[Trac #1122] EC code, dead lock code at 0x75b9

[Zarro Boogs per Child]

#1122: EC code, dead lock code at 0x75b9
---------------------------------+------------------------------------------
 Reporter:  frief                |       Owner:  ray.tseng at quantatw.com     
     Type:  defect               |      Status:  new                        
 Priority:  normal               |   Milestone:  Untriaged                  
Component:  embedded controller  |    Keywords:  EC watchdog brown out reset
---------------------------------+------------------------------------------
 at address 0x75b9 of the embedded controler
 (ec_vB81.img in directory http://dev.laptop.org/pub/ec/)
 is some code which I perceive is dead-lock code:

 {{{
         clr     a               ; 755b   e4         d
         mov     ie,a            ; 755c   f5 a8      u(
         mov     dptr,#ECFV      ; 755e   90 ff 01   ...
         movx    a, at dptr         ; 7561   e0         `
         anl     a,#7fh          ; 7562   54 7f      T.
         dec     a               ; 7564   14         .
         jz      X75ad           ; 7565   60 46      `F
         dec     a               ; 7567   14         .
         jz      X758b           ; 7568   60 21      `!
         dec     a               ; 756a   14         .
         jz      X7585           ; 756b   60 18      `.
         add     a,#0feh         ; 756d   24 fe      $~
         jnz     X75bb           ; 756f   70 4a      pJ
 }}}
 ...
 {{{
 X75ad:  clr     a               ; 75ad   e4         d
         mov     dptr,#ECFV      ; 75ae   90 ff 01   ...
         movx    @dptr,a         ; 75b1   f0         p
         mov     dptr,#GPIOED0   ; 75b2   90 fc 24   .|$
         movx    a, at dptr         ; 75b5   e0         `
         anl     a,#0feh         ; 75b6   54 fe      T~
         movx    @dptr,a         ; 75b8   f0         p
 X75b9:  sjmp    X75b9           ; 75b9   80 fe      .~

 }}}

 Description:
 First (at 0x755c) interrupts are disabled.
 Then, if the contents of ECFV (page 28 of the
 KB3700 Keyboard Controller Datasheet Revision 0.1)
 equals 0x01 or 0x81 a jump to address 0x75ad is done.
 A few instructions later the controler enters a loop at 0x75b9.

 '''IMHO this code should not exist.'''

 There is another occurrence of 0x80 0xfe (sjmp .) at 0x87a8.
 Probably not to be executed as it seems to directly follow
 a data table (0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80),
 but nevertheless  a good trap for an erratic program counter
 if the watchdog is disabled.
 (see also ticket #988 for code that would be dangerous in
 a brown out condition).

 I'm attaching (or trying to attach) a header file
 with register definitions as derived from the data
 sheet attached to ticket #477.

 Greetings,

 Frieder Ferlemann

-- 
Ticket URL: <http://dev.laptop.org/ticket/1122>
One Laptop Per Child <http://laptop.org/>