coreboot on PC Engines Alix 2c3

IMG_2883.JPG
I’ve been following coreboot (formally LinuxBIOS) for quite a while but my last attempt to run it ended disastrously a couple of years back on the defunct coreboot 3 branch, requiring an RMA for a new Alix 2c3 board & the purchase of additional tools.
A ThinkPad X60s was offered up by my friendly local “old computer” pusher which I chose to try coreboot on but before I bricked that, I thought I’d try the Alix again as I was in possession of the everything needed to debug or recover the board if things went wrong.
A lot of time was wasted trying to get things built on OS X & diverged into briefly trying CentOS 7 (systemd, run away) before settling on Debian 7.6 to build on.

Running apt-get install gcc make libncurses-dev doxygen iasl gdb flex bison will install the necessary dependencies to build coreboot on Debian following the build guide.

Selecting a board from the menu should set the ROM size as well but I was advised to double check, on the Alix 2c3 the flash chip is located under the board, my board had a AMIC A49LF040ATY-33F.
IMG_2891

Once the image was built, coreboot.rom was copied to the Alix running FreeBSD/i386 10-RELEASE & flashed with sysutils/flashrom built from ports.
Flashrom currently assumes that there’s a device node named /dev/cpu0 and sysutils/devcpu-data offers the necessary device but on FreeBSD it’s named /dev/cpuctl0, a symlink allows you to work around the hardcoded assumption once the micro_code service has been started.

service micro_code onestart
ln -s /dev/cpuctl0 /dev/cpu0

coreboot can then be programmed with flashrom -p internal:laptop=this_is_not_a_laptop -w ~/coreboot.rom

flashrom v0.9.7-r1711 on FreeBSD 10.0-RELEASE-p7 (i386)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop… delay loop is unreliable, trying to continue OK.
========================================================================
WARNING! You may be running flashrom on an unsupported laptop. We could
not detect this for sure because your vendor has not setup the SMBIOS
tables correctly. You can enforce execution by adding
‘-p internal:laptop=this_is_not_a_laptop’ to the command line, but
please read the following warning if you are not sure.

Laptops, notebooks and netbooks are difficult to support and we
recommend to use the vendor flashing utility. The embedded controller
(EC) in these machines often interacts badly with flashing.
See the manpage and http://www.flashrom.org/Laptops for details.

If flash is shared with the EC, erase is guaranteed to brick your laptop
and write may brick your laptop.
Read and probe may irritate your EC and cause fan failure, backlight
failure and sudden poweroff.
You have been warned.
========================================================================
Proceeding anyway because user forced us to.
Found chipset “AMD CS5536”. Enabling flash write… OK.
Warning: unexpected second chipset match: “AMD CS5536”
ignoring, please report lspci and board URL to flashrom@flashrom.org
with ‘CHIPSET: your board name’ in the subject line.
Found AMIC flash chip “A49LF040A” (512 kB, LPC) at physical address 0xfff80000.
Reading old flash chip contents… done.
Erasing and writing flash chip… Erase/write done.
Verifying flash… VERIFIED.

Power cycling the box will result in text output or garbage depending on if your console speed settings have changed or not, coreboot defaults to the speed of 115200bps, the factory default speed of Alix is 38400bps & the default console speed of FreeBSD is 9600bps.

When attempting to generate a new image with different settings be sure to make clean before starting.
In my image I removed the “PS/2 keyboard init” option from the “Generic Drivers” menu. Still todo is building an image with PXE support, test booting other BSD’s, try different payloads, in particular Open Firmware & generate status data for submission to change board support status on wiki.

IMG_2886.JPG

Through the previously failed attempt to run coreboot 3 I ended up with a LPC.1a & a POST.5a mini-pci board, the LPC.1a is absolutely essential for testing if you do not have more advanced equipment which would allow you to re-program the flash chip. The LPC.1a is a secondary BIOS chip which can override the onboard the flash, allowing you to boot the system & reprogram the onboard chip again. J2 jumper allows you to select which chip to boot from. When reflashing the chip on the motherboard with flashrom with the LPC.1a inserted (and set to read only), flashrom trashed the image on the onboard chip. Rebooting the system & carefully removing the LPC.1a before re-flashing allowed the process to complete successfully.

