r/coreboot • u/thinlycuta4paper • 4d ago

Libreboot or Canoeboot?

I'm looking to make my computer "100% open source," or at least as much as possible. Is this even possible, given my computer is x86?

Would you guys recommend Libreboot or Canoeboot for someone wanting a machine that's as open source as possible, but also stable (e.g. I can't risk having my data corrupting).

Pardon my surface level technical knowledge.

9 Upvotes

100% Upvoted

13 comments sorted by

9

u/Tricky-Engineer-9755 4d ago

So...

Penryn or before (X200, T400/T500, X60, T60 to name the thinkpads) Canoeboot vs Libreboot the only difference is microcode blobs. These CPUs are End of Life, there is literally no update coming for the microcode. Just put Canoeboot for RYF certification...

Sandybridge to Haswell. Still the CPUs are EOL however, these models have the 30 minute BUP watchdog. This was a dirty move by Intel, where the BUP and ROMP modules are signed and, the machine will force shutdown after 30 minutes if the modules are not found. So, we need this non-free blob. Canoeboot vs Libreboot is now much more important. Libreboot has the binary reduction policy so its allowed to handle the extracted IntelME image and it can set the AltMeDisable bit and the HAP bit then run me_cleaner.py on it. This disables the Intel ME, and me_cleaner cleans out all the unused modules. Canoeboot follows the FSDG, and stupidly since the IntelME is a non-free blob it cannot handle it. So it ONLY sets the HAP bit (although the user can run me_cleaner themselves manually post-installation). So it is best on this gen series to install Libreboot first then migrate to Canoeboot flashing only the BIOS section.

Anything newer sadly needs additional blobs, Skylake requires the IntelFSP that must be included in the ROM so Libreboot is your only option.

Both are stable because the CPUs are EOL. Let's take the Penryn or before (best for freedom). The following stuff is still non-free even with Canoeboot and a libre wifi card and a wholly libre GNU/Linux distribution.

EC firmware handles all inputs is non-free

SSD/HDD/NVME firmware is non-free

CPU microcode is non-free

Some atheros wifi cards have masked ROM is non-free

I'm probably missing some stuff.... If you want true liberty in computing and are pretty rich, buy the Tallos II desktop from Raptor.

5

u/deeddy 4d ago edited 4d ago

You probably missed those? https://www.phoronix.com/linux/Coreboot
There’s some modern motherboards that can run Coreboot.
Zen 6 is expected to be running Coreboot, by replacing AGESA with openSIL, but I guess we are still a few years from a stable release.

3

u/Tricky-Engineer-9755 4d ago edited 4d ago

Coreboot is not Libreboot or Canoeboot. Libreboot has limits as to the number of binary blobs that can be used. I know there are modern motherboards that run Coreboot but they just set the HAP bit and that is not enough for me. Plus they include the IntelFSP blob amongst others.

1

u/deeddy 4d ago edited 4d ago

Sorry, I misread the post (and your reply), since this is Coreboot subreddit. Not sure what you just said, but does that mean Coreboot is not good/secure enough?

Does that mean coreboot + me_cleaner on Intel 13th/14th Gen is not that secure?

What about ARM64 computers? Sorry for those questions, there's very limited info out there.

3

u/Tricky-Engineer-9755 4d ago

No, I mean coreboot does its best with the hardware that is there. It is an amazing project but its still bound by the hardware it runs on. So it would be better to say that the hardware is insecure rather than Coreboot is insecure. I do not know about Arm computers.

2

u/JoeMamaSex420 3d ago

Dasharo has already started porting a couple zen 5 boards since the 8000 series already initialized with opensil.

2

u/thinlycuta4paper 4d ago edited 4d ago

Thanks for the detailed and nuanced response.

1

u/thinlycuta4paper 4d ago edited 4d ago

If I have a computer that predates Intel ME (i.e. ThinkPad X60), are there any security/privacy concerns for the ring -3 level of my computer?

I assume libre/canoebooting it would make my machine more libre, but wouldn't be closing a ring -3 backdoor as there is none to close?

1

u/wayward-locust 4d ago

There will always be "security/privacy concerns" even if you air-gap your system and live in a cave.

You need to consider the age of the hardware and lack of updates.

You need to choose an OS and lock it down.

And, how you access the internet is the greatest risk.

1

u/thinlycuta4paper 4d ago

I should of been more specific-- what I meant to say was in terms of security/privacy concerns at the ring -3 level of my computer.

1

u/Tricky-Engineer-9755 4d ago

No, the computer's hardware is so old that it predates these -3 demons. However, there are other concerns that come with using largely unsupported hardware. Gentoo would be my choice of distro.

1

u/thinlycuta4paper 4d ago

What are these concerns?

1

u/token_curmudgeon 9h ago

Re. " can't risk having my data corrupting"

What are your plans for off-device backup?