Compiling your own Coreboot firmware for the Samsung Series 5 550 Chromebook

Okay, so, why would you want to do this? Well, in a nutshell, so your Chromebook pretty much behaves like a normal laptop i.e. no secure boot, will boot from any USB key, no more signing kernels and dd’ing them to obscure partitions, etc, etc. Before you start: It’s important to note this comes without any warranty, express or implied. If something goes wrong you will end up with a bricked Chromebook. If that happens you can purchase a Bus Pirate, Bus Pirate probe cable, and Pomona 5250 SOIC clip and get unbricking, as per my previous post. This will also make ChromeOS unbootable, so if you want to use ChromeOS at all, then don’t do this. The impatient and ill-resourced among you can scroll to the end for instructions on how to download and flash my Coreboot build, which again comes without any warranty and could bring hell and damnation upon your souls. There is now a patch which allows all 4 GB of RAM to be recognised, but it takes 5 seconds to reach the SeaBIOS prompt on a cold boot.IMG_20130726_165740 First of all you need to make sure the Chromebook is in developer mode as per http://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-sandy-bridge and you also need to disable the BIOS write protect jumper which this picture shows you. For reference, I carefully placed a small watch screwdriver in between the 2 pins to make a circuit. Worked for me anyway. ;) On your Chromebook, make a copy of your existing ROM with

sudo flashrom -r bios.bin

Copy it to USB or use SFTP to get it onto your other PC/Laptop. This is extremely important because you may need something to recover from later. Now we have to download the Coreboot sourcecode onto a laptop with a suitable Linux distro, using Git. Obviously we need Git installed, as well as GCC, Ncurses development, and iasl. From your home directory on this machine.

git clone http://review.coreboot.org/p/coreboot

Then go into menuconfig.

make menuconfig

Now we need to check and uncheck some options. I don’t list categories here for brevity. Just go into each section to find the options mentioned.

  • Uncheck Compress ramstage with LZMA
  • Uncheck Include the coreboot .config file into the ROM image
  • Check Allow use of binary-only repository
  • Change Mainboard Vendor to Samsung, which should automatically change the mainboard to “Lumpy”
  • Check Mark graphics memory as write-combining.
  • Check Enable VMX for virtualization
  • Check Allow for caching system ROM.
  • Check Add a System Agent binary
  • Check Add a VGA BIOS image.
  • Change the binary path to 3rdparty/mainboard/$(MAINBOARDDIR)/snm_2130_coreboot.bin
  • Uncheck Serial port console output
  • Check Use onboard VGA as primary video device
  • Change SeaBIOS version to “master”
  • Uncheck Use LZMA compression for payloads

Install iasl

make 

Next we need to make a trivial change to the SeaBIOS source to change the bootmenu key from F12 (because Chromebook’s don’t have F12) From the coreboot directory vim build/seabios/src/boot.c and change the following section like so:

int menukey = romfile_loadint("etc/boot-menu-key", 0x86);
 printf("%s", bootmsg ?: "\nPress F12 for boot menu.\n\n");
 free(bootmsg);

to

int menukey = romfile_loadint("etc/boot-menu-key", 0x44);
 printf("%s", bootmsg ?: "\nPress F10 for boot menu.\n\n");
 free(bootmsg);

We change the “F12″ to “F10″ and “0x86″ to “0x44″.

make

The cbfstool printout at the end should look something like this:

Name Offset Type Size
cmos_layout.bin 0x400000 cmos_layout 1120
pci8086,0106.rom 0x4004c0 optionrom 65536
cpu_microcode_blob.bin 0x410500 microcode 20544
fallback/romstage 0x4155c0 stage 28660
fallback/coreboot_ram 0x41c600 stage 287464
fallback/payload 0x462940 payload 106916
(empty) 0x47cb40 null 3159128
mrc.cache 0x77ffc0 (unknown) 65536
(empty) 0x790000 null 65432
mrc.bin 0x79ffc0 (unknown) 195732
(empty) 0x7cfcc0 null 49880
spd.bin 0x7dbfc0 (unknown) 1536
(empty) 0x7dc600 null 144216

Copy the coreboot.rom file in build to your Chromebook and write the file to your ROM!

sudo flashrom -w coreboot.rom

Alternatively, as mentioned at the beginning of the post, you can download a prebuilt Coreboot from my website, and flash it without much bother. Just to confuse you even more, you will need to enable developer mode and have the flash write-protect disabled as is mentioned near the start of the article, just after the bit for the impatient. ;) Then on the Chromebook shell, in a writable directory, type

wget http://johnlewis.ie/coreboot.rom
md5sum coreboot.rom
flashrom -w coreboot.rom

Please do not do this unless you have a Samsung 5 series 550 Chromebook as you will brick it, assuming your ROM can take 8 megs. If md5sum output is any different to “64a1ed35d9e37e022ae817268ad3cea9″ then your download is corrupt and should not be written as it will probably brick your Chromebook i.e. download again and test using md5sum. Make sure you have a copy of the existing firmware using “flashrom -r bios.bin” onto a USB stick/SD before attempting. If it doesn’t work you will need to purchase a Bus Pirate, Bus Pirate probe cable, and Pomona 5250 SOIC clip to recover.

