.jpg deleted file mode 100644 index d22d932..0000000 Binary files a/docs/howtos/x60_unbrick/0028.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0029.jpg b/docs/howtos/x60_unbrick/0029.jpg deleted file mode 100644 index 27f9190..0000000 Binary files a/docs/howtos/x60_unbrick/0029.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0030.jpg b/docs/howtos/x60_unbrick/0030.jpg deleted file mode 100644 index 813b5c6..0000000 Binary files a/docs/howtos/x60_unbrick/0030.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0031.jpg b/docs/howtos/x60_unbrick/0031.jpg deleted file mode 100644 index 49fe541..0000000 Binary files a/docs/howtos/x60_unbrick/0031.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0032.jpg b/docs/howtos/x60_unbrick/0032.jpg deleted file mode 100644 index e8625ef..0000000 Binary files a/docs/howtos/x60_unbrick/0032.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0033.jpg b/docs/howtos/x60_unbrick/0033.jpg deleted file mode 100644 index 3abfa37..0000000 Binary files a/docs/howtos/x60_unbrick/0033.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0034.jpg b/docs/howtos/x60_unbrick/0034.jpg deleted file mode 100644 index c8ab597..0000000 Binary files a/docs/howtos/x60_unbrick/0034.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0035.jpg b/docs/howtos/x60_unbrick/0035.jpg deleted file mode 100644 index 03d5482..0000000 Binary files a/docs/howtos/x60_unbrick/0035.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0036.jpg b/docs/howtos/x60_unbrick/0036.jpg deleted file mode 100644 index 244c06c..0000000 Binary files a/docs/howtos/x60_unbrick/0036.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0037.jpg b/docs/howtos/x60_unbrick/0037.jpg deleted file mode 100644 index f55db4f..0000000 Binary files a/docs/howtos/x60_unbrick/0037.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0038.jpg b/docs/howtos/x60_unbrick/0038.jpg deleted file mode 100644 index 0735825..0000000 Binary files a/docs/howtos/x60_unbrick/0038.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0039.jpg b/docs/howtos/x60_unbrick/0039.jpg deleted file mode 100644 index dff9ba4..0000000 Binary files a/docs/howtos/x60_unbrick/0039.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0040.jpg b/docs/howtos/x60_unbrick/0040.jpg deleted file mode 100644 index 74a9b7f..0000000 Binary files a/docs/howtos/x60_unbrick/0040.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0041.jpg b/docs/howtos/x60_unbrick/0041.jpg deleted file mode 100644 index 1b15834..0000000 Binary files a/docs/howtos/x60_unbrick/0041.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0042.jpg b/docs/howtos/x60_unbrick/0042.jpg deleted file mode 100644 index 849a260..0000000 Binary files a/docs/howtos/x60_unbrick/0042.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0043.jpg b/docs/howtos/x60_unbrick/0043.jpg deleted file mode 100644 index c842695..0000000 Binary files a/docs/howtos/x60_unbrick/0043.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0044.jpg b/docs/howtos/x60_unbrick/0044.jpg deleted file mode 100644 index 2b78380..0000000 Binary files a/docs/howtos/x60_unbrick/0044.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0045.jpg b/docs/howtos/x60_unbrick/0045.jpg deleted file mode 100644 index d6d8e2d..0000000 Binary files a/docs/howtos/x60_unbrick/0045.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0046.jpg b/docs/howtos/x60_unbrick/0046.jpg deleted file mode 100644 index 5eef878..0000000 Binary files a/docs/howtos/x60_unbrick/0046.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0047.jpg b/docs/howtos/x60_unbrick/0047.jpg deleted file mode 100644 index 87517e0..0000000 Binary files a/docs/howtos/x60_unbrick/0047.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0048.jpg b/docs/howtos/x60_unbrick/0048.jpg deleted file mode 100644 index a701a48..0000000 Binary files a/docs/howtos/x60_unbrick/0048.jpg and /dev/null differ diff --git a/docs/howtos/x60_unbrick/0049.jpg b/docs/howtos/x60_unbrick/0049.jpg deleted file mode 100644 index 630ac53..0000000 Binary files a/docs/howtos/x60_unbrick/0049.jpg and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/.htaccess b/docs/howtos/x60t_unbrick/.htaccess deleted file mode 100644 index 75da674..0000000 --- a/docs/howtos/x60t_unbrick/.htaccess +++ /dev/null @@ -1,2 +0,0 @@ -Options +Indexes -IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* diff --git a/docs/howtos/x60t_unbrick/0000.JPG b/docs/howtos/x60t_unbrick/0000.JPG deleted file mode 100644 index 4d8de31..0000000 Binary files a/docs/howtos/x60t_unbrick/0000.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0001.JPG b/docs/howtos/x60t_unbrick/0001.JPG deleted file mode 100644 index 7783c4f..0000000 Binary files a/docs/howtos/x60t_unbrick/0001.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0002.JPG b/docs/howtos/x60t_unbrick/0002.JPG deleted file mode 100644 index ddc6aac..0000000 Binary files a/docs/howtos/x60t_unbrick/0002.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0003.JPG b/docs/howtos/x60t_unbrick/0003.JPG deleted file mode 100644 index e1b6586..0000000 Binary files a/docs/howtos/x60t_unbrick/0003.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0004.JPG b/docs/howtos/x60t_unbrick/0004.JPG deleted file mode 100644 index b4ae18d..0000000 Binary files a/docs/howtos/x60t_unbrick/0004.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0005.JPG b/docs/howtos/x60t_unbrick/0005.JPG deleted file mode 100644 index b7b324b..0000000 Binary files a/docs/howtos/x60t_unbrick/0005.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0006.JPG b/docs/howtos/x60t_unbrick/0006.JPG deleted file mode 100644 index 795d02a..0000000 Binary files a/docs/howtos/x60t_unbrick/0006.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0007.JPG b/docs/howtos/x60t_unbrick/0007.JPG deleted file mode 100644 index 0ccdbad..0000000 Binary files a/docs/howtos/x60t_unbrick/0007.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0008.JPG b/docs/howtos/x60t_unbrick/0008.JPG deleted file mode 100644 index 5312934..0000000 Binary files a/docs/howtos/x60t_unbrick/0008.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0009.JPG b/docs/howtos/x60t_unbrick/0009.JPG deleted file mode 100644 index 9d8e7fa..0000000 Binary files a/docs/howtos/x60t_unbrick/0009.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0010.JPG b/docs/howtos/x60t_unbrick/0010.JPG deleted file mode 100644 index ea37b18..0000000 Binary files a/docs/howtos/x60t_unbrick/0010.JPG and /dev/null differ diff --git a/docs/howtos/x60t_unbrick/0011.JPG b/docs/howtos/x60t_unbrick/0011.JPG deleted file mode 100644 index ebbaa74..0000000 Binary files a/docs/howtos/x60t_unbrick/0011.JPG and /dev/null differ diff --git a/docs/howtos/x60tablet_unbrick.html b/docs/howtos/x60tablet_unbrick.html deleted file mode 100644 index da60227..0000000 --- a/docs/howtos/x60tablet_unbrick.html +++ /dev/null @@ -1,219 +0,0 @@ - - - - - - - - - Libreboot documentation: Unbricking the ThinkPad X60 Tablet - - - - -
    -

    Unbricking the ThinkPad X60

    - -
    - -

    Or go back to main index

    - -

    Table of Contents

    - - -

    Hardware requirements

    -
      -
    • a 2nd computer (maybe another X60 Tablet. any computer will do)
    • -
    • external flashrom-compatible programmer (I'm using the "bus pirate") -
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • -
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • -
    • USB mini a to b cable (for buspirate<>computer connection).
    • -
    - -

    Software requirements

    -
      -
    • GNU/Linux (on the 2nd computer)
    • -
    • flashrom software (on the 2nd computer): http://flashrom.org/ -
    - -

    Brick type 1: bucts not reset.

    -

    - You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and - the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    - - In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    -

    - - *Those dd commands should be applied to all newly compiled X60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    - dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    - dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    - dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    - (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, - using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. -

    - -

    bad rom (or user error), machine won't boot

    -

    - In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from - booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. -

    -

    - "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). -

    - -

    - -

    - -

    - Remove those screws:
    - -

    - -

    - Remove the HDD:
    - -

    - -

    - Push keyboard forward to loosen it:
    - -

    - -

    - Lift:
    - -

    - -

    - Remove those:
    - -

    - -

    - - -

    - -

    - Also remove that (marked) and unroute the antenna cables:
    - -

    - -

    - Some X60T's you have to unroute those too:
    - -

    - -

    - Remove the LCD extend board screws. Also remove those screws (see blue marks) and remove/unroute the cables and remove the metal plate:
    - -

    - -

    - Remove that screw and then remove the board:
    - -

    - -

    - At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    - http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    - Correlating with the following information, I was able to wire up my pirate correctly:
    - http://flashrom.org/Bus_Pirate#Connections
    - And by following that advice:
    - http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    - Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    - Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the - AC adapter (without powering on the board).
    - Note: I ignored that advice, and wired up all 8 pins. And it worked.
    - - Here is the pinout (correlate it with your programmer's documentation):
    -
    - (SPI chip here is on the bottom of the board) -

    - -

    - Bus pirate:
    - -

    - -

    - Pomona 5250:
    - -

    - -

    - Connect pomona:
    - -

    - -

    - Connect pirate to USB on 2nd computer:
    - -

    - -

    - Pirate is active:
    - -

    - -

    - -

    - -

    - On the 2nd machine, I did: flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60t/libreboot_ukqwerty.rom -

    - -
    -			flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    -			flashrom is free software, get the source code at http://www.flashrom.org
    -
    -			Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    -			Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    -			Reading old flash chip contents... done.
    -			Erasing and writing flash chip... Erase/write done.
    -			Verifying flash... VERIFIED. 
    -		
    - -

    - At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means that you can put your X60T back together. So let's do that now. -

