Actions

Chromebook

From Trammell Hudson's Projects

Chell Chromebook

Check Chromebook servo connector

The "Chell" chromebook is available as the HP Chromebook 13 G1 and includes a Core m5 Skylake with SGX, VT-x, VT-d, etc. It supports coreboot out of the box and should be a decent machine for Heads and Qubes.

ROM Images

Chromebook-ROMS/shellballs/chell has the original images, including the stock ME firmware. The Chell board has 3.3V SPI flash, so the command to read it is:

dut_control.py \
	spi2_vref:pp3300 \
	spi2_buf_en:on \
	spi2_buf_on_flex_en:on \
	spi_hold:off \
	cold_reset:on
	
sudo ~/build/chromium/flashrom/flashrom \
	-V \
	-p ft2232_spi:type=servo-v2 \
	-r chell.rom
	
   Found Winbond flash chip "W25Q128" (16384 kB, SPI) on ft2232_spi.
   
dut_control.py \
	spi2_vref:off \
	spi2_buf_en:off \
	spi2_buf_on_flex_en:off \
	spi_hold:off \
	cold_reset:off

Xen issues

  • Skylake debug UART doesn't seem to work in Linux (or xen)
  • x2apic causes hangs; had to comment it out
  • xsave bug

Building Heads

Todo: document the changes necessary and how to extract the ME/FSP firmware.

Servo debug board

Rework complete, servo board connected

The best way to install is via the servo connector (shown above) and use an official google servo board. You will need to build some packages

git clone https://chromium.googlesource.com/chromiumos/third_party/hdctools
git clone https://chromium.googlesource.com/chromiumos/third_party/flashrom

If you watch the ec_uart when desasserting the cold_reset line, it prints a startup message:

littlefw chell_v1.9.172-8db02d9
lfw-RO load


--- UART initialized after reboot ---
[Reset cause: reset-pin]
[Image: RO, chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2]
[0.001033 KB boot key 0]
[0.001090 Inits done]
[0.001805 low power idle task started]
[0.007110 hash start 0x00040000 0x00019cb4]
[0.011022 PB init-on]
[0.014249 chipset -> S5]
[0.018368 PD comm disabled]
[0.018434 event set 0x00200000]
[0.018603 KB init state: -- -- -- -- -- -- -- -- -- -- -- -- --]
[0.[18911 KB wait]
[0.020370 PB task 8 = init-on]
C1 st2
Console is enabled; type HELP for help[0.028565 TCPC p0 ready]
.
> [0.029888 event set 0xC0 st2
00002000]
[0.037125 hostcmd init 0x202000]
[0.038483 power state 0 = G3, in 0x0030]
[0.038725 power state 5 = G3->S5, in 0x0030]
[0.046931 PB PCH pwrbtn=LOW]
[0.046998 PB task 6 = released, wait 199999]
[0.057850 power state 1 = S5, in 0x0030]
[0.070596 RSMRST: 1]
[0.083654 event set 0x00000080]
[0.083779 event set 0x00400000]
[0.084505 Battery 73% / 1092h:15 to empty]
[0.089160 CL: p-1 s-1 i0 v0]
[0.247370 PB task 6 = released]
[0.247479 PB PCH pwrbtn=HIGH]
[0.247579 PB task 0 = idle, wait -1]
[0.248278 power state 6 = S5->S3, in 0x003b]
[0.248436 chipset -> S3]
[0.248495 power state 2 = S3, in 0x003f]
[0.248593 power state 7 = S3->S0, in 0x003f]
[0.248715 Port 80: 0x1001][0.248789 chipset -> S0]
[0.250469 power state 3 = S0, in 0x003f]
[0.250569 power state 3 = S0, in 0x003f]
[0.420249 LPC RESET# deasserted]
[0.546804 Port 80: 0x1002][0.546871 LPC RESET# asserted]
[0.553049 LPC RESET# deasserted]
[0.577009 Port 80: 0x2a][0.578836 HC 0x87]
++[0.777302 HC 0x4b]
[0.778131 HC 0x49]
[0.786459 Port 80: 0x30][0.786559 HC 0x06]
[0.787151 HC 0x23]
[0.788116 Port 80: 0x33][0.788378 HC 0x87]
[0.814009 Port 80: 0x55][0.818749 hash done 20d03054528db6d2daeefef8b98719dcd2271a7db6b4eddb75d66db3165b2207]
[0.888037 Port 80: 0x37][0.889781 HC 0x8f]
[0.893403 HC 0x87]
[1.035037 Port 80: 0x74][1.043504 HC 0x8d]
[1.044122 Port 80: 0x75][1.044402 HC 0x8e]
[1.044743 event clear 0x00000080]
[1.045066 event clear 0x00002000]
[1.045402 event clear 0x00200000]
[1.045743 event clear 0x00400000]
[1.046091 ACPI query = 0]
[1.086037 Port 80: 0x75][1.087196 HC 0x8b]
[1.087564 ACPI query = 0]
[1.088123 HC 0x8a]
[1.090037 Port 80: 0x75][1.093521 KB enable]
[1.098558 KB scancode set to 2]
[1.100599 KB IRQ enable]
[1.101627 KS enable]
[1.104328 HC 0x01]
[1.104868 HC 0x02]
[1.107452 HC 0x87]
[1.135037 Port 80: 0x9d][1.135458 HC 0x06]
[1.180037 Port 80: 0xaa][1.185801 HC 0x0b]
[1.186985 HC 0x400b]
[1.189538 HC 0x02]
[1.191750 HC 0x8f]
[1.192270 HC 0x02]
[1.194759 HC 0x2a]
[1.196320 HC 0xd2]
[1.197216 Executing host reboot command 2]
[1.210820 Jumping to image RW]
littlefw chell_v1.9.172-8db02d9
lfw-RW load
[1.213737 UART initialized after sysjump]
[Image: RW, chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2]
[1.214741 Inits done]
[1.214991 already in S0]
[1.215528 low power idle task started]
[1.220809 hash start 0x00040000 0x00019cb4]
[1.221140 KB IRQ enable]
[1.221199 KB enable]
[1.221252 PB init-jumped]
[1.224462 chipset -> S0]
[1.224527 event set 0x00200000]
[1.225836 TCPC p1 ready]
[1.228339 TCPC p0 ready]
C1 st2
C0 st2
[1.231432 KB init state: -- -- -- -- -- -- -- -- -- -- -- -- --]
[1.231638 KB wait]
[1.231698 PB task 0 = idle]
[1.231800 PB task 0 = idle, wait -1]
Console is enabled; type HELP for help.
> [1.231959 event set 0x00002000]
[1.232040 hostcmd init 0x202000]
[1.232214 power state 3[1.259373 event set 0x00000080]
[1.259492 event set 0x00400000]
[1.260220 Battery 73% / 165h:7 to empty]
[1.264818 HC 0x01]
[1.265036 HC 0x15]
+[1.284515 HC 0xd2]
[1.284581 Executing host reboot command 5]
[1.284928 HC 0x4002]
