Coreboot for Macbook2,1

This page documents some effort for a possible coreboot port for the Macbook2,1. This page mainly exists because 1) I cannot keep all the things in memory and thus I possibly can recover from this page and 2) maybe you might be interested on this or for whatever reason might want to comment/help me with the project.

References:

Getting infomations about the Macbook2,1

Visual Inspection

Chips Location

Flash Chip MICROCHIP SST25VF016B
Audio Chip SIGMATEL STAC9220X5
Battery Charger and Power Source Selector:
Intersil ISL6255AHRZ
Logic board bottom side, top left.
Embedded Controller: Renesas H8S/2116V
Cypress CY8C24794-24LFXI
Accelerometer Chip: Kionix KXM52
PWM Controller: Intersil ISL6269CRZ
2-Phase Synchronous Regulator:
Linear Technology LTC3728LX
Logic board bottom side, top right.
Firewire chip: AGERE L-FW32306
SILEGO SLG8LP436V
2-Phase Synchronous Regulator:
Linear Technology LTC3728LX
LAN Filter: DELTA LFE8456A-R
Intersil ISL9504CRZ
Marvell 88E8053-NNC1
Logic board bottom side, bottom left.
Southbridge Intel NH82801GBM
Logic board bottom side.
Northbridge Intel QG82945GM
Processor Intel T7200
Silicon Image Sil 1362ACLU
LAN Filter: DELTA LFE8456A-R
Logic board top side.

Chips Concerning Coreboot

Northbridge
Intel QG82945GM
Wikipedia List of Intel Chipsets
Southbridge
Southbridge Intel NH82801GBM
Intel-82945GM-Graphics-and-Memory-Controller

I/O Controller Hub (ICH) is a family of Intel southbridge microchips used to manage data communications between a CPU and a motherboard


Wikipedia ICH7
datasheet
datasheet (local)
Embedded Controller Embedded Controller: Renesas H8S/2116V
Flash chip Flash chip: SST25VF016B 50-4C-52AF 0707371-A
Audio chip Audio chip: SIGMATEL STAC9220X5
Cypress chip Unknown Purpose: Semiconductor Programmable System-on-Chip mixed-signal array family component The CY8C24794-24LFXI is ideal for human interface devices (HIDs), including mice, keyboards, gamepads and joysticks, as well as uninterruptible power supply (UPS) and other PC peripheral applications.New Chip Provides Traditional PSoC Integration Benefits Plus USB and Cypress CapSense(TM) Technology for HID, UPS and other Applications

Other Chips

Software Inspection

Reference: http://www.coreboot.org/Motherboard_Porting_Guide

# lspci -nnvvvxxxx > lspci.log
lspci.log 
# lspnp -vv > lspnp.log

Couldn't find this executable

# lsusb -vvv > lsusb.log
lsusb.log 
# superiotool -deV > superiotool.log
superiotool.log 
# inteltool -a > inteltool.log
inteltool.log 
# ectool > ectool.log
ectool.log 
# msrtool > msrtool.log
msrtool.log 
# dmidecode > dmidecode.log

I changed the Serial Number and the UUID

dmidecode.log 
# biosdecode > biosdecode.log
biosdecode.log 
# nvramtool -x > nvramtool.log
nvramtool.log 
# dmesg > dmesg.log
dmesg.log 
# flashrom -V -p internal:laptop=force_I_want_a_brick > flashrom_info.log
flashrom_info.log 
# flashrom -V -p internal:laptop=force_I_want_a_brick -r rom.bin > flashrom_read.log
flashrom_read.log

ACPI

# acpidump >acpidump.log
acpidump.log
see https://wiki.archlinux.org/index.php/DSDT
Extract ACPI tables (as root): 
# cat /sys/firmware/acpi/tables/DSDT > dsdt.dat
dsdt.dat
decompile 
$ iasl -d dsdt.dat
dsdt.dsl
There are four sections with _PRT data:

