Iru Cai wrote:
What we need to do is to find out how the BIOS code initialize the EC so that the machine can be brought up.
I can think of two ways.
1. Software - use SerialICE for dynamic analysis of the factory BIOS.
2. Hardware - monitor the LPC bus or see if the EC maybe has tracing or its debug UART enabled. The datasheet is good.
I would tend to 2, but 1 requires no dealing with hardware.
Alexander Couzens wrote an LPC sniffer for iCE40 FPGAs: https://github.com/lynxis/lpc_sniffer
Someone modified it to only report specific addresses, that might be useful with the EC too: (But I wish they had just cloned lynxis repo..) https://github.com/denandz/lpc_sniffer_tpm
//Peter