    - -

    - Reverse the steps to re-assemble your machine. -

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

    - - - diff --git a/docs/images/t60_dev/.htaccess b/docs/images/t60_dev/.htaccess new file mode 100644 index 0000000..75da674 --- /dev/null +++ b/docs/images/t60_dev/.htaccess @@ -0,0 +1,2 @@ +Options +Indexes +IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* diff --git a/docs/images/t60_dev/0001.JPG b/docs/images/t60_dev/0001.JPG new file mode 100644 index 0000000..84d2f4f Binary files /dev/null and b/docs/images/t60_dev/0001.JPG differ diff --git a/docs/images/t60_dev/0002.JPG b/docs/images/t60_dev/0002.JPG new file mode 100644 index 0000000..5f8ead5 Binary files /dev/null and b/docs/images/t60_dev/0002.JPG differ diff --git a/docs/images/t60_dev/0003.JPG b/docs/images/t60_dev/0003.JPG new file mode 100644 index 0000000..4b0826f Binary files /dev/null and b/docs/images/t60_dev/0003.JPG differ diff --git a/docs/images/t60_dev/0004.JPG b/docs/images/t60_dev/0004.JPG new file mode 100644 index 0000000..42d9086 Binary files /dev/null and b/docs/images/t60_dev/0004.JPG differ diff --git a/docs/images/t60_dev/0005.JPG b/docs/images/t60_dev/0005.JPG new file mode 100644 index 0000000..8e9bce3 Binary files /dev/null and b/docs/images/t60_dev/0005.JPG differ diff --git a/docs/images/t60_dev/0006.JPG b/docs/images/t60_dev/0006.JPG new file mode 100644 index 0000000..6371b46 Binary files /dev/null and b/docs/images/t60_dev/0006.JPG differ diff --git a/docs/images/t60_dev/0007.JPG b/docs/images/t60_dev/0007.JPG new file mode 100644 index 0000000..cedc9d9 Binary files /dev/null and b/docs/images/t60_dev/0007.JPG differ diff --git a/docs/images/t60_dev/0008.JPG b/docs/images/t60_dev/0008.JPG new file mode 100644 index 0000000..bec57a1 Binary files /dev/null and b/docs/images/t60_dev/0008.JPG differ diff --git a/docs/images/t60_dev/0009.JPG b/docs/images/t60_dev/0009.JPG new file mode 100644 index 0000000..aeeda57 Binary files /dev/null and b/docs/images/t60_dev/0009.JPG differ diff --git a/docs/images/t60_dev/0010.JPG b/docs/images/t60_dev/0010.JPG new file mode 100644 index 0000000..c776171 Binary files /dev/null and b/docs/images/t60_dev/0010.JPG differ diff --git a/docs/images/t60_dev/0011.JPG b/docs/images/t60_dev/0011.JPG new file mode 100644 index 0000000..24cb443 Binary files /dev/null and b/docs/images/t60_dev/0011.JPG differ diff --git a/docs/images/t60_dev/0012.JPG b/docs/images/t60_dev/0012.JPG new file mode 100644 index 0000000..c719958 Binary files /dev/null and b/docs/images/t60_dev/0012.JPG differ diff --git a/docs/images/t60_dev/0013.JPG b/docs/images/t60_dev/0013.JPG new file mode 100644 index 0000000..b8ed7ee Binary files /dev/null and b/docs/images/t60_dev/0013.JPG differ diff --git a/docs/images/t60_dev/0014.JPG b/docs/images/t60_dev/0014.JPG new file mode 100644 index 0000000..5160dc3 Binary files /dev/null and b/docs/images/t60_dev/0014.JPG differ diff --git a/docs/images/t60_dev/0015.JPG b/docs/images/t60_dev/0015.JPG new file mode 100644 index 0000000..0c1fd18 Binary files /dev/null and b/docs/images/t60_dev/0015.JPG differ diff --git a/docs/images/t60_dev/0016.JPG b/docs/images/t60_dev/0016.JPG new file mode 100644 index 0000000..c698be2 Binary files /dev/null and b/docs/images/t60_dev/0016.JPG differ diff --git a/docs/images/t60_dev/0017.JPG b/docs/images/t60_dev/0017.JPG new file mode 100644 index 0000000..652a66e Binary files /dev/null and b/docs/images/t60_dev/0017.JPG differ diff --git a/docs/images/t60_dev/0018.JPG b/docs/images/t60_dev/0018.JPG new file mode 100644 index 0000000..cf43067 Binary files /dev/null and b/docs/images/t60_dev/0018.JPG differ diff --git a/docs/images/t60_dev/0019.JPG b/docs/images/t60_dev/0019.JPG new file mode 100644 index 0000000..a75f68a Binary files /dev/null and b/docs/images/t60_dev/0019.JPG differ diff --git a/docs/images/t60_dev/0020.JPG b/docs/images/t60_dev/0020.JPG new file mode 100644 index 0000000..0c4f7db Binary files /dev/null and b/docs/images/t60_dev/0020.JPG differ diff --git a/docs/images/t60_dev/0021.JPG b/docs/images/t60_dev/0021.JPG new file mode 100644 index 0000000..c7d5757 Binary files /dev/null and b/docs/images/t60_dev/0021.JPG differ diff --git a/docs/images/t60_dev/0022.JPG b/docs/images/t60_dev/0022.JPG new file mode 100644 index 0000000..5971da2 Binary files /dev/null and b/docs/images/t60_dev/0022.JPG differ diff --git a/docs/images/t60_dev/0023.JPG b/docs/images/t60_dev/0023.JPG new file mode 100644 index 0000000..99f67c3 Binary files /dev/null and b/docs/images/t60_dev/0023.JPG differ diff --git a/docs/images/t60_dev/0024.JPG b/docs/images/t60_dev/0024.JPG new file mode 100644 index 0000000..f89b537 Binary files /dev/null and b/docs/images/t60_dev/0024.JPG differ diff --git a/docs/images/t60_dev/0025.JPG b/docs/images/t60_dev/0025.JPG new file mode 100644 index 0000000..d6b180e Binary files /dev/null and b/docs/images/t60_dev/0025.JPG differ diff --git a/docs/images/t60_dev/0026.JPG b/docs/images/t60_dev/0026.JPG new file mode 100644 index 0000000..c8f3299 Binary files /dev/null and b/docs/images/t60_dev/0026.JPG differ diff --git a/docs/images/t60_dev/0027.JPG b/docs/images/t60_dev/0027.JPG new file mode 100644 index 0000000..10ab8e0 Binary files /dev/null and b/docs/images/t60_dev/0027.JPG differ diff --git a/docs/images/t60_dev/0028.JPG b/docs/images/t60_dev/0028.JPG new file mode 100644 index 0000000..64cba1c Binary files /dev/null and b/docs/images/t60_dev/0028.JPG differ diff --git a/docs/images/t60_dev/0029.JPG b/docs/images/t60_dev/0029.JPG new file mode 100644 index 0000000..960ebdd Binary files /dev/null and b/docs/images/t60_dev/0029.JPG differ diff --git a/docs/images/t60_dev/0030.JPG b/docs/images/t60_dev/0030.JPG new file mode 100644 index 0000000..046fd00 Binary files /dev/null and b/docs/images/t60_dev/0030.JPG differ diff --git a/docs/images/t60_dev/0031.JPG b/docs/images/t60_dev/0031.JPG new file mode 100644 index 0000000..870f22b Binary files /dev/null and b/docs/images/t60_dev/0031.JPG differ diff --git a/docs/images/t60_dev/0032.JPG b/docs/images/t60_dev/0032.JPG new file mode 100644 index 0000000..70ff44a Binary files /dev/null and b/docs/images/t60_dev/0032.JPG differ diff --git a/docs/images/t60_dev/0033.JPG b/docs/images/t60_dev/0033.JPG new file mode 100644 index 0000000..142ca97 Binary files /dev/null and b/docs/images/t60_dev/0033.JPG differ diff --git a/docs/images/t60_dev/0034.JPG b/docs/images/t60_dev/0034.JPG new file mode 100644 index 0000000..907192e Binary files /dev/null and b/docs/images/t60_dev/0034.JPG differ diff --git a/docs/images/t60_dev/0035.JPG b/docs/images/t60_dev/0035.JPG new file mode 100644 index 0000000..bf38c89 Binary files /dev/null and b/docs/images/t60_dev/0035.JPG differ diff --git a/docs/images/t60_dev/0036.JPG b/docs/images/t60_dev/0036.JPG new file mode 100644 index 0000000..a7e5bdf Binary files /dev/null and b/docs/images/t60_dev/0036.JPG differ diff --git a/docs/images/t60_dev/0037.JPG b/docs/images/t60_dev/0037.JPG new file mode 100644 index 0000000..ab30c27 Binary files /dev/null and b/docs/images/t60_dev/0037.JPG differ diff --git a/docs/images/t60_dev/0038.JPG b/docs/images/t60_dev/0038.JPG new file mode 100644 index 0000000..362c547 Binary files /dev/null and b/docs/images/t60_dev/0038.JPG differ diff --git a/docs/images/t60_dev/0039.JPG b/docs/images/t60_dev/0039.JPG new file mode 100644 index 0000000..224f72e Binary files /dev/null and b/docs/images/t60_dev/0039.JPG differ diff --git a/docs/images/t60_dev/0040.JPG b/docs/images/t60_dev/0040.JPG new file mode 100644 index 0000000..adcd923 Binary files /dev/null and b/docs/images/t60_dev/0040.JPG differ diff --git a/docs/images/t60_dev/0041.JPG b/docs/images/t60_dev/0041.JPG new file mode 100644 index 0000000..2a04682 Binary files /dev/null and b/docs/images/t60_dev/0041.JPG differ diff --git a/docs/images/t60_dev/0042.JPG b/docs/images/t60_dev/0042.JPG new file mode 100644 index 0000000..b5ed8ec Binary files /dev/null and b/docs/images/t60_dev/0042.JPG differ diff --git a/docs/images/t60_dev/0043.JPG b/docs/images/t60_dev/0043.JPG new file mode 100644 index 0000000..7144a98 Binary files /dev/null and b/docs/images/t60_dev/0043.JPG differ diff --git a/docs/images/t60_dev/0044.JPG b/docs/images/t60_dev/0044.JPG new file mode 100644 index 0000000..27a24c6 Binary files /dev/null and b/docs/images/t60_dev/0044.JPG differ diff --git a/docs/images/t60_dev/0045.JPG b/docs/images/t60_dev/0045.JPG new file mode 100644 index 0000000..997b498 Binary files /dev/null and b/docs/images/t60_dev/0045.JPG differ diff --git a/docs/images/t60_dev/0046.JPG b/docs/images/t60_dev/0046.JPG new file mode 100644 index 0000000..25d6baa Binary files /dev/null and b/docs/images/t60_dev/0046.JPG differ diff --git a/docs/images/t60_dev/0047.JPG b/docs/images/t60_dev/0047.JPG new file mode 100644 index 0000000..6b57bf3 Binary files /dev/null and b/docs/images/t60_dev/0047.JPG differ diff --git a/docs/images/t60_dev/0048.JPG b/docs/images/t60_dev/0048.JPG new file mode 100644 index 0000000..7339f07 Binary files /dev/null and b/docs/images/t60_dev/0048.JPG differ diff --git a/docs/images/t60_dev/0049.JPG b/docs/images/t60_dev/0049.JPG new file mode 100644 index 0000000..cf3a7fd Binary files /dev/null and b/docs/images/t60_dev/0049.JPG differ diff --git a/docs/images/t60_dev/0050.JPG b/docs/images/t60_dev/0050.JPG new file mode 100644 index 0000000..7de4edd Binary files /dev/null and b/docs/images/t60_dev/0050.JPG differ diff --git a/docs/images/t60_dev/0051.JPG b/docs/images/t60_dev/0051.JPG new file mode 100644 index 0000000..87c41b3 Binary files /dev/null and b/docs/images/t60_dev/0051.JPG differ diff --git a/docs/images/t60_dev/0052.JPG b/docs/images/t60_dev/0052.JPG new file mode 100644 index 0000000..4a8e443 Binary files /dev/null and b/docs/images/t60_dev/0052.JPG differ diff --git a/docs/images/t60_dev/0053.JPG b/docs/images/t60_dev/0053.JPG new file mode 100644 index 0000000..e1044fc Binary files /dev/null and b/docs/images/t60_dev/0053.JPG differ diff --git a/docs/images/t60_dev/0054.JPG b/docs/images/t60_dev/0054.JPG new file mode 100644 index 0000000..c96c020 Binary files /dev/null and b/docs/images/t60_dev/0054.JPG differ diff --git a/docs/images/t60_dev/0055.JPG b/docs/images/t60_dev/0055.JPG new file mode 100644 index 0000000..6da87d5 Binary files /dev/null and b/docs/images/t60_dev/0055.JPG differ diff --git a/docs/images/t60_dev/0056.JPG b/docs/images/t60_dev/0056.JPG new file mode 100644 index 0000000..81a6659 Binary files /dev/null and b/docs/images/t60_dev/0056.JPG differ diff --git a/docs/images/t60_dev/0057.JPG b/docs/images/t60_dev/0057.JPG new file mode 100644 index 0000000..268fede Binary files /dev/null and b/docs/images/t60_dev/0057.JPG differ diff --git a/docs/images/t60_dev/0058.JPG b/docs/images/t60_dev/0058.JPG new file mode 100644 index 0000000..bedfb12 Binary files /dev/null and b/docs/images/t60_dev/0058.JPG differ diff --git a/docs/images/t60_dev/0059.JPG b/docs/images/t60_dev/0059.JPG new file mode 100644 index 0000000..422687c Binary files /dev/null and b/docs/images/t60_dev/0059.JPG differ diff --git a/docs/images/t60_dev/0060.JPG b/docs/images/t60_dev/0060.JPG new file mode 100644 index 0000000..8743c0d Binary files /dev/null and b/docs/images/t60_dev/0060.JPG differ diff --git a/docs/images/t60_dev/0061.JPG b/docs/images/t60_dev/0061.JPG new file mode 100644 index 0000000..e05f626 Binary files /dev/null and b/docs/images/t60_dev/0061.JPG differ diff --git a/docs/images/t60_dev/0062.JPG b/docs/images/t60_dev/0062.JPG new file mode 100644 index 0000000..1fe77a7 Binary files /dev/null and b/docs/images/t60_dev/0062.JPG differ diff --git a/docs/images/t60_dev/0063.JPG b/docs/images/t60_dev/0063.JPG new file mode 100644 index 0000000..87b7761 Binary files /dev/null and b/docs/images/t60_dev/0063.JPG differ diff --git a/docs/images/t60_dev/0064.JPG b/docs/images/t60_dev/0064.JPG new file mode 100644 index 0000000..e80189e Binary files /dev/null and b/docs/images/t60_dev/0064.JPG differ diff --git a/docs/images/t60_dev/0065.JPG b/docs/images/t60_dev/0065.JPG new file mode 100644 index 0000000..4e77a88 Binary files /dev/null and b/docs/images/t60_dev/0065.JPG differ diff --git a/docs/images/t60_dev/0066.JPG b/docs/images/t60_dev/0066.JPG new file mode 100644 index 0000000..793c0f8 Binary files /dev/null and b/docs/images/t60_dev/0066.JPG differ diff --git a/docs/images/t60_dev/0068.JPG b/docs/images/t60_dev/0068.JPG new file mode 100644 index 0000000..9f9f299 Binary files /dev/null and b/docs/images/t60_dev/0068.JPG differ diff --git a/docs/images/t60_dev/0069.JPG b/docs/images/t60_dev/0069.JPG new file mode 100644 index 0000000..98931e6 Binary files /dev/null and b/docs/images/t60_dev/0069.JPG differ diff --git a/docs/images/t60_dev/0070.JPG b/docs/images/t60_dev/0070.JPG new file mode 100644 index 0000000..09958c3 Binary files /dev/null and b/docs/images/t60_dev/0070.JPG differ diff --git a/docs/images/t60_dev/0071.JPG b/docs/images/t60_dev/0071.JPG new file mode 100644 index 0000000..104d21e Binary files /dev/null and b/docs/images/t60_dev/0071.JPG differ diff --git a/docs/images/t60_dev/0072.JPG b/docs/images/t60_dev/0072.JPG new file mode 100644 index 0000000..66c8e3b Binary files /dev/null and b/docs/images/t60_dev/0072.JPG differ diff --git a/docs/images/t60_dev/0073.JPG b/docs/images/t60_dev/0073.JPG new file mode 100644 index 0000000..5d9b9fa Binary files /dev/null and b/docs/images/t60_dev/0073.JPG differ diff --git a/docs/images/t60_dev/0074.JPG b/docs/images/t60_dev/0074.JPG new file mode 100644 index 0000000..303264a Binary files /dev/null and b/docs/images/t60_dev/0074.JPG differ diff --git a/docs/images/t60_dev/t60_unbrick.jpg b/docs/images/t60_dev/t60_unbrick.jpg new file mode 100644 index 0000000..820a9b4 Binary files /dev/null and b/docs/images/t60_dev/t60_unbrick.jpg differ diff --git a/docs/images/x60_heatsink/0000.jpg b/docs/images/x60_heatsink/0000.jpg new file mode 100644 index 0000000..ce0ec3b Binary files /dev/null and b/docs/images/x60_heatsink/0000.jpg differ diff --git a/docs/images/x60_heatsink/0001.jpg b/docs/images/x60_heatsink/0001.jpg new file mode 100644 index 0000000..2bbc0ca Binary files /dev/null and b/docs/images/x60_heatsink/0001.jpg differ diff --git a/docs/images/x60_heatsink/0002.jpg b/docs/images/x60_heatsink/0002.jpg new file mode 100644 index 0000000..b55db3b Binary files /dev/null and b/docs/images/x60_heatsink/0002.jpg differ diff --git a/docs/images/x60_heatsink/0003.jpg b/docs/images/x60_heatsink/0003.jpg new file mode 100644 index 0000000..c5799ae Binary files /dev/null and b/docs/images/x60_heatsink/0003.jpg differ diff --git a/docs/images/x60_heatsink/0004.jpg b/docs/images/x60_heatsink/0004.jpg new file mode 100644 index 0000000..cd47840 Binary files /dev/null and b/docs/images/x60_heatsink/0004.jpg differ diff --git a/docs/images/x60_heatsink/0005.jpg b/docs/images/x60_heatsink/0005.jpg new file mode 100644 index 0000000..418c9d2 Binary files /dev/null and b/docs/images/x60_heatsink/0005.jpg differ diff --git a/docs/images/x60_heatsink/0006.jpg b/docs/images/x60_heatsink/0006.jpg new file mode 100644 index 0000000..6d36d93 Binary files /dev/null and b/docs/images/x60_heatsink/0006.jpg differ diff --git a/docs/images/x60_heatsink/0007.jpg b/docs/images/x60_heatsink/0007.jpg new file mode 100644 index 0000000..971ccdf Binary files /dev/null and b/docs/images/x60_heatsink/0007.jpg differ diff --git a/docs/images/x60_heatsink/0008.jpg b/docs/images/x60_heatsink/0008.jpg new file mode 100644 index 0000000..24e6526 Binary files /dev/null and b/docs/images/x60_heatsink/0008.jpg differ diff --git a/docs/images/x60_heatsink/0009.jpg b/docs/images/x60_heatsink/0009.jpg new file mode 100644 index 0000000..d318395 Binary files /dev/null and b/docs/images/x60_heatsink/0009.jpg differ diff --git a/docs/images/x60_heatsink/0010.jpg b/docs/images/x60_heatsink/0010.jpg new file mode 100644 index 0000000..5e6fdc7 Binary files /dev/null and b/docs/images/x60_heatsink/0010.jpg differ diff --git a/docs/images/x60_heatsink/0011.jpg b/docs/images/x60_heatsink/0011.jpg new file mode 100644 index 0000000..101cf6a Binary files /dev/null and b/docs/images/x60_heatsink/0011.jpg differ diff --git a/docs/images/x60_heatsink/0012.jpg b/docs/images/x60_heatsink/0012.jpg new file mode 100644 index 0000000..dbb6669 Binary files /dev/null and b/docs/images/x60_heatsink/0012.jpg differ diff --git a/docs/images/x60_heatsink/0013.jpg b/docs/images/x60_heatsink/0013.jpg new file mode 100644 index 0000000..2d2b9dd Binary files /dev/null and b/docs/images/x60_heatsink/0013.jpg differ diff --git a/docs/images/x60_heatsink/0014.jpg b/docs/images/x60_heatsink/0014.jpg new file mode 100644 index 0000000..733f997 Binary files /dev/null and b/docs/images/x60_heatsink/0014.jpg differ diff --git a/docs/images/x60_heatsink/0015.jpg b/docs/images/x60_heatsink/0015.jpg new file mode 100644 index 0000000..1e81166 Binary files /dev/null and b/docs/images/x60_heatsink/0015.jpg differ diff --git a/docs/images/x60_heatsink/0016.jpg b/docs/images/x60_heatsink/0016.jpg new file mode 100644 index 0000000..ea418a5 Binary files /dev/null and b/docs/images/x60_heatsink/0016.jpg differ diff --git a/docs/images/x60_heatsink/0017.jpg b/docs/images/x60_heatsink/0017.jpg new file mode 100644 index 0000000..8a67482 Binary files /dev/null and b/docs/images/x60_heatsink/0017.jpg differ diff --git a/docs/images/x60_heatsink/0018.jpg b/docs/images/x60_heatsink/0018.jpg new file mode 100644 index 0000000..98c43ac Binary files /dev/null and b/docs/images/x60_heatsink/0018.jpg differ diff --git a/docs/images/x60_lcd_change/0001.JPG b/docs/images/x60_lcd_change/0001.JPG new file mode 100755 index 0000000..fd066eb Binary files /dev/null and b/docs/images/x60_lcd_change/0001.JPG differ diff --git a/docs/images/x60_lcd_change/0002.JPG b/docs/images/x60_lcd_change/0002.JPG new file mode 100755 index 0000000..96949f1 Binary files /dev/null and b/docs/images/x60_lcd_change/0002.JPG differ diff --git a/docs/images/x60_lcd_change/0003.JPG b/docs/images/x60_lcd_change/0003.JPG new file mode 100755 index 0000000..90216aa Binary files /dev/null and b/docs/images/x60_lcd_change/0003.JPG differ diff --git a/docs/images/x60_lcd_change/0004.JPG b/docs/images/x60_lcd_change/0004.JPG new file mode 100755 index 0000000..3b704a4 Binary files /dev/null and b/docs/images/x60_lcd_change/0004.JPG differ diff --git a/docs/images/x60_lcd_change/0005.JPG b/docs/images/x60_lcd_change/0005.JPG new file mode 100755 index 0000000..823bab9 Binary files /dev/null and b/docs/images/x60_lcd_change/0005.JPG differ diff --git a/docs/images/x60_lcd_change/0006.JPG b/docs/images/x60_lcd_change/0006.JPG new file mode 100755 index 0000000..040f2ca Binary files /dev/null and b/docs/images/x60_lcd_change/0006.JPG differ diff --git a/docs/images/x60_lcd_change/0007.JPG b/docs/images/x60_lcd_change/0007.JPG new file mode 100755 index 0000000..42c2607 Binary files /dev/null and b/docs/images/x60_lcd_change/0007.JPG differ diff --git a/docs/images/x60_security/0000.jpg b/docs/images/x60_security/0000.jpg new file mode 100644 index 0000000..ce0ec3b Binary files /dev/null and b/docs/images/x60_security/0000.jpg differ diff --git a/docs/images/x60_security/0000_bluetooth.jpg b/docs/images/x60_security/0000_bluetooth.jpg new file mode 100644 index 0000000..94a255f Binary files /dev/null and b/docs/images/x60_security/0000_bluetooth.jpg differ diff --git a/docs/images/x60_security/0000_bluetooth0.jpg b/docs/images/x60_security/0000_bluetooth0.jpg new file mode 100644 index 0000000..a750b0c Binary files /dev/null and b/docs/images/x60_security/0000_bluetooth0.jpg differ diff --git a/docs/images/x60_security/0000_simcard0.jpg b/docs/images/x60_security/0000_simcard0.jpg new file mode 100644 index 0000000..40837ea Binary files /dev/null and b/docs/images/x60_security/0000_simcard0.jpg differ diff --git a/docs/images/x60_security/0000_simcard1.jpg b/docs/images/x60_security/0000_simcard1.jpg new file mode 100644 index 0000000..c0a5b35 Binary files /dev/null and b/docs/images/x60_security/0000_simcard1.jpg differ diff --git a/docs/images/x60_security/0001.jpg b/docs/images/x60_security/0001.jpg new file mode 100644 index 0000000..2bbc0ca Binary files /dev/null and b/docs/images/x60_security/0001.jpg differ diff --git a/docs/images/x60_security/0001_microphone.jpg b/docs/images/x60_security/0001_microphone.jpg new file mode 100644 index 0000000..c419060 Binary files /dev/null and b/docs/images/x60_security/0001_microphone.jpg differ diff --git a/docs/images/x60_security/0001_modem.jpg b/docs/images/x60_security/0001_modem.jpg new file mode 100644 index 0000000..6a7a6a0 Binary files /dev/null and b/docs/images/x60_security/0001_modem.jpg differ diff --git a/docs/images/x60_security/0001_overview.jpg b/docs/images/x60_security/0001_overview.jpg new file mode 100644 index 0000000..7268e49 Binary files /dev/null and b/docs/images/x60_security/0001_overview.jpg differ diff --git a/docs/images/x60_security/0001_speaker.jpg b/docs/images/x60_security/0001_speaker.jpg new file mode 100644 index 0000000..28d3ed6 Binary files /dev/null and b/docs/images/x60_security/0001_speaker.jpg differ diff --git a/docs/images/x60_security/0001_wlan_wwan.jpg b/docs/images/x60_security/0001_wlan_wwan.jpg new file mode 100644 index 0000000..0db858d Binary files /dev/null and b/docs/images/x60_security/0001_wlan_wwan.jpg differ diff --git a/docs/images/x60_security/0002.jpg b/docs/images/x60_security/0002.jpg new file mode 100644 index 0000000..b55db3b Binary files /dev/null and b/docs/images/x60_security/0002.jpg differ diff --git a/docs/images/x60_security/0003.jpg b/docs/images/x60_security/0003.jpg new file mode 100644 index 0000000..c5799ae Binary files /dev/null and b/docs/images/x60_security/0003.jpg differ diff --git a/docs/images/x60_security/0004.jpg b/docs/images/x60_security/0004.jpg new file mode 100644 index 0000000..cd47840 Binary files /dev/null and b/docs/images/x60_security/0004.jpg differ diff --git a/docs/images/x60_unbrick/0000.jpg b/docs/images/x60_unbrick/0000.jpg new file mode 100644 index 0000000..ce0ec3b Binary files /dev/null and b/docs/images/x60_unbrick/0000.jpg differ diff --git a/docs/images/x60_unbrick/0001.jpg b/docs/images/x60_unbrick/0001.jpg new file mode 100644 index 0000000..2bbc0ca Binary files /dev/null and b/docs/images/x60_unbrick/0001.jpg differ diff --git a/docs/images/x60_unbrick/0002.jpg b/docs/images/x60_unbrick/0002.jpg new file mode 100644 index 0000000..b55db3b Binary files /dev/null and b/docs/images/x60_unbrick/0002.jpg differ diff --git a/docs/images/x60_unbrick/0003.jpg b/docs/images/x60_unbrick/0003.jpg new file mode 100644 index 0000000..c5799ae Binary files /dev/null and b/docs/images/x60_unbrick/0003.jpg differ diff --git a/docs/images/x60_unbrick/0004.jpg b/docs/images/x60_unbrick/0004.jpg new file mode 100644 index 0000000..cd47840 Binary files /dev/null and b/docs/images/x60_unbrick/0004.jpg differ diff --git a/docs/images/x60_unbrick/0005.jpg b/docs/images/x60_unbrick/0005.jpg new file mode 100644 index 0000000..418c9d2 Binary files /dev/null and b/docs/images/x60_unbrick/0005.jpg differ diff --git a/docs/images/x60_unbrick/0006.jpg b/docs/images/x60_unbrick/0006.jpg new file mode 100644 index 0000000..6d36d93 Binary files /dev/null and b/docs/images/x60_unbrick/0006.jpg differ diff --git a/docs/images/x60_unbrick/0007.jpg b/docs/images/x60_unbrick/0007.jpg new file mode 100644 index 0000000..971ccdf Binary files /dev/null and b/docs/images/x60_unbrick/0007.jpg differ diff --git a/docs/images/x60_unbrick/0008.jpg b/docs/images/x60_unbrick/0008.jpg new file mode 100644 index 0000000..24e6526 Binary files /dev/null and b/docs/images/x60_unbrick/0008.jpg differ diff --git a/docs/images/x60_unbrick/0009.jpg b/docs/images/x60_unbrick/0009.jpg new file mode 100644 index 0000000..d318395 Binary files /dev/null and b/docs/images/x60_unbrick/0009.jpg differ diff --git a/docs/images/x60_unbrick/0010.jpg b/docs/images/x60_unbrick/0010.jpg new file mode 100644 index 0000000..5e6fdc7 Binary files /dev/null and b/docs/images/x60_unbrick/0010.jpg differ diff --git a/docs/images/x60_unbrick/0011.jpg b/docs/images/x60_unbrick/0011.jpg new file mode 100644 index 0000000..edc14c7 Binary files /dev/null and b/docs/images/x60_unbrick/0011.jpg differ diff --git a/docs/images/x60_unbrick/0012.jpg b/docs/images/x60_unbrick/0012.jpg new file mode 100644 index 0000000..dbb6669 Binary files /dev/null and b/docs/images/x60_unbrick/0012.jpg differ diff --git a/docs/images/x60_unbrick/0013.jpg b/docs/images/x60_unbrick/0013.jpg new file mode 100644 index 0000000..2d2b9dd Binary files /dev/null and b/docs/images/x60_unbrick/0013.jpg differ diff --git a/docs/images/x60_unbrick/0014.jpg b/docs/images/x60_unbrick/0014.jpg new file mode 100644 index 0000000..733f997 Binary files /dev/null and b/docs/images/x60_unbrick/0014.jpg differ diff --git a/docs/images/x60_unbrick/0015.jpg b/docs/images/x60_unbrick/0015.jpg new file mode 100644 index 0000000..1e81166 Binary files /dev/null and b/docs/images/x60_unbrick/0015.jpg differ diff --git a/docs/images/x60_unbrick/0016.jpg b/docs/images/x60_unbrick/0016.jpg new file mode 100644 index 0000000..a44b2e6 Binary files /dev/null and b/docs/images/x60_unbrick/0016.jpg differ diff --git a/docs/images/x60_unbrick/0017.jpg b/docs/images/x60_unbrick/0017.jpg new file mode 100644 index 0000000..69b28c0 Binary files /dev/null and b/docs/images/x60_unbrick/0017.jpg differ diff --git a/docs/images/x60_unbrick/0019.jpg b/docs/images/x60_unbrick/0019.jpg new file mode 100644 index 0000000..f88cc22 Binary files /dev/null and b/docs/images/x60_unbrick/0019.jpg differ diff --git a/docs/images/x60_unbrick/0020.jpg b/docs/images/x60_unbrick/0020.jpg new file mode 100644 index 0000000..e6b2536 Binary files /dev/null and b/docs/images/x60_unbrick/0020.jpg differ diff --git a/docs/images/x60_unbrick/0022.jpg b/docs/images/x60_unbrick/0022.jpg new file mode 100644 index 0000000..cb2bf33 Binary files /dev/null and b/docs/images/x60_unbrick/0022.jpg differ diff --git a/docs/images/x60_unbrick/0024.jpg b/docs/images/x60_unbrick/0024.jpg new file mode 100644 index 0000000..9ce9d45 Binary files /dev/null and b/docs/images/x60_unbrick/0024.jpg differ diff --git a/docs/images/x60_unbrick/0025.jpg b/docs/images/x60_unbrick/0025.jpg new file mode 100644 index 0000000..7b6da73 Binary files /dev/null and b/docs/images/x60_unbrick/0025.jpg differ diff --git a/docs/images/x60_unbrick/0026.jpg b/docs/images/x60_unbrick/0026.jpg new file mode 100644 index 0000000..526c11c Binary files /dev/null and b/docs/images/x60_unbrick/0026.jpg differ diff --git a/docs/images/x60_unbrick/0027.jpg b/docs/images/x60_unbrick/0027.jpg new file mode 100644 index 0000000..877dc59 Binary files /dev/null and b/docs/images/x60_unbrick/0027.jpg differ diff --git a/docs/images/x60_unbrick/0028.jpg b/docs/images/x60_unbrick/0028.jpg new file mode 100644 index 0000000..d22d932 Binary files /dev/null and b/docs/images/x60_unbrick/0028.jpg differ diff --git a/docs/images/x60_unbrick/0029.jpg b/docs/images/x60_unbrick/0029.jpg new file mode 100644 index 0000000..27f9190 Binary files /dev/null and b/docs/images/x60_unbrick/0029.jpg differ diff --git a/docs/images/x60_unbrick/0030.jpg b/docs/images/x60_unbrick/0030.jpg new file mode 100644 index 0000000..813b5c6 Binary files /dev/null and b/docs/images/x60_unbrick/0030.jpg differ diff --git a/docs/images/x60_unbrick/0031.jpg b/docs/images/x60_unbrick/0031.jpg new file mode 100644 index 0000000..49fe541 Binary files /dev/null and b/docs/images/x60_unbrick/0031.jpg differ diff --git a/docs/images/x60_unbrick/0032.jpg b/docs/images/x60_unbrick/0032.jpg new file mode 100644 index 0000000..e8625ef Binary files /dev/null and b/docs/images/x60_unbrick/0032.jpg differ diff --git a/docs/images/x60_unbrick/0033.jpg b/docs/images/x60_unbrick/0033.jpg new file mode 100644 index 0000000..3abfa37 Binary files /dev/null and b/docs/images/x60_unbrick/0033.jpg differ diff --git a/docs/images/x60_unbrick/0034.jpg b/docs/images/x60_unbrick/0034.jpg new file mode 100644 index 0000000..c8ab597 Binary files /dev/null and b/docs/images/x60_unbrick/0034.jpg differ diff --git a/docs/images/x60_unbrick/0035.jpg b/docs/images/x60_unbrick/0035.jpg new file mode 100644 index 0000000..03d5482 Binary files /dev/null and b/docs/images/x60_unbrick/0035.jpg differ diff --git a/docs/images/x60_unbrick/0036.jpg b/docs/images/x60_unbrick/0036.jpg new file mode 100644 index 0000000..244c06c Binary files /dev/null and b/docs/images/x60_unbrick/0036.jpg differ diff --git a/docs/images/x60_unbrick/0037.jpg b/docs/images/x60_unbrick/0037.jpg new file mode 100644 index 0000000..f55db4f Binary files /dev/null and b/docs/images/x60_unbrick/0037.jpg differ diff --git a/docs/images/x60_unbrick/0038.jpg b/docs/images/x60_unbrick/0038.jpg new file mode 100644 index 0000000..0735825 Binary files /dev/null and b/docs/images/x60_unbrick/0038.jpg differ diff --git a/docs/images/x60_unbrick/0039.jpg b/docs/images/x60_unbrick/0039.jpg new file mode 100644 index 0000000..dff9ba4 Binary files /dev/null and b/docs/images/x60_unbrick/0039.jpg differ diff --git a/docs/images/x60_unbrick/0040.jpg b/docs/images/x60_unbrick/0040.jpg new file mode 100644 index 0000000..74a9b7f Binary files /dev/null and b/docs/images/x60_unbrick/0040.jpg differ diff --git a/docs/images/x60_unbrick/0041.jpg b/docs/images/x60_unbrick/0041.jpg new file mode 100644 index 0000000..1b15834 Binary files /dev/null and b/docs/images/x60_unbrick/0041.jpg differ diff --git a/docs/images/x60_unbrick/0042.jpg b/docs/images/x60_unbrick/0042.jpg new file mode 100644 index 0000000..849a260 Binary files /dev/null and b/docs/images/x60_unbrick/0042.jpg differ diff --git a/docs/images/x60_unbrick/0043.jpg b/docs/images/x60_unbrick/0043.jpg new file mode 100644 index 0000000..c842695 Binary files /dev/null and b/docs/images/x60_unbrick/0043.jpg differ diff --git a/docs/images/x60_unbrick/0044.jpg b/docs/images/x60_unbrick/0044.jpg new file mode 100644 index 0000000..2b78380 Binary files /dev/null and b/docs/images/x60_unbrick/0044.jpg differ diff --git a/docs/images/x60_unbrick/0045.jpg b/docs/images/x60_unbrick/0045.jpg new file mode 100644 index 0000000..d6d8e2d Binary files /dev/null and b/docs/images/x60_unbrick/0045.jpg differ diff --git a/docs/images/x60_unbrick/0046.jpg b/docs/images/x60_unbrick/0046.jpg new file mode 100644 index 0000000..5eef878 Binary files /dev/null and b/docs/images/x60_unbrick/0046.jpg differ diff --git a/docs/images/x60_unbrick/0047.jpg b/docs/images/x60_unbrick/0047.jpg new file mode 100644 index 0000000..87517e0 Binary files /dev/null and b/docs/images/x60_unbrick/0047.jpg differ diff --git a/docs/images/x60_unbrick/0048.jpg b/docs/images/x60_unbrick/0048.jpg new file mode 100644 index 0000000..a701a48 Binary files /dev/null and b/docs/images/x60_unbrick/0048.jpg differ diff --git a/docs/images/x60_unbrick/0049.jpg b/docs/images/x60_unbrick/0049.jpg new file mode 100644 index 0000000..630ac53 Binary files /dev/null and b/docs/images/x60_unbrick/0049.jpg differ diff --git a/docs/images/x60t_unbrick/.htaccess b/docs/images/x60t_unbrick/.htaccess new file mode 100644 index 0000000..75da674 --- /dev/null +++ b/docs/images/x60t_unbrick/.htaccess @@ -0,0 +1,2 @@ +Options +Indexes +IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* diff --git a/docs/images/x60t_unbrick/0000.JPG b/docs/images/x60t_unbrick/0000.JPG new file mode 100644 index 0000000..4d8de31 Binary files /dev/null and b/docs/images/x60t_unbrick/0000.JPG differ diff --git a/docs/images/x60t_unbrick/0001.JPG b/docs/images/x60t_unbrick/0001.JPG new file mode 100644 index 0000000..7783c4f Binary files /dev/null and b/docs/images/x60t_unbrick/0001.JPG differ diff --git a/docs/images/x60t_unbrick/0002.JPG b/docs/images/x60t_unbrick/0002.JPG new file mode 100644 index 0000000..ddc6aac Binary files /dev/null and b/docs/images/x60t_unbrick/0002.JPG differ diff --git a/docs/images/x60t_unbrick/0003.JPG b/docs/images/x60t_unbrick/0003.JPG new file mode 100644 index 0000000..e1b6586 Binary files /dev/null and b/docs/images/x60t_unbrick/0003.JPG differ diff --git a/docs/images/x60t_unbrick/0004.JPG b/docs/images/x60t_unbrick/0004.JPG new file mode 100644 index 0000000..b4ae18d Binary files /dev/null and b/docs/images/x60t_unbrick/0004.JPG differ diff --git a/docs/images/x60t_unbrick/0005.JPG b/docs/images/x60t_unbrick/0005.JPG new file mode 100644 index 0000000..b7b324b Binary files /dev/null and b/docs/images/x60t_unbrick/0005.JPG differ diff --git a/docs/images/x60t_unbrick/0006.JPG b/docs/images/x60t_unbrick/0006.JPG new file mode 100644 index 0000000..795d02a Binary files /dev/null and b/docs/images/x60t_unbrick/0006.JPG differ diff --git a/docs/images/x60t_unbrick/0007.JPG b/docs/images/x60t_unbrick/0007.JPG new file mode 100644 index 0000000..0ccdbad Binary files /dev/null and b/docs/images/x60t_unbrick/0007.JPG differ diff --git a/docs/images/x60t_unbrick/0008.JPG b/docs/images/x60t_unbrick/0008.JPG new file mode 100644 index 0000000..5312934 Binary files /dev/null and b/docs/images/x60t_unbrick/0008.JPG differ diff --git a/docs/images/x60t_unbrick/0009.JPG b/docs/images/x60t_unbrick/0009.JPG new file mode 100644 index 0000000..9d8e7fa Binary files /dev/null and b/docs/images/x60t_unbrick/0009.JPG differ diff --git a/docs/images/x60t_unbrick/0010.JPG b/docs/images/x60t_unbrick/0010.JPG new file mode 100644 index 0000000..ea37b18 Binary files /dev/null and b/docs/images/x60t_unbrick/0010.JPG differ diff --git a/docs/images/x60t_unbrick/0011.JPG b/docs/images/x60t_unbrick/0011.JPG new file mode 100644 index 0000000..ebbaa74 Binary files /dev/null and b/docs/images/x60t_unbrick/0011.JPG differ diff --git a/docs/index.html b/docs/index.html index e5fe5df..fe17fc4 100644 --- a/docs/index.html +++ b/docs/index.html @@ -5,1752 +5,165 @@ - Libreboot documentation: Main + Documentation for libreboot project -
    -

