code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Installing Parabola GNU/Linux with full disk encryption (including /boot)</title>

Installing Parabola GNU/Linux with full disk encryption (including /boot)

				Libreboot uses the GRUB payload
				by default, which means that the GRUB configuration file
				(where your GRUB menu comes from) is stored directly alongside libreboot
				and it's GRUB payload executable, inside
				the flash chip. In context, this means that installing distributions and managing them
				is handled slightly differently compared to traditional BIOS systems.

				On most systems, the /boot partition has to be left unencrypted while the others are encrypted.
				This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware
				can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a
				payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical
				access to the system.

				Back to previous index

			Boot Parabola's install environment. How to boot a GNU/Linux installer.

			For this guide I used the 2015 08 01 image to boot the live installer and install the system.
			This is available at this page.

			This guide will go through the installation steps taken at the time of writing, which may or may not change due to
			the volatile nature of Parabola (it changes all the time). In general most of it should remain the same. If you spot mistakes,
			please say so! This guide will be ported to the Parabola wiki at a later date. For up to date Parabola install guide, go to
			the Parabola wiki. This guide essentially cherry picks the useful information (valid at the
			time of writing: 2015-08-25).

	This section deals with wiping the storage device on which you plan to install Parabola
			GNU/Linux. Follow these steps, but if you use an SSD, also:

			- beware there are issues with TRIM (not enabled through luks) and security issues if you do enable it.
			See this page
			for more info.

	- make sure it's brand-new (or barely used). Or, otherwise, be sure that it never previously contained plaintext copies of your data.

	- make sure to read this article. Edit /etc/fstab later on when
			chrooted into your install. Also, read the whole article and keep all points in mind, adapting them for this guide.

			Wipe the MBR (if you use MBR):

			# lsblk

			Your storage is probably /dev/sda, but be very sure to double check this or you WILL lose your data!

			# dd if=/dev/zero of=/dev/sda bs=446 count=1; sync

			Never use SeaBIOS! The MBR section can easily be changed with malicious code, which SeaBIOS will blindly execute.
			This guide is for libreboot with GRUB-as-payload only.

			Securely wipe the drive:

			# dd if=/dev/urandom of=/dev/sda; sync

			NOTE: If you have an SSD, only do this the first time. If it was already LUKS-encrypted before,
			use the info below to wipe the LUKS header. Also, check online for your SSD what the recommended
			erase block size is. For example if it was 2MiB:

			# dd if=/dev/urandom of=/dev/sda bs=2M; sync

			If your drive was already LUKS encrypted (maybe you are re-installing your distro) then
			it is already 'wiped'. You should just wipe the LUKS header.
			https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/
			showed me how to do this. It recommends doing the first 3MiB. Now, that guide is recommending putting zero there. I'm going to use urandom. Do this:

			# head -c 3145728 /dev/urandom > /dev/sda; sync

			(Wiping the LUKS header is important, since it has hashed passphrases and so on. It's 'secure', but 'potentially' a risk).

			Change keyboard layout

				Parabola live shell assumes US Qwerty. If you have something different, list the available keymaps and use yours:

				# localectl list-keymaps

				# loadkeys LAYOUT

				For me, LAYOUT would have been dvorak-uk.

Establish an internet connection

				Refer to this guide. Wired is recommended,
				but wireless is also explained there.

Getting started

				The beginning is based on https://wiki.parabolagnulinux.org/Installation_Guide.
				Then I referred to https://wiki.archlinux.org/index.php/Partitioning at first.

dm-mod

				device-mapper will be used - a lot. Make sure that the kernel module is loaded:

				# modprobe dm-mod

Create LUKS partition

				I am using MBR partitioning, so I use cfdisk:

				# cfdisk /dev/sda

				I create a single large sda1 filling the whole drive, leaving it as the default type 'Linux' (83).

				Now I refer to https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning:

				I am then directed to https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption.

				Parabola forces you to RTFM. Do that.

				It tells me to run:

				# cryptsetup benchmark (for making sure the list below is populated)

				Then:

				# cat /proc/crypto

				This gives me crypto options that I can use. It also provides a representation of the best way to set up LUKS (in this case, security is a priority; speed, a distant second).
				To gain a better understanding, I am also reading:

				# man cryptsetup

				Following that page, based on my requirements, I do the following based on https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode.
				Reading through, it seems like Serpent (encryption) and Whirlpool (hash) is the best option.

				I am initializing LUKS with the following:

				# cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool --use-random --verify-passphrase luksFormat /dev/sda1
				Choose a secure passphrase here. Ideally lots of lowercase/uppercase numbers, letters, symbols etc all in a random pattern. The
				password length should be as long as you are able to handle without writing it down or storing it anywhere.

Create LVM

				Now I refer to https://wiki.archlinux.org/index.php/LVM.

				Open the LUKS partition:

				# cryptsetup luksOpen /dev/sda1 lvm

				(it will be available at /dev/mapper/lvm)

				Create LVM partition:

				# pvcreate /dev/mapper/lvm

				Show that you just created it:

				# pvdisplay

				Now I create the volume group, inside of which the logical volumes will be created:

				# vgcreate matrix /dev/mapper/lvm

				(volume group name is 'matrix' - choose your own name, if you like)
				Show that you created it:

				# vgdisplay

				Now create the logical volumes:

				# lvcreate -L 2G matrix -n swapvol (2G swap partition, named swapvol)

				Again, choose your own name if you like. Also, make sure to choose a swap size of your own needs. It basically depends on how much RAM
				you have installed. I refer to http://www.linux.com/news/software/applications/8208-all-about-linux-swap-space.

				# lvcreate -l +100%FREE matrix -n rootvol (single large partition in the rest of the space, named rootvol)

				You can also be flexible here, for example you can specify a /boot, a /, a /home, a /var, a /usr, etc. For example,
				if you will be running a web/mail server then you want /var in its own partition (so that if it fills up with logs, it won't crash your system).
				For a home/laptop system (typical use case), a root and a swap will do (really).

				Verify that the logical volumes were created, using the following command:

				# lvdisplay

Create / and swap partitions, and mount

				For the swapvol LV I use:

				# mkswap /dev/mapper/matrix-swapvol

				Activate swap:

				# swapon /dev/matrix/swapvol

				For the rootvol LV I use:

				# mkfs.ext4 /dev/mapper/matrix-rootvol

				Mount the root (/) partition:

				# mount /dev/matrix/rootvol /mnt

Continue with Parabola installation

				This guide is really about GRUB, Parabola and cryptomount. I have to show how to install Parabola
				so that the guide can continue.

				Now I am following the rest of https://wiki.parabolagnulinux.org/Installation_Guide.
				I also cross referenced https://wiki.archlinux.org/index.php/Installation_guide.

				Create /home and /boot on rootvol mountpoint:

				# mkdir -p /mnt/home

				# mkdir -p /mnt/boot

				Once all the remaining partitions, if any, have been mounted, the devices are ready to install Parabola.

				In /etc/pacman.d/mirrorlist, comment out all lines except the Server line closest to where you are (I chose the UK Parabola
				server (main server)) and then did:

				# pacman -Syy

				# pacman -Syu

				# pacman -Sy pacman (and then I did the other 2 steps above, again)

				In my case I did the steps in the next paragraph, and followed the steps in this paragraph again.

				<troubleshooting>

					   The following is based on 'Verification of package signatures' in the Parabola install guide.

					   Check there first to see if steps differ by now.

					   Now you have to update the default Parabola keyring. This is used for signing and verifying packages:

					   # pacman -Sy parabola-keyring

					   It says that if you get GPG errors, then it's probably an expired key and, therefore, you should do:

					   # pacman-key --populate parabola

					   # pacman-key --refresh-keys

					   # pacman -Sy parabola-keyring

					   To be honest, you should do the above anyway. Parabola has a lot of maintainers, and a lot of keys. Really!

