8 files changed, 257 insertions, 146 deletions

diff --git a/docs/gnulinux/encrypted_debian.md b/docs/gnulinux/encrypted_debian.md
index 71129950..2b95b2a9 100644
--- a/docs/gnulinux/encrypted_debian.md
+++ b/docs/gnulinux/encrypted_debian.md
@@ -170,7 +170,7 @@ payload, press C to get to the command line, and enter:
 
     grub> cryptomount -a
     grub> set root='lvm/matrix-rootvol'
-    grub> linux /vmlinuz root=/dev/mapper/matrix-rootvolcryptdevice=/dev/mapper/matrix-rootvol:root
+    grub> linux /vmlinuz root=/dev/mapper/matrix-rootvol cryptdevice=/dev/mapper/matrix-rootvol:root
     grub> initrd /initrd.img
     grub> boot
 
@@ -201,7 +201,7 @@ Operating System' to say this inside:
 
     cryptomount -a
     set root='lvm/matrix-rootvol'
-    linux /vmlinuz root=/dev/mapper/matrix-rootvolcryptdevice=/dev/mapper/matrix-rootvol:root
+    linux /vmlinuz root=/dev/mapper/matrix-rootvol cryptdevice=/dev/mapper/matrix-rootvol:root
     initrd /initrd.img
     
 Without specifying a device, the *-a* parameter tries to unlock all
diff --git a/docs/hardware/index.md b/docs/hardware/index.md
index 58161090..5f54675e 100644
--- a/docs/hardware/index.md
+++ b/docs/hardware/index.md
@@ -406,7 +406,7 @@ likes to think that Apple and Microsoft are all that exist.) Now to
 install libreboot, follow
 [../install/\#flashrom\_macbook21](../install/#flashrom_macbook21).
 
-### coreboot wiki page
+### Coreboot wiki page
 
 -   <https://www.coreboot.org/Board:apple/macbook21>
 
@@ -444,27 +444,56 @@ For external flashing, refer to
 You need to replace OS X with GNU+Linux before flashing libreboot. (OSX
 won't run at all in libreboot).
 
-There are some issues with this system (compared to other computers that
-libreboot supports):
+### Issues and solutions
 
-This is an apple laptop, so it comes with OS X: it has an Apple
-keyboard, which means that certain keys are missing: insert, del, home,
-end, pgup, pgdown. There is also one mouse button only. Battery life is
-poor compared to X60/T60 (for now). It also has other issues: for
-example, the Apple logo on the back is a hole, exposing the backlight,
-which means that it glows. You should cover it up.
+There is one mouse button only, however multiple finger tapping
+works. Battery life is poor compared to X60/T60. The Apple logo on the
+back is a hole, exposing the backlight, which means that it glows. You
+should [cover it up](http://cweiske.de/tagebuch/tuxbook.htm).
 
-The system does get a bit hotter compared to when running the original
-firmware. It is certainly hotter than an X60/T60. The heat issues have
-been partially fixed by the following patch (now merged in libreboot):
-<https://review.coreboot.org/#/c/7923/>.
-
-*The MacBook2,1 comes with a webcam, which does not work without
-proprietary software. Also, webcams are a security risk; cover it up! Or
+*The MacBook2,1 comes with a webcam which does not work with free
+software. Webcams are a privacy and security risk; cover it up! Or
 remove it.*
 
