112 lines
3.4 KiB
Markdown
112 lines
3.4 KiB
Markdown
|
# HP EliteBook series
|
||
|
|
|
||
|
|
This document is about HP EliteBook series laptops up to Ivy Bridge era
|
||
|
|
which use SMSC KBC1126 as embedded controller.
|
||
|
|
|
||
|
|
## EC
|
||
|
|
|
||
|
|
SMSC KBC1098/KBC1126 has been used in HP EliteBooks for many generations.
|
||
|
|
They use similar EC firmware that will load other code and data from the
|
||
|
|
SPI flash chip, so we need to put some firmware blobs to the coreboot image.
|
||
|
|
|
||
|
|
The following document takes EliteBook 2760p as an example.
|
||
|
|
|
||
|
|
First, you need to extract the blobs needed by EC firmware using util/kbc1126.
|
||
|
|
You can extract them from your backup firmware image, or firmware update
|
||
|
|
provided by HP with [unar] as follows:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
wget https://ftp.hp.com/pub/softpaq/sp79501-80000/sp79710.exe
|
||
|
|
unar sp79710.exe
|
||
|
|
${COREBOOT_DIR}/util/kbc1126/kbc1126_ec_dump sp79710/Rompaq/68SOU.BIN
|
||
|
|
mv 68SOU.BIN.fw1 ${COREBOOT_DIR}/2760p-fw1.bin
|
||
|
|
mv 68SOU.BIN.fw2 ${COREBOOT_DIR}/2760p-fw2.bin
|
||
|
|
```
|
||
|
|
|
||
|
|
When you config coreboot, select:
|
||
|
|
|
||
|
|
```text
|
||
|
|
Chipset --->
|
||
|
|
[*] Add firmware images for KBC1126 EC
|
||
|
|
(2760p-fw1.bin) KBC1126 firmware #1 path and filename
|
||
|
|
(2760p-fw2.bin) KBC1126 filename #2 path and filename
|
||
|
|
```
|
||
|
|
|
||
|
|
## Super I/O
|
||
|
|
|
||
|
|
EliteBook 8000 series laptops have SMSC LPC47n217 Super I/O to provide
|
||
|
|
a serial port and a parallel port, you can debug the laptop via this
|
||
|
|
serial port.
|
||
|
|
|
||
|
|
## porting
|
||
|
|
|
||
|
|
To port coreboot to an HP EliteBook laptop, you need to do the following:
|
||
|
|
|
||
|
|
- select Kconfig option `EC_HP_KBC1126`
|
||
|
|
- select Kconfig option `SUPERIO_SMSC_LPC47N217` if there is LPC47n217 Super I/O
|
||
|
|
- initialize EC and Super I/O in romstage
|
||
|
|
- add EC and Super I/O support to devicetree.cb
|
||
|
|
|
||
|
|
To get the related values for EC in devicetree.cb, you need to extract the EFI
|
||
|
|
module EcThermalInit from the vendor UEFI firmware with [UEFITool]. Usually,
|
||
|
|
`ec_data_port`, `ec_cmd_port` and `ec_ctrl_reg` has the following values:
|
||
|
|
|
||
|
|
- For xx60 series: 0x60, 0x64, 0xca
|
||
|
|
- For xx70 series: 0x62, 0x66, 0x81
|
||
|
|
|
||
|
|
You can use [radare2] and the following [r2pipe] Python script to find
|
||
|
|
these values from the EcThermalInit EFI module:
|
||
|
|
|
||
|
|
```python
|
||
|
|
#!/usr/bin/env python
|
||
|
|
|
||
|
|
# install radare2 and use `pip3 install --user r2pipe` to install r2pipe
|
||
|
|
|
||
|
|
import r2pipe
|
||
|
|
import sys
|
||
|
|
|
||
|
|
if len(sys.argv) < 2:
|
||
|
|
fn = "ecthermalinit.efi"
|
||
|
|
else:
|
||
|
|
fn = sys.argv[1]
|
||
|
|
|
||
|
|
r2 = r2pipe.open(fn)
|
||
|
|
r2.cmd("aa")
|
||
|
|
entryf = r2.cmdj("pdfj")
|
||
|
|
|
||
|
|
for insn in entryf["ops"]:
|
||
|
|
if "lea r8" in insn["opcode"]:
|
||
|
|
_callback = insn["ptr"]
|
||
|
|
break
|
||
|
|
|
||
|
|
r2.cmd("af @ {}".format(_callback))
|
||
|
|
callbackf_insns = r2.cmdj("pdfj @ {}".format(_callback))["ops"]
|
||
|
|
|
||
|
|
def find_port(addr):
|
||
|
|
ops = r2.cmdj("pdfj @ {}".format(addr))["ops"]
|
||
|
|
for insn in ops:
|
||
|
|
if "lea r8d" in insn["opcode"]:
|
||
|
|
return insn["ptr"]
|
||
|
|
|
||
|
|
ctrl_reg_found = False
|
||
|
|
|
||
|
|
for i in range(0, len(callbackf_insns)):
|
||
|
|
if not ctrl_reg_found and "mov cl" in callbackf_insns[i]["opcode"]:
|
||
|
|
ctrl_reg_found = True
|
||
|
|
ctrl_reg = callbackf_insns[i]["ptr"]
|
||
|
|
print("ec_ctrl_reg = 0x%02x" % ctrl_reg)
|
||
|
|
cmd_port = find_port(callbackf_insns[i+1]["jump"])
|
||
|
|
data_port = find_port(callbackf_insns[i+3]["jump"])
|
||
|
|
print("ec_cmd_port = 0x%02x\nec_data_port = 0x%02x" % (cmd_port, data_port))
|
||
|
|
|
||
|
|
if "mov bl" in callbackf_insns[i]["opcode"]:
|
||
|
|
ctrl_value = callbackf_insns[i]["ptr"]
|
||
|
|
print("ec_fan_ctrl_value = 0x%02x" % ctrl_value)
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
[unar]: https://theunarchiver.com/command-line
|
||
|
|
[UEFITool]: https://github.com/LongSoft/UEFITool
|
||
|
|
[radare2]: https://radare.org/
|
||
|
|
[r2pipe]: https://github.com/radare/radare2-r2pipe
|