					   If you get an error mentioning dirmngr, do:

					   # dirmngr </dev/null

					   Also, it says that if the clock is set incorrectly then you have to manually set the correct time

					   (if keys are listed as expired because of it):

					   # date MMDDhhmm[[CC]YY][.ss]

					   I also had to install:

					   # pacman -S archlinux-keyring

					   # pacman-key --populate archlinux

					   In my case I saw some conflicting files reported in pacman, stopping me from using it.

					   I deleted the files that it mentioned
					and then it worked. Specifically, I had this error:

					   licenses: /usr/share/licenses/common/MPS exists in filesystem

					   I rm -Rf'd the file and then pacman worked. I'm told that the following would have also made it work:

					   # pacman -Sf licenses

				</troubleshooting>

				I also like to install other packages (base-devel, compilers and so on) and wpa_supplicant/dialog/iw/wpa_actiond are needed for wireless after the install:

				# pacstrap /mnt base base-devel wpa_supplicant dialog iw wpa_actiond

Configure the system

				Generate an fstab - UUIDs are used because they have certain advantages (see https://wiki.parabola.nu/Fstab#Identifying_filesystems.
				If you prefer labels instead, replace the -U option with -L):

				# genfstab -U -p /mnt >> /mnt/etc/fstab

				Check the created file:

				# cat /mnt/etc/fstab

				(If there are any errors, edit the file. Do NOT run the genfstab command again!)

				Chroot into new system:

				# arch-chroot /mnt /bin/bash

				It's a good idea to have this installed:

				# pacman -S linux-libre-lts

				It was also suggested that you should install this kernel (read up on what GRSEC is):

				# pacman -S linux-libre-grsec

				This is another kernel that sits inside /boot, which you can use. LTS means 'long-term support'. These are so-called 'stable' kernels
				that can be used as a fallback during updates, if a bad kernel causes issues for you.

				Parabola does not have wget. This is sinister. Install it:

				# pacman -S wget

				Locale:

				# nano /etc/locale.gen

				Uncomment your needed localisations. For example en_GB.UTF-8 (UTF-8 is highly recommended over other options).

				# locale-gen

				# echo LANG=en_GB.UTF-8 > /etc/locale.conf

				# export LANG=en_GB.UTF-8

				Console font and keymap:

				# nano /etc/vconsole.conf

				In my case:

KEYMAP=dvorak-uk
FONT=Lat9w-16

				Time zone:

				# ln -s /usr/share/zoneinfo/Europe/London /etc/localtime

				(Replace Zone and Subzone to your liking. See /usr/share/zoneinfo)

				Hardware clock:

				# hwclock --systohc --utc

				Hostname:
				Write your hostname to /etc/hostname. For example, if your hostname is parabola:

				# echo parabola > /etc/hostname

				Add the same hostname to /etc/hosts:

				# nano /etc/hosts

#<ip-address>	<hostname.domain.org>	<hostname>
127.0.0.1	localhost.localdomain	localhost	parabola
::1		localhost.localdomain	localhost	parabola

	Configure the network:
				Refer to https://wiki.parabola.nu/Beginners%27_guide#Configure_the_network.

	Mkinitcpio:
				Configure /etc/mkinitcpio.conf as needed (see https://wiki.parabola.nu/Mkinitcpio).
				Runtime modules can be found in /usr/lib/initcpio/hooks, and build hooks can be found in /usr/lib/initcpio/install. (# mkinitcpio -H hookname gives information about each hook.)
				Specifically, for this use case:

				# nano /etc/mkinitcpio.conf

				Then modify the file like so:

MODULES="i915"

This forces the driver to load earlier, so that the console font isn't wiped out after getting to login)

HOOKS="base udev autodetect modconf block keyboard keymap consolefont encrypt lvm2 filesystems fsck shutdown"

Explanation:

keymap adds to initramfs the keymap that you specified in /etc/vconsole.conf

consolefont adds to initramfs the font that you specified in /etc/vconsole.conf

encrypt adds LUKS support to the initramfs - needed to unlock your disks at boot time

lvm2 adds LVM support to the initramfs - needed to mount the LVM partitions at boot time

shutdown is needed according to Parabola wiki for unmounting devices (such as LUKS/LVM) during shutdown)

				Now using mkinitcpio, you can create the kernel and ramdisk for booting with (this is different from Arch, specifying linux-libre instead of linux):

				# mkinitcpio -p linux-libre

				Also do it for linux-libre-lts:

				# mkinitcpio -p linux-libre-lts

				Also do it for linux-libre-grsec:

				# mkinitcpio -p linux-libre-grsec

				Set the root password:
				At the time of writing, Parabola used SHA512 by default for its password hashing. I referred to https://wiki.archlinux.org/index.php/SHA_password_hashes.

				# nano /etc/pam.d/passwd

				Add rounds=65536 at the end of the uncommented 'password' line.

				# passwd root

				Make sure to set a secure password! Also, it must never be the same as your LUKS password.

Extra security tweaks

				Based on https://wiki.archlinux.org/index.php/Security.

				Restrict access to important directories:

				# chmod 700 /boot /etc/{iptables,arptables}

				Lockout user after three failed login attempts:

				Edit the file /etc/pam.d/system-login and comment out that line:

				# auth required pam_tally.so onerr=succeed file=/var/log/faillog

				Or just delete it. Above it, put:

				auth required pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog

				To unlock a user manually (if a password attempt is failed 3 times), do:

				# pam_tally --user theusername --reset
				What the above configuration does is lock the user out for 10 minutes, if they make 3 failed login attempts.

				Configure sudo - not covered here. Will be covered post-installation in another tutorial, at a later date.
				If this is a single-user system, you don't really need sudo.

Unmount, reboot!

				Exit from chroot:

				# exit

				unmount:

				# umount -R /mnt

				# swapoff -a

				deactivate the lvm lv's:

				# lvchange -an /dev/matrix/rootvol

				# lvchange -an /dev/matrix/swapvol

				Lock the encrypted partition (close it):

				# cryptsetup luksClose lvm

				# shutdown -h now

				Remove the installation media, then boot up again.

Booting from GRUB

				Initially you will have to boot manually. Press C to get to the GRUB command line. The underlined parts are optional
				(using those 2 underlines will boot lts kernel instead of normal).

				grub> cryptomount -a

				grub> set root='lvm/matrix-rootvol'

				grub> linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root

				grub> initrd /boot/initramfs-linux-libre-lts.img

				grub> boot

				You could also make it load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img

Follow-up tutorial: configuring Parabola

				We will modify grub.config inside the ROM and do all kinds of fun stuff, but I recommend that you first transform the current bare-bones Parabola install into a more useable system.
				Doing so will make the upcoming ROM modifications MUCH easier to perform and less risky!
				configuring_parabola.html shows my own notes post-installation. Using these, you can get a basic
				system similar to the one that I chose for myself. You can also cherry pick useful notes and come up with your own system.
				Parabola is user-centric, which means that you are in control. For more information, read The Arch Way
				(Parabola also follows it).

Modify grub.cfg inside the ROM

				(Re-)log in to your system, pressing C, so booting manually from GRUB (see above). You need to modify the ROM, so that Parabola can boot automatically with this configuration.
				grub_cbfs.html shows you how. Follow that guide, using the configuration details below.
				If you go for option 2 (re-flash), promise to do this on grubtest.cfg first! We can't emphasise this enough. This is to reduce the possibility of bricking your device!

				I will go for the re-flash option here. Firstly, cd to the libreboot_util/cbfstool/{armv7l i686 x86_64} directory.
				Dump the current firmware - where libreboot.rom is an example: make sure to adapt:

            # flashrom -p internal -r libreboot.rom

            If flashrom complains about multiple flash chips detected, add a -c option at the end, with the name of your chosen chip is quotes.

