102 lines
3.7 KiB
ReStructuredText
102 lines
3.7 KiB
ReStructuredText
|
.. SPDX-License-Identifier: GPL-2.0+
|
||
|
|
.. sectionauthor:: Simon Glass <sjg@chromium.org>
|
||
|
|
|
||
|
|
Chromebook Samus
|
||
|
|
================
|
||
|
|
|
||
|
|
First, you need the following binary blobs:
|
||
|
|
|
||
|
|
* descriptor.bin - Intel flash descriptor
|
||
|
|
* me.bin - Intel Management Engine
|
||
|
|
* mrc.bin - Memory Reference Code, which sets up SDRAM
|
||
|
|
* refcode.elf - Additional Reference code
|
||
|
|
* vga.bin - video ROM, which sets up the display
|
||
|
|
|
||
|
|
If you have a samus you can obtain them from your flash, for example, in
|
||
|
|
developer mode on the Chromebook (use Ctrl-Alt-F2 to obtain a terminal and
|
||
|
|
log in as 'root')::
|
||
|
|
|
||
|
|
cd /tmp
|
||
|
|
flashrom -w samus.bin
|
||
|
|
scp samus.bin username@ip_address:/path/to/somewhere
|
||
|
|
|
||
|
|
If not see the coreboot tree where you can use::
|
||
|
|
|
||
|
|
bash crosfirmware.sh samus
|
||
|
|
|
||
|
|
to get the image. There is also an 'extract_blobs.sh' scripts that you can use
|
||
|
|
on the 'coreboot-Google_Samus.*' file to short-circuit some of the below.
|
||
|
|
|
||
|
|
Then 'ifdtool -x samus.bin' on your development machine will produce::
|
||
|
|
|
||
|
|
flashregion_0_flashdescriptor.bin
|
||
|
|
flashregion_1_bios.bin
|
||
|
|
flashregion_2_intel_me.bin
|
||
|
|
|
||
|
|
Rename flashregion_0_flashdescriptor.bin to descriptor.bin
|
||
|
|
Rename flashregion_2_intel_me.bin to me.bin
|
||
|
|
You can ignore flashregion_1_bios.bin - it is not used.
|
||
|
|
|
||
|
|
To get the rest, use 'cbfstool samus.bin print'::
|
||
|
|
|
||
|
|
samus.bin: 8192 kB, bootblocksize 2864, romsize 8388608, offset 0x700000
|
||
|
|
alignment: 64 bytes, architecture: x86
|
||
|
|
|
||
|
|
============================ ======== =========== ======
|
||
|
|
Name Offset Type Size
|
||
|
|
============================ ======== =========== ======
|
||
|
|
cmos_layout.bin 0x700000 cmos_layout 1164
|
||
|
|
pci8086,0406.rom 0x7004c0 optionrom 65536
|
||
|
|
spd.bin 0x710500 (unknown) 4096
|
||
|
|
cpu_microcode_blob.bin 0x711540 microcode 70720
|
||
|
|
fallback/romstage 0x722a00 stage 54210
|
||
|
|
fallback/ramstage 0x72fe00 stage 96382
|
||
|
|
config 0x7476c0 raw 6075
|
||
|
|
fallback/vboot 0x748ec0 stage 15980
|
||
|
|
fallback/refcode 0x74cd80 stage 75578
|
||
|
|
fallback/payload 0x75f500 payload 62878
|
||
|
|
u-boot.dtb 0x76eb00 (unknown) 5318
|
||
|
|
(empty) 0x770000 null 196504
|
||
|
|
mrc.bin 0x79ffc0 (unknown) 222876
|
||
|
|
(empty) 0x7d66c0 null 167320
|
||
|
|
============================ ======== =========== ======
|
||
|
|
|
||
|
|
You can extract what you need::
|
||
|
|
|
||
|
|
cbfstool samus.bin extract -n pci8086,0406.rom -f vga.bin
|
||
|
|
cbfstool samus.bin extract -n fallback/refcode -f refcode.rmod
|
||
|
|
cbfstool samus.bin extract -n mrc.bin -f mrc.bin
|
||
|
|
cbfstool samus.bin extract -n fallback/refcode -f refcode.bin -U
|
||
|
|
|
||
|
|
Note that the -U flag is only supported by the latest cbfstool. It unpacks
|
||
|
|
and decompresses the stage to produce a coreboot rmodule. This is a simple
|
||
|
|
representation of an ELF file. You need the patch "Support decoding a stage
|
||
|
|
with compression".
|
||
|
|
|
||
|
|
Put all 5 files into board/google/chromebook_samus.
|
||
|
|
|
||
|
|
Now you can build U-Boot and obtain u-boot.rom::
|
||
|
|
|
||
|
|
$ make chromebook_samus_defconfig
|
||
|
|
$ make all
|
||
|
|
|
||
|
|
If you are using em100, then this command will flash write -Boot::
|
||
|
|
|
||
|
|
em100 -s -d filename.rom -c W25Q64CV -r
|
||
|
|
|
||
|
|
Flash map for samus / broadwell:
|
||
|
|
|
||
|
|
:fffff800: SYS_X86_START16
|
||
|
|
:ffff0000: RESET_SEG_START
|
||
|
|
:fffd8000: TPL_TEXT_BASE
|
||
|
|
:fffa0000: X86_MRC_ADDR
|
||
|
|
:fff90000: VGA_BIOS_ADDR
|
||
|
|
:ffed0000: SYS_TEXT_BASE
|
||
|
|
:ffea0000: X86_REFCODE_ADDR
|
||
|
|
:ffe70000: SPL_TEXT_BASE
|
||
|
|
:ffbf8000: CONFIG_ENV_OFFSET (environemnt offset)
|
||
|
|
:ffbe0000: rw-mrc-cache (Memory-reference-code cache)
|
||
|
|
:ffa00000: <spare>
|
||
|
|
:ff801000: intel-me (address set by descriptor.bin)
|
||
|
|
:ff800000: intel-descriptor
|