Install Libreboot Open Source BIOS/UEFI boot firmware

English | Français

Return to previous index

WARNING: UEFI-only!!!

Libreboot 26.11 “Rubber Duck” and newer releases only ship with EDK2 UEFI payload on most boards, but you can add back EFI versions of GRUB, SeaBIOS (ReBIOS) and MemTest86plus if you wish - please note: some legacy 32-bit hardware, and hardware with incompatible graphics setups, still use the bare coreboot-payload version of SeaBIOS, but nearly all mainboards use EDK2.

EDK2 offers full support for modern UEFI-compliant operating systems. Users who installed Libreboot 26.10 with SeaGRUB/SeaBIOS, or an earlier version with GRUB/SeaGRUB/SeaBIOS, should either: convert their OS installations to EFI with ESP (EFI System Partition)…. or follow this guide:

Adding back legacy payloads to Libreboot EDK2.

This guide tells you how to add back GRUB EFI, SeaBIOS (ReBIOS CSM module) and MemTest86plus - and briefly more. This policy change is part of an ongoing modernisation effort within the Libreboot project. The default release builds are UEFI-only on most boards, but you can build from source or run the old payloads through other means (USB drive and EFI shell, place them on ESP, etc). Read the guide for more info.

This warning was written in advance of the Libreboot 26.11 release, which is a major design and likely to cause some havoc because of this policy change. Hence the advanced warning. Most users will probably be happy with EDK.

Open source BIOS/UEFI boot firmware

ALWAYS remember to make a backup of the current flash, when overwriting it, regardless of what firmware you currently have and what firmware you’re re-flashing it with; this includes updates between Libreboot releases. Use the -r option in flashprog instead -w, to read from the flash.

These documents will teach you how to install Libreboot, on these devices/motherboards. Libreboot is a Free Software project that replaces proprietary BIOS/UEFI firmware.

Trouble?

Inquiries can be done via Libreboot IRC and other channels.

If you want professional installation, Minifree Ltd sells Libreboot pre-installed on select hardware, and it also provides a Libreboot preinstall service if you want to send your machine in to have Libreboot installed for you.

Leah Rowe, the founder and lead developer of Libreboot, also owns and operates Minifree Ltd; sales provide funding for the Libreboot project.

Chromebook install/update

Be careful as certain config in RO_VPD must be retained during installation and updates. Check chromebooks-x86.html for guidance, cross-referenced with MrChromebook documentation.

PCI-E rebar

The EDK2-based images work with modern graphics cards, which often lack VGA ROMs these days; EDK2 does GOP ROM execution by default, in Libreboot.

However, we do not enable re-locatable BAR by default. This is required for higher-end modern cards with large amounts of video RAM. Please read the documentation for this.

If in doubt, please just follow the link and enable rebar if you’re using a graphics card.

SMMSTORE settings

Modern Libreboot releases use EDK2 with SMMSTORE.

If you used an EDK2 build before Libreboot 26.10, note that SMMSTORE was set to 256KB. It was upped back to 512KB as is default, on most platforms. For safety, please flash your entire image when switching to a stable release with EDK2.

If you’re installing for first time, please also flash the whole image.

If updating from an existing stable Libreboot release with EDK2, note that you can avoid overwriting your EFI setup config by doing this:

flashprog -p internal --fmap -i COREBOOT -w whatever.rom

This avoids flashing the SMMSTORE section, where your settings are. This is because the EDK2 payload writes settings to that section in the flash.

Conversely, you may reset it thus:

flashprog -p internal --fmap -i SMMSTORE -w whatever.rom

Be very careful with this. Note that fmap exists inside the BIOS region on IFD-based systems.

Laptops (x86_64 chromebooks)

See: x86 chromebooks - also pertains to EDK2 more generally, across all boards, not just Chromebooks.

Libreboot 26.10 and higher have full integration of all EDK2-based MrChromebox Chromebook setups. That is to say: we support every Chromebook that MrChromebox does, in Libreboot.

The MrChromebook coreboot tree contains support for the following Chromebook boards, most of which Libreboot now also has direct support for:

WARNING: Make/model don’t always match; sometimes the same model can use different hardware. Please try only to use serial numbers corresponding to proper codenames when flashing, and cross reference that with what’s included in the Libreboot build system.*

The list of models/makes for chromebooks may be incomplete. Please make sure to use codenames and serial numbers when identifying your device.