Many thanks to Ron Minnich, Aaron Durbin, Stefan Reinauer and Kyösti Mälkki, on the Coreboot mailing list.

Creative Commons License
This work, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.

22 thoughts on “Compiling your own Coreboot firmware for the Samsung Series 5 550 Chromebook”

  1. Today I was able to boot my i5 Stumpy box by putting in a preinstalled SSD. Immediately after that I’ve tried your new script, but it has failed.

    After some debugging I’ve found a solution:
    model=`dmidecode | grep -m1 "Product Name:" | awk '{print $3}'`

    The -m1 is necessary, because grep finds “Product Name: Stumpy” twice.

    Finally all is working fine, including Standby and USB-Boot, even using unetbootin created sticks.

    Thank you very much John. A PayPal Donation will follow shortly.

  2. I think the version of SeaBIOS in that build has a problem with external keyboards. I’ve updated it to 1.7.5. I’ve also added a “links” file which will automatically cope with the different PCI id’s that Stumpy has for the graphics card i.e. 8086:0106 and 8086:0126 so you can flash it using the script once you get your distro on there.

  3. Have you managed to boot the USB stick on another machine?

    Yes, that’s a good next move. Possible problem with the SeaBIOS I have in there.

  4. Hi John,

    I’ve flashed your test build (coreboot-stumpy-youaintgettingit.rom).

    It tries to boot Chrome OS from the mSATA SSD and fails. That was expected, but I’m unable to boot from USB as well. The boot menu shows both the internal SSD an the USB thumb drive. After selecting “2” (USB) it gets stuck at “Booting from Hard Disk”.

    Removing the write protect jumper doesn’t help.

    As next step I plan to replace the SDD with one that has Debian or Ubuntu preinstalled.

    Do you have any further tips?

    Kind regards,
    Christian

  5. What does crossystem say?

    You could also post a pic of your board? I’ve seen a number of models at this stage, so I know the kind of thing to look for.

  6. Hmm, flashrom is still telling me this board is still disabled with it’s writes, and reading the flash gets a transaction error? SPI Configuration Lockdown activated.. bugger.

    If you look at this: https://a77db9aa-a-7b23c8ea-s-sites.googlegroups.com/a/chromium.org/dev/chromium-os/developer-information-for-chrome-os-devices/samsung-sandy-bridge/stumpy-bottom-cards.jpg

    The two jumpers I’ve tried are on the left top side, near the 4 USB sockets..

    Currently running Chrbuntu and got flashrom with a apt-get install flashrom (noticed it doesn’t have the –wp-disable flag supported).

    Any ideas? I’ll keep trying to hack away at it.

  7. Gotcha, haven’t tried it yet, as jumper I foiled was the wrong one, so taking Chromebox apart to see if I can get the damn thing to be writeable.. have downloaded and verified the md5sum tho, and that all checks out.

    It’s one of two jumpers in the most inconvenient spot (info on Chromium site is wrong, not to mention the Stumpy doesn’t have a battery), however on the board, there are two jumpers on the top side.

    Gotta love lack of time, so sorry I can’t test it as quickly.. should have it done soon.

  8. 00:02.0 0300: 8086:0126 (rev 09) (prog-if 00 [VGA controller])
    Subsystem: 8086:0126
    Flags: bus master, fast devsel, latency 0, IRC 43
    Memory at e0000000 (64-bit, non-prefetchable) [size=4M]
    Memory at d0000000 (64-bit, prefetchable) [size=256M]
    I/O ports at 2000 [size=64]
    Expansion ROM at [disabled]
    Capabilities:
    Kernel driver in use: i915

  9. John, the VGA controller has a kernel driver in use: i915 (if that’s what you’re looking for?)

  10. Well, if you can tell me the PCI id’s of the graphics card, I’ll build one, and add it to the script. “lspci -nv” is your friend.

  11. Actually, while that is awesome, just realised it won’t work for me.. I haven’t got a Celeron based Stumpy, however I do have a Core i5 based on.. (Google I/O edition).

  12. John, you’re a star.. perfect… just need to disable the write protection and I’m gonna give it a shot.

    Have you managed to test installing Windows with it?

  13. Hello John,

    Actually that raises a valid point, would you have an idea if trying to build coreboot for stumpy (Samsung Series 3 Chromebox) would be much different then this process? According to the SeaBios site, it is supported and also supported to use flashrom to install. Just can’t find a valid binary, so using your example to see if I can build one..

    Cheers,
    Raj

  14. Can we just clear this up once and far all. Which model do you have? Is it the Samsung Series 3 ARM Chromebook *or* the Samsung Series 3 Chromebox?

    I think somebody in the community group managed to compile a ROM for Lumpy which is confirmed working. Take a look through there, it was fairly recent.

  15. Hey…I am sorry I was off for 3 days …
    So I used this pre-build firmware http://johnlewis.ie/coreboot-lumpy-grub2-good-23102013.rom for my Samsung series 3 and I’ve got this error
    Error: Image size doesn’t match
    FAILED
    So yea I know this pre-build firmware is for series 5 which their processors are inter, but here is my question…If I downloaded your source code and compiled for Arm…Will it work for the series 3 ???
    Thank you…
    Regards.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>