    Libreboot Documentation

    - - -
    - -

    - It is assumed that you are running GNU/Linux. No other operating system is known to be compatible (with libreboot) for this release. -

    - -

    - The information here is mainly user documentation. For development notes and TODO's, see release.html and - future/index.html -

    - -

    GNU/Linux distributions

    - - -

    Working with source code

    - - -

    Supported hardware

    - - -

    Installing libreboot (software: using internal programmer)

    - - -

    Installing libreboot (hardware: using external programmer)

    - - -

    Security topics

    - - -

    Hardware maintenance

    - - -

    GRUB2 payload

    - - -

    Miscallaneous

    - - -
    - -

    What is libreboot, really?

    - -

    - Project goals (and differences versus coreboot): -

    -
      -
    • - Coreboot contains blobs (proprietary data/code) and libreboot does not (it intentionally removes them). -
    • -
    • - Coreboot is hacker-friendly and focuses on software developers, libreboot is user-focused and attempts to - turn coreboot into a distribution, sort of like a GNU/Linux distribution (same concept, different software). For example, libreboot - distributes GRUB/memtest86+/bucts/flashrom (and more) and comes with user-focused documentation and build scripts; libreboot - is therefore made more 'user-friendly'. -
    • -
    - -

    - Libreboot is not a fork of coreboot, despite misconceptions of this fact. Libreboot (downstream supplier) is a parallel effort - which works closely with and re-bases on the latest coreboot (upstream supplier) every so often. -

    - -

    - - As such, all new coreboot development should be done in coreboot, not libreboot! - Libreboot is about deblobbing, and packaging coreboot in a user-friendly way, where most work is already done for the user! - If, for example you wanted to attempt porting a new motherboard then you should do that in coreboot. Libreboot will (as a downstream) - receive your change at some point in the future, in a future release. - -

    - -

    - A 'stable' coreboot: -

    -
      -
    • - Coreboot uses the rolling release model - (and it is therefore quite volatile; one day when you build coreboot, it may or may not work correctly on your machine). -
    • -
    • - Libreboot changes less often (as far as the release model is concerned), focusing instead on 'tested' releases for specific machines. - At any given time, it might also be possible to build ROM images for systems other than those officially supported. If you get your board to work - (without violating the "coreboot development goes in coreboot" rule, then others could benefit from your work). -
    • -
    - -

    - On the other hand, coreboot is also strict about what it accepts (merges) into the main git repository: - most of the time, a lot of changes are under review at review.coreboot.org (as a way of encouraging as much further development - as possible before accepting the patch). -

    - -

    - Meanwhile, libreboot is a lot less strict in this area and freely merges specific patches that are desirable, sometimes before they are merged into coreboot's main repository. -

    - -

    Back to top of page.

    - -
    - -

    Install build dependencies

    - -

    - Before doing anything, you need the dependencies first. -

    -
      -
    • deps-trisquel script installs dependencies for Trisquel 6 (also tested in Trisquel 7).
    • -
    • deps-parabola script installs dependencies for Parabola
    • -
    - -

    - For all other GNU/Linux distributions, you may have to adapt these scripts. By all means send patches! -

    - -

    Back to top of page

    - -
    - -

    Get the full source code from metadata (git clone)

    - -

    - If you downloaded libreboot from git, then there are some steps to download and patch - the source code for all relevant dependencies. The archive in the git repository used to be - available as a tarball called 'libreboot_meta.tar.gz'. It contains 'metadata' (scripts) - which define how the source was created (where it came from). -

    - -

    - You can use the scripts included to download everything. -

    - -

    - First, install the build dependencies. -

    - -

    - After that, run the get script:
    - $ ./getall -

    - -

    - What this did was download everything (grub, coreboot, memtest86+, bucts, flashrom) - at the versions last tested for this release, and patch them. Read the script - in a text editor to learn more. -

    - -

    - To build the ROM's, see #build. -

    - -

    Back to top of page.

    - -
    - -

    How to build "bucts" (for LenovoBIOS X60/X60S/X60T/T60)

    - -

    - This is for Lenovo BIOS users on the ThinkPad X60/X60S, X60 Tablet and T60. If you have coreboot or libreboot running already, ignore this. -

    - -

    - Bucts is needed when flashing in software the X60/X60S/X60T/T60 ROM while Lenovo BIOS is running; - external flashing will be safe regardless. - Each ROM contains identical data inside the two final 64K region in the file. - This corresponds to the final two 64K regions in the flash chip. Lenovo BIOS will prevent you from writing the - final one, so running "bucts 1" will set the machine to boot from the other block instead (which - is writeable along with everything beneath it when using a patched flashrom. see #build_flashrom). - After shutting down and booting up after the first flash, - the final 64K block is writeable so you flash the ROM again with an unpatched flashrom and run "bucts 0" to - make the machine boot from the normal (highest) block again. -

    - -

    - BUC.TS utility is included in libreboot_src.tar.gz and libreboot_bin.tar.gz.
    - If you downloaded from git, follow #build_meta before you proceed. -

    - -

    - "BUC" means "Backup Control" (it's a register) and "TS" means "Top Swap" - (it's a status bit). Hence "bucts" (BUC.TS). TS 1 and TS 0 corresponds to bucts 1 and bucts 0. -

    - -

    - First, install the build dependencies. -

    - -

    - To build bucts, do this in the main directory:
    - $ ./builddeps-bucts -

    - -

    - The "builddeps" script in libreboot_src also makes use of builddeps-bucts. -

    - -

    Back to top of page.

    - -
    - -

    How to build "flashrom"

    - -

    - Flashrom is the utility for flashing/dumping ROM's. This is what you will use to install libreboot. -

    - -

    - Flashrom source code is included in libreboot_src.tar.gz and libreboot_bin.tar.gz.
    - If you downloaded from git, follow #build_meta before you proceed. -

    - -

    - First, install the build dependencies. -

    - -

    - To build it, do that in the main directory:
    - $ ./builddeps-flashrom -

    - -

    - After you've done that, under ./flashrom/ you will find the following executables: -

    -
      -
    • - flashrom -
        -
      • For flashing while coreboot or libreboot is running.
      • -
      -
    • -
    • - flashrom_lenovobios_sst -
        -
      • This is patched for flashing while Lenovo BIOS is running on an X60 or T60 with the SST25VF016B (SST) flash chip.
      • -
      -
    • -
    • - flashrom_lenovobios_macronix -
        -
      • This is patched for flashing while Lenovo BIOS is running on an X60 or T60 with the MX25L1605D (Macronix) flash chip.
      • -
      -
    • -
    - -

    - The "builddeps" script in libreboot_src also makes use of builddeps-flashrom. -

    - -

    Back to top of page.