				You can check if everything is in there (grub.cfg and grubtest.cfg would be really nice):

				$ ./cbfstool libreboot.rom print

				Extract grubtest.cfg:

				$ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg

				And modify:

				$ nano grubtest.cfg

				In grubtest.cfg, inside the 'Load Operating System' menu entry, change the contents to:

cryptomount -a

set root='lvm/matrix-rootvol'

linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root

initrd /boot/initramfs-linux-libre-lts.img

				Note: the underlined parts above (-lts) can also be removed, to boot the latest kernel instead of LTS (long-term support) kernels.
				You could also copy the menu entry and in one have -lts, and without in the other menuentry.
				You could also create a menu entry to load /boot/vmlinuz-linux-libre-grsec and /boot/initramfs-linux-libre-grsec.img
				The first entry will load by default.

				Without specifying a device, the -a parameter tries to unlock all detected LUKS volumes.
				You can also specify -u UUID or -a (device).

				Now, to protect your system from an attacker simply booting a live usb distro and re-flashing the boot firmware, we are going to add a password for GRUB.
				In a new terminal window, if you are not yet online, start dhcp on ethernet:

				# systemctl start dhcpcd.service
				Or make sure to get connected to the internet in any other way you prefer, at least.

				AGAIN: MAKE SURE TO DO THIS WHOLE SECTION ON grubtest.cfg *BEFORE* DOING IT ON grub.cfg.
				(When we get there, upon reboot, select the menu entry that says Switch to grubtest.cfg and test that it works.
				Only once you are satisfied, copy that to grub.cfg. Only a few steps to go, though.)
				WHY? BECAUSE AN INCORRECTLY SET PASSWORD CONFIG MEANS YOU CAN'T AUTHENTICATE, WHICH MEANS 'BRICK'.

				(emphasis added, because it's needed: this is a common roadblock for users.)

				We need a utility that comes with GRUB, so we will download it temporarily. (Remember that GRUB isn't needed for booting, since it's already included as a payload in libreboot.)
				Also, we will use flashrom, and I installed dmidecode. You only need base-devel (compilers and so on) to build and use cbfstool. It was already installed if you followed this tutorial, but here
				it is:

				# pacman -S grub flashrom dmidecode base-devel

				Next, do:

				# grub-mkpasswd-pbkdf2

				Enter your chosen password at the prompt and your hash will be shown. Copy this string - you will add it to your grubtest.cfg.

				The password below (it's password, by the way) after 'password_pbkdf2 root' should be changed to your own.
				Make sure to specify a password that is different from both your LUKS *and* your root/user password.
				Obviously, do not simply copy and paste the examples shown here...

				Next, back in grubtest.cfg, above the first 'Load Operating System' menu entry, you should now add your GRUB password, like so
				(replace with your own name (I used root on both lines, feel free to choose another one) and the password hash which you copied):

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711

				Save your changes in grubtest.cfg, then delete the unmodified config from the ROM image:

				$ ./cbfstool libreboot.rom remove -n grubtest.cfg

				and insert the modified grubtest.cfg:

				$ ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t raw

				Now refer to http://libreboot.org/docs/install/index.html#flashrom.
				Cd (up) to the libreboot_util directory and update the flash chip contents:

				# ./flash update libreboot.rom

				Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command:

				# ./flash forceupdate libreboot.rom

				You should see "Verifying flash... VERIFIED." written at the end of the flashrom output.

				With this new configuration, Parabola can boot automatically and you will have to enter a password at boot time, in GRUB, before being able to use any of the menu entries or switch to the terminal.
				Let's test it out: reboot and choose grubtest.cfg from the GRUB menu, using the arrow keys on your keyboard.
				Enter the name you chose, the GRUB password, your LUKS passphrase and login as root/your user. All went well? Great!

				If it does not work like you want it to, if you are unsure or sceptical in any way, don't despair: you have been wise and did not brick your device! Reboot and login the default way, and then modify
				your grubtest.cfg until you get it right!
				Do *not* proceed past this point unless you are 100% sure that your new configuration is safe (or desirable) to use.

				Now, we can easily and safely create a copy of grubtest.cfg, called grub.cfg. This will be the same except for one difference: the menuentry 'Switch to grub.cfg' is changed to 'Switch to grubtest.cfg'
				and, inside it, all instances of grub.cfg to grubtest.cfg. This is so that the main config still links (in the menu) to grubtest.cfg, so that you don't have to manually switch to it, in case you ever
				want to follow this guide again in the future (modifying the already modified config).
				Inside libreboot_util/cbfstool/{armv7l i686 x86_64}, we can do this with the following command:

				$ sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg

				Delete the grub.cfg that remained inside the ROM:

				$ ./cbfstool libreboot.rom remove -n grub.cfg

				Add the modified version that you just made:

				$ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw

				Now you have a modified ROM. Once more, refer to http://libreboot.org/docs/install/index.html#flashrom.
                                Cd to the libreboot_util directory and update the flash chip contents:

                                # ./flash update libreboot.rom

				And wait for the "Verifying flash... VERIFIED." Once you have done that, shut down and then boot up with your new configuration.

				When done, delete GRUB (remember, we only needed it for the grub-mkpasswd-pbkdf2 utility;
				GRUB is already part of libreboot, flashed alongside it as a payload):

				# pacman -R grub

			If you followed all that correctly, you should now have a fully encrypted Parabola installation.
			Refer to the wiki for how to do the rest.

Bonus: Using a key file to unlock /boot/

			By default, you will have to enter your LUKS passphrase twice; once in GRUB, and once when booting the kernel.
			GRUB unlocks the encrypted partition and then loads the kernel, but the kernel is not aware of the fact
			that it is being loaded from an encrypted volume. Therefore, you will be asked to enter your passphrase a second time.
			A workaround is to put a keyfile inside initramfs, with instructions for the kernel to use it when
			booting. This is safe, because /boot/ is encrypted (otherwise, putting a keyfile inside initramfs would be a bad idea).

			Boot up and login as root or your user. Then generate the key file:

			# dd bs=512 count=4 if=/dev/urandom of=/etc/mykeyfile iflag=fullblock

			Insert it into the luks volume:

			# cryptsetup luksAddKey /dev/sdX /etc/mykeyfile

			and enter your LUKS passphrase when prompted.
			Add the keyfile to the initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example:

			# FILES="/etc/mykeyfile"

			Create the initramfs image from scratch:

			# mkinitcpio -p linux-libre

			# mkinitcpio -p linux-libre-lts

			# mkinitcpio -p linux-libre-grsec

			Add the following to your grub.cfg - you are now able to do that, see above! -, or add it in the kernel command line for GRUB:

			# cryptkey=rootfs:/etc/mykeyfile

			You can also place this inside the grub.cfg that exists in CBFS: grub_cbfs.html.

Further security tips

				https://wiki.archlinux.org/index.php/Security.

				https://wiki.parabolagnulinux.org/User:GNUtoo/laptop

Troubleshooting

				A user reported issues when booting with a docking station attached
				on an X200, when decrypting the disk in GRUB. The error
				AHCI transfer timed out was observed. The workaround
				was to remove the docking station.

				Further investigation revealed that it was the DVD drive causing problems.
				Removing that worked around the issue.

"sudo wodim -prcap" shows information about the drive:
Device was not specified. Trying to find an appropriate drive...
Detected CD-R drive: /dev/sr0
Using /dev/cdrom of unknown capabilities
Device type    : Removable CD-ROM
Version        : 5
Response Format: 2
Capabilities   :
Vendor_info    : 'HL-DT-ST'
Identification : 'DVDRAM GU10N    '
Revision       : 'MX05'
Device seems to be: Generic mmc2 DVD-R/DVD-RW.

