I own a Lenovo X60, T400 and GA-G41M-ES2l that all run Libreboot. They all have served me well.
I have grown curious lately and set out to see if I could build a desktop that had a little more power.
I came across this guide for an Asus F2A85-M
in my Google searches, and as luck would have it, found the exact same board and CPU on Ebay.
Upon receiving the board and CPU I followed the guide and was more or less happy. This may sound silly but the
biggest bummer for me was the non functional CPU temperature sensor. This was not a coreboot issue, the
issue was also present on the original bios.
While I was making the coreboot rom for the Asus board I peaked at
what other boards coreboot supports. Luck struck again as I saw that coreboot supported the GA-B75M-D3V. I just
so happened to have a GA-B75M-D3V in my spare parts. I was able to build coreboot for my GA-B75M-D3V using the process from
Asus F2A85-M guide
with the parameters for the
GA-B75M-D3V on the coreboot wiki.
A notable concession I am making with the GA-B75M-D3V is settling for a cleaned Intel ME instead of an erased one.
Being able to use an i5 instead of being limited to a Core2 Duo is pretty nice though in my opinion.
With all this being said I figured it would be nice to lay a guide out for the GA-B75M-D3V much like the guide for the
Asus F2A85-M.
Before we go any further lets get the disclaimer out of the way. Flashing a bios improperly can result in a dead motherboard.
I am in no way shape or form offering any warranty or accepting any liability for your motherboard. I have performed this guide on my GA-B75M-D3V
several times with no issues. However, if you choose to follow this guide you are doing so at your own risk.
Still here? Cool! With that out of the way lets get to work.
The desktop that I put together for this project contains the following hardware.
Build the PC enough to install an operating system. If you are going to use a GPU do not add it yet. Just use the integrated Intel GPU for now. After we have flashed coreboot you can add your GPU. For this task you will need to install Ubuntu 20.04 AMD64. After coreboot has been flashed you can install your preferred variant of GNU/Linux or BSD. I have not personally tried to run a BSD on this setup. I have not attempted to and will not attempt to run Windows on this.
Reconfigure grub. I am not sure if this is absolutely needed for building and flashing coreboot. It is needed for checking the status of the Intel ME later on. We are going to add a flag to our grub config.
sudo nano /etc/default/grub
We need to add iomem=relaxed to the line GRUB_CMDLINE_LINUX_DEFAULT in our grub config. The following line...
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
Will become...
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash iomem=relaxed"
Now run the following commands to make our change take effect and then reboot.
sudo update-grub
sudo reboot
Now we will install the packages needed to build coreboot and check on the Intel ME.
sudo apt-get install git build-essential gnat flex bison libncurses5-dev wget
zlib1g-dev libpci-dev python
Before building coreboot we must take backups of a handful of binaries.
Clone the coreboot repository. This will be our working directory for the remainder of this project.
git clone https://review.coreboot.org/coreboot
cd coreboot
Now we need to backup our stock bios.
sudo flashrom -p internal -c "MX25L6406E/MX25L6408E" -r stock_bios.bin
We will now grab our flashdescriptor and our ME binaries for coreboot.
cp stock_bios.bin ./util/ifdtool
cd ./util/ifdtool
make
./ifdtool -x stock_bios.bin
cp flashregion_0_flashdescriptor.bin ~/coreboot/descriptor.bin
cp flashregion_2_intel_me.bin ~/coreboot/me.bin
cd ~/coreboot
Now we need to find our integrated gpus pci id.
lspci -vvvtnnn
The command above will produce output similar to the next block of text.
-[0000:00]-+-00.0 Intel Corporation 2nd Generation Core Processor Family DRAM Controller [8086:0100]
+-02.0 Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller [8086:0112]
+-14.0 Intel Corporation 7 Series/C210 Series Chipset Family USB xHCI Host Controller [8086:1e31]
+-1a.0 Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller #2 [8086:1e2d]
+-1b.0 Intel Corporation 7 Series/C216 Chipset Family High Definition Audio Controller [8086:1e20]
+-1c.0-[01]--
+-1c.4-[02]----00.0 Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [10ec:8168]
+-1d.0 Intel Corporation 7 Series/C216 Chipset Family USB Enhanced Host Controller #1 [8086:1e26]
+-1e.0-[03]--
+-1f.0 Intel Corporation B75 Express Chipset LPC Controller [8086:1e49]
+-1f.2 Intel Corporation 7 Series/C210 Series Chipset Family 6-port SATA Controller [AHCI mode] [8086:1e02]
\-1f.3 Intel Corporation 7 Series/C216 Chipset Family SMBus Controller [8086:1e22]
Note the Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller section.
We will use the 02.0 in the next step and the [8086:0112] later.
Please be aware that these values may be different for you.
