What if your laptop had a FOSS firmware?

So, you have finally moved to free and open source software on your computer. Your laptop boots into Fedora, then it loads the KDE Plasma desktop environment, then you browse the web with Firefox and write Rust code on Neovim. It feels satisfying, in a way: everything you are using is under your control, and, if you find a bug, you can clone the repo and try to be the one who fixes it.

It's all great, until it hits you that you forgot one tiny detail. Your computer's firmware. The program that runs all the time, putting itself between your Operating System and your hardware components, some of which also run their own on-board firmware as well.

The problem with proprietary firmware

Nowadays, it's very hard to fully move to FOSS on your computer, because the BIOS/UEFI firmware that bootstraps your computer's hardware when you fire it up is, in most cases, proprietary software.

Laptop and motherboard manufacturers typically do not write the firmware for the device themselves, but they buy and customize an existing solution off the shelf, like American Megatrend's Aptio firmware, or Insyde Corp's InsydeH2O.

There are several reasons for this. First, firmware development is really hard, and it doesn't make sense to in-house it, when established off-the-shelf options are the industry standard. Secondly, the firmware needs to deal with the hardware directly, which means it is probably contains some trade secrets, like proprietary Intel or AMD-specific code.

The overwhelming majority of modern laptops and motherboards also use something that is called a “UEFI firmware”. UEFI, which stands for “Unified Extensible Firmware Interface”, released in 2010 as a substitute for older BIOS firmware (often referred to as “legacy firmware”).

While UEFI is far away more modern than BIOS — for example, the EFI standard allows multi-boot setups in a way that is far more seamless than what BIOS would allow — it was not the best of starts for Linux users. The design of the UEFI interface closely matched low-level Windows concepts, posing some initial challenges to Linux users.

BIOS and UEFI both have their pros and cons, but they are actually far from the only alternative.

What else is out there?

Enter coreboot.

Initially released in 1999, coreboot is a free and open source replacement for proprietary BIOS firmware, like BIOS and UEFI. It was initially called “LinuxBIOS”, and - as the name suggests - its focus has been to only provide the bare minimum functionality necessary to bootstrap a modern operating system.

Unfortunately, coreboot is not a “drop-in” replacement: it needs to be specifically ported to a platform. If you want coreboot, you will need to specifically seek out a motherboard or a laptop that comes with it. They are not very common, but they exist: after all, the coreboot project was developed also thanks to the conjunct collaboration between several important entities, including AMD themselves, and several motherboard vendors.

The fastest way to get going with coreboot is to buy hardware that comes with it. If you are looking for a Linux laptop, you are in luck! There is no shortage of Linux-enabled Linux laptops, by numerous manufacturers. If you want to go that route, you can't go wrong with Linux-focused vendor System76. Many of System76's Intel-based laptops run coreboot, and they are pretty reasonably priced for what they are. For example, the Lemur Pro looks superb here: fully upgradable NVMe and RAM, great and versatile form-factor, a recent enough Intel Core Ultra 100 series options for the CPU and - of course - coreboot support baked in.

The selection doesn't end there, though. Just from some cursory research, I can also point you to the Purism Librem 14, or the Star Labs Starbook, an incredibly premium-built Linux laptop with some of the most baller specs I've seen for an ultrabook, with full support for coreboot and flashable upgrades through the LVFS.

Benefits of coreboot

Being free and open source software is cool and all, sure. But are there any technical benefits to running coreboot over a much more widely available traditional American Megatrends or Insyde firmware?

The answer is, of course, yes.

One of the best qualities of coreboot is that, by design, it doesn't try to overdo it. It's designed with simplicity in mind, and it's pretty stripped-down. The design of coreboot is pretty straightforward: all it does it bootstrap your kernel - no frills. As a result, the cold boot times tend to be significantly faster compared to UEFI, and sleep functionality tends to work a lot better. While spotty sleep/wake and battery drain during standby is a known pain point of running Linux on a laptop, the situation fares far better on coreboot: the laptop will enter good old S3 Sleep (suspend-to-ram) rather than the more modern s0ix sleep (suspend-to-idle) modern laptops use now. As you would expect, battery consumption is minimal during sleep, and the machine tends to take much less time to get out of S3 sleep than older UEFI implementations that still support S3.

If you're wondering about Security, you don't need to worry. While "Secure Boot" is mostly a Windows / UEFI concept, the fact that coreboot does not support it does not mean it's not secure. On the contrary, the platform is very reliable and secure. From their website:

coreboot comes with a minimal Trusted Computing Base which reduces the general attack surface. It also supports a secure boot process called VBOOT2. It’s written in MISRA-C standard and provides other languages like Ada for formal verification of special properties. Also the use of platform features like IOMMU, flash protections and deactivated SMM mode increases the security as well.

You should, by now, be convinced that coreboot is cool. Just be prepared to know about libreboot!

If you like coreboot, you'll love Libreboot!

Libreboot is a coreboot distribution that is fully focused on software freedom. It is very important to understand that Libreboot is not considered a coreboot fork, but, rather, a variant of it. Libreboot tries to stay very close to coreboot, while offering many types of configuration automatically through its build system, making it immediately more configurable than vanilla coreboot.

The main idea about Libreboot is to provide a coreboot distribution completely free from binary blobs. This is something that sets it apart "vanilla coreboot". While coreboot is free software, sadly, that does not imply every single piece of software that gets loaded in between the firmware and the kernel is. A lot of hardware, including bleeding-edge Intel and AMD platforms, sadly requires loading some binary blobs in order to bootstrap the computer.

Libreboot comes loaded with GRUB and SeaBIOS payloads, on top of a host of very compelling security features, like true full-disk encryption.

Since Libreboot does not support binary blobs by definition, it also does not support a lot of modern hardware. Libreboot is available as a flashable, drop-in replacement to proprietary BIOS on a select number of platforms it has been ported to. As in tradition, the easiest way to get started with Libreboot is to buy a machine with Libreboot preinstalled. In this case, it's a little trickier: you will not find manufacturers producing these laptops at scale, and you will not be offered bleeding-edge hardware. You will, instead, need to contact Minifree to conduct the deal, and get your hands on a Libreboot machine - or peruse their installation service to get Libreboot installed on your own, compatible hardware without needing to get your hands dirty.

In case you do want to get your hands dirty, though, you absolutely have the opportunity to do that. The ThinkPad T480 is a very popular Linux machine - for great reason, too - and it is very compatible with libreboot. I would bet money at least a few of you are reading or watching from a ThinkPad T480: if you are, and you are okay with taking a risk, you might want to consider librebooting your machine!

Long live open source firmware!

Open source firmware is great, and I hope it grows bigger and bigger as time goes on. Things are already looking pretty good for it: while UEFI is still dominant, more and more Linux machines are getting offered with coreboot. Also, with AMD's OpenSIL project slowly taking shape, I find it quite likely that the day we will be able to port Libreboot to bleeding-edge AMD hardware is not too far into the future.