The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html

Copyright (C) 2024 Free Software Foundation sysadmin@fsf.org

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.

disable option roms with cbfstool

This method applies a hard-coded variable to the LibreBoot / Coreboot ROM that tells it to not load external option roms. (LibreBoot from 2016 loads option roms by default.)

documentation on this method

If those pages are missing, visit https://archive.is or https://archive.org.

compile cbfstool

Clone the Coreboot git repo:

git clone http://review.coreboot.org/coreboot.git

Compile cbfstool:

cd coreboot
cd util/cbfstool

    make -j5

sudo cp cbfstool /usr/local/bin/

If dependencies are missing, libreboot_r20160907_util.tar.xz has a compiled version at the https://libreboot.org/download.html mirrors.

get the LibreBoot rom from the machine

Downloading the rom from the machine itself is a good approach so you don't have to worry about setting the MAC address to a non-generic value before writing the patched rom.

If you are able to boot to GNU/Linux on the device:

flashrom -p internal -r libreboot.rom

patch the LibreBoot ROM

Controls option ROM execution for roms found on PCI devices (as opposed to roms found in CBFS/fw_cfg). Valid values are 0: Execute no ROMs, 1: Execute only VGA ROMs, 2: Execute all ROMs. The default is 2 (execute all ROMs).

cbfstool libreboot.rom add-int -i 1 -n etc/pci-optionrom-exec
cbfstool libreboot.rom print

write the LibreBoot ROM

If you are using a fresh ROM image, don't forget to patch it so there aren't MAC collisions. Alternatively, get the rom from the machine itself (see above).

If you are booted into GNU/Linux on the device:

flashrom -p internal -w libreboot.rom

Do a shutdown, then a cold boot.