Drive capabilities, per MMC-3 page 2A:

  Does read CD-R media
  Does write CD-R media
  Does read CD-RW media
  Does write CD-RW media
  Does read DVD-ROM media
  Does read DVD-R media
  Does write DVD-R media
  Does read DVD-RAM media
  Does write DVD-RAM media
  Does support test writing

  Does read Mode 2 Form 1 blocks
  Does read Mode 2 Form 2 blocks
  Does read digital audio blocks
  Does restart non-streamed digital audio reads accurately
  Does support Buffer-Underrun-Free recording
  Does read multi-session CDs
  Does read fixed-packet CD media using Method 2
  Does not read CD bar code
  Does not read R-W subcode information
  Does read raw P-W subcode data from lead in
  Does return CD media catalog number
  Does return CD ISRC information
  Does support C2 error pointers
  Does not deliver composite A/V data

  Does play audio CDs
  Number of volume control levels: 256
  Does support individual volume control setting for each channel
  Does support independent mute setting for each channel
  Does not support digital output on port 1
  Does not support digital output on port 2

  Loading mechanism type: tray
  Does support ejection of CD via START/STOP command
  Does not lock media on power up via prevent jumper
  Does allow media to be locked in the drive via PREVENT/ALLOW command
  Is not currently in a media-locked state
  Does not support changing side of disk
  Does not have load-empty-slot-in-changer feature
  Does not support Individual Disk Present feature

  Maximum read  speed:  4234 kB/s (CD  24x, DVD  3x)
  Current read  speed:  4234 kB/s (CD  24x, DVD  3x)
  Maximum write speed:  4234 kB/s (CD  24x, DVD  3x)
  Current write speed:  4234 kB/s (CD  24x, DVD  3x)
  Rotational control selected: CLV/PCAV
  Buffer size in KB: 1024
  Copy management revision supported: 1
  Number of supported write speeds: 4
  Write speed # 0:  4234 kB/s CLV/PCAV (CD  24x, DVD  3x)
  Write speed # 1:  2822 kB/s CLV/PCAV (CD  16x, DVD  2x)
  Write speed # 2:  1764 kB/s CLV/PCAV (CD  10x, DVD  1x)
  Write speed # 3:   706 kB/s CLV/PCAV (CD   4x, DVD  0x)

Supported CD-RW media types according to MMC-4 feature 0x37:
  Does write multi speed       CD-RW media
  Does write high  speed       CD-RW media
  Does write ultra high speed  CD-RW media
  Does not write ultra high speed+ CD-RW media

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Copyright ©  2015 Jeroen Quint <jezza@diplomail.ch>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Installing Trisquel GNU/Linux with full disk encryption (including /boot)</title>

Installing Trisquel GNU/Linux with full disk encryption (including /boot)

				Libreboot uses the GRUB payload
				by default, which means that the GRUB configuration file
				(where your GRUB menu comes from) is stored directly alongside libreboot
				and its GRUB payload executable, inside
				the flash chip. In context, this means that installing distributions and managing them
				is handled slightly differently compared to traditional BIOS systems.

				On most systems, the /boot partition has to be left unencrypted while the others are encrypted.
				This is so that GRUB, and therefore the kernel, can be loaded and executed since the firmware
				can't open a LUKS volume. Not so with libreboot! Since GRUB is already included directly as a
				payload, even /boot can be encrypted. This protects /boot from tampering by someone with physical
				access to the system.

				This works in Trisquel 7, and probably Trisquel 6. Boot the 'net installer' (Install Trisquel in Text Mode).
				How to boot a GNU/Linux installer.

Back to previous index

			Set a strong user password (lots of lowercase/uppercase, numbers and symbols).

			when the installer asks you to set up
			encryption (ecryptfs) for your home directory, select 'Yes' if you want to: LUKS is already secure and performs well. Having ecryptfs on top of it
			will add noticeable performance penalty, for little security gain in most use cases. This is therefore optional, and not recommended.
			Choose 'no'.

				Your user password should be different from the LUKS password which you will set later on.
				Your LUKS password should, like the user password, be secure.

Partitioning

Choose 'Manual' partitioning:

Select drive and create new partition table

						Single large partition. The following are mostly defaults:

Use as: physical volume for encryption

Encryption: aes

key size: 256

IV algorithm: xts-plain64

Encryption key: passphrase

erase data: Yes (only choose 'No' if it's a new drive that doesn't contain your private data)

						Select 'configure encrypted volumes'

Create encrypted volumes

Select your partition

Finish

Really erase: Yes

(erase will take a long time. be patient)

(if your old system was encrypted, just let this run for about a minute to
							make sure that the LUKS header is wiped out)

						Select encrypted space:

use as: physical volume for LVM

Choose 'done setting up the partition'

						Configure the logical volume manager:

Keep settings: Yes

						Create volume group:

Name: grubcrypt (you can use whatever you want here, this is just an example)

Select crypto partition

						Create logical volume

select grubcrypt (or whatever you named it before)

name: trisquel (you can use whatever you want here, this is just an example)

size: default, minus 2048 MB

						Create logical volume

select grubcrypt (or whatever you named it before)

name: swap (you can use whatever you want here, this is just an example)

size: press enter

Further partitioning

				Now you are back at the main partitioning screen. You will simply set mountpoints and filesystems to use.

						LVM LV trisquel

use as: ext4

mount point: /

done setting up partition

						LVM LV swap

use as: swap area

done setting up partition

Now you select 'Finished partitioning and write changes to disk'.

Kernel

				Installation will ask what kernel you want to use. linux-generic is fine.

Tasksel

				Choose "Trisquel Desktop Environment" if you want GNOME,
				"Trisquel-mini Desktop Environment" if you
				want LXDE or "Triskel Desktop Environment" if you want KDE.
				If you want to have no desktop (just a basic shell)
				when you boot or if you want to create your own custom setup, then choose nothing here (don't select anything).
				You might also want to choose some of the other package groups; it's up to you.

Postfix configuration

				If asked, choose "No Configuration" here (or maybe you want to select something else. It's up to you.)

Install the GRUB boot loader to the master boot record

				Choose 'Yes'. It will fail, but don't worry. Then at the main menu, choose 'Continue without a bootloader'.
				You could also choose 'No'. Choice is irrelevant here.

				You do not need to install GRUB at all, since in libreboot you are using the GRUB payload (for libreboot) to boot your system directly.

Clock UTC

				Just say 'Yes'.

			Booting your system

				At this point, you will have finished the installation. At your GRUB payload, press C to get to the command line.

				Do that:

				grub> cryptomount -a

				grub> set root='lvm/grubcrypt-trisquel'

				grub> linux /vmlinuz root=/dev/mapper/grubcrypt-trisquel cryptdevice=/dev/mapper/grubcrypt-trisquel:root

				grub> initrd /initrd.img

				grub> boot

			ecryptfs

				If you didn't encrypt your home directory, then you can safely ignore this section.

				Immediately after logging in, do that:

				$ sudo ecryptfs-unwrap-passphrase

				This will be needed in the future if you ever need to recover your home directory from another system, so write it down and keep the note
				somewhere secret. Ideally, you should memorize it and then burn the note (or not even write it down, and memorize it still)>

			Modify grub.cfg (CBFS)

				Now you need to set it up so that the system will automatically boot, without having to type a bunch of commands.

				Modify your grub.cfg (in the firmware) using this tutorial;
				just change the default menu entry 'Load Operating System' to say this inside:

				cryptomount -a

				set root='lvm/grubcrypt-trisquel'

				linux /vmlinuz root=/dev/mapper/grubcrypt-trisquel cryptdevice=/dev/mapper/grubcrypt-trisquel:root

				initrd /initrd.img

				Without specifying a device, the -a parameter tries to unlock all detected LUKS volumes.
				You can also specify -u UUID or -a (device).

				Additionally, you should set a GRUB password. This is not your LUKS password, but it's a password that you have to enter to see
				GRUB. This protects your system from an attacker simply booting a live USB and re-flashing your firmware. This should be different than your LUKS passphrase and user password.