Check the list to get a full list of Chromebooks. Libreboot supports most of them!

Yes. Again: the list is very big.

Laptops

Intel

8th Gen.

5th Gen.

4th Gen.

3rd -> 2nd Gen.

(Socketed processors are fully compatible with motherboards from different generations)

Core 2

Arm

Chromebooks with U-Boot payload

Games consoles

Servers (x86_64 with ECC support)

Intel

9th -> 6th gen (Xeon v5-6 and Core up to the 9th gen ones)

(Different gen. CPUs compatible with older and newer motherboards too, on older ones 8th-9th Core with B0 stepping; i3, Pentium Gold, Celeron. 6/8 core processors might work with pin-mod, untested.)

AMD

Opteron 6300

Opteron 4300/4200

Desktops/WorkStations (x86/_64)

12th Gen

9th -> 6th gen (Xeon v5-6 and Core up to the 9th gen ones)

(Different gen. CPUs compatible with older and newer motherboards too, on older ones 8th-9th Core with B0 stepping; i3, Pentium Gold, Celeron. 6/8 core processors might work with pin-mod, untested.)

5th -> 4th Gen. (Core + Xeon v3-4)

(5th gen cpus are compatible with some the 4gen boards; C222/4/6 and H/Z97 chipsets https://en.wikipedia.org/wiki/LGA_1150#Haswell_chipsets )

3rd -> 2nd Gen. (Core + Xeon v1-2)

(Processors are fully compatible with motherboards from different generations)

Core 2

Emulation

More information about the Libreboot build system can be found in the lbmk maintenance manual, and information about porting new systems in the porting manual.

ROM image file names

Modern Libreboot standardises on EDK2 these days, not SeaBIOS/GRUB which are provided inside EDK2 for backward compatibility but recommended only for legacy use. Please use the edk2_ images provided by modern Libreboot, where possible as this is much more compatible with modern operating systems.

Libreboot ROM images are named like this: payload_board_inittype_displaytype_keymap.rom

The payload option can be EDK2, SeaBIOS, GRUB or U-Boot. U-Boot on ARM64 and EDK2 on x86; GRUB and SeaBIOS EFI builds provided for backward compatibility with older releases, inside of the EDK2 build.

Inittype can be libgfxinit, vgarom or normal. The libgfxinit option means coreboot provides native video initialisation, for onboard graphics. The vgarom option means coreboot executes a VGA option ROM for video initialisation. The normal option means coreboot provides no video initialisation, via VGA ROM or native code.

Displaytype can be txtmode or corebootfb - if inittype is normal, this is ignored because txtmode is assumed.

NOTE: modern releases also support fspgop which, semantics aside, works essentially just like libgfxinit_corebootfb.

If you use a libgfxinit image on a desktop machine, you can still insert a graphics card and it’ll work just fine; its own VGA option ROM will be executed instead, if the primary payload is SeaBIOS, whether that be pure SeaBIOS or a SeaGRUB setup.

EC firmware updates

Obviously, free EC firmware would be preferable, but it is not the case on all machine. We would like to have free EC firmware on more machines, but for now, we must rely on the vendor in a lot of cases. The EC is usually on a separate flash, so you wouldn’t think about it unless you knew it was there; this is exactly why it’s mentioned, so that you think about it, because proprietary software is bad.

In many cases, the EC firmware must be updated on a separate IC to the main boot flash, and this can usually only be done with the vendor’s own tool, running from the vendor boot firmware, and usually only on Windows, because they provide EC and BIOS/UEFI updates in the same utility. Find out what you need to do for your machine before installing Libreboot.

It is recommended that you update to the latest EC firmware version. The EC firmware

Updating the EC can sometimes provide benefit depending on the vendor. For example, they might fix power issues that could then enhance battery life.

ThinkPads

See: http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk

Otherwise, check the Lenovo website to find the update utility for your motherboard.

Flash lockdown / boot security

IFD-based systems can be locked down using this on the ROM before flashing:

ifdtool --lock your.rom

Make sure to use the --platform argument if needed for your board; check the help output (run ifdtool without argument) to get the list. This is if you need platform-specific quirks.

