Install Libreboot on Dell OptiPlex 5050 SFF

Return to index

PLEASE READ THESE INSTRUCTIONS BEFORE INSTALLING, OR YOU MAY BRICK YOUR MACHINE!! - Please click the link and follow the instructions there, before flashing. For posterity, here is the link again.

W+: Works without vendor firmware; 
N: Doesn't work; 
W*: Works with vendor firmware; 
U: Untested; 
P+: Partially works; 
P*: Partially works with vendor firmware
?: UNKNOWN AT THIS TIME

TODO: test coffeelake CPUs. Might be possible to do 4x32GB with that (2x32GB is possible on 3050Micro with coffeelake refresh CPU)

This document will teach you how to install Libreboot, on your Dell OptiPlex 5050 Micro desktop motherboard. Libreboot is a Free Software project that replaces proprietary BIOS/UEFI firmware.

Unavailable in Libreboot 26.01rev1 or earlier. You must compile from source, or use a version newer than Libreboot 26.01rev1.

The build target, when building from source, is thus:

./mk -b coreboot dell5050sff_vfsp_16mb

Mate Kukri’s deguard utility disables the Intel Boot Guard on this machine. Libreboot uses this by default, along with me_cleaner to provide a neutered ME setup; unlike on other platforms, arbitrary code execution is also possible inside the ME on this motherboard, giving it much higher potential for software freedom in the future.

8th/9th generation (Coffee Lake/Coffee Lake Refresh) quad core CPUs likely do work on this board using libreboot, with no modifications required. i3-9300t has been confirmed to work on this board with libreboot without any modifications.

There is a pin mod to allow 6/8 core Coffee Lake CPUs to be used, but it doesn’t work on this board. It is not currently known whether this is a software limitation that could be fixed in a future release, or a hardware limitation.

The i3-9100t is cheap, and easy to find.

Regarding stepping: B0 stepping is assumed. U0 stepping is untested, and it is assumed that you need the pin mod to be able to use this.

At present, we only know that the quad-core 9th gen processors work, e.g. i3-9100t.

This can take non-T CPUs, e.g. i5-7500, and so you could get higher performance than a 3050 Micro.

Not properly tested yet, but see:

• https://winraid.level1techs.com/t/guide-coffeelake-cpus-on-skylake-kabylake-mainboards/32344
• https://hackaday.com/2024/05/31/intels-anti-upgrade-tricks-defeated-with-kapton-tape/

If it does work, this mod is useful because newer generation optiplexes have a newer version of Intel ME, where it is not yet known how to disable the Intel Boot Guard. Retrofitting newer CPUs onto these older boards is a good way to modernise them somewhat.

NOTE: the MAINBOARD_SUPPORTS_COFFEELAKE_CPU option must be enabled in coreboot menuconfig, for those CPUs to work. This also means that the microcode will be loaded properly. This is currently enabled by default, on 5050sff.

Please also see:

https://review.coreboot.org/c/coreboot/+/90588/2/src/mainboard/dell/sklkbl_desktops/Kconfig#16

This coreboot gerrit note says to modify the IFD accordingly, when using the higher core CPU models.

It is believed that all 9100/9100T will have B0 stepping, but this is not guaranteed. Some may have different stepping. Please make sure you know what stepping your CPU has when doing any of this.

More testing needed

If you’re using a release ROM, please ensure that you’ve inserted extra firmware required refer to the guide for that. (failure to adhere to this advice will result in a bricked machine)

Libreboot’s build system automatically downloads and processes these files if you build Libreboot from source, but the same logic that it uses must be re-run if you’re using a release image.

Of particular interest, this board uses the deguard software, to disable Intel Boot Guard. This means also that the ME firmware no longer has functional cryptographic signature checking for most of it; you can theoretically run whatever you want on the ME coprocessor.

Libre ME doesn’t exist yet, but it’s now possible. Example use-case for a libre ME could include, for example, running an out-of-bound packet filter on a secure network (with flash write protection, making it invincible to any OS-based software attacks).

Intel NIC present. Use the inject command (./mk inject) to change the MAC address if you want to.

If you’re already running Libreboot, and you don’t have flash protection turned on, internal flashing is possible.

TODO: photo

If you have factory firmware (Dell), you can short the service jumper. It’s near the RAM, under where the HDD goes (click the photos shown above). Just put a short on it when booting, and all flash protection is disabled; the factory firmware write might EFI variables to flash during shutdown sequence, so you should pull the plug to shut it down (remove the power by pulling the plug) after flashprog says VERIFIED.

For general information, please refer to 25xx NOR flash instructions - that page refers to use of socketed flash.

The side cover comes off easily, and you can find the flash ICs next to the RAM. Simply remove the screw at the back. The top panel then slides forward, and you can remove the SSD caddy; from then on, the flash is accessible.

Observe the following photo of the flash (SOIC-8):

TODO: photo

You can otherwise flash internally, including from factory firmware (if the service jumper is set).

TODO: more testing needed

SPDX-License-Identifier: GFDL-1.3-or-later

Markdown file for this page: https://libreboot.org/docs/install/dell5050.md

Site map

This HTML page was generated by the Libreboot Static Site Generator.