				The GRUB utility can be used like so:

				$ grub-mkpasswd-pbkdf2

				Give it a password (remember, it has to be secure) and it'll output something like:

				grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711

				Put that in the grub.cfg (the one for CBFS inside the ROM) before the 'Load Operating System' menu entry like so (example):

set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711

				MAKE SURE TO DO THIS ON grubtest.cfg *BEFORE* DOING IT ON grub.cfg.
				Then select the menu entry that says Switch to grubtest.cfg and test that it works.
				Then copy that to grub.cfg once you're satisfied.
				WHY? BECAUSE AN INCORRECTLY SET PASSWORD CONFIG MEANS YOU CAN'T AUTHENTICATE, WHICH MEANS 'BRICK'.

				(emphasis added, because it's needed. This is a common roadblock for users)

				Obviously, replace it with the correct hash that you actually got for the password that you entered. Meaning, not the hash that you see above!

				After this, you will have a modified ROM with the menu entry for cryptomount, and the entry before that for the GRUB password. Flash the modified ROM
				using this tutorial.

Troubleshooting

				A user reported issues when booting with a docking station attached
				on an X200, when decrypting the disk in GRUB. The error
				AHCI transfer timed out was observed. The workaround
				was to remove the docking station.

				Further investigation revealed that it was the DVD drive causing problems.
				Removing that worked around the issue.

"sudo wodim -prcap" shows information about the drive:
Device was not specified. Trying to find an appropriate drive...
Detected CD-R drive: /dev/sr0
Using /dev/cdrom of unknown capabilities
Device type    : Removable CD-ROM
Version        : 5
Response Format: 2
Capabilities   :
Vendor_info    : 'HL-DT-ST'
Identification : 'DVDRAM GU10N    '
Revision       : 'MX05'
Device seems to be: Generic mmc2 DVD-R/DVD-RW.

Drive capabilities, per MMC-3 page 2A:

  Does read CD-R media
  Does write CD-R media
  Does read CD-RW media
  Does write CD-RW media
  Does read DVD-ROM media
  Does read DVD-R media
  Does write DVD-R media
  Does read DVD-RAM media
  Does write DVD-RAM media
  Does support test writing

  Does read Mode 2 Form 1 blocks
  Does read Mode 2 Form 2 blocks
  Does read digital audio blocks
  Does restart non-streamed digital audio reads accurately
  Does support Buffer-Underrun-Free recording
  Does read multi-session CDs
  Does read fixed-packet CD media using Method 2
  Does not read CD bar code
  Does not read R-W subcode information
  Does read raw P-W subcode data from lead in
  Does return CD media catalog number
  Does return CD ISRC information
  Does support C2 error pointers
  Does not deliver composite A/V data

  Does play audio CDs
  Number of volume control levels: 256
  Does support individual volume control setting for each channel
  Does support independent mute setting for each channel
  Does not support digital output on port 1
  Does not support digital output on port 2

  Loading mechanism type: tray
  Does support ejection of CD via START/STOP command
  Does not lock media on power up via prevent jumper
  Does allow media to be locked in the drive via PREVENT/ALLOW command
  Is not currently in a media-locked state
  Does not support changing side of disk
  Does not have load-empty-slot-in-changer feature
  Does not support Individual Disk Present feature

  Maximum read  speed:  4234 kB/s (CD  24x, DVD  3x)
  Current read  speed:  4234 kB/s (CD  24x, DVD  3x)
  Maximum write speed:  4234 kB/s (CD  24x, DVD  3x)
  Current write speed:  4234 kB/s (CD  24x, DVD  3x)
  Rotational control selected: CLV/PCAV
  Buffer size in KB: 1024
  Copy management revision supported: 1
  Number of supported write speeds: 4
  Write speed # 0:  4234 kB/s CLV/PCAV (CD  24x, DVD  3x)
  Write speed # 1:  2822 kB/s CLV/PCAV (CD  16x, DVD  2x)
  Write speed # 2:  1764 kB/s CLV/PCAV (CD  10x, DVD  1x)
  Write speed # 3:   706 kB/s CLV/PCAV (CD   4x, DVD  0x)

Supported CD-RW media types according to MMC-4 feature 0x37:
  Does write multi speed       CD-RW media
  Does write high  speed       CD-RW media
  Does write ultra high speed  CD-RW media
  Does not write ultra high speed+ CD-RW media

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.

repo_name: Amlouden/libreboot

license: mit


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>How to install GNU/Linux on a libreboot system</title>

How to install GNU/Linux on a libreboot system

				This section relates to preparing, booting and installing a
				GNU/Linux distribution on your libreboot system, using nothing more than a USB flash drive (and dd).

Prepare the USB drive (in GNU/Linux)

Installing GNU/Linux with full disk encryption

GNU Guix System Distribution?

Trisquel net install?

Booting ISOLINUX images (automatic method)

Booting ISOLINUX images (manual method)

Troubleshooting

				Back to previous index

Prepare the USB drive (in GNU/Linux)

				Connect the USB drive. Check dmesg:

				$ dmesg

				Check lsblk to confirm which drive it is:

				$ lsblk

				Check that it wasn't automatically mounted. If it was, unmount it. For example:

				$ sudo umount /dev/sdX*

				# umount /dev/sdX*

				dmesg told you what device it is. Overwrite the drive, writing your distro ISO to it with dd. For example:

				$ sudo dd if=gnulinux.iso of=/dev/sdX bs=8M; sync

				# dd if=gnulinux.iso of=/dev/sdX bs=8M; sync

				You should now be able to boot the installer from your USB drive. Continue reading, for
				information about how to do that.

				Back to top of page.

Installing GNU/Linux with full disk encryption

Installing Trisquel GNU/Linux with full disk encryption (including /boot)

Installing Parabola GNU/Linux with full disk encryption (including /boot)

				Back to top of page.

GNU Guix System Distribution?

				The Guix installers uses the GRUB bootloader, unlike most GNU/Linux installers which will likely use ISOLINUX.

				To boot the Guix live USB install, select Search for GRUB configuration (grub.cfg) outside of CBFS from
				the GRUB payload menu. After you have done that, a new menuentry will appear at the very bottom with text like
				Load Config from (usb0); select that, and it should boot.

				Once you have installed Guix onto the main storage device, check
				grub_cbfs.html#option1_dont_reflash for hints on how
				to boot it.

				GuixSD (Guix System Distribution) is highly recommended; it's part of GNU, and
				endorsed by the Free Software Foundation.

				Back to top of page.

Trisquel net install?

				Tip: don't use the official net install image. Download the full GNOME ISO (the ~1.5GiB one).
				In this ISO, there is still the capability to boot the net install, while it also provides
				an easy to use live system (which you can boot from USB). This ISO also works using
				syslinux_configfile -i (the Parse ISOLINUX menu entries in the default
				GRUB configuration that libreboot uses).

				Back to top of page.

Booting ISOLINUX images (automatic method)

				Boot it in GRUB using the Parse ISOLINUX config (USB) option.

				A new menu should appear in GRUB, showing the boot options for that distro; this is a GRUB menu, converted from the usual
				ISOLINUX menu provided by that distro.

				Back to top of page.

Booting ISOLINUX images (manual method)

				These are generic instructions. They may or may not be correct for your
				distribution. You must adapt them appropriately, for whatever GNU/Linux distribution
				it is that you are trying to install.

				If the ISOLINUX parser or Search for GRUB configuration options won't work, then press C in GRUB to access the command line.

					grub> ls

				Get the device from above output, eg (usb0). Example:

					grub> cat (usb0)/isolinux/isolinux.cfg

				Either this will show the ISOLINUX menuentries for that ISO, or link to other .cfg files, for example /isolinux/foo.cfg.

				If it did that, then you do:

					grub> cat (usb0)/isolinux/foo.cfg

				And so on, until you find the correct menuentries for ISOLINUX.
				The file /isolinux/foo.cfg is a fictional example. Do not actually
				use this example, unless you actually have that file, if it is appropriate.