-A user reported that they could get better response from the touchpad
-with the following in their xorg.conf:
+Further issues do have solutions:
+
+#### Enable AltGr
+
+The keyboard has a keypad enter instead of an AltGr. The first key on
+the right side of the spacebar is the Apple "command" key. On its
+right is the keypad enter. We can make it act as an AltGr.
+
+If your operating system is Trisquel or other dpkg-based distribution,
+there is an easy solution. Under root (or sudo) run
+
+      # dpkg-reconfigure keyboard-configuration
+
+and select the option "apple laptop", leave other settings as their
+defaults until you are given the option "Use Keypad Enter as
+AltGr". Select this. The keypad enter key will then act as an AltGr
+everywhere.
+
+
+For Parabola or other systemd-based distributions you can enable AltGr
+manually. Simply add the line
+
+      KEYMAP_TOGGLE=lv3:enter_switch
+
+to the file /etc/vconsole.conf and then restart the computer.
+
+
+#### Enable 3-finger tap
+
+A user submitted a utility to enable 3-finger tap on this laptop. It's
+available at *resources/utilities/macbook21-three-finger-tap* in the
+libreboot git repository.
+
+
+#### Make touchpad more responsive
+
+Linux kernels of version 3.15 or lower might make the touchpad
+extremely sluggish. A user reported that they could get better
+response from the touchpad with the following in their xorg.conf:
 
     Section "InputClass"
      Identifier "Synaptics Touchpad"
@@ -507,15 +536,9 @@ with the following in their xorg.conf:
      Option "VertEdgeScroll" "1"
     EndSection
 
-A user reported that the above is only for linux kernel 3.15 or lower.
-For newer kernels, the touchpad works fine out of the box, except middle
-tapping.
-
-A user submitted a utility to enable 3-finger tap on this laptop. It's
-available at *resources/utilities/macbook21-three-finger-tap* in the
-libreboot git repository.
 
 Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>\
+Copyright © 2017 Eemeli Blåsten <https://drblasten.com>\
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License Version 1.3 or any later
diff --git a/libreboot b/libreboot
index f02de202..a89b78e5 100755
--- a/libreboot
+++ b/libreboot
@@ -63,6 +63,7 @@ libreboot_usage() {
 	printf "  TOOLS_FORCE - Tools to always perform actions for\n" >&2
 	printf "  RELEASE_KEY - GPG key to use for release\n" >&2
 	printf "  VBOOT_KEYS_PATH - Path to the vboot keys\n" >&2
+	printf "  LIBFAKETIME_PATH - Path to the libfaketime shared library\n" >&2
 	printf "  TASKS - Number of simultaneous tasks to run\n" >&2
 	printf "  VERSION - Version string to use\n" >&2
 
@@ -172,21 +173,18 @@ libreboot_setup_variables() {
 	local vboot_tools_path="$(project_install_path 'vboot' 'tools')"
 	local version_path="${root}/${DOTVERSION}"
 	local epoch_path="${root}/${DOTEPOCH}"
+	local rnd_seed_path="${root}/${DOTRNDSEED}"
 
-	if [[ -z "${TASKS}" ]]; then
-		TASKS=1
-	fi
-
-	if [[ -z "${VERSION}" ]]; then
-		if git_check "${root}"; then
-			VERSION="${BUILD_SYSTEM}-$(git_describe "${root}" 2> /dev/null || echo 'git')"
-		elif [[ -f "${version_path}" ]]; then
-			VERSION="$(cat "${version_path}")"
+	# Used by GCC, e.g., -frandom-seed="${RANDOM_SEED}"
+	if [[ -z "${RANDOM_SEED}" ]]; then
+		if [[ -f "${rnd_seed_path}" ]]; then
+			RANDOM_SEED="$(cat "${rnd_seed_path}")"
 		else
-			VERSION="${BUILD_SYSTEM}"
+			RANDOM_SEED="${RANDOM}" # True randomness is unnecessary
 		fi
 	fi
 
+	# Also used by GCC, but as an environment variable
 	if [[ -z "${SOURCE_DATE_EPOCH}" ]]; then
 		if git_check "${root}"; then
 			SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
@@ -197,12 +195,32 @@ libreboot_setup_variables() {
 		fi
 	fi
 
