X210/X2100 embedded controller fixes (was: X210 EC datasheet/better brightness control)

[L29Ah]

For the latest X210 EC firmware reverse engineering developments, see viewtopic.php?f=80&t=128267&start=30#p837219
Thanks vladisslav2011 for all the hard work!

End-user X210 EC patching framework: https://github.com/l29ah/x210-ec
X2100: https://github.com/jwise/x2100-ec

Original post:

I found out there are only 15 levels of brightness in X210, and the lowest level is a lot more brighter than on proper Thinkpads, and it makes me hate it in the dark (the battery isn't happy either). The EC seems to be Nuvoton NPCE985LA0DX, and i was unable to find a datasheet on it. Can anyone help me finding it?
Alternatively, can the brightness control be returned to the Intel video stuff?

[L29Ah]

Wrote HOPE at 51nb, if he won't answer, i'll play with Ghidra. EC seems to be CR16C+, and its firmware resides in the BIOS flash.

[L29Ah]

Poked the firmware downloaded using flashrom and then dissected with UEFITool (https://dump.bitcheese.net/files/pixovu ... didate.bin) with ghidra a little and it looks good: the architecture is CR16C and the entry point seems to be 0x100. I'm yet to understand why do i see quite a lot of unreferenced chunks of data though.

https://interactive.freertos.org/attach ... P_Demo.zip may provide invaluable information about the chip's peripherals, for instance the ld script chunk:

Code: Select all

MEMORY {
    cram 	    :   ORIGIN = 0x10000,    LENGTH = 0xFB0              /* CR16CPlus core RAM 4K */
    flash_head  :   ORIGIN = 0x20000,    LENGTH = 0x100               /* Booter header */
    flash       :   ORIGIN = 0x20100,    LENGTH = 0x10F00             /* 90K code */
    mram_top    :   ORIGIN = 0x31000,    LENGTH = 0x7000              /* 10K data & stack */
}

Also lots of interesting stuff in SWC_HAL/Chips/npce9mnx/.

[L29Ah]

It is challenging to poke the SPI flash with an external programmer: the EC gets powered as well and pulls all the signals the wrong way. It seems like i have to find a level shifter to hopefully power the flash chip enough to talk to me while the EC is underpowered.

[vladisslav2011]

Wrote HOPE at 51nb, if he won't answer, i'll play with Ghidra. EC seems to be CR16C+, and its firmware resides in the BIOS flash.

Hmmm. I can't post at 51nb forums. It is asking for chinese wechat messenger, that does not accept phone numbers and asks to find anybody having it installed for some time to scan QR code to confirm that I am a real person. Sigh...
It is unlikely that anybody will answer. I've tried to contact Nuvoton and it's local representatives for NPCE985 datasheet. Nuvoton did not answer at all (maybe my emails just end up in a spam folder). Local representatives answered that they are not selling multicontollers and do not have any documentation.
So, I've made exactly same decision. Ghidra works very well, althrough it does not support bit fields in structures and function pointer type detection.

Also lots of interesting stuff in SWC_HAL/Chips/npce9mnx/.

Thank you very much. It should let me save some time analyzing the firmware.
You may peek some useful information about Nuvoton EC peripherals and architecture by googling "PC8763L Notebook Embedded Controller".

It is challenging to poke the SPI flash with an external programmer: the EC gets powered as well and pulls all the signals the wrong way. It seems like i have to find a level shifter to hopefully power the flash chip enough to talk to me while the EC is underpowered.

If you want to dump EC firmware, then there is an easy way: it is mapped to 64k of system RAM at 0xFFA00000. Just dump it with dd. If you want to flash patched firmware... I think, it would be better to unsolder the chip and solder a dip8 socket to the so8 pads with some thin wire. Then solder the chip to a breakout board, read it, save stock firmware, write patched firmware to the chip and give it a try. I'll go this way.

[mjg59]

The EC firmware is at offset 0x200000 in the flash, so can theoretically just be replaced with flashrom without touching anything else. And (on my batch 2 board, at least) the flash can be rewritten in situ without needing to desolder the chip - you just need a SOIC clip and a programmer. However, if the EC fails to find its firmware, it will keep the SPI bus active and in-situ flashing will fail. I was able to get around this by undervolting the flash, which meant there wasn't enough voltage for the EC to boot. Writing to flash wasn't reliable, but it was reliable enough to be able to reflash the EC firmware. I have all the hardware required for this, so if you have replacement firmware you'd like testing then let me know (you can email me at mjg59@srcf.ucam.org)

[vladisslav2011]

