Hallo, Would you help me on a coreboot port? I just installed coreboot on a Thinkpad X60 following the wiki. Now I want it on this mid-2007 macbook2,1 too. I read some pages in the wiki and started to collect information about the macbook. it seems it has no superIO chip and I dont know what to think of the ectool output. As I understood by now, not knowing how the ec might interfere with the bios or coreboot is one of the big obstacles, no? I hope that once I would try a coreboot flash, recovery might be possible by an external programmer (which I do not have, yet). the flash chip is the same as on the X60 (I've read the factory bios already) as is the northbridge and southbridge. an usb debug port seems available. I've put the log files here: http://macbook.donderklumpen.de/coreboot/ Any comment about what you think about this and how I should proceed is very much welcome!
thanks Mono
Mono wrote:
how I should proceed
Spend somewhere between months and years learning tools and x86 firmware, and proceed to then spend much less than that on creating the actual port.
I know that this isn't very helpful. It isn't realistic to expect the kind of help that I'm afraid you might need.
//Peter
* Mono mono@posteo.de [140124 23:20]:
Hallo, Would you help me on a coreboot port? I just installed coreboot on a Thinkpad X60 following the wiki. Now I want it on this mid-2007 macbook2,1 too. I read some pages in the wiki and started to collect information about the macbook. it seems it has no superIO chip and I dont know what to think of the ectool output. As I understood by now, not knowing how the ec might interfere with the bios or coreboot is one of the big obstacles, no? I hope that once I would try a coreboot flash, recovery might be possible by an external programmer (which I do not have, yet). the flash chip is the same as on the X60 (I've read the factory bios already) as is the northbridge and southbridge. an usb debug port seems available. I've put the log files here: http://macbook.donderklumpen.de/coreboot/ Any comment about what you think about this and how I should proceed is very much welcome!
- Make sure you have the external tools in place to recover from a bad flash. You will not boot successfully on the first attempt.
- Keep a copy of the original firmware around
- Try to make sure that your USB debug gadget is working before starting
- Start with one of the existing i945 based notebooks
- find out what EC is used, and if it shares flash with the main system
- try to get hold of schematics
Regards, Stefan
Hallo Vladimir, Peter and Stefan
thank you for your emails! You already helped me alot. I don't expect to successfully close this project in a fast run and I'm willing to learn a number of tools.
At the moment I am still collecting hardware informations about this computer. I dissembled it completely and documented the chip names of what I thought might be of interest. Please see http://macbook.donderklumpen.de/coreboot/ for what I got. My biggest concern is with the EC. It is a Renesas H8S/2116V. I read about this chip that it makes coreboot impossible on other machines, but I do not know whether this issue is machine specific, or if the chip definitely makes coreboot impossible for this macbook too. Could you comment on this? Also I do not know yet how I could verify whether the EC shares memory with the main system.
As for the ability of flashing the EPROM chip, I plan to test it in the near future (at first with an empty brand new chip, then with the soldered one). The EPROM is supported by flashrom and I plan to use a Beaglebone Black to be the programmer. (this page shows Beaglebone Black can flash a chip via SPI also flashrom is not used here: http://www.linux.com/learn/tutorials/746860-how-to-access-chips-over-the-spi... ) I already learned how to use the Beaglebone Black to debug what coreboot outputs to the USB port on a Thinkpad X60. I assume this should work the same for the macbook (the debug port at the macbook seems to exist, but the factory BIOS does not write anything to it).
One more question: The macbook atm uses a 32bit EFI which when it was purchased booted a 32bit kernel, and today boots a 64bit linux-libre kernel. Would I need to expect any additional problems from the fact that it is not a traditional BIOS, but some EFI which is to be replaced? My optimistic wish is to replace that EFI with coreboot plus a 64bit GRUB2 payload (same as done on my Thinkpad X60). Or would the payload need to be kept at 32bit?