    - -
    - -

    Configuring libreboot

    - -

    - Before building a ROM in libreboot (or coreboot, for that matter), you need to configure it. - This is done using the following inside the source tree:
    - $ make menuconfig -

    - -

    - If you've already built a kernel before, you know how to use this interface. -

    - -

    - Configurations are then saved as files called ".config". Copies of each configuration used - for each machine type by the libreboot build scripts are stored in resources/libreboot/config/ -

    - -

    - dmidecode -

    -

    - There is certain information that can be useful to enter in particular: -

    -
      -
    • Local version string
    • -
    • SMBIOS Serial Number
    • -
    • SMBIOS Manufacturer
    • -
    • SMBIOS Version
    • -
    • SMBIOS Product name
    • -
    -

    - This information can be obtained using:
    - $ sudo dmidecode
    - # dmidecode -

    -

    - Specifically, it's good practise to enter the same information for libreboot that you found when running this - with the original BIOS or firmware. libreboot has already done this for you. This information is for reference, - in the hope that it will be useful. -

    - -

    - ThinkPad X60 configuration (file: resources/libreboot/config/x60/config) -

    -
      -
    • General setup / Expert mode = enable
    • -
    • General setup / Local version string = 7BETC7WW (2.08 )
    • -
    • Mainboard / Mainboard vendor = Lenovo
    • -
    • Mainboard / Mainboard model = ThinkPad X60 / X60s / X60t
    • -
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • -
    • Mainboard / SMBIOS Serial Number = L3BH242
    • -
    • Mainboard / SMBIOS Version Number = ThinkPad X60s
    • -
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • -
    • Mainboard / SMBIOS Product name = 1702L8G
    • -
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • -
    • Devices / Use native graphics initialization = enable
    • -
    • - Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) -
        -
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time - to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • -
      -
    • -
    • Generic Drivers / Digitizer = Autodetect
    • -
    • Console / Send console output to a CBMEM buffer = enable
    • -
    • Payload / Add a payload = An ELF executable payload
    • -
    • Payload / Payload path and filename = grub.elf
    • -
    -

    - Now go back into Devices: -

    -
      -
    • Devices / Run VGA Option ROMs = disable
    • -
    • Devices / Run Option ROMs on PCI devices = disable
    • -
    -

    - The resulting .config file was saved as resources/libreboot/config/x60/config and is used by the build - scripts for this machine. -

    -

    - This is based on an X60S with the Core 2 Duo L7400 processor. -

    -

    - SMBIOS Version Number is ThinkPad X60 on the X60, but it is believed that the X60 and X60s both have identical - motherboards where the only difference is the CPU. This same configuration is used on the X60 and X60s. -

    - -

    - ThinkPad X60 Tablet configuration (file: resources/libreboot/config/x60t/config) -

    -
      -
    • General setup / Expert mode = enable
    • -
    • General setup / Local version string = 7JET23WW (1.08 )
    • -
    • Mainboard / Mainboard vendor = Lenovo
    • -
    • Mainboard / Mainboard model = ThinkPad X60 / X60s / X60t
    • -
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • -
    • Mainboard / SMBIOS Serial Number = L3B8281
    • -
    • Mainboard / SMBIOS Version Number = ThinkPad X60 Tablet
    • -
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • -
    • Mainboard / SMBIOS Product name = 6364WJ1
    • -
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • -
    • Devices / Use native graphics initialization = enable
    • -
    • - Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) -
        -
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time - to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • -
      -
    • -
    • Generic Drivers / Digitizer = Present
    • -
    • Console / Send console output to a CBMEM buffer = enable
    • -
    • Payload / Add a payload = An ELF executable payload
    • -
    • Payload / Payload path and filename = grub.elf
    • -
    -

    - Now go back into Devices: -

    -
      -
    • Devices / Run VGA Option ROMs = disable
    • -
    • Devices / Run Option ROMs on PCI devices = disable
    • -
    -

    - The resulting .config file was saved as resources/libreboot/config/x60t/config and is used by the build - scripts for this machine. -

    -

    - This is based on an X60T with the Core 2 Duo L7400 processor. -

    - -

    - ThinkPad T60 configuration (file: resources/libreboot/config/t60/config) -

    -
      -
    • General setup / Expert mode = enable
    • -
    • General setup / Local version string = 79ETE7WW (2.27 )
    • -
    • Mainboard / Mainboard vendor = Lenovo
    • -
    • Mainboard / Mainboard model = ThinkPad T60 / T60p
    • -
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • -
    • Mainboard / SMBIOS Serial Number = L3DKE06
    • -
    • Mainboard / SMBIOS Version Number = ThinkPad T60
    • -
    • Mainboard / SMBIOS Manufacturer = LENOVO
    • -
    • Mainboard / SMBIOS Product name = 1951FEG
    • -
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • -
    • Devices / Use native graphics initialization = enable
    • -
    • - Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) -
        -
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time - to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • -
      -
    • -
    • Console / Send console output to a CBMEM buffer = enable
    • -
    • Payload / Add a payload = An ELF executable payload
    • -
    • Payload / Payload path and filename = grub.elf
    • -
    - Go back into Devices: -

    -
      -
    • Devices / Run VGA Option ROMs = disable
    • -
    • Devices / Run Option ROMs on PCI devices = disable
    • -
    -

    - The resulting .config file was saved as resources/libreboot/config/t60/config and is used by the build - scripts for this machine. -

    -

    - It is believed that the motherboards on 14.1" and 15.1" T60's are the same, so the same configuration is used - on both the 14.1" and 15.1" T60's. -

    - -

    - MacBook2,1 configuration (file: resources/libreboot/config/macbook21/config) -

    -
      -
    • General / Expert mode = enable
    • -
    • General / Local version string = "    MB21.88Z.00A5.B07.0706270922" (without the quotes)
    • -
    • Mainboard / Mainboard vendor = Apple
    • -
    • Mainboard / Mainboard model = Macbook2,1 ICH7 TESTING
    • -
    • Mainboard / ROM chip size = 2048 KB (2 MB)
    • -
    • Mainboard / SMBIOS Serial Number = W8724XXXXXX
    • -
    • Mainboard / SMBIOS Version Number = 1.0
    • -
    • Mainboard / SMBIOS Manufacturer = Apple Inc.
    • -
    • Mainboard / SMBIOS Product Name = MacBook2,1
    • -
    • Chipset / Include CPU microcode in CBFS = Do not include microcode updates
    • -
    • Devices / Use native graphics initialization = enable
    • -
    • - Display / Keep VESA framebuffer = disable (disable for text-mode graphics, enable for coreboot vesa framebuffer) -
        -
      • Libreboot provides this with text-mode enabled by default, but it automatically patches a copy of the config at build time - to enable coreboot framebuffer for a separate set of ROM images, in each machine.
      • -
      -
    • -
    • Console / Send console output to a CBMEM buffer = enable
    • -
    • Payload / Add a payload = An ELF executable payload
    • -
    • Payload / Payload path and filename = grub.elf
    • -
    -

    - Go back and disable option ROM's: -

    -
      -
    • Devices / Run VGA Option ROMs = disable
    • -
    • Devices / Run Option ROMs on PCI devices = disable
    • -
    -

    - The resulting .config file was saved as resources/libreboot/config/macbook21/config and is used by the build - scripts for this machine. This config is also used for the MacBook1,1. -

    - -

    Back to top of page.

    - -
    - -

    How to build the ROM's!

    - -

    You don't need to do much, as there are scripts already written for you that can build everything automatically.

    - -

    - First, install the build dependencies. -

    -

    - If you downloaded libreboot from git, refer to #build_meta. -

    - -

    If running for the first time, run this:
    - $ ./buildall (also performs the "./build" step below)
    - Or if you only want to build dependencies (crossgcc, grub and so on):
    - $ ./builddeps

    - -

    If you've already run ./builddeps and/or ./buildall before, you don't need to run them again. - Just run that from now on to build your ROM's:
    - $ ./build

    - -

    To un-build (clean) the build dependencies that you built before, do the following:
    - This also deletes the ROM images under ./bin/:
    - $ ./cleandeps

    - -

    Note: after running 'cleandeps', you will need to run 'builddeps' or 'buildall' again before you can use 'build'.

    - -

    After 'build' or 'buildall' has finished, you'll find the ROM images for each machine under ./bin/

    - -

    Preparing release archives (optional)

    - -

    - Run that script:
    - $ ./build-release -

    - -

    - You'll find that the files libreboot_bin.tar.xz and libreboot_src.tar.xz have been created. -

    - -

    Back to top of page

    - -
    - -

    How to add SeaBIOS to your ROM's

    - -

    - SeaBIOS isn't really needed since libreboot uses the GRUB payload which - is much better (for several reasons), so it is no longer included in the ROM - images by default. Instead, you can add it afterwards. -

    - -

    - In the supplied binary archives, or in your own (if you did 'build-release') you can add SeaBIOS - to the ROM images, along with SeaVGABIOS which is a free/libre Video BIOS implementation that wraps - around the 'native graphics initializitation' code in coreboot, for boards that have support for it. -

    - -

    - First, install the build dependencies. -

    - -

    - Build cbfstool:
    - $ ./builddeps-cbfstool -

    - -

    - Now:
    - $ ./addseabios -

    - -

    - SeaBIOS and SeaVGABIOS (which the build scripts created, and the build-release script put - compiled - - inside the binary archive) have now been added to all of the ROM images under ./bin/. A GRUB menuentry will show - up when you boot your machine, allowing you to use SeaBIOS. -

    - -

    Back to top of page

    - -
    - -

    List of supported hardware

    - -

    - Libreboot supports the following machines in this release: -

    - - -

    - 'Supported' means that the build scripts know how to build ROM's for these machines, - and that the machines have been tested (confirmed working). There may be exceptions; - in other words, this is a list of 'officially' supported machines. -

    - -

    - It is also possible to build ROM images (from source) for other machines (and virtual machines, e.g. QEMU). -

    - -

    Back to top of page

    - -
    - -

    Recommended wifi chipsets

    -

    - The following are known to work well: -

    - - -

    Back to top of page

    - -
    - -

    List of supported ThinkPad X60's

    - -

    - Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM - ('Video BIOS' or 'VBIOS'), - all known LCD panels are currently compatible: -

    - -

    - To find what LCD panel you have, see: #get_edid_panelname. -

    - -
      -
    • TMD-Toshiba LTD121ECHB: #
    • -
    • CMO N121X5-L06: #
    • -
    • Samsung LTN121XJ-L07: #
    • -
    • BOE-Hydis HT121X01-101: #
    • -
    - -

    - You can remove an X61/X61s motherboard from the chassis and install an X60/X60s motherboard in it's place (for flashing libreboot). The chassis is mostly identical - and the motherboards are the same shape/size. -

    - -

    - The X60 typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running - the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; - just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. -

    - -

    Back to top of page.

    - -
    - -

    List of supported ThinkPad X60 Tablets

    - -

    - Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM - ('Video BIOS' or 'VBIOS'). -

    - -

    - To find what LCD panel you have, see: #get_edid_panelname. -

    - -

    - There are 5 known LCD panels for the X60 Tablet: -

    -
      -
    • - X60T XGA (1024x768): -
        -
      • BOE-Hydis HV121X03-100 (works)
      • -
      • Samsung LTN121XP01 (does not work. blank screen)
      • -
      • BOE-Hydis HT12X21-351 (does not work. blank screen)
      • -
      -
    • -
    • - X60T SXGA+ (1400x1050): -
        -
      • BOE-Hydis HV121P01-100 (works)
      • -
      • BOE-Hydis HV121P01-101 (works)
      • -
      -
    • -
    - -

    - Most X60T's only have digitizer (pen), but some have finger (touch) aswell as pen; finger/multitouch doesn't work, only digitizer (pen) does. -

    - -

    - You can remove an X61/X61s motherboard from the chassis and install an X60/X60s motherboard in it's place (for flashing libreboot). The chassis is mostly identical - and the motherboards are the same shape/size. It is unknown if the same applies between the X60 Tablet and the X61 Tablet. -

    - -

    - The X60 Tablet typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running - the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; - just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. -

    - -

    - A user with a X60T that has digitizer+finger support, reported that they could get finger input working. They - used linuxwacom at git tag 0.25.99.2 and had the following in their xorg.conf: -

    - -
    -# This file be public domain.
    -
    -# Now, for some reason (probably a bug in linuxwacom),
    -# the 'Touch=on' directive gets reset to 'off'.
    -# So you'll need to do
    -# $ xsetwacom --set WTouch Touch on
    -#
    -# tested with linuxwacom git 42a42b2a8636abc9e105559e5dea467163499de7
    -
    -Section "Monitor"
    -    Identifier             ""
    -    DisplaySize     245 184
    -EndSection
    -
    -Section "Screen"
    -    Identifier "Default Screen Section"
    -    Monitor    ""
    -EndSection
    -
    -Section "InputDevice"
    -    Identifier  "WTouch"
    -    Driver      "wacom"
    -    Option      "Device" "/dev/ttyS0"
    -#    Option      "DebugLevel" "12"
    -    Option      "BaudRate" "38400"
    -    Option      "Type" "touch"
    -    Option      "Touch" "on"
    -    Option      "Gesture" "on"
    -    Option      "ForceDevice" "ISDV4"
    -#    Option      "KeepShape" "on"
    -    Option      "Mode" "Absolute"
    -    Option      "RawSample" "2"
    -#    Option      "TPCButton" "off"
    -    Option      "TopX" "17"
    -    Option      "TopY" "53"
    -    Option      "BottomX" "961"
    -    Option      "BottomY" "985"
    -EndSection
    -
    -Section "ServerLayout"
    -  Identifier    "Default Layout"
    -  Screen        "Default Screen Section"
    -  InputDevice   "WTouch" "SendCoreEvents"
    -EndSection
    -
    -
    - -

    Back to top of page.

    - -
    - -

    Supported T60 list

    - -

    - Native gpu initialization ('native graphics') which replaces the proprietary VGA Option ROM - ('Video BIOS' or 'VBIOS'). -

    - -

    - To find what LCD panel you have, see: #get_edid_panelname. -

    - -

    - - Some T60's have ATI GPU's, and all T60p's have ATI GPU's These are incompatible! See #t60_ati_intel for how to remedy this. - -

    - -

    - How to dump the EDID:
    - -

    - -

    - Tested LCD panels: working(compatible) -

    -
      -
    • TMD-Toshiba LTD141EN9B (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • -
    • Samsung LTN141P4-L02 (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • -
    • LG-Philips LP150E05-A2K1 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • Samsung LTN150P4-L01 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board) (not a T60 screen afaik, but it works)
    • -
    • BOE-Hydis HV150UX1-100 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • IDtech IAQX10N (15.1" 2048x1536) (GRUB doesn't display at the moment, but GNU/Linux works) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    - -
    - -

    - Tested LCD panels: not working yet (incompatible; see future/index.html#lcd_i945_incompatibility) -

    -
      -
    • Samsung LTN141XA-L01 (14.1" 1024x768)
    • -
    • LG-Philips LP150X09 (15.1" 1024x768)
    • -
    • Samsung LTN150XG (15.1" 1024x768) - EDID dump (taken using sudo i2cdump -y 5 0x50)
    • -
    • LG-Philips LP150E06-A5K4 (15.1" 1400x1050) (also, not an official T60 screen)
    • -
    • Samsung LTN154X3-L0A (15.4" 1280x800)
    • -
    - -

    - The following LCD panels are UNTESTED. If you have one of these panels - then please submit a report!: -

    -
      -
    • CMO(IDtech?) N141XC (14.1" 1024x768)
    • -
    • BOE-Hydis HT14X14 (14.1" 1024x768)
    • -
    • TMD-Toshiba LTD141ECMB (14.1" 1024x768)
    • -
    • Boe-Hydis HT14P12 (14.1" 1400x1050) (FRU P/N 41W1478 recommended for the inverter board)
    • -
    • CMO (IDtech?) 13N7068 (15.1" 1024x768)
    • -
    • CMO (IDtech?) 13N7069 (15.1" 1024x768)
    • -
    • BOE-Hydis HV150P01-100 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • IDtech N150U3-L01 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • BOE-Hydis HV150UX1-102 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • IDtech IAQX10S (15.1" 2048x1536) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended for the inverter board)
    • -
    • Samsung LTN154P2-L05 (42X4641 42T0329) (15.4" 1680x1050)
    • -
    • LG-Philips LP154W02-TL10 (13N7020 42T0423) (15.4" 1680x1050)
    • -
    • LG-Philips LP154WU1-TLB1 (42T0361) (15.4" 1920x1200) (for T61p but it might work in T60. Unknown!)
    • -
    • Samsung LTN154U2-L05 (42T0408 42T0574) (15.4" 1920x1200) (for T61p but it might work in T60. Unknown!)
    • -
    - -

    - It is unknown whether the 1680x1050 (15.4") and 1920x1200 (15.4") panels use a different inverter board than the 1280x800 panels. -

    - -

    - The T60 typically comes with an Intel wifi chipset which does not work at all without proprietary firmware, and while Lenovo BIOS is running - the machine will refuse to boot if you replace the card. Fortunately it is very easily replaced; - just remove the card and install another one after libreboot is installed. See #recommended_wifi for replacements. -

    - -
    - -

    Back to top of page.

    - -
    - -

    ThinkPad T60 (ATI GPU) and ThinkPad T60 (Intel GPU) differences.

    - -

    - If your T60 is a 14.1" or 15.1" model with an ATI GPU, it won't work with libreboot by default but - you can replace the motherboard with another T60 motherboard that has an Intel GPU, and then libreboot should work. -

    - -

    - As far as I know, 14.1" (Intel GPU) and 15.1" (Intel GPU) T60 motherboards are the same, where - 'spacers' are used on the 15.1" T60. In any case, it makes sense to find one that is guaranteed to fit in your chassis. -

    - -

    - There is also a 15.4" T60 with Intel GPU. -

    - -

    - Note: the T60p laptops all have ATI graphics. - The T60p laptops cannot be used with libreboot under any circumstances. -

    - -

    - The following T60 motherboard (see area highlighted in white) shows an empty space where the ATI GPU would be (this particular motherboard has an Intel GPU): - -

    - -

    - The reason that the ATI GPU on T60 is unsupported is due to the VBIOS (Video BIOS) which is non-free. - The VBIOS for the Intel GPU on X60/T60 has been reverse engineered, and replaced with Free Software and - so will work in libreboot. -

    - -

    - The 'Video BIOS' is what initializes graphics. -

    - -

    - See: https://en.wikipedia.org/wiki/Video_BIOS.
    - In fact, lack of free VBIOS in general is a big problem in coreboot, and is one reason (among others) why many ports for coreboot are - unsuitable for libreboot's purpose. -

    - -

    - Theoretically, the ThinkPad T60 with ATI GPU can work with libreboot and have ROM's compiled for it, however - in practise it would not be usable as a laptop because there would be no visual display at all. That being said, - such a configuration is acceptable for use in a 'headless' server setup (with serial and/or ssh console as the display). -

    - -

    Back to top of page.