-	if [[ -z "${VBOOT_KEYS_PATH}" ]] && [[ -d "${vboot_tools_path}/devkeys/" ]]; then
-		VBOOT_KEYS_PATH="${vboot_tools_path}/devkeys/"
+	if [[ -z "${VERSION}" ]]; then
+		if git_check "${root}"; then
+			VERSION="${BUILD_SYSTEM}-$(git_describe "${root}" 2> /dev/null || echo 'git')"
+		elif [[ -f "${version_path}" ]]; then
+			VERSION="$(cat "${version_path}")"
+		else
+			VERSION="${BUILD_SYSTEM}"
+		fi
+	fi
+
+	if [[ -d "${vboot_tools_path}/devkeys/" ]]; then
+		VBOOT_KEYS_PATH="${VBOOT_KEYS_PATH:-${vboot_tools_path}/devkeys/}"
 	fi
 
-	if [[ -z "${EDITOR}" ]]; then
-		EDITOR="vi"
+	CONFIG_SHELL="${CONFIG_SHELL:-$(which bash)}"
+	EDITOR="${EDITOR:-$(which vi || true)}"
+	TASKS="${TASKS:-1}"
+
+	# Environment variables useful for creating reproducible builds
+	if [[ -n "${LIBFAKETIME_PATH}" ]]; then
+		BUILD_DATE_FMT="%Y-%m-%d %H:%M:%S"
+		BUILD_DATE="$(date -u -d "@${SOURCE_DATE_EPOCH}" "+${BUILD_DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "+${BUILD_DATE_FMT}" 2>/dev/null || date -u "+${BUILD_DATE_FMT}")"
+		FAKETIME="@${BUILD_DATE}"
+		LC_ALL='C.UTF-8'
+		LD_PRELOAD="${LIBFAKETIME_PATH}"
+		TZ='UTC'
 	fi
 }
 
diff --git a/libs/common b/libs/common
index 8f1379ee..513d697c 100755
--- a/libs/common
+++ b/libs/common
@@ -35,6 +35,7 @@ BLOBS_IGNORE="blobs-ignore"
 BLOBS_DISCOVER="blobs-discover"
 
 DOTEPOCH=".epoch"
+DOTRNDSEED=".rndseed"
 DOTVERSION=".version"
 DOTREVISION=".revision"
 DOTTARFILES=".tarfiles"
@@ -180,145 +181,149 @@ directory_filled_check() {
 }
 
 archive_files_create() {
-	local source_path=$1
-
-	local directory=$( basename "$source_path" )
-	local tarfiles_path="$source_path/$DOTTARFILES"
-	local revision_path="$source_path/$DOTREVISION"
-	local version_path="$source_path/$DOTVERSION"
-
-	if git_check "$source_path"
-	then
-		git_files "$source_path" | tr -d '\0' > "$tarfiles_path"
-		echo "$DOTTARFILES" | tr -d '\0' >> "$tarfiles_path"
+	local source_path="$1"
+
+	local directory="$(basename "${source_path}")"
+	local tarfiles_path="${source_path}/${DOTTARFILES}"
+	local revision_path="${source_path}/${DOTREVISION}"
+	local version_path="${source_path}/${DOTVERSION}"
+	local epoch_path="${source_path}/${DOTEPOCH}"
+	local rnd_seed_path="${source_path}/${DOTRNDSEED}"
+
+	# Files in "${tarfiles_path}" are NUL terminated.
+	# `tr '\0' '\n'` for human-readable output.
+	if git_check "${source_path}"; then
+		git_files "${source_path}" > "${tarfiles_path}"
+		printf '%s\0' "${DOTTARFILES}" >> "${tarfiles_path}"
 	else
-		touch "$tarfiles_path"
-
-		(
-			cd "$source_path"
-			find
-		) | LC_ALL=C sort | sed "s,^./,," | grep -vP "^\.$" > "$tarfiles_path"
-	fi
-
-	if [ -f "$revision_path" ]
-	then
-		echo "$DOTREVISION" | tr -d '\0' >> "$tarfiles_path"
-	fi
-
-	if [ -f "$version_path" ]
-	then
-		echo "$DOTVERSION" | tr -d '\0' >> "$tarfiles_path"
+		find "${source_path}" -print0 | env LC_ALL='C.UTF-8' sort -z | sed -z "1d;s,^${source_path}/\\?,,;/^${DOTTARFILES}\$/d" > "${tarfiles_path}"
 	fi
 
