Samsung Chromebook 3 for coreboot development - evaluation

[Piotr Król]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi all,
I'm evaluating mentioned Chromebook as platforms for custom firmware
development. I'm trying to find some evidence that playing with
coreboot would be possible and source code is already available
publicly, so I can build my custom firmware for that platform.

Unfortunately information are not clear to me:
* both mainline coreboot and chromium fork on master contain only
stumpy and lumpy in mainboard/samsung
* same thing for coreboot supported motherboards
* Samsung Chromebook 3 is identified as:
- - board name: celes
- - base board: stargo
Some code for celes can be found on firmware-celes-7287.92.B branch.
depthcharge also contain that branch.
* There are various versions of Samsung Chromebook 3 XE500C13-K01US to
K05US, are there any difference from firmware point of view ?

There are no guides for this Chromebook firmware flashing, is there
anyone actively working on this platform ?

What is the status of firmware building and flashing for this platform ?

Any information about firmware status for this platform would be
appreciated.

Best Regards,
- --
Piotr Król
Embedded Systems Consultant
https://3mdeb.com | @3mdeb_com
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE4DCbLYWmfoRjKeNLsu5x6WeqnkwFAlmSIoYACgkQsu5x6Weq
nkwK5w//a5L/nUt5wWxphOy26QGUxm+AGrC0uvyDhqQBV4zEQtu4UG7crRGWbnjY
iDy0iIIJMkmFk2YuEqI2zbm6FOvAJvecYVCqxPZOFQIgs92AzxLJaqdtuj9RD9Fj
T+zGYHADVXOQkdXNX7IeZ4QaPrMlVNTzH+YnXtx+Zmibx8m+l3cXxqLkJzeFpTdI
UEC1wE47oYCxe5S7xrzqwOwj6AX/DvCFcuFCuq0dxFHWGK0UYShI8pNJPUgZx3nz
BDUvvgp087iw4zPgCCw+ay30xpCw5/DaF7Kl1okocSKWtRWW8s6MX6DhUeoACRwM
KoZJ0AYyJcFPlJWMSMrOYdH63BgjnbodLCTASvhaji4HvYZruI4NlRfyfwmH3OEb
HxWSu4g+JpgMbzdFS3GcChqmgf3Soy75nJUl6RvbDmpb/JALBc+5qMNZ76fMBr8f
aklZdFrcYX5PFIybzcUt3CpF1WP8lc3F+vQYI+/XR/2daBGgfmxqBOYoPvTuIKF9
QQpo9utYQ63K9FME93p9Yexif8QW4nC0hjuqFgyQqxmIY03OVWYoAfhPEGCizma/
5pRDFyZXZtWjJkVhe9b1w7rZZnPRHcRrkclpWmGqodiP0PsDbYxv0oWrzmfsP7ds
kxSPJ0HL85gLu6mbbAu5BSB94eOveZr+nryPiEMS2Hw89Eeg0fQ=
=L0wN
-----END PGP SIGNATURE-----

[Mike Frysinger]

unless you want to do a lot of work, stick to the firmware branch that matches your device (celes)

CrOS systems have read-write firmware slots so it's possible to do development/testing and update those so you don't brick the read-only firmware slots.  or you can chain load it.  if you search dev.chromium.org for "coreboot", you'll find a lot of docs like this one:

http://dev.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware

-mike

--
--
Chromium OS discuss mailing list: chromium-os-discuss@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-os-discuss?hl=en

[Piotr Król]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 08/15/2017 06:14 AM, Mike Frysinger wrote:

Hi Mike,

> unless you want to do a lot of work, stick to the firmware branch
> that matches your device (celes)
>
> CrOS systems have read-write firmware slots so it's possible to do
> development/testing and update those so you don't brick the
> read-only firmware slots. or you can chain load it. if you

> search dev.chromium.org <http://dev.chromium.org> for "coreboot",

> you'll find a lot of docs like this one:
> http://dev.chromium.org/chromium-os/developer-information-for-chrome-o
s-devices/custom-firmware

I
>
read that page, but it is not exactly clear to me what in case of
Celse is in RO and RW block. It looks like coreboot is in RO - this
doesn't seem to help me much.