I have patched the EC firmware. Now brightness levels are 1%,2%,4%,8%,16%,32%,44%,48%,55%,60%,65%,70%,78%,84%,94%,99%. First 6 levels were replaced with more useful values.
http://rgho.st/6rB9RGr88
Now power consumption is ~3.1W idle, offline,minimal brightness and only 2.8W with LCD off. It looks like backlight consumes about 0.3W even at minimal brightness. That's more, than expected...
I've tried to fix battery current reporting too, but replacing 0x0b (average current) command with 0x0a (current) did not change anything. And switching off absolute mode did not change anything too. As sometimes the current is fetched correctly, it looks like there is still a bug in the code, that forces EC to overwrite the current reading with zero more often, than it is read from the battery. I'll try to find where it is going on and fill that place with NOPs.
And here are screenshots....
https://i.imgur.com/MYHrvK6.png
https://i.imgur.com/ZpntNrD.png
backlight off
https://i.imgur.com/hQjLmos.png
https://i.imgur.com/izI9302.png

[flyingfishfinger]

Wow this is amazing work!

I haven't gotten my X210 yet (Jacky seems to have ghosted...I hope a package arrives sooner or later), but I'm looking forward to trying out these various fixes.

How are you currently flashing the firmware? Do you need the undervolting hack or have you removed the chip?

R

[vladisslav2011]

I've soldered sort of 'socket' and connected a pin header with some wires to the EC UART pins too.
Here are pictures:
https://i.imgur.com/MinRCrO.jpg
https://i.imgur.com/K9h0UZy.jpg
https://i.imgur.com/Q8UJG2p.jpg
And here is the next patched EC firmware:
http://rgho.st/7MNNlhp49
It shows battery current correctly now. Powertop is able to show power consumption level and runtime estimation too. And powertop can perform calibration.
https://i.imgur.com/wVJBlfd.png
https://i.imgur.com/PwV0pnG.png
https://i.imgur.com/k8Yry7F.png
https://i.imgur.com/5yWXwKH.png

[L29Ah]

Good work, thank you a lot!
Could you please also share your Ghidra/whatever project file to aid further mapping and modification of the EC firmware?

[vladisslav2011]

Could you please also share your Ghidra/whatever project file to aid further mapping and modification of the EC firmware?

The stock firmware is a piece of crap. It contains legacy code, ported from 51/31 microcontrollers, parts of some buggy libraries, many quick patches and lots of bugs.
I have not fully understood some parts of it yet. But you may take a look:
http://rgho.st/7Q8D4jYDF
I'll try to write new EC firmware from scratch to get rid of Insyde corp copyrighted pieces and share it at github. But it will take some time...

[mjg59]

Could you please also share your Ghidra/whatever project file to aid further mapping and modification of the EC firmware?

The stock firmware is a piece of crap. It contains legacy code, ported from 51/31 microcontrollers, parts of some buggy libraries, many quick patches and lots of bugs.
I have not fully understood some parts of it yet. But you may take a look:
http://rgho.st/7Q8D4jYDF
I'll try to write new EC firmware from scratch to get rid of Insyde corp copyrighted pieces and share it at github. But it will take some time...

Thanks, I'm playing with your Ghidra project now. I'm guessing that your changes around offset 0x44 are a checksum for the image - what algorithm is being used there?

[vladisslav2011]

The algorithm is very simple: 32bit sum of all firmware bytes (count FIRMW_SIZE*2 starting at FIRMW_START).
https://pastebin.com/ZjUUDdQ6

[harryK]

And here is the next patched EC firmware:
http://rgho.st/7MNNlhp49
It shows battery current correctly now. Powertop is able to show power consumption level and runtime estimation too. And powertop can perform calibration.

This is amazing!!
The erratic battery and power consumption reporting has been really frustrating. It killed most of the joy of using this otherwise fine machine for me....

Is there a way to flash this with a SOIC8 clip and flashrom? What would flashrom's string look like?

[mjg59]

The algorithm is very simple: 32bit sum of all firmware bytes (count FIRMW_SIZE*2 starting at FIRMW_START).
https://pastebin.com/ZjUUDdQ6

Great, thank you!

[verynice]

Is it possible to edit PWM freq (with either bios/ec mod)?
Tried to use the intel_reg write 0xC8254 with no luck.
Tired of the screen flickery.

[L29Ah]

I think i misunderstand something regarding layout options of flashrom. Why can i -l -i -r, but can't -l -i -w?

Code: Select all

∞ flashrom -p internal -l layout -i ec -w vladisslav2011-ec-2.bin
flashrom v1.1-rc1-2-g93db6e1 on Linux 5.1.4+ (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using region: "ec".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem.".
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
Thank you!
Enabling flash write... SPI Configuration is locked down.
Enabling hardware sequencing because some important opcode is locked.
OK.
Found Programmer flash chip "Opaque flash chip" (8192 kB, Programmer-specific) mapped at physical address 0x0000000000000000.
Error: Image size (65536 B) doesn't match the flash chip's size (8388608 B)!