-	if [ -f "$epoch_path" ]
-	then
-		echo "$DOTEPOCH" | tr -d '\0' >> "$tarfiles_path"
-	fi
+	for dotfile in "${revision_path}" \
+			"${version_path}" \
+			"${epoch_path}" \
+			"${rnd_seed_path}"
+	do
+		if [[ -f "${dotfile}" ]]; then
+			printf '%s\0' ".${dotfile##*.}" >> "${tarfiles_path}"
+		fi
+	done
 }
 
 archive_files_date() {
-	local source_path=$1
+	local source_path="$1"
 
-	local epoch_path="$source_path/$DOTEPOCH"
+	local epoch_path="${source_path}/${DOTEPOCH}"
 
-	if ! [ -z "$SOURCE_DATE_EPOCH" ]
-	then
-		(
-			cd "$source_path"
-			find -exec touch --no-dereference --date="@$SOURCE_DATE_EPOCH" {} \;
-		)
+	if [[ -n "${SOURCE_DATE_EPOCH}" ]]; then
+		find "${source_path}" -execdir touch --no-dereference --date="@${SOURCE_DATE_EPOCH}" {} +
 	fi
 }
 
 archive_create() {
-	local archive_path=$1
-	local source_path=$2
-	local directory=$3
+	local archive_path="$1"
+	local source_path="$2"
+	local directory="$3"
 
-	local tarfiles_path="$source_path/$DOTTARFILES"
-	local directory_path=$( dirname "$archive_path" )
+	local tarfiles_path="${source_path}/${DOTTARFILES}"
+	local directory_path="$(dirname "${archive_path}")"
 
-	mkdir -p "$directory_path"
+	mkdir -p "${directory_path}"
 
-	if [ -z "$directory" ]
-	then
-		directory=$( basename "$source_path" )
+	if [[ -z "${directory}" ]]; then
+		directory="$(basename "${source_path}")"
 	fi
 
-	archive_files_create "$source_path"
-	archive_files_date "$source_path"
+	archive_files_create "${source_path}"
+	archive_files_date "${source_path}"
+
+	local tar_options=(
+		--create
+		--xz
+		--file="${archive_path}"
+		--files-from="${tarfiles_path}"
+		--transform="s,^,${directory}/,S"
+		--no-recursion
+		--null
+		--owner=0
+		--group=0
+		--numeric-owner
+	)
 
 	(
-		cd "$source_path"
-		tar -cJf "$archive_path" --no-recursion -T "$tarfiles_path" --transform="s,^,$directory/,S" --owner=root --group=root --numeric-owner
+		cd "${source_path}"
+		tar "${tar_options[@]}"
 	)
 }
 
 archive_extract() {
-	local archive_path=$1
-	local destination_path=$2
+	local archive_path="$1"
+	local destination_path="$2"
 
-	if [ -z "$destination_path" ]
-	then
-		destination_path=$( dirname "$archive_path" )
+	if [[ -z "${destination_path}" ]]; then
+		destination_path="$(dirname "${archive_path}")"
 	fi
 
-	tar -xf "$archive_path" -ps -C "$destination_path"
+	tar -xf "${archive_path}" -ps -C "${destination_path}"
 }
 
 rootfs_files_create() {
-	local source_path=$1
-
-	local directory=$( basename "$source_path" )
-	local tarfiles_path="$source_path/$DOTTARFILES"
+	local source_path="$1"
 
-	touch "$tarfiles_path"
+	local directory="$(basename "${source_path}")"
+	local tarfiles_path="${source_path}/${DOTTARFILES}"
 
