Install Libreboot on Dell OptiPlex 9020/7020/XE2/T1700 MT/SFF

Return to index

!!BACKUP everything!! just in case something fails.

Specifications
Manufacturer	Dell
Name	OptiPlex 9020 SFF/MT
Variants	OptiPlex 9020/7020/Xe2/T1700 SFF/MT
Chipset	Intel Q87/C226 for T1700
CPU	Intel haswell
Graphics	Intel HD 4600
Memory	DDR3 DIMMs (max 32GB, 4x8GB), (unregistered) ECC memory supported on T1700
Architecture	x86_64
Original boot firmware	Dell UEFI firmware
Intel ME/AMD PSP	Present. Can be disabled with me_cleaner.
Flash chip	2x SOIC-8, 12MiB (8+4) (96Mbit)

W+: Works without vendor firmware; 
N: Doesn't work; 
W*: Works with vendor firmware; 
U: Untested; 
P+: Partially works; 
P*: Partially works with vendor firmware
?: UNKNOWN AT THIS TIME

Features
Internal flashing with original boot firmware	W+
Display (if Intel GPU)	W+
Display (discrete GPU, SeaBIOS payload only)	W*
Audio	W+
RAM Init	W+

Payloads supported
GRUB (libgfxinit only)	Works
SeaBIOS	Works
SeaBIOS with GRUB	Works

Download from release

If you’re using a release ROM, please ensure that you’ve inserted extra firmware required refer to the guide for that (, failure to adhere to this advice will result in a bricked machine):

• Intel ME

Build from source

With Native Ram Init:

For the MT variants:

./mk -b coreboot dell9020mt_nri_12mb

For the SFF variants:

./mk -b coreboot dell9020sff_nri_12mb

With brmc (for ECC support on the T1700 boards only):

T1700 MT:

./mk -b coreboot t1700mt_bmrc_12mb

T1700 SFF:

./mk -b coreboot t1700sff_bmrc_12mb

It is important that you choose the right one. The MT variant is the full MTX tower.

Software

Before internal flashing, Disable /dev/mem protection first.

In short add this kernel parameter: iomem=relaxed(linux distro)/kernel.securelevel=-1(bsd distro)

THEN REMOVE THIS KERNEL PARAMETER TO PREVENT UNAUTHORIZED/MALICIOUS ACCESS TO YOUR SYSTEM AFTER FLASHING LIBREBOOT.

(An important reminder for those who might forget to delete it, even better, replace it with lockdown=integrity / lockdown=confidentiality)

Backup the previous (working) firmware (atleast) twice (to check and compare if reading it gone wrong and backups differs.)

flashprog -p internal -r Backup1.bin

flashprog -p internal -r Backup2.bin

Check and compare those if reading from the flash were successful:

diff Backup1.bin Backup2.bin

For more than 2:

shasum Backup1.bin Backup2.bin Backup3.bin

If those differs, something gone wrong and proceeding further may (DON’T) leave your device unrecoverable (without a reliable backup) if flashing fails as well.

Internal flashing can also be done with the original Dell BIOS, if the SERVICE_MODE jumper near the PCIe slots is installed. Before flashing,

rmmod spi-intel-platform

needs to be run to prevent errors. Once Libreboot is installed, the SERVICE_MODE jumper can be removed.

Note: The Dell BIOS can write EFI variables to flash when shutting down, which could corrupt the newly flashed Libreboot ROM and render the system unusable. To prevent this, after flashing internally from the original Dell BIOS, remove power from the computer instead of shutting it down normally. It’s recommended to use a live USB instead of the internal drive to prevent potential filesystem corruption.

Hardware

For general information, please refer to 25xx NOR flash instructions - that page refers to use of socketed flash.

Backup the previous (working) firmware twice (to check and compare if reading it gone wrong and backups differs.)

flashprog -p serprog:dev=/dev/ttyACM0,spispeed=16M -r Backup1.bin

flashprog -p serprog:dev=/dev/ttyACM0,spispeed=16M -r Backup2.bin

Check and compare those if reading from the flash were successful:

diff Backup1.bin Backup2.bin

For more than 2:

shasum Backup1.bin Backup2.bin Backup3.bin

If those differs, something gone wrong and proceeding further may (DON’T) leave your device unrecoverable (without a reliable backup) if flashing fails as well.

REMOVE all power sources and connectors from the machine, before doing this. This is to prevent short circuiting and power surges while flashing.

There are two SOIC-8 chips. You can split up your 12MB ROM image like so:

dd if=libreboot.rom of=4mb.rom bs=1M skip=8
dd if=libreboot.rom of=8mb.rom bs=1M count=8

The side cover comes off easily, and you can find the flash ICs next to the RAM.