				For Trisquel (and other debian-based distros), there are typically menuentries listed in
				/isolinux/txt.cfg or /isolinux/gtk.cfg. For dual-architecture ISO images
				(i686 and x86_64), there may be separate files/directories for each architecture.
				Just keep searching through the image, until you find the correct ISOLINUX configuration file.

				Now look at the ISOLINUX menuentry. It'll look like:

					kernel /path/to/kernel

					append PARAMETERS initrd=/path/to/initrd MAYBE_MORE_PARAMETERS

				GRUB works the same way, but in it's own way. Example GRUB commands:

					grub> set root='usb0'

					grub> linux /path/to/kernel PARAMETERS MAYBE_MORE_PARAMETERS

					grub> initrd /path/to/initrd

					grub> boot

				Note: usb0 may be incorrect. Check the output of the ls command in GRUB,
				to see a list of USB devices/partitions.

				Of course this will vary from distro to distro. If you did all of that correctly, then it should now be booting your USB
				drive in the way that you specified.

				Back to top of page.

Troubleshooting

				Most of these issues occur when using libreboot with coreboot's 'text mode' instead of the coreboot framebuffer.
				This mode is useful for booting payloads like memtest86+ which expect text-mode, but for GNU/Linux distributions
				it can be problematic when they are trying to switch to a framebuffer because it doesn't exist.

				In most cases, you should use the vesafb ROM images. Example filename: libreboot_ukdvorak_vesafb.rom.

parabola won't boot in text-mode

					Use one of the ROM images with vesafb in the filename (uses coreboot framebuffer instead of text-mode).

debian-installer (trisquel net install) graphical corruption in text-mode

					When using the ROM images that use coreboot's "text mode" instead of the coreboot framebuffer,
					booting the Trisquel net installer results in graphical corruption because it is trying to switch to a framebuffer which doesn't
					exist. Use that kernel parameter on the 'linux' line when booting it:

					vga=normal fb=false

					Tested in Trisquel 6 (and 7). This forces debian-installer to start in text-mode, instead of trying to switch to a framebuffer.

					If selecting text-mode from a GRUB menu created using the ISOLINUX parser, you can press E on the menu entry to add this.
					Or, if you are booting manually (from GRUB terminal) then just add the parameters.

					This workaround was found on the page: https://www.debian.org/releases/stable/i386/ch05s04.html.
					It should also work for gNewSense, Debian and any other apt-get distro that provides debian-installer (text mode) net install method.

				Back to top of page.

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>How to replace the default GRUB configuration file on a libreboot system</title>

How to replace the default GRUB configuration file on a libreboot system

				Libreboot uses the GRUB payload
				by default, which means that the GRUB configuration file
				(where your GRUB menu comes from) is stored directly alongside libreboot
				and its GRUB payload executable, inside
				the flash chip. In context, this means that installing distributions and managing them
				is handled slightly differently compared to traditional BIOS systems.

				A libreboot (or coreboot) ROM image is not simply "flat"; there is an actual
				filesystem inside called CBFS (coreboot filesystem). A utility called 'cbfstool'
				allows you to change the contents of the ROM image. In this case, libreboot is configured
				such that the 'grub.cfg' and 'grubtest.cfg' files exist directly inside CBFS instead of
				inside the GRUB payload 'memdisk' (which is itself stored in CBFS).

				You can either modify
				the GRUB configuration stored in the flash chip, or you can modify a GRUB configuration
				file on the main storage which the libreboot GRUB payload will automatically search for.

				Here is an excellent writeup about CBFS (coreboot filesystem):
				http://lennartb.home.xs4all.nl/coreboot/col5.html.

				Back to previous index

Table of Contents

Introduction

1st option: don't re-flash

					2nd option: re-flash

Acquire the necessary utilities

Acquiring the correct ROM image

Extract grubtest from the ROM image

Re-insert the modified grubtest.cfg into the ROM image

Testing

Final steps

Introduction

				Download the latest release from
				http://libreboot.org/

If you downloaded from git, refer to
				../git/index.html#build_meta before continuing.

				Back to top of page.

				There are several advantages to modifying the GRUB configuration stored in CBFS, but
				this also means that you have to flash a new libreboot ROM image on your system (some users
				feel intimidated by this, to say the least).
				Doing so can be risky if not handled correctly, because it can result in a bricked
				system (recovery is easy if you have the equipment
				for it, but most people don't). If you aren't up to that then don't worry; it is possible
				to use a custom GRUB menu without flashing a new image, by loading a GRUB configuration
				from a partition on the main storage instead.

1st option: don't re-flash

				By default, GRUB in libreboot is configured to scan all partitions on the main storage
				for /boot/grub/libreboot_grub.cfg or /grub/libreboot_grub.cfg(for systems where /boot
				is on a dedicated partition), and then use it automatically.

				Simply create your custom GRUB configuration and save it to /boot/grub/libreboot_grub.cfg
				on the running system. The next time you boot, GRUB (in libreboot) will automatically switch to
				this configuration file. This means that you do not have to re-flash, recompile or otherwise
				modify libreboot at all!

				Ideally, your distribution should automatically generate a libreboot_grub.cfg file that is written
				specifically under the assumption that it will be read and used on a libreboot system that uses
				GRUB as a payload. If your distribution does not do this, then you can try to add that feature
				yourself or politely ask someone involved with or otherwise knowledgeable about the distribution
				to do it for you. The libreboot_grub.cfg could either contain the full configuration, or it could
				chainload another GRUB ELF executable (built to be used as a coreboot payload) that is located in
				a partition on the main storage.

				If you want to adapt a copy of the existing libreboot GRUB configuration and use that for the libreboot_grub.cfg file, then
				follow #tools, #rom and
				#extract_testconfig to get the grubtest.cfg.
				Rename grubtest.cfg to libreboot_grub.cfg and save it to /boot/grub/
				on the running system where it is intended to be used. Modify the file at that location however you see fit,
				and then stop reading this guide (the rest of this page is irrelevant to you); in libreboot_grub.cfg on disk,
				if you are adapting it based on grub.cfg from CBFS then remove the check for libreboot_grub.cfg otherwise it will loop..

				This is all well and good, but what should you actually put in your GRUB configuration file?
				Read grub_config.html for more information.

				Back to top of page.

2nd option: re-flash

				You can modify what is stored inside the flash chip quite easily. Read on to find out how.

				Back to top of page.

Acquire the necessary utilities

				Use cbfstool and flashrom. There are available in the libreboot_util release archive,
				or they can be compiled (see ../git/index.html#build_flashrom).
				Flashrom is also available from the repositories:

				# pacman -S flashrom

				Back to top of page.

Acquiring the correct ROM image

				You can either work directly with one of the ROM images already included in the libreboot ROM archives, or re-use the ROM that
				you have currently flashed. For the purpose of this tutorial it is assumed that your ROM image file is named libreboot.rom,
				so please make sure to adapt.

				ROM images are included pre-compiled in libreboot. You can also dump your current firmware, using flashrom:

				$ sudo flashrom -p internal -r libreboot.rom

				# flashrom -p internal -r libreboot.rom

				If you are told to specify the chip, add the option -c {your chip} to the command, for example:

				# flashrom -c MX25L6405 -p internal -r libreboot.rom

				Back to top of page.

Extract grubtest.cfg from the ROM image

				You can check the contents of the ROM image, inside CBFS:

				$ cd .../libreboot_util/cbfstool
				$ ./cbfstool libreboot.rom print

				The files grub.cfg and grubtest.cfg should be present. grub.cfg is loaded by default,
				with a menuentry for switching to grubtest.cfg. In this tutorial, you will first modify and test grubtest.cfg.
				This is to reduce the possibility of bricking your device, so DO NOT SKIP THIS!