ACPI file structure in coreboot

src/mainboard/apple/macbook21/dsdt.asl
  include src/mainboard/apple/macbook21/acpi/platform.asl
  include src/southbridge/intel/i82801gx/acpi/globalnvs.asl
  include src/mainboard/apple/macbook21/acpi/gpe.asl
    include src/mainboard/apple/macbook21/smi.h
  include src/mainboard/apple/macbook21/acpi/mainboard.asl
  include src/northbridge/intel/i945/acpi/i945.asl
    include src/northbridge/intel/i945/acpi/hostbridge.asl
      include src/arch/x86/include/arch/ioapic.h
      include src/mainboard/apple/macbook21/acpi/i945_pci_irqs.asl
    include src/northbridge/intel/i945/i945.h
      include src/southbridge/intel/i82801gx/i82801gx.h
        include src/southbridge/intel/i82801gx/chip.h
    include src/northbridge/intel/i945/acpi/peg.asl
    include src/northbridge/intel/i945/acpi/igd.asl
    include src/mainboard/apple/macbook21/acpi/video.asl
      include src/mainboard/apple/macbook21/smi.h
  include src/southbridge/intel/i82801gx/acpi/ich7.asl
    include src/southbridge/intel/i82801gx/acpi/audio.asl
    include src/southbridge/intel/i82801gx/acpi/pcie.asl
    include src/southbridge/intel/i82801gx/acpi/usb.asl
    include src/southbridge/intel/i82801gx/acpi/pci.asl
      include src/mainboard/apple/macbook21/acpi/ich7_pci_irqs.asl
    include src/southbridge/intel/i82801gx/acpi/ac97.asl
    include src/southbridge/intel/i82801gx/acpi/lpc.asl
      include src/southbridge/intel/i82801gx/acpi/irqlinks.asl
      include src/mainboard/apple/macbook21/acpi/ec.asl
        include src/ec/apple/h8/acpi/ec.asl
          include src/mainboard/apple/macbook21/smi.h
          include src/ec/apple/h8/acpi/ac.asl
          include src/ec/apple/h8/acpi/battery.asl
          include src/ec/apple/h8/acpi/sleepbutton.asl
          include src/ec/apple/h8/acpi/lid.asl
          include src/ec/apple/h8/acpi/beep.asl
          include src/ec/apple/h8/acpi/thermal.asl
          include src/ec/apple/h8/acpi/systemstatus.asl
      include src/mainboard/apple/macbook21/acpi/superio.asl
    include src/southbridge/intel/i82801gx/acpi/pata.asl
    include src/southbridge/intel/i82801gx/acpi/sata.asl
    include src/southbridge/intel/i82801gx/acpi/smbus.asl
  include src/southbridge/intel/i82801gx/acpi/sleepstates.asl

What did this get?

Eeprom/flash chip

Seems to be SST25VF016B. Nice, flashrom supports this chip. (Same chip as in my Thinkpad X60). What about those Block Protect things?

Probing for SST SST25VF016B, 2048 kB: probe_spi_rdid_generic: id1 0xbf, id2 0x2541
Found SST flash chip "SST25VF016B" (2048 kB, SPI) at physical address 0xffe00000.
Chip status register is 0x1c.
Chip status register: Block Protect Write Disable (BPL) is not set
Chip status register: Auto Address Increment Programming (AAI) is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is set
Chip status register: Block Protect 1 (BP1) is set
Chip status register: Block Protect 0 (BP0) is set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
Resulting block protection : all

Would it be possible to write to the chip? Is there some trick necessary, e.g. as for Thinkpad X60?

Northbridge and Southbridge

Northbridge: 8086:27a0 (945GM) (same as Thinkpad X60)

Southbridge: 8086:27b9 (ICH7-M) (same as Thinkpad X60)

EC

Um, there are much more 00's than for the Thinkpad X60. Not sure what this means

EC RAM:

00: 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
20: 00 80 16 16 80 00 4f 4e 30 31 36 00 00 00 00 00 
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
40: 00 00 00 00 02 14 11 10 02 00 00 00 00 00 00 00 
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

Not dumping EC IDX RAM.