    - -
    - -

    Information about the macbook1,1

    - -

    - There is an Apple laptop called the macbook1,1 from 2006 which uses the same i945 chipset as the ThinkPad X60/T60. - A developer ported the MacBook2,1 to coreboot, the ROM images also work on the macbook1,1. -

    - -

    - You can refer to #macbook21 for most of this. Macbook2,1 laptops come with Core 2 Duo processors - which support 64-bit operating systems (and 32-bit). The MacBook1,1 uses Core Duo processors (supports 32-bit OS but not 64-bit), - and it is believed that this is the only difference. -

    - -

    - It is believed that all models are compatible, listed here: -

    - - -

    - Compatible models -

    -

    - Specifically (Order No. / Model No. / CPU): -

    -
      -
    • MA255LL/A / A1181 (EMC 2092) / Core Duo T2500 (tested - working) -
    • MA254LL/A / A1181 (EMC 2092) / Core Duo T2400 (untested)
    • -
    • MA472LL/A / A1181 (EMC 2092) / Core Duo T2500 (untested)
    • -
    - -

    - Also of interest: #config_macbook21. -

    - -

    - Unbricking: this page shows disassembly guides and mono's page (see #macbook21) - shows the location of the SPI flash chip on the motherboard. How to remove the motherboard. -

    - -

    - No method is yet known for flashing in GNU/Linux while the Apple firmware is running. You will need to disassemble the machine and flash externally. - Reading from flash seems to work. Bus Pirate recommended for external flashing (there are others) and needed tools: clip (eg Pomona 5250), mini usb cable, - bus pirate cable (for connecting Pomona to the bus pirate). -

    - -

    Back to top of page.

    - -
    - -

    Information about the macbook2,1

    - -

    - There is an Apple laptop called the macbook2,1 from late 2006 or early 2007 that uses the same i945 chipset - as the ThinkPad X60 and ThinkPad T60. A developer ported coreboot to his macbook2,1, and now libreboot can run on it. -

    -

    - Mono Moosbart is the person who wrote the port for macbook2,1. Referenced below are copies (up to date at the time of writing, 20140630) - of the pages he wrote when porting coreboot to the macbook2,1. They are included here in case the main site goes down for - whatever reason, since they include a lot of useful information. -

    -

    - Backups created using wget:
    - $ wget -m -p -E -k -K -np http://macbook.donderklumpen.de/
    - $ wget -m -p -E -k -K -np http://macbook.donderklumpen.de/coreboot/
    - Use -e robots=off if using this trick for other sites and the site restricts using robots.txt -

    - -

    - Links to wget backups (and the backups themselves) of Mono's pages (see above) removed temporarily. Mono has given me permission to distribute them, but I need to ask - him to tell me what license these works fall under first. Otherwise, the above URL's should be fine. NOTE TO SELF: REMOVE THIS WHEN DONE -

    - -

    - Installing GNU/Linux distributions (on Apple EFI firmware) -

    - -

    - How to boot an ISO: burn it to a CD (like you would normally) and hold down the Alt/Control key while booting. - The bootloader will detect the GNU/Linux CD as 'Windows' (because Apple doesn't think GNU/Linux exists). Install it like you normally would. - When you boot up again, hold Alt/Control once more. The installation (on the HDD) will once again be seen as 'Windows'. (it's not actually Windows, - but Apple likes to think that Apple and Microsoft are all that exist.) - Now to install libreboot, follow #flashrom_macbook21. -

    - -

    - Information about coreboot -

    - - -

    - coreboot wiki page -

    - - -

    - Compatible models -

    -

    - It is believed that all models are compatible, listed here: -

    - -

    - Specifically (Order No. / Model No. / CPU): -

    -
      -
    • MA699LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T5600 (tested - working)
    • -
    • MA701LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 (tested - working)
    • -
    • MB061LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7200 (untested)
    • -
    • MA700LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 (tested - working)
    • -
    • MB063LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 (untested)
    • -
    • MB062LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 (tested - working)
    • -
    - -

    - Also of interest: #config_macbook21. -

    - -

    - Unbricking: this page shows disassembly guides and mono's page (see above) - shows the location of the SPI flash chip on the motherboard. How to remove the motherboard. -

    - -

    - Bus Pirate recommended for external flashing (there are others) and needed tools: clip (eg Pomona 5250), mini usb cable, - bus pirate cable (for connecting Pomona to the bus pirate). -

    - -

    - You need to replace OS X with GNU/Linux before flashing libreboot. (OSX won't run at all in libreboot). -

    - -

    - There are some issues with this machine (compared to other computers that libreboot supports): -

    - -

    - This is an apple laptop, so it comes with OS X: it has an Apple keyboard, which means that certain keys you expect are missing: - insert, del, home, end, pgup, pgdown. There is also one mouse button only. Battery life is poor compared to X60/T60 (for now). - It also has other issues: for example, the Apple logo on the back is a hole, exposing the backlight, which means that it glows. You should cover it up. -

    - -

    - The macbook21 gets extremely hot under GNU/Linux and libreboot; Macfanctld (mac fan control daemon) I'm told is a programme (GPLv3 license) that can help with this. -

    - -

    - Debugging the heating issues (initial work):
    - Distro: Trisquel 7. kernel(linux-libre): 3.13.0-32
    - CPU temperatures:
    - 52C(idle)/81C(stress) on factory.bin
    - 70C(idle)/80C(stress) on coreboot(with microcode updates). libreboot results (without microcode updates) were the same.
    - (libreboot and coreboot rom's were both built from the same code, just with or without microcode included in the rom)
    - battery life was higher on original firmware, lower on coreboot/libreboot.
    - microcode patches included [y/n] makes no difference.
    - libreboot: 1hr18min left on idle (99% battery), 42mins left on stress (82% battery)
    - factory.bin: 2 hours left on idle (99% battery), 48mins left on stress (82% battery) -

    -

    - Todo: see what the non-free firmware has in it's ACPI tables using acpidump and iasl -d. Try to implement cstate support in coreboot - (this will allow for lower temperatures). -

    - -

    - - The MacBook2,1 comes with a webcam, which does not work without proprietary software. Also, webcams are a security risk; cover it up! Or remove it. - -

    +

    Documentation for libreboot project

    - A user reported that they could get better response from the touchpad with the following in their xorg.conf: + It is assumed that you are running GNU/Linux + (no other operating system is known to work with this release).

    - -
    -Section "InputClass"
    - Identifier "Synaptics Touchpad"
    - Driver "synaptics"
    - MatchIsTouchpad "on"
    - MatchDevicePath "/dev/input/event*"
    - Driver "synaptics"
    -# The next two values determine how much pressure one needs
    -# for tapping, moving the cursor and other events.
    - Option "FingerLow" "10"
    - Option "FingerHigh" "15"
    -# Do not emulate mouse buttons in the touchpad corners.
    - Option "RTCornerButton" "0"
    - Option "RBCornerButton" "0"
    - Option "LTCornerButton" "0"
    - Option "LBCornerButton" "0"
    -# One finger tap = left-click
    - Option "TapButton1" "1"
    -# Two fingers tap = right-click
    - Option "TapButton2" "3"
    -# Three fingers tap = middle-mouse
    - Option "TapButton3" "2"
    -# Try to not count the palm of the hand landing on the touchpad
    -# as a tap. Not sure if helps.
    - Option "PalmDetect" "1"
    -# The following modifies how long and how fast scrolling continues
    -# after lifting the finger when scrolling
    - Option "CoastingSpeed" "20"
    - Option "CoastingFriction" "200"
    -# Smaller number means that the finger has to travel less distance
    -# for it to count as cursor movement. Larger number prevents cursor
    -# shaking.
    - Option "HorizHysteresis" "10"
    - Option "VertHysteresis" "10"
    -# Prevent two-finger scrolling. Very jerky movement
    - Option "HorizTwoFingerScroll" "0"
    - Option "VertTwoFingerScroll" "0"
    -# Use edge scrolling
    - Option "HorizEdgeScroll" "1"
    - Option "VertEdgeScroll" "1"
    -EndSection
    -
    - -

    Back to top of page.

    - -
    - -

    Recommended ROM's to flash

    - -

    - List of directories corresponding to each board: -

    -
      -
    • ThinkPad X60, X60s: bin/x60/
    • -
    • ThinkPad X60 Tablet: bin/x60t/
    • -
    • ThinkPad T60: bin/t60/ (note, see #supported_t60_list)
    • -
    • Apple MacBook2,1: bin/macbook21/
    • -
    • Apple MacBook1,1: bin/macbook21/ (it's not a typo; the same ROM's work)
    • -
    - -

    These images use coreboot text-mode graphics:

    -
      -
    • US Qwerty keyboard: libreboot_usqwerty_txtmode.rom
    • -
    • UK Qwerty keyboard: libreboot_ukqwerty_txtmode.rom
    • -
    • US Dvorak keyboard: libreboot_usdvorak_txtmode.rom
    • -
    • UK Dvorak keyboard: libreboot_ukdvorak_txtmode.rom
    • -
    • French Azerty keyboard: libreboot_frazerty_txtmode.rom
    • -
    • Italian Qwerty keyboard: libreboot_itqwerty_txtmode.rom
    • -
    • Swedish Qwerty keyboard: libreboot_svenska_txtmode.rom
    • -
    -

    These images use coreboot framebuffer graphics:

    -
      -
    • US Qwerty keyboard: libreboot_usqwerty_vesafb.rom
    • -
    • UK Qwerty keyboard: libreboot_ukqwerty_vesafb.rom
    • -
    • US Dvorak keyboard: libreboot_usdvorak_vesafb.rom
    • -
    • UK Dvorak keyboard: libreboot_ukdvorak_vesafb.rom
    • -
    • French Azerty keyboard: libreboot_frazerty_vesafb.rom
    • -
    • Italian Qwerty keyboard: libreboot_itqwerty_vesafb.rom
    • -
    • Swedish Qwerty keyboard: libreboot_svenska_vesafb.rom
    • -
    - -

    - _txtmode images come with a working MemTest86+ and GRUB Invaders, both of which require text-mode. - _vesafb images are recommended in most cases. -

    -

    - This will give you your native keyboard layout inside GRUB. The preferences in your OS are not affected, it just makes using - the GRUB command line easier (if you ever need to do that). - #grub_keyboardshows you how this was done. If your native keyboard layout - differs, you can adapt those notes and hack the 'build' script for your needs. + What is libreboot?

    -

    Back to top of page.

    - -
    - -

    X60/X60S/X60T/T60: How to flash the ROM's onto your machine (if running Lenovo BIOS firmware).

    - -
    - -

    - Hover over the next paragraph to make it black. -

    -

    - Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Lenovo BIOS - because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful - to have a backup. Each copy of the original Lenovo BIOS is tied to the specific machine that it came from; it will not run - on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can - re-flash it later if you want to run the original Lenovo BIOS again) or lose it forever. The X60/T60 installation - guide on the coreboot wiki will show you how to do this: - http://www.coreboot.org/Board:lenovo/x60/Installation.
    - Do not make this decision lightly! This is your last and only chance. -

    - +

    Release information

    - The following is for the libreboot image and *not* the factory bios dump: + Information about this release can be found at release.html. + Always check libreboot.org for updates.

    - Check the last two 64K regions in your ROM file (libreboot.rom in this example):
    - $ dd if=libreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x10000] count=64k
    - $ dd if=libreboot.rom of=lower64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k
    - $ sha512sum lower64k.bin top64k.bin
    - Make *sure* that they match before you continue. The ROM's included pre-compiled in libreboot should already match. - If they don't match, then do this (based on those instructions from coreboot wiki):
    - $ dd if=top64k.bin of=libreboot.rom bs=1 seek=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k conv=notrunc
    - After this, the ROM will be safe to flash. Explanation is provided in #build_bucts. + The release page and future/index.html contain details + about future work.

    -
    - -

    This is for the ThinkPad X60 and T60 while running Lenovo BIOS. If you already have coreboot or libreboot running, - then go to #flashrom instead!

    - -

    If you are flashing a Lenovo ThinkPad T60, be sure to read #supported_t60_list

    - -

    - First, install the build dependencies. -

    - -
    - +

    Hardware compatibility list

    - - Before you proceed, make *sure* to build flashrom and bucts from source. Both are provided. This is very important! - + Information about what systems libreboot supports.

    - - -
    - -

    "YOURBOARD/YOURROM" should be replaced with what is correct as per #rom. Alternatively - you may be using your own custom ROM. Adapt.

    - -

    - Run the script:
    - $ sudo ./lenovobios_firstflash bin/YOURBOARD/YOURROM. -

    - -
    -

    - You should see within the output the following:
    - "Updated BUC.TS=1 - 64kb address ranges at 0xFFFE0000 and 0xFFFF0000 are swapped". + Goto hcl/index.html.

    +

    Installing libreboot

    - You should also see within the output the following:
    - "Flash chip is in an unknown state", "FAILED" and "DO NOT SHUTDOWN OR REBOOT"
    - Seeing this means that the operation was a resounding success! DON'T PANIC. + Information about how to install libreboot on supported targets, + using software and/or dedicated hardware.

    -

    - See this link for more details: - http://thread.gmane.org/gmane.linux.bios.flashrom/575. + Goto install/index.html.

    +

    GNU/Linux distributions

    - If the above is what you see, then SHUT DOWN. Wait a few seconds, and then boot; libreboot is running, but there is a 2nd procedure *needed* (see below). + Installing GNU/Linux distributions, preparing bootable USB drives, changing the default GRUB + menu and so on.

    - -
    - -

    - - If you boot and you see nothing, try turning up the backlight (Fn+Home). - -

    - -

    - When you have booted up again:
    - $ sudo ./lenovobios_secondflash bin/YOURBOARD/YOURROM -

    - -
    -

    - You should see within the output the following:
    - "Updated BUC.TS=0 - 128kb address range 0xFFFE0000-0xFFFFFFFF is untranslated" + This also contains guides for fully encrypted Trisquel and Parabola GNU/Linux-libre installations.

    -

    - You should also see within the output the following:
    - "Verifying flash... VERIFIED." + Goto gnulinux/index.html.

    -

    Shut down again, wait a few seconds, and then boot.

    - -
    - -

    - Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed. - You might also want to remove bluetooth. See x60_security.html and - t60_security.html. -

    - -

    Back to top of page.

    - -
    - -

    macbook21: How to flash your ROM (if running Apple EFI firmware)

    - -
    - +

    Developing libreboot

    - Hover over the next paragraph to make it black. + Information about configuring libreboot, building from source, maintaining the project, + working in git and so on.

    -

    - Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Apple EFI firmware - because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful - to have a backup. Each copy of the original Apple EFI is (believed, but unproven to be) tied to the specific machine that it came from; it will not (as is believed) run - on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can - re-flash it later if you want to run the original Apple EFI firmware again) or lose it forever. The macbook21 installation - guide on the coreboot wiki will show you how to do this: - http://www.coreboot.org/Board:apple/macbook21.
    - Do not make this decision lightly! This is (very likely) your last and only chance. +

    + Goto git/index.html.

    +

    Security topics

    - (this theory is untested at the time of writing) + Goto security/index.html.

    +

    Hardware maintenance

    - Note: If you have a MacBook1,1 then these instructions will not work. See #macbook11 for MacBook1,1 flashing instructions. + Goto hardware/index.html.

    - -
    - -

    - - This is for the MacBook2,1 while running Apple EFI firmware. If you already have - coreboot or libreboot running, then go to #flashrom instead! - -

    - -

    - Be sure to read the information in #macbook21. -

    - -

    - First, install the build dependencies. -

    - -
    - + +

    GRUB payload

    - - Before you proceed, make *sure* to build flashrom from source. This is very important! - + Information about fonts and keyboard layouts used in GRUB.

    - - -
    - -

    - Look at #rom to see which ROM is suitable for your machine. Alternatively you may be using your own - custom ROM. Adapt. -

    - -

    - Flashing is actually easy (compared to X60/T60).
    - $ sudo flashrom -p internal:laptop=force_I_want_a_brick -w bin/YOURBOARD/YOURROM -

    - -

    - Alternatively, a script is provided which does the same thing:
    - $ sudo ./macbook21_firstflash bin/YOURBOARD/YOURROM -

    - -
    -

    - You should also see within the output the following:
    - "Verifying flash... VERIFIED." + Goto grub/index.html

    +

    Miscellaneous

    - If you see that, great! Shut down now (power off). Wait a few seconds and then boot! + Random topics that don't belong anywhere else.

    -

    - - If you boot and you see nothing, try turning up the backlight (F2 for macbook21). - + Goto misc/index.html.

    - -
    - -

    Back to top of page.

    -
    -

    X60/X60S/X60T/T60/macbook21: How to flash the ROM's onto your machine (if running libreboot or coreboot already)

    +

    What is libreboot, really?

    - - These instructions work for the Lenovo ThinkPad X60/X60S/X60T/T60 and Apple MacBook2,1. - -

    -

    - - This assumes that you already have coreboot or libreboot running. - -

    -

    - - If you have Lenovo BIOS running (X60/X60S/X60T/T60), go to #flashrom_lenovobios instead. - -

    -

    - - If you have Apple EFI firmware running (macbook21), go to #flashrom_macbook21 instead. - -

    -

    - - If you are flashing a Lenovo ThinkPad T60, be sure to read #supported_t60_list. - + Libreboot is a coreboot distribution (distro) with proprietary software removed, + intended to be a free + (libre) 'BIOS' replacement for your computer.

    -

    - - If you are flashing an Apple MacBook2,1, be sure to read the information in #macbook21. - -

    -

    - First, install the build dependencies. -

    -
    - -

    - - Before you proceed, make *sure* to build flashrom from source. This is very important! - -

    - -
    -

    - Look at #rom to see which ROM is suitable for your machine. Alternative you may be using your own - custom ROM. Adapt. -

    - Flash the ROM:
    - $ sudo ./flash bin/YOURBOARD/YOURROM + Read the full Free Software definition.

    -
    +

    + Project goals (and differences versus coreboot): +

    +
      +
    • + Coreboot contains blobs (proprietary data/code) and libreboot does not (it intentionally removes them). +
    • +
    • + Coreboot is hacker-friendly and focuses on software developers, libreboot is user-focused and attempts to + turn coreboot into a distribution, sort of like a GNU/Linux distribution (same concept, different software). For example, libreboot + distributes GRUB/memtest86+/bucts/flashrom (and more) and comes with user-focused documentation and build scripts; libreboot + is therefore made more 'user-friendly'. +
    • +

    - You should see "Verifying flash... VERIFIED." written at the end of the flashrom output. SHUT DOWN - after you see this, and then boot up again after a few seconds. + Libreboot is not a fork of coreboot, despite misconceptions of this fact. Libreboot (downstream supplier) is a parallel effort + which works closely with and re-bases on the latest coreboot (upstream supplier) every so often.

    - If you boot and you see nothing, try turning up the backlight (Fn+Home for X60/X60S/X60T/T60, F2 for macbook21). + As such, all new coreboot development should be done in coreboot, not libreboot! + Libreboot is about deblobbing, and packaging coreboot in a user-friendly way, where most work is already done for the user! + If, for example you wanted to attempt porting a new motherboard then you should do that in coreboot. Libreboot will (as a downstream) + receive your change at some point in the future, in a future release.

    -
    - -

    - Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed. - You might also want to remove bluetooth. See x60_security.html and - t60_security.html. -

    - -

    Back to top of page

    - -
    - -

    Setting font in GRUB (for reference)

    - -

    You don't need to do this unless you would like to change the default font yourself. - (this is just for reference. It has already been done for you)

    - -

    The old font used was Unifont, and this had some missing characters: for instance, the border showed ??? characters instead of lines.

