On 13.02.2014 23:47, Mono wrote:
Hallo
finally I managed to enable SPI on the Beaglebone Black and use it as external programmer with flashrom. I read the macbook's flash chip twice, as suggested. Both rom files are identical. But: a few days/week ago I read the flash chip with the macbook's internal programmer. This file differs from what the external programmer got. Some 9500 bytes (out of 2MiB) differ. apart from a few exeptions those bytes are 0xff read with the internal programmer, but have random hex code when read with the external programmer. Well, between the usage of internal and external programmer the macbook was in normal use. I didnt expect the OS or EC(?) or something to write to the flash chip while it is in normal use. what do you think? what could cause this differnce? I can paste the rom contents later somewhere if that would help any.
That is pretty normal. Some firmwares store debug log or parameters in flash.
best regards Mono
On Sat, Feb 08, 2014 at 03:37:40PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
On 08.02.2014 15:27, Mono wrote:
Hallo,
On Mon, Feb 03, 2014 at 10:16:30PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one?
Yes, I found out with a USB stick, dmesg and lsusb -t.
Did you already test USB debug with dbgp?
Yes, I tested USB debug for the Thinkpad X60, I assume it would work the same for Macbook.
I meant that you can use debug port as early printk device. It's recommended to check dongle this way if your dongle is the real dbgp dongle.
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
I updated the webpage about what I did ( http://macbook.donderklumpen.de/coreboot/ ). At the moment I am looking at x60's romstage.c because I'd plan to copy as much as possible from it. At the function static void ich7_enable_lpc(void) I got stuck. I can make some guesses, but don't know where the details are documented. If you could point me to any documentation, I'd love to read it. I tried ich7 datasheet and LPC Interface Specification but did not spot what the function ich7_enable_lpc does.
By comparing the output of lspci -nnvvvxxx -s 00:1f.0 on the Thinkpad with coreboot and the Macbook with factory bios I get the following:
on the Thinkpad $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
and on the Macbook $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Intel Corporation Device [8086:7270] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
In the Thinkpad output I can spot the values written by coreboot: 0xd0 at 0x64 // Enable Serial IRQ, this is the same for what the Macbook outputs, but where can I read that this enables serial IRQ? 0x0210 and 0x1f0d at 0x80 and 0x82 // decode ranges, the Macbook outputs different values here 0x1601, 0x007c, 0x15e1, 0x000c, 0x1681, 0x001c from 0x84 to 0x8e // the Thinkpad has three ranges while the Macbook seems to have two ranges only with differnt values. So how would I modify the ich7_enable_lpc function? Should I try to reproduce what the factory bios sets?
Reproducing these values is a good idea. Thinkpad ranges are mostly because of H8, PMH7 and SuperI/O.
Other from the values set in this function a few more values differ between the two computers. Better than guessing I would prefer to somewhere read about what these settings do. I just don't know where.
Don't try to think too hard now. It's time for practice. Save original BIOS in a safe place. Connect to the flash externally, read it twice, compare between the reads, store the files in safe place if they match, stop if they don't. Then flash X60 image into it. Try to boot with it and debug dongle connected. It will fail but the interesting part is *how* it fails. It will tell you where to dig.
any help is truely appreciated with best regards Mono
-- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot