[coreboot] [RFC] Netbook Support

Corey Osgood corey.osgood at gmail.com
Thu Jan 8 23:07:41 CET 2009


On Sun, Jan 4, 2009 at 6:36 AM, Rudolf Marek <r.marek at assembler.cz> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi all,
>
> > do end up needed to did deeper and you can't get any info from the
> > manufacturer then EnE is your best bet for reverse engineering.
>
>
> I have taken a BIOS from Mini A110 (q1d25i.rom). The Quanta IL1 reference
> design
> seems to use ENE3310 controller. The q1d25i.rom was examined. The EC code
> is on
> 0xFFF00000 length is 64KB. The file is called HOLE0.ROM inside BIOS.
>
> The ENE KB3310 seems to be similar to ENE KB3920, which datasheet I found
> via
> google.
>
> I have taken IDA and did the LST file. It has 8051 inside. Yesterday I
> spoke
> with Bari and got the s51 emulator from (SVN:
> https://sdcc.svn.sourceforge.net/svnroot/sdcc/trunk).
>
> I fixed the serial port issue, and now the firmware runs inside emulator:
>
> Serial output:
> 00,
> ec[ECFV]==80ac
> wake at z,ACOut
> Zttttttttttttttttttttttttttt
>
> It prints 't' every second or so.
>
> It seems that a flash can be flashed even unsoldered via serial interface
> of EC.
> (some other pins must be pulled low)
>
> http://laptop.org/teamwiki/images/e/e5/SPI_Recovery.pdf
>
> Here is a EC schematics from reference design.
> http://laptop.org/teamwiki/images/f/fe/CL1_A1A.pdf


Those links are dead, any chance you know where they've moved to?

Thanks,
Corey
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.coreboot.org/pipermail/coreboot/attachments/20090108/47f9750b/attachment.html>


More information about the coreboot mailing list