Board:hp/pavilion m6 1035dx

Hello. I'll have some more info soon enough. For now, remember this:

$ flashrom -pinternal:amd_imc_force=yes -w coreboot.rom

Now chances are that will brick your system if you're not already booting coreboot. Expect to do an external flash initially.

Status

Note that this information is for my personal records keeping, and is based on the latest local patches, some of which may not have been published yet.

What works

• Succesfully booting to OS
• Keyboard and touchpad. (This touchpad is DIVINE!!!)
• Built-in Audio
• USB ports (USB 3.0 not tested, though the ports work with USB 2.0 devices)
• Wired and wireless networking. (Wired is a little wonky with some cables, works with others)
• Batterry status and notifications
• Batterry charging
• AC status LED next to power jack (white = charged, amber = charging)
• Power LED on power button (Not sure if it works as expected during suspend)
• Keyboard backlight and on/off control
• Hotkeys: Volume (Up/Down/Mute), Media (Prev/Play/Next), Keyboard backlight, WLAN toggle
• Caps Lock LED
• WLAN enabled/disabled LED
• Suspend/resume on lid closed/open

What doesn't work

• DVD drive.
• Suspend/Resume (Kinda works, no video on resume)
• Power LED on the side (right above disk activity LED)
• Hotkeys: Brightess (Up/Down), Display Toggle. (We get SCIs from the EC)
• Mute LED
• Shutdown on critical battery level (We get a _Q25 SCI at 15% level, but that's also shared with insert/remove events)
• Setting Fn key mode to default on or default off. Right now it's default on.

GPIO layout

This information should not be considered reliable in any way, shape or form

• GPIO57 - OUT - controls WLAN (rfkill pin on minipcie slot)

General Purpose Events layout

• GEVENT3 -> GPE3 - EC SCI
• GEVENT8 -> PCIE PME (from APU)
• GEVENT23 -> EC SMI -> Configured as GEVENT23 SMI, not GPE23 SMI/SCI
• GEVENT22 -> GPE22 - EC LID

EC headaches

To ACPI or not to ACPI

The EC likes to start up in APM mode. In APM mode, it will generate an SMI whenever an external event occurs. To make it generate SCIs instead, and play nicely with ACPI, we need to tell it to go to ACPI mode.

The MMIO dilemma

The EC RAM, which contains the batterry/AC etc information is normally accessed by read commands on the EC index I/O ports (0x62 and 0x66). The EC will also respond to LPC memory read/write cycles in the address range 0xff000000 + 0x1000. In order for this to work, the chipset must pass MMIO accesses in this range to the LPC bridge, which in turn, must decode them to the LPC bus.

This can't work if there is something else using that address range, so any system with 16MiB is out of the question. Luckily, the 1035dx uses a 4 MiB chip, so that's a non-issue. As a bonus, the LPC bridge can map a 4 KiB MMIO window on the LPC bus (or two, I can't remember).

The following script enables the needed MMIO window:

# iotools pci_write32 0 0x14 3 0x4c 0xff000000
# iotools pci_write32 0 0x14 3 0x48 0x00b0ff07

The EC RAM is at an offset of 0x800 from the MMIO base address. The current compal/ene932 ACPI implementation does not handle MMIO. This should be easily fixable with some preprocessor love.

Switching between APM/ACPI modes

Coreboot does it in the SMI handler on request form the OS. Doing that can also be accomplished in userspace by uberawesome blackmagic:

# iotools io_write8 0x66 0x59 && iotools io_write8 0x62 0xe9 # Put EC in APM mode
# iotools io_write8 0x66 0x59 && iotools io_write8 0x62 0xe8 # Put EC in ACPI mode

TODO

• Check PCIe lane assignment
• Check grub2 payload (Run VGA option ROM and Keep VESA framebuffer -- works)
• Check AHCI port mask
• Make Suspend/resume (ACPI)
• WLAN hotkey does not follow OS security model
  • With vendor firmware, WLAN hotkey only works after logging in -- _Qxx handler uses device notifications rather than controlling the GPIOs directly
  • Figure out how to make coreboot's ACPI behave the same way

Detective work

Undocumented EC bits

Offsets relative to EC RAM.

• 0xb8.1 : Lid state (1 = closed, 0 = open)