thanks again and with best regards Mono
On Wed, Jan 29, 2014 at 10:24:58PM +0100, Stefan Reinauer wrote:
- Mono mono@posteo.de [140124 23:20]:
Hallo, Would you help me on a coreboot port? I just installed coreboot on a Thinkpad X60 following the wiki. Now I want it on this mid-2007 macbook2,1 too. I read some pages in the wiki and started to collect information about the macbook. it seems it has no superIO chip and I dont know what to think of the ectool output. As I understood by now, not knowing how the ec might interfere with the bios or coreboot is one of the big obstacles, no? I hope that once I would try a coreboot flash, recovery might be possible by an external programmer (which I do not have, yet). the flash chip is the same as on the X60 (I've read the factory bios already) as is the northbridge and southbridge. an usb debug port seems available. I've put the log files here: http://macbook.donderklumpen.de/coreboot/ Any comment about what you think about this and how I should proceed is very much welcome!
Make sure you have the external tools in place to recover from a bad flash. You will not boot successfully on the first attempt.
Keep a copy of the original firmware around
Try to make sure that your USB debug gadget is working before starting
Start with one of the existing i945 based notebooks
find out what EC is used, and if it shares flash with the main system
try to get hold of schematics
Regards, Stefan
-- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
On 03.02.2014 21:43, Mono wrote:
Hallo Vladimir, Peter and Stefan
thank you for your emails! You already helped me alot. I don't expect to successfully close this project in a fast run and I'm willing to learn a number of tools.
At the moment I am still collecting hardware informations about this computer.
I dissembled it completely and documented the chip names of what I thought might be of interest.
Please see http://macbook.donderklumpen.de/coreboot/ for what I got.
That is good example of relevant info collection.
My biggest concern is with the EC.
It is a Renesas H8S/2116V. I read about this chip that it makes coreboot impossible on other machines,
but I do not know whether this issue is machine specific, or if the chip definitely makes coreboot impossible for this macbook too.
Could you comment on this?
Type of EC doesn't matter. What matters is how it is connected. It may really get in the way or have almost no impact. My guess would be that on your system its influence is minor. X60 has H8 as well but with very different firmware which makes it a completely different chip from coreboot perspective.
Also I do not know yet how I could verify whether the EC shares memory with the main system.
That flashrom didn't create any ill effects when reading is an indication of separate flash. If you can flash externally you can leave the issue of internal flash for later and if you don't, don't flash.
As for the ability of flashing the EPROM chip, I plan to test it in the near future
(at first with an empty brand new chip, then with the soldered one). The EPROM is supported by flashrom
and I plan to use a Beaglebone Black to be the programmer. (this page shows Beaglebone Black can
flash a chip via SPI also flashrom is not used here: http://www.linux.com/learn/tutorials/746860-how-to-access-chips-over-the-spi... )
I already learned how to use the Beaglebone Black to debug what coreboot outputs to the USB port on a Thinkpad X60.
I assume this should work the same for the macbook (the debug port at the macbook seems to exist, but the factory BIOS does not write anything to it).
Good
One more question: The macbook atm uses a 32bit EFI which when it was purchased booted a 32bit kernel,
and today boots a 64bit linux-libre kernel. Would I need to expect any additional problems from the fact that
it is not a traditional BIOS, but some EFI which is to be replaced? My optimistic wish is to replace that
EFI with coreboot plus a 64bit GRUB2 payload (same as done on my Thinkpad X60). Or would the payload need to be kept at 32bit?
What Apple ships as firmware is irrelevant. However, decision to omit BIOS comes from higher-level decision of omiting compatibility with 95-era systems. So it's possible you won't be able to boot old OS even with coreboot due to lack of compatibility devices. I'd say it's a minor problem (95-era OS wouldn't work reliably on modern system anyway)
thanks again and with best regards Mono
On Wed, Jan 29, 2014 at 10:24:58PM +0100, Stefan Reinauer wrote:
- Mono mono@posteo.de [140124 23:20]:
Hallo, Would you help me on a coreboot port? I just installed coreboot on a Thinkpad X60 following the wiki. Now I want it on this mid-2007 macbook2,1 too. I read some pages in the wiki and started to collect information about the macbook. it seems it has no superIO chip and I dont know what to think of the ectool output. As I understood by now, not knowing how the ec might interfere with the bios or coreboot is one of the big obstacles, no? I hope that once I would try a coreboot flash, recovery might be possible by an external programmer (which I do not have, yet). the flash chip is the same as on the X60 (I've read the factory bios already) as is the northbridge and southbridge. an usb debug port seems available. I've put the log files here: http://macbook.donderklumpen.de/coreboot/ Any comment about what you think about this and how I should proceed is very much welcome!