    - -

    I tried DeJavu Sans Mono from this website: - dejavu-fonts.org

    - -

    Specifically, the version that I chose was the latest at the time of writing (Saturday 21 June 2014): - this one

    - -

    This is a free font that is also contained in GNU/Linux distributions like Trisquel or Parabola.

    - -

    $ cd libreboot_src/grub
    - compile grub ('build' script has the info on how to do this)
    - come back out into libreboot_src/resources/grub:
    - $ cd ../libreboot_src/resources/grub/font

    - -

    I took Dejavu Sans Mono from dejavu (included in this version of libreboot) and did:
    - $ ../../../grub/grub-mkfont -o dejavusansmono.pf2 ../../../dejavu-fonts-ttf-2.34/ttf/DejaVuSansMono.ttf

    - -

    I then added the instructions to 'build' script to include resources/grub/dejavusansmono.pf2 in all of the ROM's in root of cbfs.
    - I then added that instructions to the grub.cfg files (to load the font):
    - loadfont (cbfsdisk)/dejavusansmono.pf2

    - -

    Back to top of page

    - -
    - -

    GRUB keyboard layouts (for reference)

    - -

    Custom keyboard layout in GRUB (for reference)

    - -

    - Keymaps are stored in resources/utilities/grub-assemble/keymap/. -

    - -

    - Example (French Azerty):
    - $ ckbcomp fr > frazerty

    - Go in grub directory:
    - cat frazerty | ./grub/grub-mklayout -o frazerty.gkb -

    - -

    - You must make sure that the files are named keymap and keymap.gkb (where 'keymap' can be whatever you want). -

    - -

    - Then from the above example, you would put frazerty in resources/utilities/grub-assemble/keymap/original/ and - the frazerty.gkb file goes under resources/utilities/grub-assemble/keymap/ -

    +

    + A 'stable' coreboot: +

    +
      +
    • + Coreboot uses the rolling release model + (and it is therefore quite volatile; one day when you build coreboot, it may or may not work correctly on your machine). +
    • +
    • + Libreboot changes less often (as far as the release model is concerned), focusing instead on 'tested' releases for specific machines. + At any given time, it might also be possible to build ROM images for systems other than those officially supported. If you get your board to work + (without violating the "coreboot development goes in coreboot" rule, then others could benefit from your work). +
    • +

    - The scripts build and buildrom-withgrub will automatically see this, and automatically build - ROM's with your custom layout (given the name) and include them under bin. Example: libreboot_frazerty.rom. + On the other hand, coreboot is also strict about what it accepts (merges) into the main git repository: + most of the time, a lot of changes are under review at review.coreboot.org (as a way of encouraging as much further development + as possible before accepting the patch).

    -

    Back to top of page

    - -

    UK Dvorak keyboard layout in GRUB (for reference)

    -

    - ukdvorak had to be created manually, based on usdvorak. diff them (under resources/utilities/grub-assemble/keymap/original) - to see how ukdvorak file was created + Meanwhile, libreboot is a lot less strict in this area and freely merges specific patches that are desirable, sometimes before they are merged into coreboot's main repository.

    - $ cat ukdvorak | ./grub/grub-mklayout -o ukdvorak.gkb

    - -

    Back to top of page

    - -
    - -

    High Pitched Whining Noise on Idle (how to remove in Trisquel)

    - -

    - Tested in Trisquel 6. -

    -

    - Note: untested in Trisquel 7. Remove this note when it is. -

    - -

    Powertop - how to use

    - -

    Now you can use this command to kill that noise:
    - $ sudo powertop --auto-tune

    - -

    You can also run it without parameters and then go into 'Tunables' and set everything to 'Good'

    - -

    Note: On Trisquel 6, you will need to use a later powertop version from git. The one in the repositories is too old. See below:

    - -

    Powertop - Start automatically at boot time (Trisquel 6)

    - -

    Included with libreboot is a script called 'powertop.trisquel6'. Run this and it will setup powertop to run with --auto-tune - at boot time. Load the file in your text editor to see how it does that.

    - -

    $ ./powertop.trisquel6

    - -

    This has been tested on Trisquel 6.

    - -

    Back to top of page

    - -
    - -

    High Pitched Whining Noise on Idle (how to remove in Parabola)

    - -

    The following removes most of the noise. It reduces what is a high frequency whine - (that not everyone can hear) to a slight buzz (which most people can't hear or doesn't bother most people).

    - -

    This is not perfect! The full solution is still not discovered but this is a step towards that. - Also, in some instances you will need to run 'sudo powertop --auto-tune' again. - This needs to be implemented properly in coreboot itself!

    - -

    On the X60 with coreboot or libreboot, there is a high pitched sound when idle. - So far we have use processor.max_cstate=2 or idle=halt in GRUB. - These consume power. Stop using them!

    - -

    Be root
    - $ su -

    - -

    Installed powertop:
    - # pacman -S powertop

    - -

    and added the following to /etc/systemd/system/powertop.service :

    - -
    
    -[Unit]
    -Description=Powertop tunings
    -
    -[Service]
    -Type=oneshot
    -RemainAfterExit=no
    -ExecStart=/usr/bin/powertop --auto-tune
    -# "powertop --auto-tune" still needs a terminal for some reason. Possibly a bug?
    -Environment="TERM=xterm"
    -
    -[Install]
    -WantedBy=multi-user.target
    -
    - - -

    Finally, as root do that:
    - # systemctl enable powertop
    - # systemctl start powertop

    - -

    The next time you boot the machine, the buzz will be gone.

    - -

    Back to top of page

    - -
    - -

    X60/T60: Serial port - how to use (for dock owners)

    -

    - For the Thinkpad X60 you can use the "UltraBase X6" dock (for the X60 Tablet it is called - X6 Tablet UltraBase). For the ThinkPad T60, - you can use the "Advanced Mini Dock". -

    -

    - If you are using one of the ROM's with 'serial' in the name, then you have serial port enabled in libreboot - and you have memtest86+ included inside the ROM. Connect your null modem cable to the serial port on the dock - and connect the other end to a 2nd machine using your USB Serial adapter. -

    -

    - On the 2nd machine, you can try this (using GNU Screen):
    - $ sudo screen /dev/ttyUSB0 115200 -

    -

    - How to quit GNU Screen: Ctrl+A then release and press K, and then press Y. -

    -

    There are also others like Minicom but I like GNU Screen

    -

    - By doing this before booting the X60/T60, you will see console output from libreboot. You will also see - GRUB displaying on the serial output, and you will be able to see MemTest86+ on the serial output aswell. - You can also configure your distro so that a terminal (TTY) is accessible from the serial console. -

    -

    - The following guide is for Ubuntu, and can be followed for Trisquel 6.0 which is based on Ubuntu 12.04 - (should also work in Trisquel 7, based on Ubuntu 14.04) to enable a serial console using GeTTY:
    - https://help.ubuntu.com/community/SerialConsoleHowto -

    -

    - Note: part of the tutorial above requires changing your grub.cfg. Just change the linux line to add instructions for enabling getty. - See howtos/grub_cbfs.html. -

    -

    Back to top of page - -


    - -

    Get EDID: Find out the name (model) of your LCD panel

    -

    - Get the panel name with sudo get-edid | strings
    - Or look in /sys/class/drm/card0-LVDS-1/edid -

    -

    - Alternatively you can use i2cdump. In Trisquel, this is in the package i2c-tools.
    - $ sudo modprobe i2c-dev
    - $ sudo i2cdump -y 5 0x50
    - $ sudo rmmod i2c-dev
    - You'll see the panel name in the output (from the EDID dump). -

    -

    - If neither of these options work (or they are unavailable), physically removing the LCD panel is an option. - Usually, there will be information printed on the back. -

    -

    Back to top of page.


    diff --git a/docs/install/index.html b/docs/install/index.html new file mode 100644 index 0000000..571e115 --- /dev/null +++ b/docs/install/index.html @@ -0,0 +1,405 @@ + + + + + + + + + Installing libreboot + + + + +

    Installing libreboot

    +

    + This section relates to installing libreboot on supported targets. +

    +

    + Or Back to main index. +

    +

    Installing libreboot (software)

    + + +

    Installing libreboot (hardware)

    + + +
    + +

    Recommended ROM's to flash

    + +

    + List of directories corresponding to each board: +

    +
      +
    • ThinkPad X60, X60s: bin/x60/
    • +
    • ThinkPad X60 Tablet: bin/x60t/
    • +
    • ThinkPad T60: bin/t60/ (note, see ../hcl/index.html#supported_t60_list)
    • +
    • Apple MacBook2,1: bin/macbook21/
    • +
    • Apple MacBook1,1: bin/macbook21/ (it's not a typo; the same ROM's work)
    • +
    + +

    These images use coreboot text-mode graphics:

    +
      +
    • US Qwerty keyboard: libreboot_usqwerty_txtmode.rom
    • +
    • UK Qwerty keyboard: libreboot_ukqwerty_txtmode.rom
    • +
    • US Dvorak keyboard: libreboot_usdvorak_txtmode.rom
    • +
    • UK Dvorak keyboard: libreboot_ukdvorak_txtmode.rom
    • +
    • French Azerty keyboard: libreboot_frazerty_txtmode.rom
    • +
    • Italian Qwerty keyboard: libreboot_itqwerty_txtmode.rom
    • +
    • Swedish Qwerty keyboard: libreboot_svenska_txtmode.rom
    • +
    +

    These images use coreboot framebuffer graphics:

    +
      +
    • US Qwerty keyboard: libreboot_usqwerty_vesafb.rom
    • +
    • UK Qwerty keyboard: libreboot_ukqwerty_vesafb.rom
    • +
    • US Dvorak keyboard: libreboot_usdvorak_vesafb.rom
    • +
    • UK Dvorak keyboard: libreboot_ukdvorak_vesafb.rom
    • +
    • French Azerty keyboard: libreboot_frazerty_vesafb.rom
    • +
    • Italian Qwerty keyboard: libreboot_itqwerty_vesafb.rom
    • +
    • Swedish Qwerty keyboard: libreboot_svenska_vesafb.rom
    • +
    + +

    + _txtmode images come with a working MemTest86+ and GRUB Invaders, both of which require text-mode. + _vesafb images are recommended in most cases. +

    + +

    + This will give you your native keyboard layout inside GRUB. The preferences in your OS are not affected, it just makes using + the GRUB command line easier (if you ever need to do that). + ../grub/index.html#grub_keyboard shows you how this was done. If your native keyboard layout + differs, you can adapt those notes and hack the 'build' script for your needs. +

    + +

    Back to top of page.

    + +
    + +

    X60/X60S/X60T/T60: How to flash the ROM's onto your machine (if running Lenovo BIOS firmware).

    + +
    + +

    + Hover over the next paragraph to make it black. +

    +

    + Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Lenovo BIOS + because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful + to have a backup. Each copy of the original Lenovo BIOS is tied to the specific machine that it came from; it will not run + on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can + re-flash it later if you want to run the original Lenovo BIOS again) or lose it forever. The X60/T60 installation + guide on the coreboot wiki will show you how to do this: + http://www.coreboot.org/Board:lenovo/x60/Installation.
    + Do not make this decision lightly! This is your last and only chance. +

    + +

    + The following is for the libreboot image and *not* the factory bios dump: +

    +

    + Check the last two 64K regions in your ROM file (libreboot.rom in this example):
    + $ dd if=libreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x10000] count=64k
    + $ dd if=libreboot.rom of=lower64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k
    + $ sha512sum lower64k.bin top64k.bin
    + Make *sure* that they match before you continue. The ROM's included pre-compiled in libreboot should already match. + If they don't match, then do this (based on those instructions from coreboot wiki):
    + $ dd if=top64k.bin of=libreboot.rom bs=1 seek=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k conv=notrunc
    + After this, the ROM will be safe to flash. Explanation is provided in ../git/index.html#build_bucts. +

    + +
    + +

    This is for the ThinkPad X60 and T60 while running Lenovo BIOS. If you already have coreboot or libreboot running, + then go to #flashrom instead!

    + +

    If you are flashing a Lenovo ThinkPad T60, be sure to read ../hcl/index.html#supported_t60_list

    + +

    + First, install the build dependencies. +

    + +
    + +

    + + Before you proceed, make *sure* to build flashrom and bucts from source. Both are provided. This is very important! + +

    + + +
    + +

    "YOURBOARD/YOURROM" should be replaced with what is correct as per #rom. Alternatively + you may be using your own custom ROM. Adapt.

    + +

    + Run the script:
    + $ sudo ./lenovobios_firstflash bin/YOURBOARD/YOURROM. +

    + +
    + +

    + You should see within the output the following:
    + "Updated BUC.TS=1 - 64kb address ranges at 0xFFFE0000 and 0xFFFF0000 are swapped". +

    + +

    + You should also see within the output the following:
    + "Flash chip is in an unknown state", "FAILED" and "DO NOT SHUTDOWN OR REBOOT"
    + Seeing this means that the operation was a resounding success! DON'T PANIC. +

    + +

    + See this link for more details: + http://thread.gmane.org/gmane.linux.bios.flashrom/575. +

    + +

    + If the above is what you see, then SHUT DOWN. Wait a few seconds, and then boot; libreboot is running, but there is a 2nd procedure *needed* (see below). +

    + +
    + +

    + + If you boot and you see nothing, try turning up the backlight (Fn+Home). + +

    + +

    + When you have booted up again:
    + $ sudo ./lenovobios_secondflash bin/YOURBOARD/YOURROM +

    + +
    + +

    + You should see within the output the following:
    + "Updated BUC.TS=0 - 128kb address range 0xFFFE0000-0xFFFFFFFF is untranslated" +

    + +

    + You should also see within the output the following:
    + "Verifying flash... VERIFIED." +

    + +

    Shut down again, wait a few seconds, and then boot.

    + +
    + +

    + Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed. + You might also want to remove bluetooth. See ../security/x60_security.html and + ../security/t60_security.html. +

    + +

    Back to top of page.

    + +
    + +

    macbook21: How to flash your ROM (if running Apple EFI firmware)

    + +
    + +

    + Hover over the next paragraph to make it black. +

    +

    + Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Apple EFI firmware + because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful + to have a backup. Each copy of the original Apple EFI is (believed, but unproven to be) tied to the specific machine that it came from; it will not (as is believed) run + on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can + re-flash it later if you want to run the original Apple EFI firmware again) or lose it forever. The macbook21 installation + guide on the coreboot wiki will show you how to do this: + http://www.coreboot.org/Board:apple/macbook21.
    + Do not make this decision lightly! This is (very likely) your last and only chance. +

    + +

    + (this theory is untested at the time of writing) +

    + +

    + Note: If you have a MacBook1,1 then these instructions will not work. See ../hcl/index.html#macbook11 for MacBook1,1 flashing instructions. +

    + +
    + +

    + + This is for the MacBook2,1 while running Apple EFI firmware. If you already have + coreboot or libreboot running, then go to #flashrom instead! + +

    + +

    + Be sure to read the information in ../hcl/index.html#macbook21. +

    + +

    + First, install the build dependencies. +

    + +
    + +

    + + Before you proceed, make *sure* to build flashrom from source. This is very important! + +

    + + +
    + +

    + Look at #rom to see which ROM is suitable for your machine. Alternatively you may be using your own + custom ROM. Adapt. +

    + +

    + Flashing is actually easy (compared to X60/T60).
    + $ sudo flashrom -p internal:laptop=force_I_want_a_brick -w bin/YOURBOARD/YOURROM +

    + +

    + Alternatively, a script is provided which does the same thing:
    + $ sudo ./macbook21_firstflash bin/YOURBOARD/YOURROM +

    + +
    + +

    + You should also see within the output the following:
    + "Verifying flash... VERIFIED." +

    + +

    + If you see that, great! Shut down now (power off). Wait a few seconds and then boot! +

    + +

    + + If you boot and you see nothing, try turning up the backlight (F2 for macbook21). + +

    + + +
    + +

    Back to top of page.

    + +
    + +

    X60/X60S/X60T/T60/macbook21: How to flash the ROM's onto your machine (if running libreboot or coreboot already)

    + +

    + + These instructions work for the Lenovo ThinkPad X60/X60S/X60T/T60 and Apple MacBook2,1. + +

    +

    + + This assumes that you already have coreboot or libreboot running. + +

    +

    + + If you have Lenovo BIOS running (X60/X60S/X60T/T60), go to #flashrom_lenovobios instead. + +

    +

    + + If you have Apple EFI firmware running (macbook21), go to #flashrom_macbook21 instead. + +

    +

    + + If you are flashing a Lenovo ThinkPad T60, be sure to read ../hcl/index.html#supported_t60_list. + +

    +

    + + If you are flashing an Apple MacBook2,1, be sure to read the information in ../hcl/index.html#macbook21. + +

    +

    + First, install the build dependencies. +

    +
    + +

    + + Before you proceed, make *sure* to build flashrom from source. This is very important! + +

    + + +
    +

    + Look at #rom to see which ROM is suitable for your machine. Alternative you may be using your own + custom ROM. Adapt. +

    +

    + Flash the ROM:
    + $ sudo ./flash bin/YOURBOARD/YOURROM +

    + +
    + +

    + You should see "Verifying flash... VERIFIED." written at the end of the flashrom output. SHUT DOWN + after you see this, and then boot up again after a few seconds. +

    + +

    + + If you boot and you see nothing, try turning up the backlight (Fn+Home for X60/X60S/X60T/T60, F2 for macbook21). + +

    + +
    + +

    + Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed. + You might also want to remove bluetooth. See ../security/x60_security.html and + ../security/t60_security.html. +

    + +

    Back to top of page

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/install/t60_unbrick.html b/docs/install/t60_unbrick.html new file mode 100644 index 0000000..b79f3de --- /dev/null +++ b/docs/install/t60_unbrick.html @@ -0,0 +1,316 @@ + + + + + + + + + Libreboot documentation: Unbricking the ThinkPad T60 + + + + +
    +

    Unbricking the ThinkPad T60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • a 2nd computer (maybe another T60. any computer will do)
    • +
    • external flashrom-compatible programmer (I'm using the "bus pirate") +
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • +
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • +
    • USB mini a to b cable (for buspirate<>computer connection).
    • +
    • rubbing a***hol (misspelling intentional. halal internet) and thermal compound for changing CPU heatsink (procedure involves removing heatsink)
    • +
    + +

    Software requirements

    +
      +
    • GNU/Linux (on the 2nd computer)
    • +
    • flashrom software (on the 2nd computer): http://flashrom.org/ +
    + +

    Brick type 1: bucts not reset.

