Documentation: Add HP EliteBook 8760w

Also add the HP EliteBook document from wiki.

Change-Id: I189db9c279705af53d82af66d0c2e8afb6f84d73
Signed-off-by: Iru Cai <mytbk920423@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30950
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

3 files changed, 193 insertions, 0 deletions

diff --git a/Documentation/mainboard/hp/8760w.md b/Documentation/mainboard/hp/8760w.md
new file mode 100644
index 0000000000..714745aa04
--- /dev/null
+++ b/Documentation/mainboard/hp/8760w.md
@@ -0,0 +1,82 @@
+# HP EliteBook 8760w
+
+This page describes how to run coreboot on the [HP EliteBook 8760w].
+
+## Flashing coreboot
+
+```eval_rst
++---------------------+------------+
+| Type                | Value      |
++=====================+============+
+| Socketed flash      | no         |
++---------------------+------------+
+| Model               | W25Q64.V   |
++---------------------+------------+
+| Size                | 8 MiB      |
++---------------------+------------+
+| Package             | SOIC-8     |
++---------------------+------------+
+| Write protection    | no         |
++---------------------+------------+
+| Dual BIOS feature   | no         |
++---------------------+------------+
+| In circuit flashing | yes        |
++---------------------+------------+
+| Internal flashing   | yes        |
++---------------------+------------+
+```
+
+## Required proprietary blobs
+
+- Intel Firmware Descriptor, ME and GbE firmware
+- EC: please read [EliteBook Series](elitebook_series)
+
+## Flashing instructions
+
+HP EliteBook 8760w has an 8MB SOIC-8 flash chip on the bottom of the
+mainboard. You just need to remove the service cover, and use an SOIC-8
+clip to read and flash the chip.
+
+![8760w_chip_location](8760w_flash.jpg)
+
+## Untested
+
+- dock: serial port, parallel port, ...
+- TPM
+- S3 suspend/resume
+- Gigabit Ethernet
+
+## Working
+
+- i7-2630QM, 0+4G+8G+0
+- i7-3720QM, 8G+8G+8G+8G
+- Arch Linux boot from SeaBIOS payload
+- EHCI debug: the port is at the right side, next to the charging port
+- SATA
+- eSATA
+- USB2 and USB3
+- keyboard, touchpad, trackpad
+- WLAN
+- WWAN
+- EC ACPI
+- Using `me_cleaner`
+
+## Technology
+
+```eval_rst
++------------------+--------------------------------------------------+
+| Northbridge      | :doc:`../../northbridge/intel/sandybridge/index` |
++------------------+--------------------------------------------------+
+| Southbridge      | bd82x6x                                          |
++------------------+--------------------------------------------------+
+| CPU              | model_206ax                                      |
++------------------+--------------------------------------------------+
+| Super I/O        | SMSC LPC47n217                                   |
++------------------+--------------------------------------------------+
+| EC               | SMSC KBC1126                                     |
++------------------+--------------------------------------------------+
+| Coprocessor      | Intel Management Engine                          |
++------------------+--------------------------------------------------+
+```
+
+[HP EliteBook 8760w]: https://support.hp.com/us-en/product/hp-elitebook-8760w-mobile-workstation/5071180
diff --git a/Documentation/mainboard/hp/8760w_flash.jpg b/Documentation/mainboard/hp/8760w_flash.jpg
new file mode 100644
index 0000000000..d9bbac6788
--- /dev/null
+++ b/Documentation/mainboard/hp/8760w_flash.jpg
diff --git a/Documentation/mainboard/hp/elitebook_series.md b/Documentation/mainboard/hp/elitebook_series.md
new file mode 100644
index 0000000000..6668928008