Next we will grab our vgabios for coreboot. You may have seen instructions like...
echo 1 > /sys/devices/pci0000:00/0000:00:02.0/rom
... and so forth. This would not work for me. I would get permission denied errors.
Using sudo or trying it as root did not help.
The following block is what worked for me.
sudo echo 1 | sudo tee /sys/devices/pci0000:00/0000:00:02.0/rom
sudo cat /sys/devices/pci0000:00/0000:00:02.0/rom > vgabios.bin
sudo echo 0 | sudo tee /sys/devices/pci0000:00/0000:00:02.0/rom
It is time to actually build coreboot for the GA-B75M-D3V.
make nconfig
In the build menu we are going to set the following values. Having all of the binary files in the root of the cloned coreboot directory is going to make this easier. The file paths for them will simply be the file names. This is also where the PCI ID for the integrated gpu is going to come into play.
Afterwards select save to save the config. The default path is fine. Afterwards select exit until you are out of the make menu.
Now it is time to build the coreboot tool chain. This next step will take a while.
make crossgcc-i386 CPUS=4
After the tool chain is built we can finally build our new rom.
make
After all of our prep work and menu'ing to build our new rom, it is finally time to flash coreboot to our GA-B75M-D3V.
sudo flashrom -p internal -c "MX25L6406E/MX25L6408E" -w build/coreboot.rom
sudo reboot
Now you should see SeaBIOS followed by some wild green bars until the Ubuntu boot screen shows up. This is a known issue in the coreboot docs for the GA-B75M-D3V. I do not personally care as I will be using a Nvidia GPU. Speaking of GPUs now is a good time to shut down and install a GPU if you are going to use one. My old Nvidia 9600gt may not sound impressive in 2021. It's a dedicated GPU of some sort that plays nice enough with nouveau and as a result does not need a proprietary driver.
Now lets turn our attention to the Intel Management Engine or ME for short.
Now that we are running coreboot the intel ME has been "cleaned".
This will greatly reduce it's functionality and make our new platform much more secure.
Lets go back to our coreboot folder and build the intelmetool and check out the ME.
cd coreboot/util/intelmetool/
make
sudo ./intelmetool -m
You should see output similar to this.
Bad news, you have a `B75 Express Chipset LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...
MEI found: [8086:1e3a] 7 Series/C216 Chipset Family MEI Controller #1
ME Status : 0x4181
ME Status 2 : 0x163b0160
ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode : Normal
ME: Error Code : Debug Failure
ME: Progress Phase : BUP Phase
ME: Power Management Event : Pseudo-global reset
ME: Progress Phase State : 0x3b
ME: Extend Register not valid
ME: has a broken implementation on your board with this firmware
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed
Since the output reads Progress Phase BUP Phase instead of Progress Phase Host Communication and Current Working State Initializing instead of Current Working State Normal we are good to go. Our hardware backdoor has been hampered.
Now would be a good time to backup the coreboot folder that we cloned and used for all of this. This will ensure that the binaries we pulled from the stock bios, the stock bios itself and our new coreboot rom are all backed up and safe.
tar -czvf coreboot_GA-B75M-D3V.tar.gz ~/coreboot
Afterwards copy this tar archive to flash drive, burn it to a DVD or even better, both.
Thats all! We are done at this point. I personally chose to pull the hard drive that I had used to perform
all of these tasks. That way if I ever wanted to revisit this or build a newer version of coreboot I could
temporarily install this hard drive and do so. I put the hard drives in that I intend to use and
installed Debian as that is my personal preference. Feel free to go for whatever variant of
GNU/Linux or BSD you prefer.
I hope this has helped you in your quest to liberate your desktop. If you built a desktop using this guide
I hope it serves you well for years to come.
I would like to close by thanking the brilliant people behind coreboot, Roland of https://freundschafter.com
and all of the people from my various Google searches. This guide would not be possible with out the
combination of all of their contributions, knowledge and answers. You can find links to all of the resources
I used and read in the works cited section below.
Building the environment to perform these tasks.
https://freundschafter.com/research/how-to-build-a-more-secure-personal-computer/
Editing Grub2 to add iomem=relaxed
https://tipsonubuntu.com/2016/07/20/grub2-boot-order-ubuntu-16-04/
Coreboot make menu settings for Gigabyte GA-B75M-D3V for the majority of this.
https://www.coreboot.org/Board:gigabyte/ga-b75m-d3v
Fix for permission denied when trying to backup of vgabios.bin.
https://askubuntu.com/questions/778471/echo-1-sys-bus-pci-slots-4-power-bash-sys-bus-pci-slots-power-permission
mecleaner section
https://github.com/corna/me_cleaner/wiki/Get-the-status-of-Intel-ME
💰 Tip Jar
✔️
Valid HTML
✔️
Valid CSS