For those interested in close-ups of above mentioned T40 System Board, they can be downloaded here (note: JPEG, public domain, unsorted, up to 1600x1200, with many duplicates, many blurred, cropped, under-/over-exposed, etc.):

• t40-board-top.zip [92 MB]
• t40-board-bottom.zip [25 MB]

Specifics: System board assembly, ATI M7-32, 10/100 Ethernet with security chip for T40
Contains (in no particular order, incomplete):

• Atmel AT49LW080-33TC Firmware Hub Flash Memory 1 MByte
• Texas Instruments PCI1520 GHK PC Card Controller
• National Semiconductor PC87392-VJG Winbond 87392D2 100-Pin LPC SuperI/O Device for Portable Applications
• Analog Devices ADP3806J-12.5 High Frequency Switch Mode Li-Ion Battery Charger
• Analog Devices AD1981BJST AC '97 SoundMAX Codec
• TOSHIBA TPC8109 Field Effect Transistor Silicon P Channel MOS Type
• TOSHIBA TPC8014 Field Effect Transistor Silicon N Channel MOS Type
• Pericom PI5C16862CB 20-Bit, 2-Port Bus Switch with Undershoot Protection
• Panasonic AN12942B For notebook PC audio output Output (at 8 Ohm): 1.0 W x 2 ch, H/P Amp., AGC (Analog)
• Maxim MAX1845 Dual, High-Efficiency, Step-Down Controller with Accurate Current Limit
• ATI Mobility Radeon 7500 M7-CSP32
• Samsung K4D263238E-GC36 1M x 32Bit x 4 Banks Double Data Rate Synchronous DRAM with Bi-directional Data Strobe and DLL
• Texas Instruments MAX3243CPW (MA3243C) 3-V to 5.5-V Multichannel RS-232 Line Driver/Receiver
• TOSHIBA TC7WT126FU (WT126) Dual 3-State Buffer
• Pulse H0042 Magnetic Transformer Module Single Port Ethernet 10/100Base-T
• P37AG FDS
• P37AD FDS 6990A

Added a script (splitec) to strip off most conditional code. This creates from the ec.s master source file a source file for every ec version. They can also be fed to xref to create somewhat smaller HTML files (however, some ids for link targets will be differently assigned). This might make it easier to look at just the current code. Added an example how to generate all flash images in "batch mode" (shell script). Also some other comment changes. See top posting for download.

Thanks for trying all the same, it's a real shame. Admittedly I always feared that it would never get sorted, due to the age of the T43..

I also tried to make noise, by posting about this last year on the lenovoblogs site. I got the following post on lenovoblogs:

"@Ross: Thanks for the heads up on this issue, I’ve been looking into it at Thinkpads.com. If you would like to send any specific thread links, you can send them to tsupples *AT* lenovo *DOT* com."

.. and I forwarded information to this person, but I guess in the end he wasn't able to get it through either..

Now my fan is also starting to sometimes make strange ticking sounds, I think it's starting to wear. Perhaps the constant acceleration/decceleration reduces its lifespan. It's less than a year old!

oh well..

Regards.

hi folks,

I've just read the 3 pages of this thread; but I'm still a little unclear on one thing...

HAS anyone burned a modded FW into the EC and not bricked the MB ?

Or has the project not gotten to that point yet?

thanks!

As far as I know, nobody played "works ok on paper" with this.

Yes, it has been field tested.

hello hmh, thanks for replying.

I don't understand what you mean by "nobody played 'works ok on paper'. ??

From reading the 3 pages of thread, examining it on paper is exactly what has been done so far. That's why I posted my question.

I did not find any links to test-results or finished firmware files for download. Did I just miss the right post?

If you have links for those, or for any webpages of the people actually working on this, please do post them.

I would like to read more detailed info about various modified versions; to learn exactly which model-numbers they work for, and eactly what's been modified in each version.

thanks again

I do not know of anybody who has done experiments with this. I had my T43p with one of the modifications running on version 1Y/28 for a couple of months, but I did not really notice any difference. However, that at least means burning works, and the checksums are calculated correctly.

These modifications are very small, like a wrong register in an instruction. The code did not make sense to me on those locations, but these are not major bugs because the EC works with them. The code might not even get executed in normal operation.

So basically the code of different versions is in a form that can be easier modified or analyzed but no one I know of has actually thoroughly analyzed the part that controls the fan and published a fix for the noise problem.

For my part, I am busy with other projects and nobody else continued. But now, the actual interesting part of the project would start...

I have 1.06a (that's 1.06 with the fixes applied and NO other changes) running on production on my own system for more than one year, now.

I assume many others do the same, the noise reduction on the extremely annoying 30s fan control calibration step in a 268x ThinkPad is quite extreme (of course the fan still pulses, and if the fan is noisy, and continues being noisy. But at least it won't "rev'up the engine" every 30s or so anymore.

I have no idea about the I2C fix, I enabled them all, and the fan issue got better. I observed no other changes in the behaviour of the ThinkPad in about one year of continuous usage, so at least it didn't break anything further.