Make sure you have the external tools in place to recover from a bad flash. You will notg boot successfully on the first attempt.
Keep a copy of the original firmware around
Try to make sure that your USB debug gadget is working before starting
Start with one of the existing i945 based notebooks
find out what EC is used, and if it shares flash with the main system
try to get hold of schematics
Regards, Stefan
-- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one? Did you already test USB debug with dbgp?
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
Hallo,
On Mon, Feb 03, 2014 at 10:16:30PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one?
Yes, I found out with a USB stick, dmesg and lsusb -t.
Did you already test USB debug with dbgp?
Yes, I tested USB debug for the Thinkpad X60, I assume it would work the same for Macbook.
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
I updated the webpage about what I did ( http://macbook.donderklumpen.de/coreboot/ ). At the moment I am looking at x60's romstage.c because I'd plan to copy as much as possible from it. At the function static void ich7_enable_lpc(void) I got stuck. I can make some guesses, but don't know where the details are documented. If you could point me to any documentation, I'd love to read it. I tried ich7 datasheet and LPC Interface Specification but did not spot what the function ich7_enable_lpc does.
By comparing the output of lspci -nnvvvxxx -s 00:1f.0 on the Thinkpad with coreboot and the Macbook with factory bios I get the following:
on the Thinkpad $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
and on the Macbook $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Intel Corporation Device [8086:7270] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
In the Thinkpad output I can spot the values written by coreboot: 0xd0 at 0x64 // Enable Serial IRQ, this is the same for what the Macbook outputs, but where can I read that this enables serial IRQ? 0x0210 and 0x1f0d at 0x80 and 0x82 // decode ranges, the Macbook outputs different values here 0x1601, 0x007c, 0x15e1, 0x000c, 0x1681, 0x001c from 0x84 to 0x8e // the Thinkpad has three ranges while the Macbook seems to have two ranges only with differnt values. So how would I modify the ich7_enable_lpc function? Should I try to reproduce what the factory bios sets? Other from the values set in this function a few more values differ between the two computers. Better than guessing I would prefer to somewhere read about what these settings do. I just don't know where.
any help is truely appreciated with best regards Mono
On 08.02.2014 15:27, Mono wrote:
Hallo,
On Mon, Feb 03, 2014 at 10:16:30PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one?
Yes, I found out with a USB stick, dmesg and lsusb -t.
Did you already test USB debug with dbgp?
Yes, I tested USB debug for the Thinkpad X60, I assume it would work the same for Macbook.
I meant that you can use debug port as early printk device. It's recommended to check dongle this way if your dongle is the real dbgp dongle.
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
I updated the webpage about what I did ( http://macbook.donderklumpen.de/coreboot/ ). At the moment I am looking at x60's romstage.c because I'd plan to copy as much as possible from it. At the function static void ich7_enable_lpc(void) I got stuck. I can make some guesses, but don't know where the details are documented. If you could point me to any documentation, I'd love to read it. I tried ich7 datasheet and LPC Interface Specification but did not spot what the function ich7_enable_lpc does.
By comparing the output of lspci -nnvvvxxx -s 00:1f.0 on the Thinkpad with coreboot and the Macbook with factory bios I get the following:
on the Thinkpad $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
and on the Macbook $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Intel Corporation Device [8086:7270] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
In the Thinkpad output I can spot the values written by coreboot: 0xd0 at 0x64 // Enable Serial IRQ, this is the same for what the Macbook outputs, but where can I read that this enables serial IRQ? 0x0210 and 0x1f0d at 0x80 and 0x82 // decode ranges, the Macbook outputs different values here 0x1601, 0x007c, 0x15e1, 0x000c, 0x1681, 0x001c from 0x84 to 0x8e // the Thinkpad has three ranges while the Macbook seems to have two ranges only with differnt values. So how would I modify the ich7_enable_lpc function? Should I try to reproduce what the factory bios sets?