-	(
-		cd "$source_path"
-		execute_root find
-	) | LC_ALL=C sort | sed "s,^./,," | grep -vP "^$DOTTARFILES|^\.$" > "$tarfiles_path"
+	# Files in "${tarfiles_path}" are NUL terminated.
+	# `tr '\0' '\n'` for human-readable output.
+	execute_root find "${source_path}" -print0 | env LC_ALL='C.UTF-8' sort -z | sed -z "1d;s,^${source_path}/\\?,,;/^${DOTTARFILES}\$/d" > "${tarfiles_path}"
 }
 
 rootfs_files_date() {
-	local source_path=$1
+	local source_path="$1"
 
-	local epoch_path="$source_path/$DOTEPOCH"
+	local epoch_path="${source_path}/${DOTEPOCH}"
 
-	if ! [ -z "$SOURCE_DATE_EPOCH" ]
-	then
-		(
-			cd "$source_path"
-			execute_root find -exec touch --no-dereference --date="@$SOURCE_DATE_EPOCH" {} \;
-		)
+	if [[ -n "${SOURCE_DATE_EPOCH}" ]]; then
+		execute_root find "${source_path}" -execdir touch --no-dereference --date="@${SOURCE_DATE_EPOCH}" {} +
 	fi
 }
 
 rootfs_create() {
-	local rootfs_path=$1
-	local source_path=$2
-	local directory=$3
+	local rootfs_path="$1"
+	local source_path="$2"
+	local directory="$3"
 
-	local tarfiles_path="$source_path/$DOTTARFILES"
-	local directory_path=$( dirname "$rootfs_path" )
+	local tarfiles_path="${source_path}/${DOTTARFILES}"
+	local directory_path="$(dirname "${rootfs_path}")"
 
-	mkdir -p "$directory_path"
+	mkdir -p "${directory_path}"
 
-	if [ -z "$directory" ]
-	then
-		directory=$( basename "$source_path" )
+	if [[ -z "${directory}" ]]; then
+		directory="$(basename "${source_path}")"
 	fi
 
-	rootfs_files_create "$source_path"
-	rootfs_files_date "$source_path"
+	rootfs_files_create "${source_path}"
+	rootfs_files_date "${source_path}"
+
+	local tar_options=(
+		--create
+		--xz
+		--file="${rootfs_path}"
+		--files-from="${tarfiles_path}"
+		--no-recursion
+		--null
+		--owner=0
+		--group=0
+		--numeric-owner
+	)
 
 	(
-		cd "$source_path"
-		execute_root tar -cJf "$rootfs_path" --no-recursion -T "$tarfiles_path" --numeric-owner
+		cd "${source_path}"
+		execute_root tar "${tar_options[@]}"
 	)
 
-	execute_root chmod 644 "$rootfs_path"
-	execute_root chown $USER:$USER "$rootfs_path"
+	execute_root chmod 644 "${rootfs_path}"
+	execute_root chown "${USER}:${USER}" "${rootfs_path}"
 }
 
 requirements() {
diff --git a/libs/git b/libs/git
index a750be32..97352956 100755
--- a/libs/git
+++ b/libs/git
@@ -202,12 +202,12 @@ git_describe() {
 }
 
 git_files() {
-	local repository_path=$1
+	local repository_path="$1"
 
 	(
-		cd "$repository_path"
+		cd "${repository_path}"
 		# Reproducible sorting.
-		git ls-files | LC_ALL=C sort -z
+		git ls-files -z | env LC_ALL='C.UTF-8' sort -z
 	)
 }
 