Here’s the SOIC8 ICs being flashed:

This platform uses an Intel Flash Descriptor, and defines an Intel GbE NVM region. As such, release/build ROMs will contain the same MAC address. To change the MAC address, please read nvmutil documentation.

5th gen. processors using Libreboot firmware supported, with the T1700 MT/SFF devices. Those even include an 128MB eDRAM (L4 cache) like AMD has X3D, but fundamentally different at the hardware level.

Does not works yet, even with native ram init.

(Unregistered) ECC memory works with some core i3,pentium,celeron & xeon e3 v3/v4 cpus on T1700 MT only.

ECC allows for more stable desktop experience (especially for prolonged usage) and ensuring data integrity with error corrections and mitigating certain defects that develop over time in the RAM (it will not account for all defects, and memory always needs to be replaced eventually)

List of Compatible 4th gen. Core i3, Pentium, Celeron & Compatible 4th gen. Xeons v3 & Compatible 5th gen. Xeons v4

QUBES: how to get it working

Qubes requires IOMMU to be turned on. Please now read the next section. Qubes WILL work, if you configure Libreboot as directed below, but otherwise it will fail by default. This is because Libreboot disables the IOMMU by default, on this board.

Graphics cards and IOMMU

IOMMU is buggy for some reason (we don’t know why yet), when you plug in a graphics card. The graphics card simply won’t work. On some of them, you can use the console but as soon as you start xorg/wayland, it will just b0rk.

Current Libreboot revisions disable IOMMU by default, on this board. The coreboot code for initialising IOMMU was modified by the Libreboot project, to make it a toggle. IOMMU works fine if you use only Intel graphics.

If you want to use IOMMU with a graphics card, you also can. Use this Linux kernel option at boot:

intel_iommu=enable,igfx_off

With the above option, IOMMU is enabled except for the Intel GPU. However, Libreboot also disables the Intel GPU in coreboot, entirely, when a graphics card is used. With the above option, it’s possible that something like Qubes may work, which requires an IOMMU to be turned on.

If you are using Intel graphics, and not a graphics card, you can ignore the above, and instead fully turn on the IOMMU, without any special kernel options.

The way coreboot works is this: if vt-d is present on the CPU, it enables an IOMMU, and only if vt-d is present. This is still the behaviour in Libreboot, but Libreboot adds an additional check: if iommu is not set in nvram, it defaults to on, but if it’s set to disabled, then IOMMU is not initialised.

Enable IOMMU

IOMMU is disabled by default, universally, on this board. You can turn it on, by modifying the ROM image prior to flashing, or modifying it prior to re-flashing.

On all other Haswell boards, LIbreboot enables IOMMU by default. To enable it on these boards, do this on your ROM:

nvramtool -C libreboot.rom -w iommu=Enable

If you’re using a graphics card, please make sure to read the above notes about how to use IOMMU; specifically, the part that talks about Linux kernel option intel_iommu=enable,igfx_off

Then flash the ROM image. You can find nvramtool under src/coreboot/default/util/nvramtool. Do this in lbmk if you don’t already havse src/coreboot/default/:

./mk -f coreboot default

Then do this:

make -C src/coreboot/default/util/nvramtool

The binary nvramtool will then live in that directory. More information available in Libreboot build instructions. Information about dumping/flashing the ROM can be found in Libreboot flashing instructions and Libreboot external flashing instructions.

NOTE: If IOMMU is enabled, you can still use a graphics card, but you must pass this on the Linux cmdline paramaters: iommu=off - or if you need IOMMU (e.g. for Qubes), use intel_iommu=enable,igfx_off instead.

NOTE2: Libreboot uses a static option table on all boards that have nvram, which is why you must use the -C option on your ROM, to change the static table that is baked into it.

Here is an example of the type of errors we got when testing graphics cards with IOMMU enabled:

https://av.vimuser.org/error.jpg

Make sure to configure your image accordingly.

Chassis Mod (MT only) for bigger Cards (GPUs, Accelerators, …)

Remove the plastic 3.5" drive cage to fit bigger GPUs that exceed the stock 10-inch length limit.

Video walktrough here. (just found, not my)

A guide might be here soon with pictures.

Power On Mod for normal towers

Just in case any of these motherboards would be used in a different case with a 2 pin power(on) cable, connect it to the 1 (yellow/red) & 4 (Black/black) pins. (Black to black, red to yellow)

For LEDs, 2 (-/black) & 3 (+/red)

The Canoeboot version of this page is: https://canoeboot.org/docs/install/dell9020.html

SPDX-License-Identifier: GFDL-1.3-or-later

Markdown file for this page: https://libreboot.org/docs/install/dell9020.md

Site map

This HTML page was generated by the Libreboot Static Site Generator.