USB/EHCI Debug Port

Reference: http://www.coreboot.org/EHCI_Debug_Port

Macbook2,1: 

# for i in $(lspci|grep EHCI|cut -f1 -d' ') ; do
# lspci -vs $i
# done
00:1d.7 USB controller: Intel Corporation NM10/ICH7 Family USB2 EHCI Controller (rev 02) (prog-if 20 [EHCI])
        Subsystem: Intel Corporation Device 7270
        Flags: medium devsel, IRQ 21
        Memory at d0445400 (32-bit, non-prefetchable) [size=1K]
        Capabilities: [50] Power Management version 2
        Capabilities: [58] Debug port: BAR=1 offset=00a0
        Kernel driver in use: ehci-pci
        Kernel modules: ehci_pci
# for i in $(lspci|grep EHCI|cut -f1 -d' ') ; do
# lspci -ns $i
# done
00:1d.7 0c03: 8086:27cc (rev 02)

Thinkpad X60: 

# for i in $(lspci|grep EHCI|cut -f1 -d' ') ; do
# lspci -vs $i
# done
00:1d.7 USB controller: Intel Corporation NM10/ICH7 Family USB2 EHCI Controller (rev 02) (prog-if 20 [EHCI])
        Subsystem: Lenovo ThinkPad T60/R60 series
        Flags: medium devsel, IRQ 19
        Memory at e4444000 (32-bit, non-prefetchable) [size=1K]
        Capabilities: [50] Power Management version 2
        Capabilities: [58] Debug port: BAR=1 offset=00a0
        Kernel driver in use: ehci-pci
        Kernel modules: ehci_pci
# for i in $(lspci|grep EHCI|cut -f1 -d' ') ; do
# lspci -ns $i
# done
00:1d.7 0c03: 8086:27cc (rev 02)

USB deport is available and apart from the IRQ and the Memory address it's the same as for the Thinkpad X60.

Exercise: Debug the Thinkpad X60 (done)

Debugging coreboot on the Thinkpad X60 by use of the Beaglebone Black and the EHCI gadget debug

References:

  1. http://www.coreboot.org/EHCI_Gadget_Debug
  2. http://johnlewis.ie/coreboot-ehci-debug-gadget-demonstration/

  1. On the Beaglebone Black add the patches from reference 1 to the kernel.
  2. Compile and install coreboot for the Thinkpad X60 with debug modus on.
  3. Power on the Beaglebone Black and load the kernel module g_dbgp. Disable some CR/LF translations on the device: stty -icrnl -inlcr -F /dev/ttyGS0.
  4. Connect the Beaglebone Black to the Thinkpad X60 with a standard usb cable before powering on the Thinkpad.
  5. On the Beaglebone Black monitor the debug channel: cat /dev/ttyGS0
  6. Power on the Thinkpad and watch the coreboot debug output on the Beaglebone Black
Note: the correct USB port on the Thinkpad was found by trial and error. Two of the three USB ports simply keep silent during the power on, one USB port outputs the debug information.

Exercise: Find the USB debug port on the Macbook2,1 (done)

$ dmesg
[    2.530098] ehci-pci 0000:00:1d.7: EHCI Host Controller
[    2.530154] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 5
[    2.530173] ehci-pci 0000:00:1d.7: debug port 1

# lsusb -t
/:  Bus 05.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/8p, 480M
    |__ Port 1: Dev 5, If 0, Class=Mass Storage, Driver=usb-storage, 480M
    |__ Port 4: Dev 3, If 0, Class=Vendor Specific Class, Driver=, 480M
/:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    |__ Port 2: Dev 2, If 0, Class=Human Interface Device, Driver=usbhid, 12M
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    |__ Port 2: Dev 2, If 0, Class=Human Interface Device, Driver=usbhid, 12M
    |__ Port 2: Dev 2, If 1, Class=Human Interface Device, Driver=appletouch, 12M
    |__ Port 2: Dev 2, If 2, Class=Human Interface Device, Driver=usbhid, 12M

Found it. The kernel says it has the EHCI Host Controller at USB bus number 5 with the debug port at port 1. And lsusb says the USB stick is listed as port 1 on bus 5. Note that the bus number is not consistent during reboot. The appropriate physical USB connector is the one next to the Firewire connector. This connector is labeled J5200 on the PCB (see the above photo with the logic board top side). Assumption: Using the Beaglebone Black for monitoring this debug port should work the same way as for the Thinkpad X60.