diff --git a/projects/flashrom/patches/0005-Workaround-MX25-reliable-operation.patch b/projects/flashrom/patches/0005-Workaround-MX25-reliable-operation.patch
new file mode 100644
index 00000000..472afd30
--- /dev/null
+++ b/projects/flashrom/patches/0005-Workaround-MX25-reliable-operation.patch
@@ -0,0 +1,66 @@
+diff --git a/cli_classic.c b/cli_classic.c
+index 0a09cfd..9eeafe1 100644
+--- a/cli_classic.c
++++ b/cli_classic.c
+@@ -61,6 +61,7 @@ static void cli_classic_usage(const char *name)
+ 	       " -i | --image <name>                only flash image <name> from flash layout\n"
+ 	       " -o | --output <logfile>            log output to <logfile>\n"
+ 	       " -L | --list-supported              print supported devices\n"
++	       "    | --workaround-mx               keep flash busy before sending command\n"
+ #if CONFIG_PRINT_WIKI == 1
+ 	       " -z | --list-supported-wiki         print supported devices in wiki syntax\n"
+ #endif
+@@ -130,6 +131,7 @@ int main(int argc, char *argv[])
+ 		{"help",		0, NULL, 'h'},
+ 		{"version",		0, NULL, 'R'},
+ 		{"output",		1, NULL, 'o'},
++		{"workaround-mx", 	0, NULL, 0x0101},
+ 		{NULL,			0, NULL, 0},
+ 	};
+ 
+@@ -337,6 +339,9 @@ int main(int argc, char *argv[])
+ 			}
+ #endif /* STANDALONE */
+ 			break;
++		case 0x0101: /* --workaround-mx */
++		    	workaround_mx = 1;
++		    	break;
+ 		default:
+ 			cli_classic_abort_usage();
+ 			break;
+diff --git a/programmer.h b/programmer.h
+index 1a6216a..6f97cfc 100644
+--- a/programmer.h
++++ b/programmer.h
+@@ -650,6 +650,7 @@ enum ich_chipset {
+ 	CHIPSET_8_SERIES_WELLSBURG,
+ 	CHIPSET_9_SERIES_WILDCAT_POINT,
+ };
++extern int workaround_mx; /* workaround for MX25* chips, makes flash operations more reliable, less failures */
+ 
+ /* ichspi.c */
+ #if CONFIG_INTERNAL == 1
+diff --git a/spi.c b/spi.c
+index 894f73f..05aa5d0 100644
+--- a/spi.c
++++ b/spi.c
+@@ -30,10 +30,19 @@
+ #include "programmer.h"
+ #include "spi.h"
+ 
++int workaround_mx; /* Make operations with MX25* chips more reliable */
++
+ int spi_send_command(struct flashctx *flash, unsigned int writecnt,
+ 		     unsigned int readcnt, const unsigned char *writearr,
+ 		     unsigned char *readarr)
+ {
++	if (workaround_mx) {
++		const unsigned char cmd[JEDEC_READ_OUTSIZE] = {JEDEC_READ, 0, 0, 0};
++		unsigned char buf[256];
++		/* keep flash busy for some time, keep CS warm before sending actual command */
++		flash->mst->spi.command(flash, sizeof(cmd), sizeof(buf), cmd, buf);
++	}
++	/* actual command */
+ 	return flash->mst->spi.command(flash, writecnt, readcnt, writearr,
+ 				       readarr);
+ }
diff --git a/www/contrib.md b/www/contrib.md
index 2322157e..da619d07 100644
--- a/www/contrib.md
+++ b/www/contrib.md
@@ -105,8 +105,7 @@ in coreboot, and then helped her integrate the fix in libreboot. Contact
 Peter Stuge
 -----------
 
-Helped write the section about DMA on
-[../faq.md\#firmware-hddssd](../faq.md#firmware-hddssd), and provided
+Helped write the [FAQ section about DMA](../faq.md#hddssd-firmware), and provided
 general advice in early days of the project. Contact **CareBear\\** in
 the \#coreboot IRC channel on freenode.
 
diff --git a/www/faq.md b/www/faq.md
index 96c94246..b0995b58 100644
--- a/www/faq.md
+++ b/www/faq.md
@@ -9,7 +9,7 @@ Important issues
 What version of libreboot do I have?
 ----------------------------------------------------------------
 
-See [../docs/\#version](../docs/#version)
+[See here](../docs/#version)
 
 Flashrom complains about DEVMEM access
 --------------------------------------
@@ -27,7 +27,7 @@ coreboot-libre, so we just use the default one in coreboot which has
 this issue on some CCFL panels, but not LED panels.
 