				Extract grubtest.cfg from the ROM image:

				$ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg

				Modify the grubtest.cfg accordingly.

				This is all well and good, but what should you actually put in your GRUB configuration file?
				Read grub_config.html for more information.

				Back to top of page.

Re-insert the modified grubtest.cfg into the ROM image

				Once your grubtest.cfg is modified and saved, delete the unmodified config from the ROM image:

				$ ./cbfstool libreboot.rom remove -n grubtest.cfg

				Next, insert the modified version:

				$ ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t raw

				Back to top of page.

Testing

					Now you have a modified ROM. Refer back to ../install/index.html#flashrom for information
					on how to flash it.

					$ cd /libreboot_util
					# ./flash update libreboot.rom

					Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command:

					# ./flash forceupdate libreboot.rom

					You should see "Verifying flash... VERIFIED." written at the end of the flashrom output.
					Once you have done that, shut down and then boot up with your new test configuration.

				Choose (in GRUB) the menu entry that switches to grubtest.cfg. If it works, then your config is safe and you can continue below.

					If it does not work like you want it to, if you are unsure or sceptical in any way,
					then re-do the steps above until you get it right! Do *not* proceed past this point
					unless you are 100% sure that your new configuration is safe (or desirable) to use.

				Back to top of page.

Final steps

				When you are satisfied booting from grubtest.cfg, you can create a copy of grubtest.cfg, called grub.cfg. This is the same except for one difference:
				the menuentry 'Switch to grub.cfg' will be changed to 'Switch to grubtest.cfg' and inside it,
				all instances of grub.cfg to grubtest.cfg. This is so that the main config still
				links (in the menu) to grubtest.cfg, so that you don't have to manually switch to it, in
				case you ever want to follow this guide again in the future (modifying the already modified config). From /libreboot_util/cbfstool, do:

				$ sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg

				Delete the grub.cfg that remained inside the ROM:

				$ ./cbfstool libreboot.rom remove -n grub.cfg

				Add the modified version that you just made:

				$ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw

					Now you have a modified ROM. Again, refer back to ../install/index.html#flashrom for information
					on how to flash it. It's the same method as you used before. Shut down and then boot up with your new configuration.

				Back to top of page.

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Copyright ©  2015 Jeroen Quint <jezza@diplomail.ch>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Writing a GRUB configuration file</title>

Writing a GRUB configuration file

				Back to index

Table of Contents

					Example modifications for grubtest.cfg

Trisquel GNU/Linux-libre

Parabola GNU/Linux-libre

Example modifications for grubtest.cfg

			These are some common examples of ways in which the grubtest.cfg file can be modified.

Obvious option: don't even modify the built-in grub.cfg

					Use the menuentry that says something like Search for GRUB outside CBFS. Assuming that you
					have a grub.cfg file at /boot/grub/ in your installed distro, this will generate a new menuentry in
					the GRUB menu. Use that to boot.

					Then do this as root:

					$ cd /boot/grub/

					$ ln -s grub.cfg libreboot_grub.cfg

					After that, your system should then boot automatically.

Trisquel with full disk encryption, custom partition layout

					GRUB can boot from a symlink (or symlinks) pointing to your kernel/initramfs, whether from an unencrypted or encrypted /boot/. You
					can create your own custom symlink(s) but you have to manually update them when updating your kernel. This guide (not maintained by
					the libreboot project) shows how to configure Trisquel to automatically update that symlink on every kernel update.
					http://www.rel4tion.org/people/fr33domlover/libreboot-fix/

					TODO: adapt those notes and put them here. The author said that it was CC-0, so re-licensing under GFDL shouldn't be a problem.

Trisquel GNU/Linux-libre

						As an example, on my test system in /boot/grub/grub.cfg (on the HDD/SSD) I see for the main menu entry:

linux	/boot/vmlinuz-3.15.1-gnu.nonpae root=UUID=3a008e14-4871-497b-95e5-fb180f277951 ro   crashkernel=384M-2G:64M,2G-:128M quiet splash $vt_handoff

initrd	/boot/initrd.img-3.15.1-gnu.nonpae

						ro, quiet, splash, crashkernel=384M-2G:64M,2G-:128M and
						$vt_handoff can be safely ignored.

						I use this to get my partition layout:

						$ lsblk

						In my case, I have no /boot partition, instead /boot is on the same partition as / on sda1.
						Yours might be different. In GRUB terms, sda means ahci0. 1 means msdos1, or gpt1, depending
						on whether I am using MBR or GPT partitioning. Thus, /dev/sda1 is GRUB is (ahci0,msdos1) or
						(ahci0,gpt1). In my case, I use MBR partitioning so it's (ahci0,msdos1).
						'msdos' is a GRUB name simply because this partitioning type is traditionally used by MS-DOS.
						It doesn't mean that you have a proprietary OS.

						Trisquel doesn't keep the filenames of kernels consistent, instead it keeps old kernels and
						new kernel updates are provided with the version in the filename. This can make GRUB payload
						a bit tricky. Fortunately, there are symlinks /vmlinuz and /initrd.img
						so if your /boot and / are on the same partition, you can set GRUB to boot from that.
						These are also updated automatically when installing kernel updates from your distributions
						apt-get repositories.

							Note: when using jxself kernel releases,
							these are not updated at all and you have to update them manually.

						For the GRUB payload grubtest.cfg (in the 'Load Operating System' menu entry), we therefore have (in this example):

						set root='ahci0,msdos1'

						linux /vmlinuz root=UUID=3a008e14-4871-497b-95e5-fb180f277951

						initrd /initrd.img

						Optionally, you can convert the UUID to its real device name, for example /dev/sda1 in this case.
						sdX naming isn't very reliable, though, which is why UUID is used for most distributions.

						Alternatively, if your /boot is on a separate partition then you cannot rely on the /vmlinuz and /initrd.img symlinks.
						Instead, go into /boot and create your own symlinks (update them manually when you install a new kernel update).

						$ sudo -s (or su -)

						# cd /boot/

						# rm -f vmlinuz initrd.img

						# ln -s yourkernel ksym

						# ln -s yourinitrd isym

						# exit

						Then your grubtest.cfg menu entry (for payload) becomes like that, for example if / was on sda2 and /boot was on sda1:

						set root='ahci0,msdos1'

						linux /ksym root=/dev/sda2

						initrd /isym

						There are lots of possible variations so please try to adapt.

Parabola GNU/Linux-libre

					You can basically adapt the above. Note however that Parabola does not keep old kernels still installed, and the file names
					are always consistent, so you don't need to boot from symlinks, you can just use the real thing directly.

			Back to top of page.

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>GNU/Linux distributions</title>

GNU/Linux distributions

				This section relates to dealing with GNU/Linux distributions: preparing bootable USB drives,
				changing the default GRUB menu and so on.

				Back to previous index.

How to install GNU/Linux on a libreboot system

					How to replace the default GRUB configuration file on a libreboot system

Writing a GRUB configuration file

					Installing Parabola GNU/Linux-libre with full disk encryption (including /boot)

Follow-up tutorial: Configuring Parabola (post-install)

Installing Trisquel GNU/Linux-libre with full disk encryption (including /boot)

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>GRUB payload</title>

GRUB payload

				This section relates to the GRUB payload used in libreboot.

				Or Back to main index.

Changing the background image in GRUB

Setting font in GRUB

GRUB keyboard layouts

Custom keyboard layout in GRUB

UK Dvorak keyboard layout in GRUB

Changing the background image in GRUB

				Use cbfstool from libreboot_util, or libreboot_src/coreboot/util/cbfstool/ if you want to build from source.

				./cbfstool yourrom.rom remove background.png -n background.png

				./cbfstool yourrom.rom add -f background.png -n background.png -t raw

				When you've done this, re-flash your ROM and you should have a new background at boot time.