[L29Ah]

I think i misunderstand something regarding layout options of flashrom. Why can i -l -i -r, but can't -l -i -w?

Code: Select all

∞ flashrom -p internal -l layout -i ec -w vladisslav2011-ec-2.bin
flashrom v1.1-rc1-2-g93db6e1 on Linux 5.1.4+ (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using region: "ec".
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem.".
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
Thank you!
Enabling flash write... SPI Configuration is locked down.
Enabling hardware sequencing because some important opcode is locked.
OK.
Found Programmer flash chip "Opaque flash chip" (8192 kB, Programmer-specific) mapped at physical address 0x0000000000000000.
Error: Image size (65536 B) doesn't match the flash chip's size (8388608 B)!

Okay, i just needed a little padding first:

Code: Select all

dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=2048
dd if=vladisslav2011-ec-2.bin of=fw.bin bs=1024 count=64 seek=2048
dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=6080 seek=2112
flashrom -V -p internal -l layout -i ec -w fw.bin

And it works after a power cycle w/o any external programming assistance!

[verynice]

I've soldered sort of 'socket' and connected a pin header with some wires to the EC UART pins too.
Here are pictures:
https://i.imgur.com/MinRCrO.jpg
https://i.imgur.com/K9h0UZy.jpg
https://i.imgur.com/Q8UJG2p.jpg
And here is the next patched EC firmware:
http://rgho.st/7MNNlhp49
It shows battery current correctly now. Powertop is able to show power consumption level and runtime estimation too. And powertop can perform calibration.
https://i.imgur.com/wVJBlfd.png
https://i.imgur.com/PwV0pnG.png
https://i.imgur.com/k8Yry7F.png
https://i.imgur.com/5yWXwKH.png

Can you share your kernel config and other powersave options?
As I can't manage to get less than 6.9 W

[Jacky-CNMOD]

I have patched the EC firmware. Now brightness levels are 1%,2%,4%,8%,16%,32%,44%,48%,55%,60%,65%,70%,78%,84%,94%,99%. First 6 levels were replaced with more useful values.
http://rgho.st/6rB9RGr88
Now power consumption is ~3.1W idle, offline,minimal brightness and only 2.8W with LCD off. It looks like backlight consumes about 0.3W even at minimal brightness. That's more, than expected...
I've tried to fix battery current reporting too, but replacing 0x0b (average current) command with 0x0a (current) did not change anything. And switching off absolute mode did not change anything too. As sometimes the current is fetched correctly, it looks like there is still a bug in the code, that forces EC to overwrite the current reading with zero more often, than it is read from the battery. I'll try to find where it is going on and fill that place with NOPs.
And here are screenshots....
https://i.imgur.com/MYHrvK6.png
https://i.imgur.com/ZpntNrD.png
backlight off
https://i.imgur.com/hQjLmos.png
https://i.imgur.com/izI9302.png

HI:
I'm jacky . you are so good! GOOD JOB!
thank you !

[harryK]

Okay, i just needed a little padding first:

Code: Select all

dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=2048
dd if=vladisslav2011-ec-2.bin of=fw.bin bs=1024 count=64 seek=2048
dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=6080 seek=2112
flashrom -V -p internal -l layout -i ec -w fw.bin

And it works after a power cycle w/o any external programming assistance!

Sorry, I am missing something here. How do you get the layout file?
I can extract the whole bios with

Code: Select all

flashrom -p internal -r x210-bios.bin

then run your padding code, but can't flash the final image. Would you mind posting the whole process?

Thanks!

[L29Ah]

Okay, i just needed a little padding first:

Code: Select all

dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=2048
dd if=vladisslav2011-ec-2.bin of=fw.bin bs=1024 count=64 seek=2048
dd if=x210-current-internal-flashrom.bin of=fw.bin bs=1024 count=6080 seek=2112
flashrom -V -p internal -l layout -i ec -w fw.bin

And it works after a power cycle w/o any external programming assistance!

Sorry, I am missing something here. How do you get the layout file?

I wrote it.

Code: Select all

00000000:00000fff fd
00200000:007fffff bios
00200000:0020ffff ec
00001000:001fffff me

[harryK]

Sorry, I am missing something here. How do you get the layout file?

I wrote it.

Code: Select all

00000000:00000fff fd
00200000:007fffff bios
00200000:0020ffff ec
00001000:001fffff me

Great! Thanks very much. This mod finally makes the machine usable.