External EPROM/Flash programmer

References:

  1. http://www.coreboot.org/Developer_Manual/Tools#External_EPROM.2FFlash_programmer_that_can_program_the_flash_chip_on_your_motherboard
  2. http://flashrom.org/Supported_programmers
  3. http://www.linux.com/learn/tutorials/746860-how-to-access-chips-over-the-spi-on-beaglebone-black
  4. Compiling an Overlay by adafruit
  5. Alternative overlay source code

Question: Can the Beaglebone Black be used as an external programmer to write coreboot to the macbook's SST25VF016B chip?

In list of supported external programmers for flashrom [2], the Beaglebone Black is NOT listed. But the Raspberry PI is listed.

Reference [3] shows that the Beaglebone Black can write an EPROM chip via SPI. Flashrom is not used in that example and the EPROM chip is a different one.

Exercise: Enable /dev/spidev on the Beaglebone Black (done)

References:

  1. Enable /dev/spidev on Beaglebone Black
  2. create device tree overlays for BeagleBone Boards

Install a device tree compiler with device tree overlay support on the Beaglebone Black 

# pacman -S alarm/dtc-overlay
Compile the device tree overlay. Soure code: BB-SPI0-01-00A0.dts 
$ dtc -O dtb -o BB-SPI0-01-00A0.dtbo -b 0 -@ BB-SPI0-01-00A0.dts
Copy the device tree overlay to the system firmware directory 
# cp BB-SPI0-01-00A0.dtbo /lib/firmware/
Make the system load the device tree overlay (using user root, sudo won't work). This will create /dev/spidev1.0 
# echo BB-SPI0-01 > /sys/devices/bone_capemgr.9/slots
Dump the device tree (spidev is shown in slot 7) 
$ cat /sys/devices/bone_capemgr.9/slots
 0: 54:PF--- 
 1: 55:PF--- 
 2: 56:PF--- 
 3: 57:PF--- 
 4: ff:P-O-L Bone-LT-eMMC-2G,00A0,Texas Instrument,BB-BONE-EMMC-2G
 5: ff:P-O-L Bone-Black-HDMI,00A0,Texas Instrument,BB-BONELT-HDMI
 7: ff:P-O-L Override Board Name,00A0,Override Manuf,BB-SPI0-01
To disable spidev reboot the system (unload spidev with echo -7 > /sys/devices/bone_capemgr.9/slots crashes).

Exercise: Write something to a SST25VF016B chip (to be done)

Use flashrom on the Beaglebone Black with its /dev/spidev1.0 to write a coreboot.rom file to new SST25VF016B chip.

The file coreboot.rom

coreboot.rom is what will be stored on the EEPROM chip. It has exactly the size of what the EEPROM chip can hold. Its contents is organized by following the Coreboot File System (CBFS, see documentation/cbfs.txt, src/include/cbfs_core.h, Benschop and http://www.coreboot.org/CBFS) and can be viewed with cbfstool: 
$ cbfstool coreboot.rom print
coreboot.rom: 2048 kB, bootblocksize 1592, romsize 2097152, offset 0x0
alignment: 64 bytes

Name                           Offset     Type         Size
cmos_layout.bin                0x0        cmos_layout  1560
cmos.default                   0x640      cmos_default 256
fallback/romstage              0x780      stage        48453
fallback/coreboot_ram          0xc500     stage        83737
fallback/payload               0x20c80    payload      615600
config                         0xb7180    raw          4806
(empty)                        0xb8480    null         1340632
Note that the payload in this example (GRUB2) already involves a background image, and still there is enough empty space to store a second, alternative payload. The output above does not show the CBFS header and the boot block. Both located after the empty part. The CBFS header in a hex editor looks as follows: 
001ff9a0: ffff ffff ffff ffff 4f52 4243 3131 3132  ........ORBC1112
001ff9b0: 0020 0000 0000 0638 0000 0040 0000 0000  . .....8...@....
001ff9c0: 0000 0001 ffff ffff fa66 89c5 b001 e680  .........f......
The CBFS header starts with the magic number 0x4f524243 which is equal to the ASCII-characters ORBC and the CBFS version 0x31313132 (Version 2). It follows the rom size 0x00200000 (2 MiB), the size of the boot block 0x00000638 (1592 bytes), the alignment boundaries of the above shown rom content objects 0x00000040 (64 bytes), the offset of the first stored object 0x0000000, the architecture for which coreboot.rom was built 0x00000001 (x86) and the padding 0xffffffff (not sure about this. may its the pattern that fills empty space?). Directly following the header begins the boot block and fills coreboot.rom up to its very end.