Reproducing these values is a good idea. Thinkpad ranges are mostly because of H8, PMH7 and SuperI/O.
Other from the values set in this function a few more values differ between the two computers. Better than guessing I would prefer to somewhere read about what these settings do. I just don't know where.
Don't try to think too hard now. It's time for practice. Save original BIOS in a safe place. Connect to the flash externally, read it twice, compare between the reads, store the files in safe place if they match, stop if they don't. Then flash X60 image into it. Try to boot with it and debug dongle connected. It will fail but the interesting part is *how* it fails. It will tell you where to dig.
any help is truely appreciated with best regards Mono
Hallo
finally I managed to enable SPI on the Beaglebone Black and use it as external programmer with flashrom. I read the macbook's flash chip twice, as suggested. Both rom files are identical. But: a few days/week ago I read the flash chip with the macbook's internal programmer. This file differs from what the external programmer got. Some 9500 bytes (out of 2MiB) differ. apart from a few exeptions those bytes are 0xff read with the internal programmer, but have random hex code when read with the external programmer. Well, between the usage of internal and external programmer the macbook was in normal use. I didnt expect the OS or EC(?) or something to write to the flash chip while it is in normal use. what do you think? what could cause this differnce? I can paste the rom contents later somewhere if that would help any.
best regards Mono
On Sat, Feb 08, 2014 at 03:37:40PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
On 08.02.2014 15:27, Mono wrote:
Hallo,
On Mon, Feb 03, 2014 at 10:16:30PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one?
Yes, I found out with a USB stick, dmesg and lsusb -t.
Did you already test USB debug with dbgp?
Yes, I tested USB debug for the Thinkpad X60, I assume it would work the same for Macbook.
I meant that you can use debug port as early printk device. It's recommended to check dongle this way if your dongle is the real dbgp dongle.
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
I updated the webpage about what I did ( http://macbook.donderklumpen.de/coreboot/ ). At the moment I am looking at x60's romstage.c because I'd plan to copy as much as possible from it. At the function static void ich7_enable_lpc(void) I got stuck. I can make some guesses, but don't know where the details are documented. If you could point me to any documentation, I'd love to read it. I tried ich7 datasheet and LPC Interface Specification but did not spot what the function ich7_enable_lpc does.
By comparing the output of lspci -nnvvvxxx -s 00:1f.0 on the Thinkpad with coreboot and the Macbook with factory bios I get the following:
on the Thinkpad $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
and on the Macbook $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Intel Corporation Device [8086:7270] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
In the Thinkpad output I can spot the values written by coreboot: 0xd0 at 0x64 // Enable Serial IRQ, this is the same for what the Macbook outputs, but where can I read that this enables serial IRQ? 0x0210 and 0x1f0d at 0x80 and 0x82 // decode ranges, the Macbook outputs different values here 0x1601, 0x007c, 0x15e1, 0x000c, 0x1681, 0x001c from 0x84 to 0x8e // the Thinkpad has three ranges while the Macbook seems to have two ranges only with differnt values. So how would I modify the ich7_enable_lpc function? Should I try to reproduce what the factory bios sets?
Reproducing these values is a good idea. Thinkpad ranges are mostly because of H8, PMH7 and SuperI/O.
Other from the values set in this function a few more values differ between the two computers. Better than guessing I would prefer to somewhere read about what these settings do. I just don't know where.