I assume this Chromebook use depthcharge. Is it safe to assume
depthcharge will be in RW region and I can modify that as I wish ?
Will recovery procedure work for this Chromebook ? Anyone tried that ?

Best Regards,
- --
Piotr Król
Embedded Systems Consultant
https://3mdeb.com | @3mdeb_com
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE4DCbLYWmfoRjKeNLsu5x6WeqnkwFAlmTZDYACgkQsu5x6Weq
nkwx/g//fJD56tDtdBpXvC0kl68r2h+qJ94wKGqBF1T4+7dYk/sSEx7Lt4SIGlyD
8hhAgWE0IuPU6P3O0sbgDWJr8STKkFGFpK+awG4E9SJaTi5Al5Ms61KFZmIaN0Pu
xYEu4YNznOekf3vMU0hcwBEwKqNovIJv+F3Lc+w9u4sJa6JIwxquLxhFVqXnyfh4
cIG3QbY6DrkaHfwgkN4cNr37OVWWB8HTHrUQIIG9RdTTkxO5/0j/svSBkAxP/L22
SUH+MtQBkcluuGlB6Bq7QgiXIHRsG+GktGem1TfQc/FiBRXHwFWQPqBXMV1OcAax
mOywLYqndjp4bVPZsH3go7iUxZhRmsTmCsE2i5u5JXgt0O/XxLDtIV3z6nUsZF/4
xQn1NJ3rFdMI3mveJi3TH9Hj1JCBPcHPn+bXXEhcZZSfe3M+5W4mPjdq1DQFYPt5
9Jg9WYnG8YFNB5OwDK5mOr9mBbL2p1cxN7AH527qvrD6DZgcuwEcbpYo2Q69P9Fz
tpq23wo/yVGMuxdUu/brye4+M37g9leKoQd6d9oBf0XgRSBaiUlj6UdcubtuiMh9
giw7HqcZNPpv+PA2ATAmOpJFN5Ftk3rf9ZUBdLFEaIutYQ8X7n2Ic9qHpAzj1Gth
rmYAAf3v+ldG5AJQJmOBgLC09qFZ/Pl7g57S5mzxe3BS5VbrCxs=
=uc08
-----END PGP SIGNATURE-----

[Mike Frysinger]

On Tue, Aug 15, 2017 at 5:14 PM, Piotr Król <piotr...@3mdeb.com> wrote:
> On 08/15/2017 06:14 AM, Mike Frysinger wrote:
> > unless you want to do a lot of work, stick to the firmware branch
> > that matches your device (celes)
> >
> > CrOS systems have read-write firmware slots so it's possible to do
> > development/testing and update those so you don't brick the
> > read-only firmware slots.  or you can chain load it.  if you
> > search dev.chromium.org <http://dev.chromium.org> for "coreboot",
> > you'll find a lot of docs like this one:
> > http://dev.chromium.org/chromium-os/developer-information-for-chrome-o
> s-devices/custom-firmware
>
> I
> >
> read that page, but it is not exactly clear to me what in case of
> Celse is in RO and RW block. It looks like coreboot is in RO - this
> doesn't seem to help me much.
>
> I assume this Chromebook use depthcharge. Is it safe to assume
> depthcharge will be in RW region and I can modify that as I wish ?
> Will recovery procedure work for this Chromebook ? Anyone tried that ?

i think you'll need to do a bit more reading of the many docs we have in the wiki before trying to hack on things.  all current devices use coreboot & depthcharge.  coreboot takes care of doing low level/bare mini hardware initializing/verification before executing a payload.  that payload is depthcharge which takes care of actually booting the CrOS kernel.

the RO firmware block contains everything the system needs to boot CrOS.  the point of the RW blocks to support in-field upgrades of the firmware -- early on in the startup process, the RO firmware will check to see if the RW firmware block is valid/signed, and if so, hand off execution to that.  then the RW firmware will boot up as if it were RO firmware.

you can modify the RW block as much as you want, although doing chain loading is probably better for dev hacking as it's easier to recover from if you make a mistake, and updating SSD blocks has got to be faster than updating SPI flash blocks.

if you want to poke around the SPI flash, you can use fmap_decode (flashmap) to see what each block (roughly) is for.  you'll find each copy of the coreboot firmware is stored using cbfs, and in there are various binaries and depthcharge itself.
-mike