As for distributing the firmware fix, IMO if you can't figure out what you need to do, you don't know enough to play with EC firmware safely to begin with, and anyone helping you would be liable for damages to your thinkpad...

Not to mention it would be quite illegal to distribute a modified IBM flasher. Maybe a xdelta patch would be acceptable, but I am not going to do it either (see above for why).

By the way, I am very thankful to mg for the modified firmware.

hello mg,

Thanks very much for that reply. That's exactly what I was wondering...i.e. if the project had progressed to where the file compilation and burning was being done successfully; without bricking the H8.

Is there a webpage where you list these versions, and discuss the project? I'd very much like to follow along.

thanks again

well, that's your opinion....

...but since I was doing assembly-coding and burning eproms (intel 1702's...gahhh ) when you were probably still in diapers....

...I think I'm going to have to discount it.

Just because a person doesn't want to install a new dev-system and get up to speed on a whole new CPU, that doesn't mean he isn't entirely capable of understanding the project and flashing a finished binary into a chip.

Also, if inventor-A has ALREADY invented the wheel, then it's kinda dumb for inventor-B to reinvent that same wheel.

Which is WHY I asked if there were tested binaries yet, and what the website for discussion and files-exchange was.

Now a) and b) have been answered 'yes'. Great!

In regards to the T60/p, the single biggest improvement that could be made would be to change the slowest speed from 3000 down to 2500 or even 2000 rpm.

That would allow one to run the fan continuously, but without much noise at all.

Running it continuously is the optimal configuration for both the least irritation and for the longest life of the laptop.

The BGA-bond failures are highly exacerbated by thermal-cycling... ..hot...cool...expand...contract...CRACK.

thanks again to all who are working on this project.

With the kind permission of mg to post his files, I've set up a Forum specifically for the EC Firmware project.

This eliminates any possibility of theoretical potential issues for thinkpads.com; and provides a web-presence for all who want to keep the project alive; to exchange ideas and discoveries, post and retrieve files, etc..

Of course, reporting back here when a particular problem is solved would be a good thing I think.

mg did a huge amount of work in getting us to this point; but he's indicated to me that he's now loaded with other responsibilities, and it's up to us to move EC FW work forward from here.

The URL for the EC FW project forum is:

http://ecfw.spreebb.com/index.php?act=idx

The banners looked pretty small and unobtrusive to me; but if they present a problem to using it, I'll shell out the $60/yr to get rid of them. Just let me know.

I created 2 sub-forums....one for the T43 project that's already borne binary fruit...and a 2nd one for what I hope will become an active T60/p project.

My own first objective for the T60 project is to change the minimum fan speed from 3200 down to the 2000-2500 range; as explained at the new forum.

However, there will certainly be other needs/objectives for the T60 firmware; and I encourage discussion of that at the new T60 FW page.

Currently, upload file-size is limited to the hoster's default of 200K....but I'm working on getting that raised.

Forum is set up for no BS or mickey-mouse.... no avatars, no skins, and currently no 'active' moderation....just a clean and simple place to share work together. Please contribute what you can!

Richard

I might not be that much of an old-timer, but I am not a snot-nosed punk either :p. I was already reverse-engineering z80 assembly code of MSX games when I was 14 years old, and got my degree in EE because CS was just too wimpy for me and I wanted to learn some real engineering. Let's not enter a pissing contest here, it is enough to know all of us are competent people in our own fields, and good enough to write embedded controller code in our sleep.

That said, I fail to see why what I said (and you quoted) would apply to you, since you clearly can figure out what's needed to get the binary...

Anyway, welcome to the club

uhmm....because you said it to me? And used "you" multiple times in it?

As I've already said, I have no interest or desire in learning yet another CPU and toolchain at this point in my life. I'm retired from that now.

Yet that choice is totally irrelevant to whether or not I have the ability to flash a chip from a finished binary.

In any case, thanks for the belated welcome.

ps; if you're going to continue to work on the project, I certainly welcome your participation at the dedicated forum-space I just set up for it (posted about above).

I can't work in the project the way people imagine me to. Let me explain:

* I can talk directly to Lenovo's engineering teams and ask them to fix firmware when given a good enough description of the problem for them to duplicate it. The trouble is, they cannot fix the T43 firmware anymore, the required QA for a BIOS or EC release is not available (or justifiable? they were unclear on the subject) anymore, so there won't be any further releases (unless something exceptional happens);

* I can add Linux driver support for anything the ThinkPad EC can do, as long as the interfaces are documented in a clean room way and made public. In fact, the thinkpad-acpi/ibm-acpi changelog has been quite full of new functionality since I took it over.

However, I cannot go poking into the firmware beyond the bare minimum to get it to install in my T43. I need to keep a good working relationship with Lenovo.

hmh, thanks for the info....I appreciate your position.

Anything contributed on any level is welcome.

