I’m new at the board porting game but I’m interested in making a port for a single board
computer that is running very similar hardware to the Librem 13 laptop and the Google
It seems this board is also rather close to Intel’s own Eval Kit hardware setup, both in
hardware and software regard (almost bare defaults AMI Aptio firmware).
Looking at the coreboot archives, this board might have been mentioned before:
<https://mail.coreboot.org/pipermail/coreboot/2018-July/087050.html> but that was
HTML formatted in an attachment for some reason.
- CPU: i5-5250U
- SuperIO: IT8784E-I
- HDA: ALC662
- Flash: 8MByte Winbond SPI SOIC8 (but flashrom detects it as opaque when using internal
programmer on-device, works correctly using external SPI flasher)
- 4x Intel I211 Ethernet controllers
more specifically, inteltool sees:
CPU: ID 0x306d4, Processor Type 0x0, Family 0x6, Model 0x3d, Stepping 0x4
Northbridge: 8086:1604 (5th generation (Broadwell family) Core Processor ULT)
Southbridge: 8086:9cc3 (unknown)
IGD: 8086:1626 (unknown)
Linux itself sees it as Wildcat Point-LP and Broadwell-U which makes sense.
It has a running ME, but there is an unpopulated header (ME1) which when shorted seems to
kill it or put it in manufacturing mode (soldered in a pin header and plugged in a
MEI found: [8086:9cba] Wildcat Point-LP MEI Controller #1
ME Status : 0x1e040185
ME Status 2 : 0x10522106
ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Normal
ME: Current Operation State : Bring up
ME: Current Operation Mode : Security Override via Jumper
ME: Error Code : No Error
ME: Progress Phase : BUP Phase
ME: Power Management Event : Clean Moff->Mx wake
ME: Progress Phase State : 0x52
When not using the jumper, flashrom can’t read anything using the internal programmer
mode, but when plugging the jumper in, it can read it. Output is not the same as reading
the SPI flash chip offline externally, so some of the flash it probably still hidden by
the PCH as it always does.
There are exposed pads near the Realtek ALC chip which makes it really easy to pull GPIO33
to DVDD and disable flash descriptor security.
So far so good, the hardware has easy-to-reach points to get to the flash, ME jumper and
PCH straps. The firmware isn’t very custom, and neither is the board (except the four
My next steps were: cp -R the Purism directory to Qotom, remove all the Librem15 stuff,
rename the Librem13 to Q3XXG4 and remove the EC references as this board doesn’t have an
At this point, I’m not sure what to do next, besides the text in board_info.txt (both the
vendor directory and the variant directories) I’ll probably have to make sure:
- acpi_tables.c has the correct tables, unless I can use the (generic looking) contents
the Librem 13 uses, which doe acpi_init_gnvs, and acpi_create_madt_lapics +
- there is fadt.c which seems rather generic as well.
- gpio.h is probably depending on the PCH used? Seems to be generic for this PCH as well
- hda_verb.c seems to relate to the audio system, but I don’t care about it all that much
at this time. The Librem 13 uses the ALC269 which has some differences to the ALC662,
configuring it wrong probably just makes the chip sad and audio pin routing not work
- mainboard.c contains mainboard_enable and some calls for the GMA chip
(install_intel_vga_int15_handler and some constants), probably the same accross this
- romstage.c initialises the GPIOs does some PEI data copy/memset and then romstage_common
(which probably is around or before the CAR stage?)
- acpi/mainboard.asl is empty, not sure what part of the existing ACPI I should dump in
I turned the board into a variant, because Qotom has a number of boards that mostly differ
in i3 vs i5 and more ethernet ports vs. more serial ports models. I named the variant
q3xxg4 but I think we can do better as the PCB has a revision number printed on it,
indicating more variants.
It looks like I’ll need to build some sort of devicetree.cb, perhaps by hand or converted
from a ACPI dump from a running system? Then there is pei_data.c which seems to set the
specifics for the hardware, the labels and locations.
While it is pretty close to the Librem 13 there as well (USB3 ports, USB2 ports) some of
the locations need to be changed, and the camera, bluetooth, and speakers removed). Not
sure how this relates to what is in the device tree and any *.asl files.
The old wiki and it’s porting guide isn’t up to date as far as I know, but I haven’t found
a new guide or set of docs that shows how to read/source information from a running system
and write it into a new mainboard definition.
I’ll probably need to get the GbE region from the old firmware, ME too, but what other
parts of data (ACPI tables? PEI data?)I need to get and how to fill out that data into the
mainboard definition isn’t very clear to me.
This device has a GPIO header, and two serial ports (one external DB9, one internal
header), so getting debug data out should be possible, but just randomly building an image
and flashing it in to the SPI chip probably gets me nothing until I have at least
configured the serial port for coreboot to spit out debug data. I’m not sure if I need to
get the FSP from Intel or if I should extract the one from the current firmware.
Any guidance would be appreciated.