--- /dev/null
+++ b/Documentation/mainboard/hp/elitebook_series.md
@@ -0,0 +1,111 @@
+# HP EliteBook series
+
+This document is about HP EliteBook series laptops up to Ivy Bridge era
+which use SMSC KBC1126 as embedded controller.
+
+## EC
+
+SMSC KBC1098/KBC1126 has been used in HP EliteBooks for many generations.
+They use similar EC firmware that will load other code and data from the
+SPI flash chip, so we need to put some firmware blobs to the coreboot image.
+
+The following document takes EliteBook 2760p as an example.
+
+First, you need to extract the blobs needed by EC firmware using util/kbc1126.
+You can extract them from your backup firmware image, or firmware update
+provided by HP with [unar] as follows:
+
+```bash
+wget https://ftp.hp.com/pub/softpaq/sp79501-80000/sp79710.exe
+unar sp79710.exe
+${COREBOOT_DIR}/util/kbc1126/kbc1126_ec_dump sp79710/Rompaq/68SOU.BIN
+mv 68SOU.BIN.fw1 ${COREBOOT_DIR}/2760p-fw1.bin
+mv 68SOU.BIN.fw2 ${COREBOOT_DIR}/2760p-fw2.bin
+```
+
+When you config coreboot, select:
+
+```text
+Chipset --->
+  [*] Add firmware images for KBC1126 EC
+      (2760p-fw1.bin) KBC1126 firmware #1 path and filename
+      (2760p-fw2.bin) KBC1126 filename #2 path and filename
+```
+
+## Super I/O
+
+EliteBook 8000 series laptops have SMSC LPC47n217 Super I/O to provide
+a serial port and a parallel port, you can debug the laptop via this
+serial port.
+
+## porting
+
+To port coreboot to an HP EliteBook laptop, you need to do the following:
+
+- select Kconfig option `EC_HP_KBC1126`
+- select Kconfig option `SUPERIO_SMSC_LPC47N217` if there is LPC47n217 Super I/O
+- initialize EC and Super I/O in romstage
+- add EC and Super I/O support to devicetree.cb
+
+To get the related values for EC in devicetree.cb, you need to extract the EFI
+module EcThermalInit from the vendor UEFI firmware with [UEFITool]. Usually,
+`ec_data_port`, `ec_cmd_port` and `ec_ctrl_reg` has the following values:
+
+- For xx60 series: 0x60, 0x64, 0xca
+- For xx70 series: 0x62, 0x66, 0x81
+
+You can use [radare2] and the following [r2pipe] Python script to find
+these values from the EcThermalInit EFI module:
+
+```python
+#!/usr/bin/env python
+
+# install radare2 and use `pip3 install --user r2pipe` to install r2pipe
+
+import r2pipe
+import sys
+
+if len(sys.argv) < 2:
+    fn = "ecthermalinit.efi"
+else:
+    fn = sys.argv[1]
+
+r2 = r2pipe.open(fn)
+r2.cmd("aa")
+entryf = r2.cmdj("pdfj")
+
+for insn in entryf["ops"]:
+    if "lea r8" in insn["opcode"]:
+        _callback = insn["ptr"]
+        break
+
+r2.cmd("af @ {}".format(_callback))
+callbackf_insns = r2.cmdj("pdfj @ {}".format(_callback))["ops"]
+
+def find_port(addr):
+    ops = r2.cmdj("pdfj @ {}".format(addr))["ops"]
+    for insn in ops:
+        if "lea r8d" in insn["opcode"]:
+            return insn["ptr"]
+
+ctrl_reg_found = False
+
+for i in range(0, len(callbackf_insns)):
+    if not ctrl_reg_found and "mov cl" in callbackf_insns[i]["opcode"]:
+        ctrl_reg_found = True
+        ctrl_reg = callbackf_insns[i]["ptr"]
+        print("ec_ctrl_reg = 0x%02x" % ctrl_reg)
+        cmd_port = find_port(callbackf_insns[i+1]["jump"])
+        data_port = find_port(callbackf_insns[i+3]["jump"])
+        print("ec_cmd_port = 0x%02x\nec_data_port = 0x%02x" % (cmd_port, data_port))
+
+    if "mov bl" in callbackf_insns[i]["opcode"]:
+        ctrl_value = callbackf_insns[i]["ptr"]
+        print("ec_fan_ctrl_value = 0x%02x" % ctrl_value)
+```
+
+
+[unar]: https://theunarchiver.com/command-line
+[UEFITool]: https://github.com/LongSoft/UEFITool
+[radare2]: https://radare.org/
+[r2pipe]: https://github.com/radare/radare2-r2pipe