[1.285447 CL: p-1 s-1 i0 v0]
[1.288903 HC 0x402a]
[1.294262 HC 0x40d2]
[1.321466 TCPC p0 reset!]
[1.322464 TCPC p1 reset!]
[1.345632 HC 0x01]
[1.345818 HC 0x4015]
+[1.348611 HC 0x40d2]
[1.352793 HC 0xa0]
[1.356904 HC 0xb6]
[1.697479 HC 0x02]
[1.699492 KB disable]
[1.699576 KS disable]
[1.967314 HC 0x8a]
[1.967479 event clear 0x00000080]
[1.967561 event clear 0x00002000]
[1.967646 event clear 0x00200000]
[1.967733 event clear 0x00400000]
[1.967821 ACPI query = 0]
[1.967986 HC 0x8b]
[2.022813 hash done 20d03054528db6d2daeefef8b98719dcd2271a7db6b4eddb75d66db3165b2207]
[2.423591 HC 0x0b]
[2.424286 HC 0x400b]
[2.428413 HC 0x08]
[2.428898 HC err 3]
[2.429735 HC 0x28]
[2.430012 HC err 1]
+[2.430590 HC err 1]
+[2.431117 HC err 1]
+[2.431590 HC err 1]
+[2.432076 HC err 1]
+[2.432709 HC err 1]
+[2.433377 HC err 1]
[2.433972 HC 0x112]
[2.434712 HC 0x0d]
[2.435346 HC 0x4112]
[2.440231 command 0x112 returned error 1]
[2.440743 HC err 1]
[2.441128 HC 0x400d]
++++[3.476736 KB IRQ disable]
[3.477418 KB IRQ enable]
[3.477686 KB enable]
[[.482242 KS enable]
[7.424378 ACPI kblight 10][8.205776 HC 0x103]
[8.739188 ACPI kblight 0][8.898522 HC 0x01]
[9.866666 DPTF sensor 1, threshold -73 C, index 0, disabled]
[9.867529 DPTF sensor 1, threshold -73 C, index 1, disabled]
[9.869115 DPTF sensor 2, threshold -73 C, index 0, disabled]
[9.870105 DPTF sensor 2, threshold -73 C, index 1, disabled]
[9.871701 DPTF sensor 3, threshold -73 C, index 0, disabled]
[9.872634 DPTF sensor 3, threshold -73 C, index 1, disabled]
[9.874219 DPTF sensor 4, threshold -73 C, index 0, disabled]
[9.875025 DPTF sensor 4, threshold -73 C, index 1, disabled]
[10.978115 KB disable]
[10.978455 KS disable]
[10.978819 KB IRQ disable]
[10.979217 KB IRQ enable]
[11.039486 ACPI query = 0]
[12.062041 Port 80: 0x1002][12.062324 LPC RESET# asserted]
[12.062984 power state 3 = S0, in 0x0033]
[12.063534 power state 8 = S0->S3, in 0x0023]
[12.064422 event set 0x00200000]
[12.065200 chipset -> S3]
[12.090929 power state 2 = S3, in 0x0022]
[12.091534 RSMRST: 0]
[12.091787 power state 9 = S3->S5, in 0x0022]
[12.092397 chipset -> S5]
[12.092674 power state 1 = S5, in 0x0022]
[12.093093 power state 1 = S5, in 0x0022]
[16.216281 Disable console in deepsleep]
[22.093625 power state 10 = S5->G3, in 0x0022]
[22.094291 Forcing fake G3.]
[22.094584 power state 0 = G3, in 0x0022]
help
Known commands:
  8042           ctrlram        hostevent      panicinfo      sysjump        
  adc            cutoff         i2cscan        pd             syslock        
  amonbmon       dptftemp       i2cxfer        pdcmd          taskinfo       
  apreset        dsleep         idlestats      port80         temps          
  apshutdown     flashinfo      kbd            powerbtn       thermalget     
  apthrottle     flashwp        kblight        powerindebug   thermalset     
  battery        gettime        kblog          powerinfo      typec          
  battfake       gpioget        kbpress        pwmduty        typematic      
  chan           gpioset        ksstate        reboot         version        
  charger        hcdebug        lidclose       rw             waitms         
  chgoverride    help           lidopen        shmem          wireless       
  chgstate       hibdelay       lpcinit        sleepmask      
  codeset        hibernate      md             spi_flashinfo  
  crash          history        mmapinfo       sysinfo        
> version
Chip:    smsc mec1322 81
Board:   4
RO:      chell_v1.9.172-8db02d9
RW:      chell_v1.9.172-8db02d9
Build: chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2
> 

The Winbond 25X40CL on the right hand side of the board is for the EC, not the CPU. It is hard to grab anyway.