Install RBoot Free BIOS/UEFI boot firmware

Return to previous index

Nearly all Intel/AMD boards only have EDK2 UEFI payload. Some legacy 32-bit boards have SeaBIOS. The GRUB payload was removed.

If your existing GNU/Linux-libre installation is BIOS-based, or booting via the erstwhile GRUB payload, please convert first to UEFI with EFI System Partition (ESP), so that it can boot after you flash RBoot. Consult your distro’s documentation for how to do this. A UKI (Unified Kernel Image) setup is recommended for modern usage, as this could then be checked with SecureBoot (not enabled by default) and your own enrolled keys, if you wish.

The EDK2 payload will boot any UEFI-compliant operating system, which includes free bootloaders provided by free operating systems, such as GNU GRUB or systemd-boot.

Please read the safety guide. Please also read that guide more generally, if installing RBoot, as there are several safety pitfalls that you must avoid when flashing this firmware.

ALWAYS remember to make a backup of the current flash, when overwriting it, regardless of what firmware you currently have and what firmware you’re re-flashing it with; this includes updates between RBoot releases. Use the -r option in flashprog instead -w, to read from the flash.

These documents will teach you how to install RBoot, on these devices/motherboards. RBoot is a Free Software project that replaces proprietary BIOS/UEFI firmware.

Inquiries can be done via RBoot IRC and other channels.

The EDK2-based images work with modern graphics cards, which often lack VGA ROMs these days. RBoot recommends use of integrated graphics, where VGA and GOP ROMs are not required.

EDK2 does GOP ROM execution by default, in RBoot, when you use a graphics card; it will find the ROM on your card, and execute it. This ROM is non-free, and we’ll have more to say about mitigating that in a little while.

However, we do not enable re-locatable BAR by default. This is required for higher-end modern cards with large amounts of video RAM. Please read the documentation for this.

If in doubt, please just follow the link and enable rebar if you’re using a graphics card.

Now, mitigations:

You can turn on rebar, and avoid use of GOP ROMs on some cards. Refer to the extras page; it contains guidance about use of the Intel GPU (with libgfxinit) for framebuffer, offloading rendering to a graphics card. In some cases, you can do this with the GOP ROM loaded in memory without executing it. Most people will probably just run the GOP ROM via normal EDK2 configuration, as is the default. You are warned about this.

RBoot recommends avoiding use of graphics cards entirely. Use integrated graphics, where native (libre) framebuffer initialisation is provided by RBoot. The policy here, in RBoot, is: respect the user’s choice, while warning them of the consequences. With this paragraph, the user has now been warned quite thoroughly.

RBoot always uses 256KB SMMSTORE, but other coreboot distros can sometimes use 512KB; please overwrite the entire BIOS region / relevant flash section when switching to RBoot; do not attempt to retain SMMSTORE. These other projects will, most likely, use completely different flash layouts.

Modern RBoot releases provides EDK2 with SMMSTORE on certain boards, but please only follow the notes below if updating from one RBoot release to another, otherwise please omit --fmap -i COREBOOT as shown below.

If you’re installing for first time, please also flash the whole image.

If updating from an existing stable RBoot release with EDK2, note that you can avoid overwriting your EFI setup config by doing this:

flashprog -p internal --fmap -i COREBOOT -w whatever.rom

This avoids flashing the SMMSTORE section, where your settings are. This is because the EDK2 payload writes settings to that section in the flash.

Conversely, you may reset it thus:

flashprog -p internal --fmap -i SMMSTORE -w whatever.rom

Be very careful with this. Note that fmap exists inside the BIOS region on IFD-based systems.

Intel

4th Gen.

• Lenovo ThinkPad W541 (Complex, DDR3L)
• Lenovo ThinkPad T440p (Complex, DDR3L)

3rd -> 2nd Gen.

(Socketed processors are fully compatible with motherboards from different generations)

• Lenovo ThinkPad T430 (but not the T430S) (Complex, DDR3L)
• Lenovo ThinkPad T530 (Complex, DDR3L)
• Lenovo Thinkpad X230 / X230 Tablet (Complex, DDR3L)
• Dell Latitude E5420, E5520, E5530, E6420, E6430, E6520, E6530, E6230, E6330, E6220, E7240 (Simple, DDR3L) (Intel GPU variants only)
• Lenovo Thinkpad T420/T520 (Complex, DDR3L)
• Lenovo ThinkPad T420s (Complex, DDR3L)
• Lenovo ThinkPad X220/X220 (Complex, DDR3L)

Core 2

• Dell Latitude E4300, E6400, E6400 XFR and E6400 ATG (Simple, DDR2L + DDR3L for E4300)
• Lenovo ThinkPad R400 (Complex, DDR3L)
• Lenovo ThinkPad R500 (Complex, DDR3L)
• Lenovo ThinkPad T400 / T400S (Complex, DDR3L)
• Lenovo ThinkPad T500 / W500 (Complex, DDR3L)
• Lenovo ThinkPad X200 / X200S / X200 Tablet (Complex, DDR3L)
• Apple MacBook1,1 and MacBook2,1 (Complex for 1.1/Simple for 2.1 - 2007, DDR2L)
• Lenovo ThinkPad T60 (with Intel GPU) (Complex, DDR2L)
• Lenovo ThinkPad X60 (with Intel GPU) (Complex, DDR2L)
• Lenovo ThinkPad X60S (with Intel GPU) (Complex, DDR2L)
• Lenovo ThinkPad X60 Tablet Tablet (with Intel GPU) (Complex, DDR2L)