    +

    + You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and + the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    + + In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    +

    + + *Those dd commands should be applied to all newly compiled T60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    + dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    + dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    + dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    + (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, + using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. + (it says x60, but instructions for t60 are identical) +

    + +

    bad rom (or user error), machine won't boot

    + +

    + In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from + booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. +

    +

    + "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). +

    + +

    + Remove those screws and remove the HDD:
    + +

    + +

    + Lift off the palm rest:
    + +

    + +

    + Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    + +

    + +

    + Gently wedge both sides loose:
    + +

    + +

    + Remove that cable from the position:
    + +

    + +

    + Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
    + +

    + +

    + Remove those screws:
    + +

    + +

    + Disconnect the power jack:
    + +

    + +

    + Remove nvram battery:
    + +

    + +

    + Disconnect cable (for 56k modem) and disconnect the other cable:
    + +

    + +

    + Disconnect speaker cable:
    + +

    + +

    + Disconnect the other end of the 56k modem cable:
    + +

    + +

    + Make sure you removed it:
    + +

    + +

    + Unscrew those:
    + +

    + +

    + Make sure you removed those:
    + +

    + +

    + Disconnect LCD cable from board:
    + +

    + +

    + Remove those screws then remove the LCD assembly:
    + +

    + +

    + Once again, make sure you removed those:
    + +

    + +

    + Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady + surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the + screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
    + + +

    + +

    + At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    + http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    + Correlating with the following information, I was able to wire up my pirate correctly:
    + http://flashrom.org/Bus_Pirate#Connections
    + And by following that advice:
    + http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    + (it says X60 but instructions are virtually the same for the T60, with except to physical differences in how to disassemble the machine)
    + Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    + Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the + AC adapter (without powering on the board).
    + Note: I ignored that advice, and wired up all 8 pins. And it worked.
    + + Here is the pinout (correlate it with your programmer's documentation):
    + +

    + +

    + Connecting the pomona:
    + +

    + +

    + Connect programmer to 2nd computer:
    + +

    + +

    + Programmer has power:
    + +

    + +

    + Now flash the bricked machine using the 2nd computer. in my case I did:
    + flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/t60/libreboot_usqwerty.rom
    + Note: there are also other ROM images for T60
    + Note: this is using buspirate as the programmer, so it is flashing the T60, not the 2nd computer!
    + Here's my terminal window on the 2nd computer (also the programmer is active):
    +
    + So, you should see the following:
    + -- +

    +
    +flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    +flashrom is free software, get the source code at http://www.flashrom.org
    +
    +Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    +Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    +Reading old flash chip contents... done.
    +Erasing and writing flash chip... Erase/write done.
    +Verifying flash... VERIFIED. 
    +
    +

    + --
    + At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means + that you can put your T60 back together. So let's do that now. +

    + +

    + Put those screws back:
    + +

    + +

    + Put it back into lower chassis:
    + +

    + +

    + Attach LCD and insert screws (also, attach the lcd cable to the board):
    + +

    + +

    + Insert those screws:
    + +

    + +

    + On the CPU (and there is another chip south-east to it, sorry forgot to take pic) + clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) + you should also clean the heatsink the same way
    + +

    + +

    + Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    + +

    + +

    + Reinstall that upper bezel:
    + +

    + +

    + Do that:
    + +

    + +

    + Re-attach modem, wifi, (wwan?), and all necessary cables. Sorry, forgot to take pics. Look at previous removal steps to see where they go back to. +

    + +

    + Attach keyboard and install nvram battery:
    + +

    + +

    + Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    + +

    + +

    + It lives!
    + +

    + +

    + Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    + +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/install/x60_unbrick.html b/docs/install/x60_unbrick.html new file mode 100644 index 0000000..751c4a8 --- /dev/null +++ b/docs/install/x60_unbrick.html @@ -0,0 +1,301 @@ + + + + + + + + + Libreboot documentation: Unbricking the ThinkPad X60 + + + + +
    +

    Unbricking the ThinkPad X60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • a 2nd computer (maybe another X60. any computer will do)
    • +
    • external flashrom-compatible programmer (I'm using the "bus pirate") +
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • +
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • +
    • USB mini a to b cable (for buspirate<>computer connection).
    • +
    + +

    Software requirements

    +
      +
    • GNU/Linux (on the 2nd computer)
    • +
    • flashrom software (on the 2nd computer): http://flashrom.org/ +
    + +

    Brick type 1: bucts not reset.

    +

    + You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and + the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    + + In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    +

    + + *Those dd commands should be applied to all newly compiled X60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    + dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    + dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    + dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    + (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, + using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. +

    + +

    bad rom (or user error), machine won't boot

    +

    + In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from + booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. +

    +

    + "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). +

    +

    + Remove those screws:
    + +

    +

    + Push the keyboard forward (carefully):
    + +

    +

    + Lift the keyboard up and disconnect it from the board:
    + +

    +

    + Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    + +

    +

    + You should now have this:
    + +

    +

    + Disconnect the wifi antenna cables, the modem cable and the speaker:
    + +

    +

    + Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem + cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand + side:
    + +

    +

    + Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape + that holds it into place:
    + +

    +

    + Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:
    + +

    +

    + Remove the screw that is highlighted (do NOT remove the other one; it holds part of the heatsink (other side) into place):
    + +

    +

    + Remove those screws:
    + +

    +

    + Carefully remove the plate, like so:
    + +

    +

    + Remove the SATA connector:
    + +

    +

    + Now remove the motherboard (gently) and cast the lcd/chassis aside:
    + +

    +

    + Lift back that tape and hold it with something. Highlighted is the SPI flash chip:
    + +

    +

    + At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    + http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    + Correlating with the following information, I was able to wire up my pirate correctly:
    + http://flashrom.org/Bus_Pirate#Connections
    + And by following that advice:
    + http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    + Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    + Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the + AC adapter (without powering on the board).
    + Note: I ignored that advice, and wired up all 8 pins. And it worked.
    + + Here is the pinout (correlate it with your programmer's documentation):
    + +

    + +

    + My programmer (bus pirate):
    +
    + My clip (pomona 5250):
    +
    + Connecting the pomona:
    +
    + Connecting the USB cable from programmer to 2nd(working/non-bricked) computer, my T60:
    +
    + Now I install flashrom on the T60 (running Trisquel GNU/Linux) and do this:
    + flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60/libreboot_usqwerty.rom
    + Note: there are also other ROM images for X60
    + Note: this is using buspirate as the programmer, so it is flashing the X60, not the T60!
    + Here's my terminal window on the T60:
    +
    + So, you should see the following:
    + -- +

    +
    +flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    +flashrom is free software, get the source code at http://www.flashrom.org
    +
    +Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    +Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    +Reading old flash chip contents... done.
    +Erasing and writing flash chip... Erase/write done.
    +Verifying flash... VERIFIED. 
    +
    +

    + --
    + At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means + that you can put your X60 back together. So let's do that now. +

    +

    + Remove the programmer and put it away somewhere. Put back the tape and press firmly over it:
    + +

    +

    + Your empty chassis:
    + +

    +

    + Put the motherboard back in:
    + +

    +

    + Reconnect SATA:
    + +

    +

    + Put the plate back and re-insert those screws:
    + +

    +

    + Re-route that antenna cable around the fan and apply the tape:
    + +

    +

    + Route the cable here and then (not shown, due to error on my part) reconnect the monitor cable to the motherboard + and re-insert the screws:
    + +

    +

    + Re-insert that screw:
    + +

    +

    + Route the black antenna cable like so:
    + +

    +

    + Tuck it in neatly like so:
    + +

    +

    + Route the modem cable like so:
    + +

    +

    + Connect modem cable to board and tuck it in neatly like so:
    + +

    +

    + Route the power connection and connect it to the board like so:
    + +

    +

    + Route the antenna and modem cables neatly like so:
    + +

    +

    + Connect the wifi antenna cables. At the start of the tutorial, this machine had an Intel wifi chip. Here you see I've replaced it with an + Atheros AR5B95 (supports 802.11n and can be used without blobs):
    + +

    +

    + Connect the modem cable:
    + +

    +

    + Connect the speaker:
    + +

    +

    + You should now have this:
    + +

    +

    + Re-connect the upper chassis:
    + +

    +

    + Re-connect the keyboard:
    + +

    +

    + Re-insert the screws that you removed earlier:
    + +

    +

    + Power on!
    + +

    +

    + Trisquel live USB menu (using GRUB's ISOLINUX parser):
    + +

    +

    + Trisquel live desktop:
    + +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/install/x60tablet_unbrick.html b/docs/install/x60tablet_unbrick.html new file mode 100644 index 0000000..b5aad3c --- /dev/null +++ b/docs/install/x60tablet_unbrick.html @@ -0,0 +1,209 @@ + + + + + + + + + Libreboot documentation: Unbricking the ThinkPad X60 Tablet + + + + +
    +

    Unbricking the ThinkPad X60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • a 2nd computer (maybe another X60 Tablet. any computer will do)
    • +
    • external flashrom-compatible programmer (I'm using the "bus pirate") +
    • SOIC-8 IC clip (I'm using the Pomona 5250)
    • +
    • Cable (programmer<>clip) - mine came with the bus pirate.
    • +
    • USB mini a to b cable (for buspirate<>computer connection).
    • +
    + +

    Software requirements

    +
      +
    • GNU/Linux (on the 2nd computer)
    • +
    • flashrom software (on the 2nd computer): http://flashrom.org/ +
    + +

    Brick type 1: bucts not reset.

    +

    + You still have Lenovo BIOS, or you had libreboot running and you flashed another ROM; and you had bucts 1 set and + the ROM wasn't dd'd.* or if Lenovo BIOS was present and libreboot wasn't flashed.

    + + In this case, unbricking is easy: reset BUC.TS to 0 by removing that yellow cmos coin (it's a battery) and putting it back after a minute or two:
    +

    + + *Those dd commands should be applied to all newly compiled X60 ROM's (the ROM's in libreboot binary archives already have this applied!):
    + dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
    + dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    + dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
    + (doing this makes the ROM suitable for use when flashing a machine that still has Lenovo BIOS running, + using those instructions: http://www.coreboot.org/Board:lenovo/x60/Installation. +

    + +

    bad rom (or user error), machine won't boot

    +

    + In this scenario, you compiled a ROM that had an incorrect configuration, or there is an actual bug preventing your machine from + booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash while Lenovo BIOS was running. In any case, your machine is bricked and will not boot at all. +

    +

    + "Unbricking" means flashing a known-good (working) ROM. The problem: you can't boot the machine, making this difficult. In this situation, external hardware (see hardware requirements above) is needed which can flash the SPI chip (where libreboot resides). +

    + +

    + +

    + +

    + Remove those screws:
    + +

    + +

    + Remove the HDD:
    + +

    + +

    + Push keyboard forward to loosen it:
    + +

    + +

    + Lift:
    + +

    + +

    + Remove those:
    + +

    + +

    + + +

    + +

    + Also remove that (marked) and unroute the antenna cables:
    + +

    + +

    + Some X60T's you have to unroute those too:
    + +

    + +

    + Remove the LCD extend board screws. Also remove those screws (see blue marks) and remove/unroute the cables and remove the metal plate:
    + +

    + +

    + Remove that screw and then remove the board:
    + +

    + +

    + At this point, you should wire up your programmer according to it's documentation. For me, this was (see: "SparkFun cable pin reference"):
    + http://dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts.
    + Correlating with the following information, I was able to wire up my pirate correctly:
    + http://flashrom.org/Bus_Pirate#Connections
    + And by following that advice:
    + http://www.coreboot.org/Board:lenovo/x60/Installation#Howto.
    + Note: that last page says to wire up only those 5 pins (see below) like that: 1, 2, 4, 5, 6.
    + Note: and then, for power it says (on that coreboot.org page) to connect the power jack to the board and connect the + AC adapter (without powering on the board).
    + Note: I ignored that advice, and wired up all 8 pins. And it worked.
    + + Here is the pinout (correlate it with your programmer's documentation):
    +
    + (SPI chip here is on the bottom of the board) +

    + +

    + Bus pirate:
    + +

    + +

    + Pomona 5250:
    + +

    + +

    + Connect pomona:
    + +

    + +

    + Connect pirate to USB on 2nd computer:
    + +

    + +

    + +

    + +

    + On the 2nd machine, I did: flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60t/libreboot_ukqwerty.rom +

    + +
    +			flashrom v0.9.5.2-r1517 on Linux 3.2.0-61-generic (i686), built with libpci 3.1.8, GCC 4.6.3, little endian
    +			flashrom is free software, get the source code at http://www.flashrom.org
    +
    +			Calibrating delay loop... delay loop is unreliable, trying to continue OK.
    +			Found Macronix flash chip "MX25L1605" (2048 kB, SPI) on buspirate_spi.
    +			Reading old flash chip contents... done.
    +			Erasing and writing flash chip... Erase/write done.
    +			Verifying flash... VERIFIED. 
    +		
    + +

    + At the end it says "VERIFIED", which means that the procedure worked. If you see this, it means that you can put your X60T back together. So let's do that now. +

    + +

    + Reverse the steps to re-assemble your machine. +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/misc/index.html b/docs/misc/index.html new file mode 100644 index 0000000..8fb52ff --- /dev/null +++ b/docs/misc/index.html @@ -0,0 +1,184 @@ + + + + + + + + + Miscellaneous + + + + +

    Miscellaneous

    +

    + Or Back to main index. +

    + + +
    + +

    High Pitched Whining Noise on Idle (how to remove in Trisquel)

    + +

    + Tested in Trisquel 6. +

    +

    + Note: untested in Trisquel 7. Remove this note when it is. +

    + +

    Powertop - how to use

    + +

    Now you can use this command to kill that noise:
    + $ sudo powertop --auto-tune

    + +

    You can also run it without parameters and then go into 'Tunables' and set everything to 'Good'

    + +

    Note: On Trisquel 6, you will need to use a later powertop version from git. The one in the repositories is too old. See below:

    + +

    Powertop - Start automatically at boot time (Trisquel 6)

    + +

    Included with libreboot is a script called 'powertop.trisquel6'. Run this and it will setup powertop to run with --auto-tune + at boot time. Load the file in your text editor to see how it does that.

    + +

    $ ./powertop.trisquel6

    + +

    This has been tested on Trisquel 6.

    + +

    Back to top of page

    + +
    + +

    High Pitched Whining Noise on Idle (how to remove in Parabola)

    + +

    The following removes most of the noise. It reduces what is a high frequency whine + (that not everyone can hear) to a slight buzz (which most people can't hear or doesn't bother most people).

    + +

    This is not perfect! The full solution is still not discovered but this is a step towards that. + Also, in some instances you will need to run 'sudo powertop --auto-tune' again. + This needs to be implemented properly in coreboot itself!

    + +

    On the X60 with coreboot or libreboot, there is a high pitched sound when idle. + So far we have use processor.max_cstate=2 or idle=halt in GRUB. + These consume power. Stop using them!

    + +

    Be root
    + $ su -

    + +

    Installed powertop:
    + # pacman -S powertop

    + +

    and added the following to /etc/systemd/system/powertop.service :

    + +
    
    +[Unit]
    +Description=Powertop tunings
    +
    +[Service]
    +Type=oneshot
    +RemainAfterExit=no
    +ExecStart=/usr/bin/powertop --auto-tune
    +# "powertop --auto-tune" still needs a terminal for some reason. Possibly a bug?
    +Environment="TERM=xterm"
    +
    +[Install]
    +WantedBy=multi-user.target
    +
    + + +

    Finally, as root do that:
    + # systemctl enable powertop
    + # systemctl start powertop

    + +

    The next time you boot the machine, the buzz will be gone.

    + +

    Back to top of page

    + +
    + +

    X60/T60: Serial port - how to use (for dock owners)

    +

    + For the Thinkpad X60 you can use the "UltraBase X6" dock (for the X60 Tablet it is called + X6 Tablet UltraBase). For the ThinkPad T60, + you can use the "Advanced Mini Dock". +

    +

    + If you are using one of the ROM's with 'serial' in the name, then you have serial port enabled in libreboot + and you have memtest86+ included inside the ROM. Connect your null modem cable to the serial port on the dock + and connect the other end to a 2nd machine using your USB Serial adapter. +

    +

    + On the 2nd machine, you can try this (using GNU Screen):
    + $ sudo screen /dev/ttyUSB0 115200 +

    +

    + How to quit GNU Screen: Ctrl+A then release and press K, and then press Y. +

    +

    There are also others like Minicom but I like GNU Screen

    +

    + By doing this before booting the X60/T60, you will see console output from libreboot. You will also see + GRUB displaying on the serial output, and you will be able to see MemTest86+ on the serial output aswell. + You can also configure your distro so that a terminal (TTY) is accessible from the serial console. +

    +

    + The following guide is for Ubuntu, and can be followed for Trisquel 6.0 which is based on Ubuntu 12.04 + (should also work in Trisquel 7, based on Ubuntu 14.04) to enable a serial console using GeTTY:
    + https://help.ubuntu.com/community/SerialConsoleHowto +

    +

    + Note: part of the tutorial above requires changing your grub.cfg. Just change the linux line to add instructions for enabling getty. + See ../gnulinux/grub_cbfs.html. +

    +

    Back to top of page + +


    + +

    Get EDID: Find out the name (model) of your LCD panel

    +

    + Get the panel name with sudo get-edid | strings
    + Or look in /sys/class/drm/card0-LVDS-1/edid +

    +

    + Alternatively you can use i2cdump. In Trisquel, this is in the package i2c-tools.
    + $ sudo modprobe i2c-dev
    + $ sudo i2cdump -y 5 0x50
    + $ sudo rmmod i2c-dev
    + You'll see the panel name in the output (from the EDID dump). +

    +

    + If neither of these options work (or they are unavailable), physically removing the LCD panel is an option. + Usually, there will be information printed on the back. +

    + +

    Back to top of page.

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/misc/patch.html b/docs/misc/patch.html new file mode 100644 index 0000000..3d926ac --- /dev/null +++ b/docs/misc/patch.html @@ -0,0 +1,163 @@ + + + + + + + + + + + Libreboot documentation: using diff and patch + + + + + + +
    +

    Diff and patch

    + +
    + +

    + back to index +

    + +
    + +

    + Apply a patch +

    + +

    + To apply a patch to a single file, do that in it's directory:
    + $ patch < foo.patch +

    + +

    + Assuming that the patch is distributed in unified format identifying + the file the patch should be applied to, the above will work. Otherwise:
    + $ patch foo.txt < bar.patch +

    + +

    + You can apply a patch to an entire directory, but note the "p level". + What this means is that inside patch files will be the files that you + intend to patch, identified by path names that might be different + when the files ane located on your own computer instead of on the computer + where the patch was created. 'p' level instructs the 'patch' utility to + ignore parts of the path name to identify the files correctly. Usually a + p level of 1 will work, so you would use:
    + $ patch -p1 < baz.patch +

    + +

    + Change to the top level directory before running this. If a patch level + of 1 cannot identify the files to patch, then inspect the patch file for file names. + For example:
    + /home/user/do/not/panic/yet.c +

    + +

    + and you are working in a directory that contains panic/yet.c, use:
    + $ patch -p5 < baz.patch +

    + +

    + You usually count one up for each path separator (forward slash) + removed from the beginning of the path, until you are left with a path + that exists in the current working directory. The count is the p level. +

    + +

    + Removing a patch using the -R flag
    + $ patch -p5 -R < baz.patch +

    + +

    Back to top of page.

    + +
    + +

    + Create a patch with diff +

    + +

    + Diff can create a patch for a single file:
    + $ diff -u original.c new.c > original.patch +

    + +

    + For diff'ing a source tree:
    + $ cp -R original new +

    + +

    + Do whatever you want in new/ and then diff it:
    + $ diff -rupN original/ new/ > original.patch +

    + +

    Back to top of page.

    + +
    + +

    + git diff +

    + +

    + git is something special. +

    + +

    + Just make whatever changes you want to a git clone and then:
    + $ git diff > patch.git +

    + +

    + Note the git revision that you did this with:
    + $ git log +

    + +

    Back to top of page.

    + +
    + +

    + git apply +

    + +

    it really is.

