The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html
Copyright (C) 2024 Free Software Foundation sysadmin@fsf.org
Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.
Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.
disable option roms with cbfstool
This method applies a hard-coded variable to the LibreBoot / Coreboot ROM that tells it to not load external option roms. (LibreBoot from 2016 loads option roms by default.)
documentation on this method
If those pages are missing, visit https://archive.is or https://archive.org.
compile cbfstool
Clone the Coreboot git repo:
git clone http://review.coreboot.org/coreboot.git
Compile cbfstool:
cd coreboot
cd util/cbfstool
make -j5
sudo cp cbfstool /usr/local/bin/
If dependencies are missing, libreboot_r20160907_util.tar.xz
has a compiled version at the https://libreboot.org/download.html
mirrors.
get the LibreBoot rom from the machine
Downloading the rom from the machine itself is a good approach so you don't have to worry about setting the MAC address to a non-generic value before writing the patched rom.
If you are able to boot to GNU/Linux on the device:
flashrom -p internal -r libreboot.rom
patch the LibreBoot ROM
Controls option ROM execution for roms found on PCI devices (as opposed to roms found in CBFS/fw_cfg). Valid values are 0: Execute no ROMs, 1: Execute only VGA ROMs, 2: Execute all ROMs. The default is 2 (execute all ROMs).
cbfstool libreboot.rom add-int -i 1 -n etc/pci-optionrom-exec
cbfstool libreboot.rom print
write the LibreBoot ROM
If you are using a fresh ROM image, don't forget to patch it so there aren't MAC collisions. Alternatively, get the rom from the machine itself (see above).
If you are booted into GNU/Linux on the device:
flashrom -p internal -w libreboot.rom
Do a shutdown, then a cold boot.