[harryK]

*** EDIT ***

On a second look, the ec *always* reports mWh as mAh and overestimates all batteries. The 9 cell battery reports
charge_full_design 9396000
voltage_min_design 10800000

which works out to an impossible energy-full-design: 101.477 Wh

*****

Don't know if Vladislav is still working on this, however fwiw I noticed that the patched EC correctly reports capacity and power draw of the 6 cell and 9 cell batteries, but not of the 4 cell (14.4V) battery. This battery has a capacity of 28.8Wh, which oddly enough gets interpreted as Ah instead of Wh, and therefore the design capacity is grossly overestimated.

I have:

Code: Select all

/sys/class/power_supply/BAT0/voltage_min_design: 14400000
/sys/class/power_supply/BAT0/charge_full_design: 2880000

But then upower -d reports:

Code: Select all

energy-full-design:  41.472 Wh

which works out exactly as 2880 (mAh) * 14.4V / 1000 = 41.47Wh :-/

This produces all sorts of oddities, such as power consumption being overestimated and the battery suddenly dropping capacity.

[harryK]

*** EDIT ***

On a second look, the ec *always* reports mWh as mAh and overestimates all batteries. The 9 cell battery reports
charge_full_design 9396000
voltage_min_design 10800000

which works out to an impossible energy-full-design: 101.477 Wh

Here's a patch for UPower to report the correct charge and power draw on the X210 w/ Vladislav's ec.

https://github.com/harrykipper/x210

[harryK]

Ok, the solution to the battery conundrum lies in the Linux kernel sources:

in drivers/acpi/battery.c

On Lenovo Thinkpad models from 2010 and 2011, the power unit switches between mWh and mAh depending on whether the system is running on battery or not. When mAh is the unit, most reported values are incorrect and need to be adjusted by 10000/design_voltage. Verified on x201, t410, 410s, and x220. Pre-2010 and 2012 models appear to always report in mWh and are thus unaffected (tested with t42, t61, t500, x200, x300, and x230). Also, in mid-2012 Lenovo issued a BIOS update for the 2011 models that fixes the issue (tested on x220 with a post-1.29 BIOS), but as of Nov. 2012, no such update is available for the 2010 models.

The EC of the X210 follows the same behaviour of 2010/2011 Thinkpads, but obviously the kernel code that fixes it only kicks in on actual Thinkpads. This is why we see skewed values on the X210. A quick rough patch that fixes everything is here:

https://github.com/harrykipper/x210/blo ... -fix.patch

[xytech]

Hi guys!

This just got posted to the 51nb forum and the discussion groups. The Chinese users will be testing the patch and giving some feedback and suggestions.

For now, a few users have flashed the patched bios on their 2nd batch devices and all is working.

A few users have also patched it on their 3K devices and it's working perfectly.

The battery charging issue have plagued the forum for years and it's finally fixed.

https://forum.51nb.com/forum.php?mod=vi ... id=1898673

Sent from my SM-G965F using Tapatalk

[harryK]

Hi guys!

This just got posted to the 51nb forum and the discussion groups. The Chinese users will be testing the patch and giving some feedback and suggestions.

For now, a few users have flashed the patched bios on their 2nd batch devices and all is working.

A few users have also patched it on their 3K devices and it's working perfectly.

The battery charging issue have plagued the forum for years and it's finally fixed.

https://forum.51nb.com/forum.php?mod=vi ... id=1898673

Be careful though. The ibios.rar in the post you linked is taken verbatim from my github. It's a dump of my bios with Vladislav's patched EC and a massively customized configuration tailored to my personal machine. It might not boot at all on somebody else's. The SATA problem that the post seems to refer to is due to me disabling SATA altogether, as I have an NVME ssd
My settings are very good for power saving though

Can we get a free machine now?

[harryK]

u

[xytech]

Hi guys!

This just got posted to the 51nb forum and the discussion groups. The Chinese users will be testing the patch and giving some feedback and suggestions.

For now, a few users have flashed the patched bios on their 2nd batch devices and all is working.

A few users have also patched it on their 3K devices and it's working perfectly.

The battery charging issue have plagued the forum for years and it's finally fixed.

https://forum.51nb.com/forum.php?mod=vi ... id=1898673

Be careful though. The ibios.rar in the post you linked is taken verbatim from my github. It's a dump of my bios with Vladislav's patched EC and a massively customized configuration tailored to my personal machine. It might not boot at all on somebody else's. The SATA problem that the post seems to refer to is due to me disabling SATA altogether, as I have an NVME ssd
My settings are very good for power saving though

Can we get a free machine now?

I wasn't the one who posted the thread hahaha.

It's stated there to try at their own risk.

I believe it'll get caught on by Hope and the manufacturer soon and if so, they might be able to assist in merging the patch or updating the patch properly.

Unfortunately I can't afford to throw a free machine at you guys, but a free beer is definitely doable.

I'm personally waiting for my 4th batch machine and will volunteer to be the guinea pig if there's a need

Sent from my SM-G965F using Tapatalk