Boot stages

When the computer is powered on, coreboot walks through a number of boot stages:

Stage 1: boot block

The boot block does minimal setup and then passes control to the ROM stage, potentially selecting one out of many. How does the CPU know where the boot block is? Something must be at a defined location and pointing to the boot block, no? (Some assembly code?) The Thinkpad X60 is configured as follows:

bootblock_mainboard_init() in bootblock_simple.c calls bootblock_northbridge_init() and bootblock_southbridge_init(). bootblock_mainboard_init() may also sanitize CMOS using cmos.default before passing to the ROM stage in "fallback/romstage". bootblock_northbridge_init() sets some address for PCIEXBAR given by CONFIG_MMCONF_BASE_ADDRESS=0xf0000000 (3.75 GiB). bootblock_southbridge_init() calls enable_spi_prefetch() (enables prefetching and caching?).

Assumption: Use the same configuration for the boot block on the Macbook2,1 because it has the same northbridge and southbridge.

Stage 2: ROM stage

ROM stage is executed (by the CPU) in-place, i.e. the ROM-stage code is not copied to RAM. It starts with function main in file mainboard/lenovo/x60/romstage.c:

  1. Enable local acpi. enable_lapic() is defined in src/include/cpu/x86/lapic.h and seems to be mainboard independent. --> Copy this.
  2. Force PCI reset (PCIRST). This seems to be done for all mainboards with Intel 945GM northbridge and Intel 82801GX southbridge. --> Copy this.
  3. Enable ICH7 LPC (Low Pin Count) Interface Controller 
    static void ich7_enable_lpc(void)
{                      
  // Enable Serial IRQ
  pci_write_config8(PCI_DEV(0, 0x1f, 0), 0x64, 0xd0);
  // decode range
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x80, 0x0210);
  // decode range
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x82, 0x1f0d);

  /* range 0x1600 - 0x167f */
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x84, 0x1601);
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x86, 0x007c);

  /* range 0x15e0 - 0x10ef */
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x88, 0x15e1);
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x8a, 0x000c);