Alternatively:

./mk -m coreboot yourboard

Find the section in there about flash security. Make sure to have an external flasher ready in case you brick. Note: SMMSTORE variables need to be maintained manually, using the smmstoreutil utility in coreboot; if just doing IFD, you could make the settings first in the EDK2 menu, and then lock a dump of the flash afterward, re-flashing the locked ROM. You can unlock a ROM using:

ifdtool --unlock your.rom

When running ifdtool, it will create a new ROM. To make it modify the current named image, add to end of ifdtool e.g.

ifdtool --unlock your.rom -O your.rom

You can find ifdtool under elf/coreboot/ in the build system, when doing something like:

./mk -d coreboot yourboard

This builds util binaries from the corresponding source tree. A future release of Libreboot could make use of Intel Protected Range registers, with a toggle in the EDK2 setup menu, but this has not yet been done.

ThinkPad X200/T400/T500/W500/R400/R500

If you’re running one of these with Lenovo BIOS, you must externally flash Libreboot, because the original firmware restricts writes to the flash.

There machines all use SOIC8/SOIC16 flash ICs. Refer to pages specifically for each machine:

NOTE: T400S, X200S and X200 Tablet require different steps, because these have WSON8 flash ICs on them, which will require some soldering. Please read the external flashing guide in the section pertaining to WSON.

You can find WSON8 probes online, that are similar to a SOIC8/SOIC16 clip. Your mileage may very, but WSON8 has the same pinout as SOIC8 so you might have some luck with that.

Hot-swap the flash IC with another one while it’s running, and flash it internally.

ThinkPad X220/X220T/T420/T420s/T520

T420/T520: T420 flash instructions

T420s/T520 are similar, in terms of assembly/disassembly.

Now, as for X220/X220 Tablet:

X220/X220 Tablet is essentially the same as the X230, but cannot be flashed internally; you must use an external flasher.

Otherwise, look at X230 disassembly. Note that the X220 has a single 8MB flash, instead of 8MB and 4MB.

ThinkPad X230/T430/T530/W530/X230T

Internal flashing from vendor BIOS to Libreboot is possible, but not recommended. See: IvyBridge ThinkPad internal flashing.

External flashing recommended, but only documented for X230. See: ThinkPad X230 install guide.

Otherwise, refer to external SPI flashing.

ARM-based Chromebooks

See: Chromebook flashing instructions

NOTE: The generic flashing instructions (later on this page) apply only to the x86 machines, because the Chromebooks still use flashrom with the -p host argument instead of -p internal when flashing, and you typically need to flash externally, due to Google’s security model.

QEMU (arm64 and x86)

Libreboot can be used on QEMU (virtual machine), which is useful for debugging payloads and generally trying out Libreboot, without requiring real hardware.

See: Libreboot QEMU guide

Removed boards

These boards were in Libreboot, but have been removed with the intention of re-adding them at a later date. They were removed due to issues. List:

NOTES about removed boards

WARNING: veyron speedy boards (e.g. C201) have non-functional video init as of 19 February 2023, and no fix is yet available on that date. See: https://notabug.org/libreboot/lbmk/issues/136 - the last tested revision from 2021.01 is known to work, for u-boot on this board. See:
https://wiki.postmarketos.org/wiki/ASUS_Chromebook_C201_(google-veyron-speedy) (alpernebbi on IRC is looking into this, to bisect uboot and update the latest revisions) - for now, ROM images deleted from the Libreboot 20221214 and 20230319 releases.

WARNING: daisy- and peach- boards require a BL1 bootloader firmware, but the one from coreboot 3rdparty is a fake/placeholder file. We need logic in the Libreboot build system for properly fetching/extracting these, plus docs to cover it. For now, assume that these are broken - ROM images are excluded, for now, and have been deleted from the Libreboot 20221214 and 20230319 releases. - see: https://review.coreboot.org/plugins/gitiles/blobs/+/4c0dcf96ae73ba31bf9aa689768a5ecd47bac19e and https://review.coreboot.org/plugins/gitiles/blobs/+/b36cc7e08f7337f76997b25ee7344ab8824e268d

D945GCLF: Doesn’t boot at all, according to last report. D510MO is still in lbmk but still was reported problematic; other boards should be fine (see list above).

WARNING: Support for ARM chromebooks is at a proof-of-concept stage. Refer to docs/uboot/ for more info about the U-Boot payload.

Markdown file for this page: https://libreboot.org/docs/install/index.md

Site map

This HTML page was generated by the Libreboot Static Site Generator.