Bricking & Unbricking a Dell Inspiron Mini 9

I dusted off an old Dell Mini 9 netbook I had lying around, I’d stopped using it as the netbook refused to charge its battery once it’d run down completely (easily do-able if the machine is used lightly & could go up to a month without use), after the second battery It happend to, I gave up on it.
A side effect of the battery being run down was that it was not possible to flash the BIOS through windows, Phoenix WinPhlash refuses to write to the flash if there is no battery detected & exits with error code: -144.
This is not an issue on DOS using the phlash16 utility. Here lies a different kind of madness, as it’s attempting to write to the flash it stops using the mains & switches to battery power source, which if you have an unchargable battery results in bricking the netbook.
At this point, you can perform a flash recovery using a boot floppy containing a special boot sector, the phlash16 utility, some library and a copy of the image to flash named as BIOS.WPH generated with the BIOS recovery tool.
To initiate the recovery mode, the power and battery need to be removed, a USB floppy drive connected (of the left hand side ports only the USB port closest to the SD card reader worked on mine). With the Fn & B keys held down on the keyboard, connect the power whilst continuing to hold the keys down. At this point the power light should switch on. Press the power button & when you hear a beep, let go of the keyboard keys.
After a moment the system will begin reading the floppy & once reflashing commences, the system will begin beeping, once it has finished the system will reboot & startup normally.
I was unable to find working links for prepared images which I could write using dd so instead had to resort to finding another machine running Windows XP & a USB floppy drive but I’ve imaged the floppies I created so hopefully It wont be a repeated exercise.

The images can be written to a USB flash drive & used to recover a Mini 9

A04 Bios recovery image
A07 Bios recovery image

If you have a faulty or uncharged battery & you intend to use the phlash16 utility, remove the battery before attempting to flash the BIOS.

More on the ThinkPad X61s

I came across a couple of bits of information which are useful if your looking to improve performance on your ThinkPad.
First thing is though the X61s is specced as a system only capable of running 4GB of RAM, it can in fact take up to 8GB using 2x 4GB PC2-5300 or 6400 sodimms, Its can be quiet an expensive upgrade but very useful if you’re taking advantage of the VT extension on your CPU.
Second thing is the ICH8M chipset actually supports SATA II at 3Gbps but is soft locked in the bios to 1.5Gbps, this is a big difference in terms of performance, there is lots of information/rants/flames regarding the matter as it seems other vendors implemented the same restriction (completely missed this), it appears that there is a negotiation problem between the ICH8M chipset & marvel PATA to SATA bridges, this post provides a good summary of the situation & what changes are required to a bios image, but theres no need to get your hands dirty, there are modified bios images available from a couple of sources, I used the image available on the same forum, there are images available for other ThinkPads too, covering the X300, T61, T61p, R61 & R61e.

dmesg snippet from FreeBSD 9.0 before

ahci0: port 0x1c30-0x1c37,0x1c24-0x1c27,0x1c28-0x1c2f,0x1c20-0x1c23,0x1c00-0x1c1f mem 0xf8426000-0xf84267ff irq 16 at device 31.2 on pci0
ahci0: attempting to allocate 1 MSI vectors (4 supported)
msi: routing MSI IRQ 258 to local APIC 0 vector 58
ahci0: using IRQ 258 for MSI
ahci0: AHCI v1.10 with 3 1.5Gbps ports, Port Multiplier not supported
ahci0: Caps: 64bit NCQ SNTF ALP AL CLO 1.5Gbps PMD SSC PSC 32cmd CCC 3ports
ahci0: Caps2:

& after

ahci0: port 0x1c30-0x1c37,0x1c24-0x1c27,0x1c28-0x1c2f,0x1c20-0x1c23,0x1c00-0x1c1f mem 0xf8426000-0xf84267ff irq 16 at device 31.2 on pci0
ahci0: attempting to allocate 1 MSI vectors (4 supported)
msi: routing MSI IRQ 258 to local APIC 0 vector 58
ahci0: using IRQ 258 for MSI
ahci0: AHCI v1.10 with 3 3Gbps ports, Port Multiplier not supported
ahci0: Caps: 64bit NCQ SNTF ALP AL CLO 3Gbps PMD SSC PSC 32cmd CCC 3ports
ahci0: Caps2:

My MacBookPro3,1 is also locked to 1.5Gbps but there doesn’t seem to be any solution at the moment due to the signed firmware images.

Intel ICH8-M AHCI:

Vendor: Intel
Product: ICH8-M AHCI
Link Speed: 1.5 Gigabit
Negotiated Link Speed: 1.5 Gigabit
Description: AHCI Version 1.10 Supported