Setting font in GRUB (for reference)

You don't need to do this unless you would like to change the default font yourself.
			(this is just for reference. It has already been done for you)

The old font used was Unifont, and this had some missing characters: for instance, the border showed ??? characters instead of lines.

I tried DeJavu Sans Mono from this website:
			dejavu-fonts.org

Specifically, the version that I chose was the latest at the time of writing (Saturday 21 June 2014):
			this one

This is a free font that is also contained in GNU/Linux distributions like Trisquel or Parabola.

$ cd libreboot_src/grub

			compile grub (the build scripts info on how to do this)

			come back out into libreboot_src/resources/grub:

			$ cd ../libreboot_src/resources/grub/font

I took Dejavu Sans Mono from dejavu (included in this version of libreboot) and did:

			$ ../../../grub/grub-mkfont -o dejavusansmono.pf2 dejavu-fonts-ttf-2.34/ttf/DejaVuSansMono.ttf

I then added the instructions to 'gen.sh' script in grub-assemble to include resources/grub/dejavusansmono.pf2
			in all of the ROM images, at the root of the GRUB memdisk.

			I then added that instructions to the grub.cfg files (to load the font):

			loadfont (memdisk)/dejavusansmono.pf2

Back to top of page

GRUB keyboard layouts (for reference)

Custom keyboard layout in GRUB (for reference)

						Keymaps are stored in resources/utilities/grub-assemble/keymap/.

						Example (French Azerty):

						$ ckbcomp fr > frazerty

						Go in grub directory:

						cat frazerty | ./grub/grub-mklayout -o frazerty.gkb

						You must make sure that the files are named keymap and keymap.gkb (where 'keymap' can be whatever you want).

						Then from the above example, you would put frazerty in resources/utilities/grub-assemble/keymap/original/ and
						the frazerty.gkb file goes under resources/utilities/grub-assemble/keymap/

						The build scripts will automatically see this, and automatically build
						ROM images with your custom layout (given the name) and include them under bin. Example: libreboot_frazerty.rom.

Back to top of page

UK Dvorak keyboard layout in GRUB (for reference)

						ukdvorak had to be created manually, based on usdvorak. diff them (under resources/utilities/grub-assemble/keymap/original)
						to see how ukdvorak file was created

$ cat ukdvorak | ./grub/grub-mklayout -o ukdvorak.gkb

Back to top of page

			Copyright ©  2014 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Hardware maintenance</title>

Hardware maintenance

				This section relates to hardware maintenance on supported targets.

				Back to previous index.

ThinkPad X60/X60s/X60T: Change keyboard (the procedure on X200/X200S/X200T is almost identical)

ThinkPad X60/X60S: change the fan/heatsink

ThinkPad X60/X60s: How to change the LCD panel (incomplete. pics only for now)

ThinkPad T60 15.1" changing LCD panel

ThinkPad T60: change the fan/heatsink

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Changing the heatsink or CPU on a ThinkPad T60</title>

Changing heatsink (or CPU) on the ThinkPad T60

				Using this guide you can also change/upgrade the CPU.

Back to previous index

Hardware requirements

rubbing alcohol or isopropyl alcohol, and thermal compound for changing CPU heatsink (procedure involves removing heatsink)

thermal compound/paste (Arctic MX-4 is good. Others are also good.)

Software requirements

xsensors

stress

Disassembly

				Remove those screws and remove the HDD:

				Lift off the palm rest:

				Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:

				Gently wedge both sides loose:

				Remove that cable from the position:

				Remove the bezel (sorry forgot to take pics).

				On the CPU (and there is another chip south-east to it, sorry forgot to take pic)
				clean off the old thermal paste (with the alcohol) and apply new (Artic Silver 5 is good, others are good too)
				you should also clean the heatsink the same way

				This is also an opportunity to change the CPU to another one. For example if you had a Core Duo T2400, you can upgrade it to a better processor
				(higher speed, 64-bit support). A Core 2 Duo T7600 was installed here.

				Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):

				Reinstall that upper bezel:

				Do that:

				Attach keyboard:

				Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:

				It lives!

				Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Changing LCD panel on 15.1 inch T60</title>

Changing the LCD panel on a 15.1" T60

			This is for the 15.1" T60. If you have another size then the procedure will differ; for example, on 14.1" you have
			to remove the hinges and the procedure is a bit more involved than on 15.1".

Back to previous index

Disassembly

				Remove those covers and unscrew:

				Gently pry off the front bezel.

				Remove inverter board:

				Disconnect LCD cable:

				Remove the panel:

				Move the rails (left and right side) from the old panel to the new one and then attach LCD cable:

				Insert panel (this one is an LG-Philips LP150E05-A2K1, and there are others. See ../hcl/index.html#supported_t60_list):

				Insert new inverter board (see ../hcl/index.html#supported_t60_list for what is recommended on your LCD panel):

				Now re-attach the front bezel and put all the screws in.

				It lives!

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Libreboot documentation: Switch heatsink on ThinkPad X60</title>

Changing the fan/heatsink on the ThinkPad X60

				This guide will teach you how to replace the fan and heatsink on your ThinkPad X60.

Back to main index

Table of Contents

Hardware Requirements

Software Requirements

Disassembly

Hardware requirements

isopropyl alcohol (sometimes called rubbing alcohol)

your new fan and/or heatsink

CPU thermal compound (some say Arctic MX-4 is good, others are also 'ok')

Something to spread the paste with

Software requirements (for CPU stress testing)

xsensors utility

stress utility

Disassembly

				Remove those screws:

				Push the keyboard forward (carefully):

				Lift the keyboard up and disconnect it from the board:

				Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:

				You should now have this:

				Disconnect the wifi antenna cables, the modem cable and the speaker:

				Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem
				cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand
				side:

				Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape
				that holds it into place:

				Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:

				Remove those screws:

				Remove those screws:

				Carefully remove the plate, like so:

				Remove the SATA connector:

				Now remove the motherboard (gently) and cast the lcd/chassis aside:

				Look at that black tape above the heatsink, remove it:

				Now you have removed it:

				Disconnect the fan and remove all the screws, heatsink will easily come off:

				Remove the old paste with a cloth (from the CPU and heatsink) and then clean both of them with the alcohol (to remove remaining residue of the paste).
				Apply a pea-sized amount of paste to the both chipsets that the heatsink covered and spread it evenly (uniformally).
				Finally reinstall the heatsink, reversing previous steps.

				stress -c 2 command can be used to push the CPU to 100%, and xsensors (or watch sensors command) can be used to monitor heat.
				Below 90C is ok.

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>ThinkPad X60: Change keyboard</title>

Thinkpad X60/X60s/X60t: Change keyboard

				Use this guide to replace the keyboard on your ThinkPad X60. Also works for X60s and X60 Tablet.

				Although slightly different, this guide can also be followed for the ThinkPad X200, X200S and X200 Tablet.
				The screws are in more or less the same place, and it's the same procedure.

Back to previous index

Just follow these steps, and then reverse

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.


code:
<!DOCTYPE html>

	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<title>Libreboot documentation: Unbricking the ThinkPad T60</title>

Changing the LCD panel on X60

This tutorial is incomplete, and only pictures for now.

Back to previous index

			Copyright ©  2014, 2015 Francis Rowe <info@gluglug.org.uk>

			Permission is granted to copy, distribute and/or modify this document
			under the terms of the GNU Free Documentation License, Version 1.3
			or any later version published by the Free Software Foundation;
			with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
			A copy of the license can be found at ../gfdl-1.3.txt

			Updated versions of the license (when available) can be found at
			https://www.gnu.org/licenses/licenses.html

			UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
			EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
			AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
			ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
			IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
			WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
			PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
			ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
			KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
			ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.

			TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
			TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
			NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
			INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
			COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
			USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
			ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
			DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
			IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.

			The disclaimer of warranties and limitation of liability provided
			above shall be interpreted in a manner that, to the extent
			possible, most closely approximates an absolute disclaimer and
			waiver of all liability.