Skip to content

Chromebook

Chell Chromebook

The "Chell" chromebook is available as the HP Chromebook 13 G1 and includes a Core m5 Skylake with SGX, VT-x, VT-d, etc. It supports coreboot out of the box and should be a decent machine for Heads and Qubes.

ROM Images

Chromebook-ROMS/shellballs/chell has the original images, including the stock ME firmware. The Chell board has 3.3V SPI flash, so the command to read it is:

dut_control.py \
        spi2_vref:pp3300 \
        spi2_buf_en:on \
        spi2_buf_on_flex_en:on \
        spi_hold:off \
        cold_reset:on

sudo ~/build/chromium/flashrom/flashrom \
        -V \
        -p ft2232_spi:type=servo-v2 \
        -r chell.rom

       Found Winbond flash chip "W25Q128" (16384 kB, SPI) on ft2232_spi.

dut_control.py \
        spi2_vref:off \
        spi2_buf_en:off \
        spi2_buf_on_flex_en:off \
        spi_hold:off \
        cold_reset:off

Xen issues

  • Skylake debug UART doesn't seem to work in Linux (or xen)
  • x2apic causes hangs; had to comment it out
  • xsave bug

Building Heads

Todo: document the changes necessary and how to extract the ME/FSP firmware.

Servo debug board

The best way to install is via the servo connector (shown above) and use an official google servo board. You will need to build some packages

git clone https://chromium.googlesource.com/chromiumos/third_party/hdctools
git clone https://chromium.googlesource.com/chromiumos/third_party/flashrom

If you watch the ec_uart when desasserting the cold_reset line, it prints a startup message:

littlefw chell_v1.9.172-8db02d9
lfw-RO load


--- UART initialized after reboot ---
[cause: reset-pin](Reset)
[RO, chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2](Image:)
[KB boot key 0](0.001033)
[Inits done](0.001090)
[low power idle task started](0.001805)
[hash start 0x00040000 0x00019cb4](0.007110)
[PB init-on](0.011022)
[chipset -> S5](0.014249)
[PD comm disabled](0.018368)
[event set 0x00200000](0.018434)
[KB init state: -- -- -- -- -- -- -- -- -- -- -- -- --](0.018603)
[0.[KB wait](18911)
[PB task 8 = init-on](0.020370)
C1 st2
Console is enabled; type HELP for help[TCPC p0 ready](0.028565)
.
> [event set 0xC0 st2
00002000](0.029888)
[hostcmd init 0x202000](0.037125)
[power state 0 = G3, in 0x0030](0.038483)
[power state 5 = G3->S5, in 0x0030](0.038725)
[PB PCH pwrbtn=LOW](0.046931)
[PB task 6 = released, wait 199999](0.046998)
[power state 1 = S5, in 0x0030](0.057850)
[RSMRST: 1](0.070596)
[event set 0x00000080](0.083654)
[event set 0x00400000](0.083779)
[Battery 73% / 1092h:15 to empty](0.084505)
[CL: p-1 s-1 i0 v0](0.089160)
[PB task 6 = released](0.247370)
[PB PCH pwrbtn=HIGH](0.247479)
[PB task 0 = idle, wait -1](0.247579)
[power state 6 = S5->S3, in 0x003b](0.248278)
[chipset -> S3](0.248436)
[power state 2 = S3, in 0x003f](0.248495)
[power state 7 = S3->S0, in 0x003f](0.248593)
[Port 80: 0x1001](0.248715)[chipset -> S0](0.248789)
[power state 3 = S0, in 0x003f](0.250469)
[power state 3 = S0, in 0x003f](0.250569)
[LPC RESET# deasserted](0.420249)
[Port 80: 0x1002](0.546804)[LPC RESET# asserted](0.546871)
[LPC RESET# deasserted](0.553049)
[Port 80: 0x2a](0.577009)[HC 0x87](0.578836)
++[HC 0x4b](0.777302)
[HC 0x49](0.778131)
[Port 80: 0x30](0.786459)[HC 0x06](0.786559)
[HC 0x23](0.787151)
[Port 80: 0x33](0.788116)[HC 0x87](0.788378)
[Port 80: 0x55](0.814009)[hash done 20d03054528db6d2daeefef8b98719dcd2271a7db6b4eddb75d66db3165b2207](0.818749)
[Port 80: 0x37](0.888037)[HC 0x8f](0.889781)
[HC 0x87](0.893403)
[Port 80: 0x74](1.035037)[HC 0x8d](1.043504)
[Port 80: 0x75](1.044122)[HC 0x8e](1.044402)
[event clear 0x00000080](1.044743)
[event clear 0x00002000](1.045066)
[event clear 0x00200000](1.045402)
[event clear 0x00400000](1.045743)
[ACPI query = 0](1.046091)
[Port 80: 0x75](1.086037)[HC 0x8b](1.087196)
[ACPI query = 0](1.087564)
[HC 0x8a](1.088123)
[Port 80: 0x75](1.090037)[KB enable](1.093521)
[KB scancode set to 2](1.098558)
[KB IRQ enable](1.100599)
[KS enable](1.101627)
[HC 0x01](1.104328)
[HC 0x02](1.104868)
[HC 0x87](1.107452)
[Port 80: 0x9d](1.135037)[HC 0x06](1.135458)
[Port 80: 0xaa](1.180037)[HC 0x0b](1.185801)
[HC 0x400b](1.186985)
[HC 0x02](1.189538)
[HC 0x8f](1.191750)
[HC 0x02](1.192270)
[HC 0x2a](1.194759)
[HC 0xd2](1.196320)
[Executing host reboot command 2](1.197216)
[Jumping to image RW](1.210820)
littlefw chell_v1.9.172-8db02d9
lfw-RW load
[UART initialized after sysjump](1.213737)
[RW, chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2](Image:)
[Inits done](1.214741)
[already in S0](1.214991)
[low power idle task started](1.215528)
[hash start 0x00040000 0x00019cb4](1.220809)
[KB IRQ enable](1.221140)
[KB enable](1.221199)
[PB init-jumped](1.221252)
[chipset -> S0](1.224462)
[event set 0x00200000](1.224527)
[TCPC p1 ready](1.225836)
[TCPC p0 ready](1.228339)
C1 st2
C0 st2
[KB init state: -- -- -- -- -- -- -- -- -- -- -- -- --](1.231432)
[KB wait](1.231638)
[PB task 0 = idle](1.231698)
[PB task 0 = idle, wait -1](1.231800)
Console is enabled; type HELP for help.
> [event set 0x00002000](1.231959)
[hostcmd init 0x202000](1.232040)
[power state 3[1.259373 event set 0x00000080](1.232214)
[event set 0x00400000](1.259492)
[Battery 73% / 165h:7 to empty](1.260220)
[HC 0x01](1.264818)
[HC 0x15](1.265036)
+[HC 0xd2](1.284515)
[Executing host reboot command 5](1.284581)