Don't try to think too hard now. It's time for practice. Save original BIOS in a safe place. Connect to the flash externally, read it twice, compare between the reads, store the files in safe place if they match, stop if they don't. Then flash X60 image into it. Try to boot with it and debug dongle connected. It will fail but the interesting part is *how* it fails. It will tell you where to dig.
any help is truely appreciated with best regards Mono
-- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
On 13.02.2014 23:47, Mono wrote:
Hallo
finally I managed to enable SPI on the Beaglebone Black and use it as external programmer with flashrom. I read the macbook's flash chip twice, as suggested. Both rom files are identical. But: a few days/week ago I read the flash chip with the macbook's internal programmer. This file differs from what the external programmer got. Some 9500 bytes (out of 2MiB) differ. apart from a few exeptions those bytes are 0xff read with the internal programmer, but have random hex code when read with the external programmer. Well, between the usage of internal and external programmer the macbook was in normal use. I didnt expect the OS or EC(?) or something to write to the flash chip while it is in normal use. what do you think? what could cause this differnce? I can paste the rom contents later somewhere if that would help any.
That is pretty normal. Some firmwares store debug log or parameters in flash.
best regards Mono
On Sat, Feb 08, 2014 at 03:37:40PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
On 08.02.2014 15:27, Mono wrote:
Hallo,
On Mon, Feb 03, 2014 at 10:16:30PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
CY8C24794-24LFXI
My guess: it's part of keyboard + touchpad Do you already know which port is USBdebug one?
Yes, I found out with a USB stick, dmesg and lsusb -t.
Did you already test USB debug with dbgp?
Yes, I tested USB debug for the Thinkpad X60, I assume it would work the same for Macbook.
I meant that you can use debug port as early printk device. It's recommended to check dongle this way if your dongle is the real dbgp dongle.
Um, there are much more 00's than for the Thinkpad X60. Not sure what
this means Different firmware. Most likely less functions are on it (keyboard and touchpad are on USB and handled by another chip). You'll need to make directory ec/apple/h8 for it and no code from lenovo/h8 will be reusable.
What about those Block Protect things?
Forget them for now, you'll be flashing externally until you have working version anyway
I updated the webpage about what I did ( http://macbook.donderklumpen.de/coreboot/ ). At the moment I am looking at x60's romstage.c because I'd plan to copy as much as possible from it. At the function static void ich7_enable_lpc(void) I got stuck. I can make some guesses, but don't know where the details are documented. If you could point me to any documentation, I'd love to read it. I tried ich7 datasheet and LPC Interface Specification but did not spot what the function ich7_enable_lpc does.
By comparing the output of lspci -nnvvvxxx -s 00:1f.0 on the Thinkpad with coreboot and the Macbook with factory bios I get the following:
on the Thinkpad $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
and on the Macbook $ lspci -nnvvvxxx -s 00:1f.0 00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02) Subsystem: Intel Corporation Device [8086:7270] Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Capabilities: [e0] Vendor Specific Information: Len=0c <?> Kernel driver in use: lpc_ich Kernel modules: intel_rng, lpc_ich, leds_ss4200 00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
In the Thinkpad output I can spot the values written by coreboot: 0xd0 at 0x64 // Enable Serial IRQ, this is the same for what the Macbook outputs, but where can I read that this enables serial IRQ? 0x0210 and 0x1f0d at 0x80 and 0x82 // decode ranges, the Macbook outputs different values here 0x1601, 0x007c, 0x15e1, 0x000c, 0x1681, 0x001c from 0x84 to 0x8e // the Thinkpad has three ranges while the Macbook seems to have two ranges only with differnt values. So how would I modify the ich7_enable_lpc function? Should I try to reproduce what the factory bios sets?
Reproducing these values is a good idea. Thinkpad ranges are mostly because of H8, PMH7 and SuperI/O.
Other from the values set in this function a few more values differ between the two computers. Better than guessing I would prefer to somewhere read about what these settings do. I just don't know where.
Don't try to think too hard now. It's time for practice. Save original BIOS in a safe place. Connect to the flash externally, read it twice, compare between the reads, store the files in safe place if they match, stop if they don't. Then flash X60 image into it. Try to boot with it and debug dongle connected. It will fail but the interesting part is *how* it fails. It will tell you where to dig.
any help is truely appreciated with best regards Mono
-- coreboot mailing list: coreboot@coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot
-
Mono -
Peter Stuge -
Stefan Reinauer -
Vladimir 'φ-coder/phcoder' Serbinenko