  /* range 0x1680 - 0x169f */
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x8c, 0x1681);
  pci_write_config16(PCI_DEV(0, 0x1f, 0), 0x8e, 0x001c);
}
    The above function produces on the Thinkpad X60: 
    # lspci -nnvvvxxx -s 00:1f.0
00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02)
	Subsystem: Lenovo ThinkPad T60/R60 series [17aa:2009]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Capabilities: [e0] Vendor Specific Information: Len=0c <?>
	Kernel driver in use: lpc_ich
	Kernel modules: intel_rng, lpc_ich, leds_ss4200
00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 00 00 00 00 00 00 00 00 00 00 00 aa 17 09 20
30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00
40: 01 05 00 00 80 00 00 00 81 04 00 00 10 00 00 00
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 10 02 0d 1f 01 16 7c 00 e1 15 0c 00 81 16 1c 00
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
a0: ac 06 00 00 30 00 00 00 13 1c 0a 00 00 03 00 00
b0: 00 00 f0 00 00 00 00 00 00 00 02 0a 00 00 00 00
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
d0: 33 22 11 00 67 45 00 00 cf ff 00 00 08 00 00 00
e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00
f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
    Looking what the factory BIOS on the Macbook2,1 produces: 
    # lspci -nnvvvxxx -s 00:1f.0
00:1f.0 ISA bridge [0601]: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge [8086:27b9] (rev 02)
	Subsystem: Intel Corporation Device [8086:7270]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Capabilities: [e0] Vendor Specific Information: Len=0c <?>
	Kernel driver in use: lpc_ich
	Kernel modules: intel_rng, lpc_ich, leds_ss4200
00: 86 80 b9 27 07 00 10 02 02 00 01 06 00 00 80 00
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 00 00 00 00 00 00 00 00 00 00 00 86 80 70 72 <-- subvendor ID and subdevice ID differ
30: 00 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00
40: 01 04 00 00 80 00 00 00 01 05 00 00 10 00 00 00 <-- ACPI base address and GPIO base address differ
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 80 80 80 80 d0 00 00 00 80 80 80 80 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 10 00 07 38 81 06 0c 00 41 16 0c 00 00 00 00 00 <-- decode ranges, LPT enables, LPT decode ranges differ
90: 01 03 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 <-- LPT decode range differs
a0: 04 02 00 00 01 00 00 00 13 1c 0a 00 00 03 00 00 <-- power management differs
b0: 00 00 f0 00 00 00 00 00 08 80 00 00 00 00 00 00 <-- power management differs
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
d0: 33 22 00 00 67 45 00 00 00 ff 00 00 00 00 00 00 <-- firmware hub select 1, firmware hub decode enable 1, BIOS control differs
e0: 09 00 0c 10 b4 02 24 17 00 00 00 00 00 00 00 00 
f0: 01 c0 d1 fe 00 00 00 00 86 0f 02 00 00 00 00 00
    The Southbridge datasheet explains the registers on page 363. ToDo: Find a strategy whether to reproduce the Thinkpad's or the Macbook's values.
  4. Initialize Dock related things (this can be removed because the Macbook2,1 does not have a docking station)
  5. Initialize console (maybe just copy this)
  6. Test if MCHBAR (Memory Controler Hub Base Address Register) indicates a soft reset
  7. early chipset initialization required before RAM initialization, i945_early_initialization() (copy this)
  8. Test if PM1_CNT indicates resume from S3. In this case set boot_mode=2 (Maybe keep resume for later and disable CONFIG_HAVE_ACPI_RESUME)
  9. Enable SMbus (SPD ROMs and DDR-II DRAM)
  10. Initialize SDRAM
  11. Perform some initialization that must run before RAM stage (early_ich7_init)
  12. Mainboard specific: rcba_config() (what is this?)
  13. Chipset Errata: fixup_i945_errata (check if this involves blobs)
  14. Initialize the internal PCIe links before we go into ROM stage: i945_late_initialization()
  15. Initialize cbmem
  16. Eventually resume memory from S3.
  17. That's it. main jumps back from whereever it was called.

Stage 3: RAM stage

(the code is copied to RAM before its execution)

RAM stage seems to start with function main in file lib/hardwaremain.c

Reset the Embedded Controller

In Apple language the embedded controller is called System Management Controller (SMC). Searching for macbook SMC reset yield [link]: Quote:

On Mac notebooks with removable battery
  1. Shut down the computer.
  2. Disconnect the MagSafe power adapter from the computer if it's connected.
  3. Remove the battery.
  4. Press and hold the power button for five seconds.
  5. Release the power button.
  6. Reconnect the battery and MagSafe power adapter.
  7. Press the power button to turn on the computer.

Resetting the embedded controller with the above steps while vendor BIOS is installed, and booting Parabola GNU/Linux-libre via USB, ectool yields (the numbers might be set by the ec reset, by vendor BIOS or by Parabola:

EC RAM:

00: 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 90 16 01 10 80 00 00 00 00 00 00 00 00 00 00
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40: 00 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Resetting the embedded controller with coreboot installed and reading EC RAM at the end of romstage yields:

EC RAM:

00: 00 07 01 00 00 00 00 00 00 00 00 00 00 00 00 00
10: 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40: 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

after coreboot, grub, and Parabola have finished booting, ectool reads:

EC RAM:

00: 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00
10: 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 80 14 01 00 00 00 00 00 00 00 00 00 00 00 00
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40: 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00