Arm

Chromebooks with U-Boot payload

• ASUS Chromebook Flip C101 (gru-bob) (Complex)
• Samsung Chromebook Plus (v1) (gru-kevin) (Complex)

• Sony Playstation (Complex) (PS1/PSX)

Intel

AMD

Opteron 6300

• ASUS KGPE-D16 motherboard (Moderate, DDR3)

Opteron 4300/4200

• ASUS KCMA-D8 motherboard (Moderate, DDR3)

4th Gen. (Core + Xeon v3)

(5th gen cpus are compatible with some the 4gen boards; C222/4/6 and H/Z97 chipsets https://en.wikipedia.org/wiki/LGA_1150#Haswell_chipsets )

• Dell OptiPlex 7020/9020/XE2 MT and SFF (Simple, DDR3)

3rd -> 2nd Gen. (Core + Xeon v1-2)

(Processors are fully compatible with motherboards from different generations)

• Dell OptiPlex 7010/9010 SFF/MT +T1650 (Simple, DDR3 + ECC for T1650)
• HP Compaq Elite 8300 USDT (Simple, DDR3)
• HP Compaq Elite 8200/Compaq 6200 Pro SFF/MT (Simple, DDR3)

Core 2

• Dell OptiPlex 780 variants e.g. MT, USFF (Simple, DDR3)
• Apple Apple iMac 5,2 (Simple, DDR2) (Same as Macbook 2.1 to flash)

• Qemu x86 and arm64

More information about the RBoot build system can be found in the rbmk maintenance manual, and information about porting new systems in the porting manual.

IFD-based systems can be locked down using this on the ROM before flashing:

ifdtool --lock your.rom

Make sure to use the --platform argument if needed for your board; check the help output (run ifdtool without argument) to get the list. This is if you need platform-specific quirks.

Alternatively:

./mk -m coreboot yourboard

Find the section in there about flash security. Make sure to have an external flasher ready in case you brick. Note: SMMSTORE variables need to be maintained manually, using the smmstoreutil utility in coreboot; if just doing IFD, you could make the settings first in the EDK2 menu, and then lock a dump of the flash afterward, re-flashing the locked ROM. You can unlock a ROM using:

ifdtool --unlock your.rom

When running ifdtool, it will create a new ROM. To make it modify the current named image, add to end of ifdtool e.g.

ifdtool --unlock your.rom -O your.rom

You can find ifdtool under elf/coreboot/ in the build system, when doing something like:

./mk -d coreboot yourboard

This builds util binaries from the corresponding source tree. A future release of RBoot could make use of Intel Protected Range registers, with a toggle in the EDK2 setup menu, but this has not yet been done.

If you’re running one of these with Lenovo BIOS, you must externally flash RBoot, because the original firmware restricts writes to the flash.

There machines all use SOIC8/SOIC16 flash ICs. Refer to pages specifically for each machine:

• ThinkPad X200
• ThinkPad T400
• ThinkPad R400
• ThinkPad T500/W500 (R500 is similar)

NOTE: T400S, X200S and X200 Tablet require different steps, because these have WSON8 flash ICs on them, which will require some soldering. Please read the external flashing guide in the section pertaining to WSON.

You can find WSON8 probes online, that are similar to a SOIC8/SOIC16 clip. Your mileage may very, but WSON8 has the same pinout as SOIC8 so you might have some luck with that.

Hot-swap the flash IC with another one while it’s running, and flash it internally.

T420/T520: T420 flash instructions

T420s/T520 are similar, in terms of assembly/disassembly.

Now, as for X220/X220 Tablet:

X220/X220 Tablet is essentially the same as the X230, but cannot be flashed internally; you must use an external flasher.

Otherwise, look at X230 disassembly. Note that the X220 has a single 8MB flash, instead of 8MB and 4MB.

Internal flashing from vendor BIOS to RBoot is possible, but not recommended. See: IvyBridge ThinkPad internal flashing.

External flashing recommended, but only documented for X230. See: ThinkPad X230 install guide.

Otherwise, refer to external SPI flashing.

See: Chromebook flashing instructions

NOTE: The generic flashing instructions (later on this page) apply only to the x86 machines, because the Chromebooks still use flashrom with the -p host argument instead of -p internal when flashing, and you typically need to flash externally, due to Google’s security model.

RBoot can be used on QEMU (virtual machine), which is useful for debugging payloads and generally trying out RBoot, without requiring real hardware.

See: RBoot QEMU guide

The RBoot version of this page is: https://rboot.org/docs/install/

SPDX-License-Identifier: GFDL-1.3-or-later

Markdown file for this page: https://rboot.org/docs/install/index.md

Site map

This HTML page was generated by the Rboot Static Site Generator.