User AdaSch has posted some pictures of a hardware modification to heat sink and fan. My interpretation of the associated text is as follows:

The GPU on T43p types 2668-[GH]xx, 266[89]-C[4A]x and 2687-D5x is an ATI MOBILITY FireGL V3200 (M24 GL-128) with a different height than other GPUs. Instead of redesigning the heat sink they added a thermal pad to the GPU to bring it to the same height as the CPU, but the pad is too thick. Also, the fan hub touches the base cover and so its vibration is amplified. The thermal pad is then being replaced with Coollaboratory Liquid Pro paste (apparently preferred over Arctic Silver 5) and the fan made ½ mm thinner (How – with a vice?) to not touch the base assembly.

The fan itself includes also some electronics since it doesn't use a regular DC motor. It uses a Sanyo LA6581M (bipolar transistor logic single-phase full-wave brushless fan motor driver) using a Hall effect sensor. The motor itself uses 4 coils connected in series (only 2 wires to the IC).

While I didn't notice a choke (inductor) at the time, it could be that actually switch-mode is used and not PWM (see DC-DC mode on Maxim's AppNote 1784).

The fan sucks in air above the headphones und microphone mini-jack sockets and blows it out through the grille on the right of them immediately. The air doesn't go to the inside of the notebook anywhere. It's only cooling the grille whose little plates are soldered (tin alloy – no welding) to the copper (alloy) that then extends to the top of CPU and GPU.

It looks like a T43p is falling apart less than a month after warranty expires... Anyway...

The inverter (high voltage module for the LCD backlight) uses an MPS MP1015EM in burst mode with DC input from the EC's D/A converter. It's on the same little board as the 13 LEDs below the LCD screen.

[Well, as it turned out, it was the CCFL that was dying.]

The ThinkPad packs have some non-SBS behaviour, maybe someone that has access to an open pack might help with this...

To access these, you need tp_smapi and to change the code so that the battery dump goes up to row 0x0b, not just 0x0a. Be careful with THIS bug: http://www.thinkwiki.org/wiki/Embedded_ ... es_EC_hang), tough.

There are three monotonic counters (little endian, 16 bits each) on row 0x0B of the dump:

The first increases at some pace while charging the pack.

The second increases at some pace (once at a bit over an hour) while the pack exists (probably that means while the pack uC runs).

The third increases at some pace while discharging the pack.

The behavior of the SBS error margin (recently added by Shem to tp_smapi) is also very very weird, and seems coupled to the cycle count. It does not reset on calibration, which is annoying.

Any ideas? Does a 3rd-party pack also have the above behavior?

It would be cool to know what these mean, to ask Shem to add them to tp_smapi...

This is slightly incorrect. The first one seems monotonic, but it is not a time counter. The third one is also a mistery. My current pet theory is that one is related to how much effort was spent on the last "cycle" or maybe to fast-charging, and the other is related to trickle/slow-charging.

I have now scripts that continuously dump these registers and warn me every time they change in a meaningful way, so that I can try to correlate with what I see in the battery LED (which does change from yellow to blinking green when the EC switches from fast to slow charge mode...)

See http://forum.thinkpads.com/viewtopic.php?t=69539 for a mechanical workaround (drilling a hole into the fan) of the T43p fan noise issue.

In The Name Of God The compassionate merciful

Good day everyone ;
Has anyone worked on this issue ? to use HDAPS in suspend/sleep mode ?there is an alarm script that works when laptop moves as theft alarm , but laptop should be on for this ,
Is it possible to write code in that micro to communicate with sensor ?

Regards dehqan

Hi Richard,

This link is dead now. Any updates? Maybe we can find some better place to work together, like github or sourceforge. I could also do the hosting on my own.

So tell me about the current status and what is missing.

Hi mg,

Thanks a lot for your work.

I am with a broken EEPROM crc X41T MB, and want to figure a way out the hard and ultimate way.[1] I plan to find out that EEPROM R/W and verification routine and strip it out.

I have some leaked schematics at hand. Maybe I could pass it to you personally to figure the connections out.

How is things going? Did you post your methods to reproduce the firmwares?

Footnote

1. http://www.awa.tohoku.ac.jp/~benda/proj ... nkpad.html

There is an example to run coreboot on thinkpad.

At present coreboot just use the vanilla EC firmware and write to the registers of EC. This means at least the software hacks can be implemented in BIOS

If your EEPROM has been corrupted you can fix it, there are at least a few websites that can help you with this. In some cases you may have to pay a small fee, but they will give you the image to fix it yourself.

Regards,

Ross..

Yeah, I have got info from allservice.ro. What's the "few websites" besides allservice.ro?

Hmm.. I want to figure out how to make a good image before resorting to the given solution.

Maybe by looking at the physics memory of the good running thinkpad would give a good dump. Any ideas on the memory map of thinkpads for the memory range of the EEPROM?

This guy has been offering the same service for a long time: http://www.ja.axxs.net/ - he is based in Australia. If you look carefully through the website, there is info on how to build your own RS232 adapter for reading the EPROM, but he doesn't support this anymore.

You can't make a good image once your EPROM is trashed, and you probably can't use the image from another machine either.

I don't have any knowledge of the EEPROM layout or the CRC algorithm, and unfortunately those who do, keep it as a trade secret.