Hello,
I've been reverse-engineering the ThinkPad X230's MEC 1619 EC firmware (G2HT35WW) and the UEFI binaries which interface with it on ports 62h/66h and 1600h/1604h. In particular I've been looking at the process for flashing new EC firmware, referencing the public MEC1618 datasheet[1], so I could try to flash new EC firmware on a corebooted ThinkPad; the relevant binaries are the following:
* EcFwUpdateDxe 0C396FCA-6BDA-4A15-B6A3-A6FA4544BDB7 * EcIoDxe 114CA60C-D965-4C13-BEF7-C4062248E1FA * Installs a native protocol interface 3161DDAB-9600-4301-AAB2-93006395824A * EcIoSmm 03EBDB4B-96BA-4F40-8329-7F3AA8865707 * Installs a native protocol interface AADE7C97-98E7-4CFA-B4EF-BBE20506A31D
From this, I found that these binaries uses at least some of the the EC register layout for Quanta's firmware for IT8518 ECs (ec/quanta/it8518/acpi/ec.asl), which is included in mb/google/stout. The stout codename refers to ThinkPad X131e, which are also Ivy Bridges, and also has a different mainboard tree in mb/lenovo/x131e which separately uses ec/lenovo/h8/acpi/ec.asl. The X230 mainboard also uses the H8S ASL.
Both the H8S and IT8518 definitions line up pretty well for the most part, but here are also some evidence from my reversing on the X230:
EcIoDxe exposes a function that appears to implement the SMBus Host Controller Interface specifications. The following are the EC registers used there: * 50h SMB_PRTCL * 51h SMB_STS * 52h SMB_ADDR * 53h SMB_CMD * 54h-73h SMB_DATA * 74h SMB_BCNT
EcFwUpdateDxe also updates the register at 3Dh, bitwise-orring it with DFh. This action is said to restrict EC flash access past the boot sequence [2], and lines up with the description of "Password Control" given by the IT8518 ASL.
Since the H8 configuration appears to be common across multiple boards, I believe these two can be merged seeing as the IT8518 definitions are a bit more detailed, potential mainboard-specific quirks notwithstanding. I'm curious to hear if there would be any issues or incompatibilities with this.
Cheers, Avery
[1]: https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocume... [2]: https://i.blackhat.com/USA-19/Thursday/us-19-Matrosov-Breaking-Through-Anoth...
-
Avery