[HC 0x4002](1.284928)
[CL: p-1 s-1 i0 v0](1.285447)
[HC 0x402a](1.288903)
[HC 0x40d2](1.294262)
[TCPC p0 reset!](1.321466)
[TCPC p1 reset!](1.322464)
[HC 0x01](1.345632)
[HC 0x4015](1.345818)
+[HC 0x40d2](1.348611)
[HC 0xa0](1.352793)
[HC 0xb6](1.356904)
[HC 0x02](1.697479)
[KB disable](1.699492)
[KS disable](1.699576)
[HC 0x8a](1.967314)
[event clear 0x00000080](1.967479)
[event clear 0x00002000](1.967561)
[event clear 0x00200000](1.967646)
[event clear 0x00400000](1.967733)
[ACPI query = 0](1.967821)
[HC 0x8b](1.967986)
[hash done 20d03054528db6d2daeefef8b98719dcd2271a7db6b4eddb75d66db3165b2207](2.022813)
[HC 0x0b](2.423591)
[HC 0x400b](2.424286)
[HC 0x08](2.428413)
[HC err 3](2.428898)
[HC 0x28](2.429735)
[HC err 1](2.430012)
+[HC err 1](2.430590)
+[HC err 1](2.431117)
+[HC err 1](2.431590)
+[HC err 1](2.432076)
+[HC err 1](2.432709)
+[HC err 1](2.433377)
[HC 0x112](2.433972)
[HC 0x0d](2.434712)
[HC 0x4112](2.435346)
[command 0x112 returned error 1](2.440231)
[HC err 1](2.440743)
[HC 0x400d](2.441128)
++++[KB IRQ disable](3.476736)
[KB IRQ enable](3.477418)
[KB enable](3.477686)
[[.482242 KS enable]
[ACPI kblight 10](7.424378)[HC 0x103](8.205776)
[ACPI kblight 0](8.739188)[HC 0x01](8.898522)
[DPTF sensor 1, threshold -73 C, index 0, disabled](9.866666)
[DPTF sensor 1, threshold -73 C, index 1, disabled](9.867529)
[DPTF sensor 2, threshold -73 C, index 0, disabled](9.869115)
[DPTF sensor 2, threshold -73 C, index 1, disabled](9.870105)
[DPTF sensor 3, threshold -73 C, index 0, disabled](9.871701)
[DPTF sensor 3, threshold -73 C, index 1, disabled](9.872634)
[DPTF sensor 4, threshold -73 C, index 0, disabled](9.874219)
[DPTF sensor 4, threshold -73 C, index 1, disabled](9.875025)
[KB disable](10.978115)
[KS disable](10.978455)
[KB IRQ disable](10.978819)
[KB IRQ enable](10.979217)
[ACPI query = 0](11.039486)
[Port 80: 0x1002](12.062041)[LPC RESET# asserted](12.062324)
[power state 3 = S0, in 0x0033](12.062984)
[power state 8 = S0->S3, in 0x0023](12.063534)
[event set 0x00200000](12.064422)
[chipset -> S3](12.065200)
[power state 2 = S3, in 0x0022](12.090929)
[RSMRST: 0](12.091534)
[power state 9 = S3->S5, in 0x0022](12.091787)
[chipset -> S5](12.092397)
[power state 1 = S5, in 0x0022](12.092674)
[power state 1 = S5, in 0x0022](12.093093)
[Disable console in deepsleep](16.216281)
[power state 10 = S5->G3, in 0x0022](22.093625)
[Forcing fake G3.](22.094291)
[power state 0 = G3, in 0x0022](22.094584)
help
Known commands:
      8042           ctrlram        hostevent      panicinfo      sysjump
      adc            cutoff         i2cscan        pd             syslock
      amonbmon       dptftemp       i2cxfer        pdcmd          taskinfo
      apreset        dsleep         idlestats      port80         temps
      apshutdown     flashinfo      kbd            powerbtn       thermalget
      apthrottle     flashwp        kblight        powerindebug   thermalset
      battery        gettime        kblog          powerinfo      typec
      battfake       gpioget        kbpress        pwmduty        typematic
      chan           gpioset        ksstate        reboot         version
      charger        hcdebug        lidclose       rw             waitms
      chgoverride    help           lidopen        shmem          wireless
      chgstate       hibdelay       lpcinit        sleepmask
      codeset        hibernate      md             spi_flashinfo
      crash          history        mmapinfo       sysinfo
> version
Chip:    smsc mec1322 81
Board:   4
RO:      chell_v1.9.172-8db02d9
RW:      chell_v1.9.172-8db02d9
Build: chell_v1.9.172-8db02d9 2016-04-14 00:52:59 @build196-m2
>

The Winbond 25X40CL on the right hand side of the board is for the EC, not the CPU. It is hard to grab anyway.

2016 Heads

Last update: November 8, 2020