    + +

    + Now to apply that patch in the future, just git clone it again and do + with the git revision you found from above:
    + $ git reset --hard REVISIONNUMBER +

    + +

    + Now put patch.git in the git clone directory and do:
    + $ git apply patch.git +

    + +

    Back to top of page.

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/patch.html b/docs/patch.html deleted file mode 100644 index 2131951..0000000 --- a/docs/patch.html +++ /dev/null @@ -1,168 +0,0 @@ - - - - - - - - - - - Libreboot documentation: using diff and patch - - - - - - -
    -

    Diff and patch

    - -
    - -

    - back to index -

    - -
    - -

    - Apply a patch -

    - -

    - To apply a patch to a single file, do that in it's directory:
    - $ patch < foo.patch -

    - -

    - Assuming that the patch is distributed in unified format identifying - the file the patch should be applied to, the above will work. Otherwise:
    - $ patch foo.txt < bar.patch -

    - -

    - You can apply a patch to an entire directory, but note the "p level". - What this means is that inside patch files will be the files that you - intend to patch, identified by path names that might be different - when the files ane located on your own computer instead of on the computer - where the patch was created. 'p' level instructs the 'patch' utility to - ignore parts of the path name to identify the files correctly. Usually a - p level of 1 will work, so you would use:
    - $ patch -p1 < baz.patch -

    - -

    - Change to the top level directory before running this. If a patch level - of 1 cannot identify the files to patch, then inspect the patch file for file names. - For example:
    - /home/user/do/not/panic/yet.c -

    - -

    - and you are working in a directory that contains panic/yet.c, use:
    - $ patch -p5 < baz.patch -

    - -

    - You usually count one up for each path separator (forward slash) - removed from the beginning of the path, until you are left with a path - that exists in the current working directory. The count is the p level. -

    - -

    - Removing a patch using the -R flag
    - $ patch -p5 -R < baz.patch -

    - -

    Back to top of page.

    - -
    - -

    - Create a patch with diff -

    - -

    - Diff can create a patch for a single file:
    - $ diff -u original.c new.c > original.patch -

    - -

    - For diff'ing a source tree:
    - $ cp -R original new -

    - -

    - Do whatever you want in new/ and then diff it:
    - $ diff -rupN original/ new/ > original.patch -

    - -

    Back to top of page.

    - -
    - -

    - git diff -

    - -

    - git is something special. -

    - -

    - Just make whatever changes you want to a git clone and then:
    - $ git diff > patch.git -

    - -

    - Note the git revision that you did this with:
    - $ git log -

    - -

    Back to top of page.

    - -
    - -

    - git apply -

    - -

    it really is.

    - -

    - Now to apply that patch in the future, just git clone it again and do - with the git revision you found from above:
    - $ git reset --hard REVISIONNUMBER -

    - -

    - Now put patch.git in the git clone directory and do:
    - $ git apply patch.git -

    - -

    Back to top of page.

    - -
    - -

    - Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at license.txt. -

    - -

    - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See license.txt for more information. -

    - - - diff --git a/docs/release.html b/docs/release.html index 9547eda..3f66e5e 100644 --- a/docs/release.html +++ b/docs/release.html @@ -5,21 +5,7 @@ Libreboot release information @@ -73,8 +59,8 @@

    - Installation instructions can be found at index.html#flashrom. - Building instructions (for source code) can be found at index.html#build. + Installation instructions can be found at install/index.html#flashrom. + Building instructions (for source code) can be found at git/index.html#build.

    Machines supported in this release:

    @@ -91,29 +77,29 @@
  • Lenovo ThinkPad X60 Tablet (1024x768 and 1400x1050) with digitizer support
  • - Lenovo ThinkPad T60 (Intel GPU) (there are issues; see below) + Lenovo ThinkPad T60 (Intel GPU) (there are issues; see below):
  • Apple MacBook1,1 (MA255LL/A, MA254LL/A, MA472LL/A)
  • Apple MacBook2,1 (MA699LL/A, MA701LL/A, MB061LL/A, MA700LL/A, MB063LL/A, MB062LL/A)
  • @@ -139,7 +125,7 @@
  • builddeps-coreboot: use 'make crossgcc-i386' instead of 'make crossgcc'. Libreboot only targets x86 at the time of writing.
  • ROM images no longer include SeaBIOS. Instead, the user adds it afterwards. Documentation and scripts updated.
  • -
  • docs/howtos/encrypted_parabola.html: Notes about linux-libre-grsec
  • +
  • docs/images/encrypted_parabola.html: Notes about linux-libre-grsec
  • Documentation: encrypted_parabola.html: add tutorial for encrypted Parabola GNU/Linux installation.
  • Documentation: added more info about wifi chipsets
  • diff --git a/docs/security/dock.html b/docs/security/dock.html new file mode 100644 index 0000000..2b7fe75 --- /dev/null +++ b/docs/security/dock.html @@ -0,0 +1,154 @@ + + + + + + + + + Notes about DMA and the docking station (X60/T60) + + + +
    +

    Notes about DMA and the docking station (X60/T60)

    +
    + +
    +
    +Use case:
    +---------
    +Usually when people do full disk encryption, it's not really full disk,
    +instead they still have a /boot in clear.
    +
    +So an evil maid attack can still be done, in two passes:
    +1) Clone the hdd, Infect the initramfs or the kernel.
    +2) Wait for the user to enter its password, recover the password,
    +luksOpen the hdd image.
    +
    +I wanted a real full-disk encryption so I've put grub in flash and I
    +have the following: The HDD has a LUKS rootfs(containing /boot) on an
    +lvm partition, so no partition is in clear.
    +
    +So when the computer boots it executes coreboot, then grub as a payload.
    +Grub then opens the LUKS partition and loads the kernel and initramfs
    +from there.
    +
    +To prevent hardware level tempering(like reflashing), I used nail
    +polish with a lot of gilder, that acts like a seal. Then a high
    +resolution picture of it is taken, to be able to tell the difference.
    +
    +The problem:
    +------------
    +But then comes the docking port issue: Some LPC pins are exported
    +there, such as the CLKRUN and LDRQ#.
    +
    +LDRQ# is "Encoded DMA/Bus Master Request": "Only needed by
    +peripherals that need DMA or bus mastering. Requires an
    +individual signal per peripheral. Peripherals may not share
    +an LDRQ# signal."
    +
    +So now DMA access is possible trough the dock connector.
    +So I want to be able to turn that off.
    +
    +If I got it right, the X60 has 2 superio, one is in the dock, and the
    +other one is in the laptop, so we have:
    +                            ________________
    + _________________         |                |
    +|                 |        | Dock connector:|
    +|Dock: NSC pc87982|<--LPC--->D_LPC_DREQ0    |
    +|_________________|        |_______^________|
    +                                   |
    +                                   |
    +                                   |
    +                                   |
    +                ___________________|____
    +               |                   v    |
    +               | SuperIO:        DLDRQ# |
    +               | NSC pc87382     LDRQ#  |
    +               |___________________^____|
    +                                   |
    +                                   |
    +                                   |
    +                                   |
    +                ___________________|___
    +               |                   v   |
    +               | Southbridge:    LDRQ0 |
    +               | ICH7                  |
    +               |_______________________|
    +
    +
    +The code:
    +---------
    +Now if I look at the existing code, there is some superio drivers, like
    +pc87382 in src/superio/nsc, the code is very small. 
    +The only interesting part is the pnp_info pnp_dev_info struct.
    +
    +Now if I look inside src/mainboard/lenovo/x60 there is some more
    +complete dock driver:
    +
    +Inside dock.c I see some dock_connect and dock_disconnect functions.
    +
    +Such functions are called during the initialisation (romstage.c) and
    +from the x60's SMI handler (smihandler.c).
    +
    +Questions:
    +----------
    +1) Would the following be sufficent to prevent DMA access from the
    +outside:
    +> int dock_connect(void)
    +> {
    +>          int timeout = 1000;
    +> +        int val;
    +> +        
    +> +        if (get_option(&val, "dock") != CB_SUCCESS)
    +> +                val = 1;
    +> +        if (val == 0)
    +> +                return 0;
    +>          [...]
    +> }
    +>
    +> void dock_disconnect(void) {
    +> +        if (dock_present())
    +> +                return;
    +>          [...]
    +> }
    +2) Would an nvram option be ok for that? Should a Kconfig option be
    +added too?
    +
    +> config DOCK_AUTODETECT
    +>         bool "Autodetect"
    +>         help
    +>           The dock is autodetected. If unsure select this option.
    +>
    +> config DOCK_DISABLED
    +>         bool "Disabled"
    +>         help
    +>           The dock is always disabled.
    +>
    +> config DOCK_NVRAM_ENABLE
    +>         bool "Nvram"
    +>         help
    +>           The dock autodetection is tried only if it is also enabled
    +> trough nvram.
    +
    +
    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/security/index.html b/docs/security/index.html new file mode 100644 index 0000000..64008b8 --- /dev/null +++ b/docs/security/index.html @@ -0,0 +1,40 @@ + + + + + + + + + Security topics + + + + +

    Security topics

    +

    + Or Back to main index. +

    + + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/security/t60_security.html b/docs/security/t60_security.html new file mode 100644 index 0000000..eb3db03 --- /dev/null +++ b/docs/security/t60_security.html @@ -0,0 +1,440 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad T60 + + + + +
    +

    Security on the ThinkPad T60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • A T60
    • +
    • screwdriver
    • +
    • (in a later version of this tutorial: soldering iron and scalpel)
    • +
    + +

    Software requirements

    +
      +
    • none (at least in the scope of the article as-is)
    • +
    • You probably want to encrypt your GNU/Linux install using LUKS
    • +
    + +

    + Rationale +

    +

    + Most people think of security on the software side: the hardware is important aswell. + Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. + It is also generally useful to all those that believe security and privacy are inalienable rights. + Security starts with the hardware; crypto and network security come later. +

    +

    + Paradoxically, going this far to increase your security also makes you a bigger target. + At the same time, it protects you in the case that someone does attack your machine. + This paradox only exists while few people take adequate steps to protect yourself: it is your duty + to protect yourself, not only for your benefit but to make strong security normal so + that those who do need protection (and claim it) are a smaller target against the masses. +

    +

    + Even if there are levels of security beyond your ability (technically, financially and so on) + doing at least something (what you are able to do) is extremely important. + If you use the internet and your computer without protection, attacking you is cheap (some say it is + only a few US cents). If everyone (majority of people) use strong security by default, + it makes attacks more costly and time consuming; in effect, making them disappear. +

    +

    + This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). +

    + +

    Disassembly

    + +

    + Remove those screws and remove the HDD:
    + +

    + +

    + Lift off the palm rest:
    + +

    + +

    + Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
    + +

    + +

    + Gently wedge both sides loose:
    + +

    + +

    + Remove that cable from the position:
    + +

    + +

    + Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
    +
    + Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
    + Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most T60's come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + it's risk-level is very high. +

    + +

    + Remove those screws:
    + +

    + +

    + Disconnect the power jack:
    + +

    + +

    + Remove nvram battery (we will put it back later):
    + +

    + +

    + Disconnect cable (for 56k modem) and disconnect the other cable:
    + +

    + +

    + Disconnect speaker cable:
    + +

    + +

    + Disconnect the other end of the 56k modem cable:
    + +

    + +

    + Make sure you removed it:
    + +

    + +

    + Unscrew those:
    + +

    + +

    + Make sure you removed those:
    + +

    + +

    + Disconnect LCD cable from board:
    + +

    + +

    + Remove those screws then remove the LCD assembly:
    + +

    + +

    + Once again, make sure you removed those:
    + +

    + +

    + Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady + surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the + screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
    + + +

    + +

    + Remove microphone (soldering iron not needed. Just wedge it out gently):
    +
    + Rationale:
    + Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

    + +

    + Remove infrared:
    + +

    + +

    + Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):
    +
    + Rationale:
    + It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See + 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 + but the same topics apply to T60. +

    + +

    + Before re-installing the upper chassis, remove the speaker:
    +
    + Reason: combined with the microphone issue, this could be used to leak data.
    + If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
    + Replacement: headphones/speakers (line-out) or external DAC (USB). +

    + +

    + Remove the wwan:
    +
    + Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
    + Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

    + +

    + This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery + and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)
    + +

    + +

    + Put those screws back:
    + +

    + +

    + Put it back into lower chassis:
    + +

    + +

    + Attach LCD and insert screws (also, attach the lcd cable to the board):
    + +

    + +

    + Insert those screws:
    + +

    + +

    + On the CPU (and there is another chip south-east to it, sorry forgot to take pic) + clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) + you should also clean the heatsink the same way
    + +

    + +

    + Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
    + +

    + +

    + Reinstall that upper bezel:
    + +

    + +

    + Do that:
    + +

    + +

    + Attach keyboard and install nvram battery:
    + +

    + +

    + Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
    + +

    + +

    + Remove those covers and unscrew:
    + +

    + +

    + Gently pry off the front bezel (sorry, forgot to take pics). +

    + +

    + Remove bluetooth module:
    + +

    + +

    + Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). +

    + +

    + It lives!
    + +

    + +

    + Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
    + +

    + +

    + Not covered yet: +

    +
      +
    • Disable flashing the ethernet firmware
    • +
    • Disable SPI flash writes (can be re-enabled by unsoldering two parts)
    • +
    • Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
    • +
    • Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)
    • +
    +

    + Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

    +

    + A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

    + +

    + Also not covered yet: +

    +
      +
    • + Intrusion detection: randomized seal on screws
      + Just put nail polish with lot of glider on the important screws, take + some good pictures. Keep the pictueres and make sure of their integrity. + Compare the nail polish with the pictures before powering on the laptop. +
    • +
    • + Tips about preventing/mitigating risk of cold boot attack. +
        +
      • soldered RAM?
      • +
      • wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
      • +
      • ask gnutoo about fallback patches (counts number of boots)
      • +
      +
    • +
    • + General tips/advice and web links showing how to detect physical intrusions. +
    • +
    • + For example: http://cs.tau.ac.il/~tromer/acoustic/ +
    • +
    • + https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: +
    • +
    + +

    + Extra notes +

    +

    + EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

    +

    + Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

    + +

    + Risk level +

    +
      +
    • Modem (3g/wwan): highest
    • +
    • Intel wifi: Near highest
    • +
    • Atheros PCI wifi: unknown, but lower than intel wifi.
    • +
    • Microphone: only problematic if the computer gets compromised.
    • +
    • Speakers: only problematic if the computer gets compromised.
    • +
    • EC: can be mitigated if following the guide on software security.
    • +
    + +

    + Further reading material (software security) +

    + + +

    + References +

    +

    [1] physical access

    +

    + Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

    +

    [2] microphone

    +

    + It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

    +

    [3] Video (CCC)

    +

    + 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + diff --git a/docs/security/x60_security.html b/docs/security/x60_security.html new file mode 100644 index 0000000..33ccb6d --- /dev/null +++ b/docs/security/x60_security.html @@ -0,0 +1,301 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad X60 + + + + +
    +

    Security on the ThinkPad X60

    + +
    + +

    Or go back to main index

    + +

    Table of Contents

    + + +

    Hardware requirements

    +
      +
    • An X60
    • +
    • screwdriver
    • +
    • (in a later version of this tutorial: soldering iron and scalpel)
    • +
    + +

    Software requirements

    +
      +
    • none (at least in the scope of the article as-is)
    • +
    • You probably want to encrypt your GNU/Linux install using LUKS
    • +
    + +

    + Rationale +

    +

    + Most people think of security on the software side: the hardware is important aswell. + Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. + It is also generally useful to all those that believe security and privacy are inalienable rights. + Security starts with the hardware; crypto and network security come later. +

    +

    + Paradoxically, going this far to increase your security also makes you a bigger target. + At the same time, it protects you in the case that someone does attack your machine. + This paradox only exists while few people take adequate steps to protect yourself: it is your duty + to protect yourself, not only for your benefit but to make strong security normal so + that those who do need protection (and claim it) are a smaller target against the masses. +

    +

    + Even if there are levels of security beyond your ability (technically, financially and so on) + doing at least something (what you are able to do) is extremely important. + If you use the internet and your computer without protection, attacking you is cheap (some say it is + only a few US cents). If everyone (majority of people) use strong security by default, + it makes attacks more costly and time consuming; in effect, making them disappear. +

    +

    + This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). +

    + +

    Disassembly

    + +

    + Firstly remove the bluetooth (if your X60 has this):
    + The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
    +
    + Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
    +
    +

    + +

    + If your model was WWAN, remove the simcard (check anyway):
    + Uncover those 2 screws at the bottom:
    +
    + SIM card (not present in the picture) is in the marked location:
    +
    + Replacement: USB dongle. +

    + +

    + Now get into the motherboard. +

    + +

    + Remove those screws:
    + +

    +

    + Push the keyboard forward (carefully):
    + +

    +

    + Lift the keyboard up and disconnect it from the board:
    + +

    +

    + Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
    + +

    +

    + You should now have this:
    + +

    + +

    + The following is a summary of what you will remove (already done to this machine):
    +
    + Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional +

    + +

    + Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
    +
    + Rationale:
    + Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

    + +

    + Remove the modem:
    +
    + (useless, obsolete device) +

    + +

    + Remove the speaker:
    +
    + Reason: combined with the microphone issue, this could be used to leak data.
    + If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
    + Replacement: headphones/speakers (line-out) or external DAC (USB). +

    + +

    + Remove the wlan (also remove wwan if you have it):
    +
    + Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
    + Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most X60's come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + it's risk-level is very high.
    + Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
    + Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

    + +

    + Not covered yet: +

    +
      +
    • Disable cardbus (has fast/direct memory access)
    • +
    • Disable firewire (has fast/direct memory access)
    • +
    • Disable flashing the ethernet firmware
    • +
    • Disable SPI flash writes (can be re-enabled by unsoldering two parts)
    • +
    • Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
    • +
    • Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)
    • +
    +

    + Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

    +

    + A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

    + +

    + Also not covered yet: +

    +
      +
    • + Intrusion detection: randomized seal on screws
      + Just put nail polish with lot of glider on the important screws, take + some good pictures. Keep the pictueres and make sure of their integrity. + Compare the nail polish with the pictures before powering on the laptop. +
    • +
    • + Tips about preventing/mitigating risk of cold boot attack. +
        +
      • soldered RAM?
      • +
      • seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)
      • +
      • wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
      • +
      • ask gnutoo about fallback patches (counts number of boots)
      • +
      +
    • +
    • + General tips/advice and web links showing how to detect physical intrusions. +
    • +
    • + For example: http://cs.tau.ac.il/~tromer/acoustic/ +
    • +
    • + https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: +
    • +
    + +

    + Extra notes +

    +

    + EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

    +

    + Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

    + +

    + Risk level +

    +
      +
    • Modem (3g/wwan): highest
    • +
    • Intel wifi: Near highest
    • +
    • Atheros PCI wifi: unknown, but lower than intel wifi.
    • +
    • Microphone: only problematic if the computer gets compromised.
    • +
    • Speakers: only problematic if the computer gets compromised.
    • +
    • EC: can be mitigated if following the guide on software security.
    • +
    + +

    + Further reading material (software security) +

    + + +

    + References +

    +

    [1] physical access

    +

    + Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

    +

    [2] microphone

    +

    + It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

    +

    [3] Video (CCC)

    +

    + 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

    + +
    + +

    + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
    + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

    + +

    + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

    + + + -- cgit v1.1-4-g5e80