 You can work around this in your distribution, by following the notes at
-[../docs/misc/\#backlight%20control](../docs/misc/#backlight%20control).
+[docs: backlight control](../docs/misc/#finetune-backlight-control-on-intel-gpus).
 
 The ethernet doesn't work on my X200/T400/X60/T60 when I plug in it 
 -------------------------------------------------------------------
@@ -76,7 +76,7 @@ Hardware compatibility
 What systems are compatible with libreboot?
 -----------------------------------------------------------------------------------
 
-See [../docs/hardware/](docs/hardware/).
+[See here](docs/hardware/).
 
 Why is the latest Intel hardware unsupported in libreboot? {#intel}
 -----------------------------------------------------------
@@ -471,7 +471,7 @@ Will desktop/server hardware be supported?
 ------------------------------------------------------------------------
 
 Libreboot now supports desktop hardware:
-[../docs/hardware/\#supported\_desktops\_x86amdintel](../docs/hardware/#supported_desktops_x86/intel)
+[(see list)](../docs/hardware/#supported_desktops_x86/intel)
 (with full native video initialization).
 
 A common issue with desktop hardware is the Video BIOS, when no onboard
@@ -519,7 +519,7 @@ General questions
 How do I install libreboot?
 -------------------------------------------------------
 
-See [../docs/install/](docs/install/)
+See [installation guide](docs/install/)
 
 How do I program an SPI flash chip?
 ---------------------------------------------------------------------------------
@@ -535,9 +535,9 @@ If you are using the GRUB payload, you can add a username and password
 (salted, hashed) to your GRUB configuration that resides inside the
 flash chip. The following guides (which also cover full disk encryption,
 including the /boot/ directory) show how to set a boot password in GRUB:
-[../docs/gnulinux/encrypted\_debian.md](../docs/gnulinux/encrypted_debian.md)
+[(Installing Debian or Devuan with FDE)](../docs/gnulinux/encrypted_debian.md)
 and
-[../docs/gnulinux/encrypted\_parabola.md](../docs/gnulinux/encrypted_parabola.md)
+[(Installing Parabola or Arch GNU+Linux-Libre, with FDE)](../docs/gnulinux/encrypted_parabola.md)
 
 How do I write-protect the flash chip?
 ----------------------------------------------------------------------------
@@ -551,7 +551,7 @@ On some systems, it is possible to write-protect the firmware, such that
 it is rendered read-only at the OS level (external flashing is still
 possible, using dedicated hardware). For example, on current GM45
 laptops (e.g. ThinkPad X200, T400), you can write-protect (see
-[../docs/hardware/gm45\_remove\_me.html\#ich9gen](../docs/hardware/gm45_remove_me.html#ich9gen)).
+[ICH9 gen utility](../docs/hardware/gm45_remove_me.html#ich9gen)).
 
 It's possible to write-protect on all libreboot systems, but the instructions
 need to be written. The documentation is in the main git repository, so you are
@@ -600,7 +600,7 @@ boot just fine, using the bootloader (GRUB) that is in the flash chip.
 This also means that even if you remove the HDD or SSD, you'll still
 have a functioning bootloader installed which could be used to boot a
 live distribution installer from a USB flash drive. See
-[\.../docs/gnulinux/grub\_boot\_installer.md](../docs/gnulinux/grub_boot_installer.md)
+[How to install GNU+Linux on a libreboot system](../docs/gnulinux/grub_boot_installer.md)
 
 Do I need to re-flash when I re-install a distribution?
 -------------------------------------------------------------------------------------------
@@ -610,7 +610,7 @@ automatically switch to a GRUB configuration on the HDD or SSD, if it
 exists. You can also load a different GRUB configuration, from any kind
 of device that is supported in GRUB (such as a USB flash drive). For
 more information, see
-[../docs/gnulinux/grub\_cbfs.md](../docs/gnulinux/grub_cbfs.md)
+[Modifying the GRUB Configuration in Libreboot Systems](../docs/gnulinux/grub_cbfs.md)
 
 What does a flash chip look like?
 -----------------------------------------------------------------