[Openec] Few questions about KB3700/3926
maximlevitsky at gmail.com
Wed Jul 23 07:18:15 EDT 2008
Frieder Ferlemann wrote:
> Hi Maxim,
> Maxim Levitsky schrieb:
>> Accidentally I discovered that my laplop has an KB3926 embedded
>> It seems that it is quite popular since both olps and eee use some
>> variations of it.
>> KB3700 is very similar to this chip, for example its datasheet
>> reference s KB3925 several times
>> I was looking for that hardware that powers o/b IR port, and found out
>> that EC powers it.
>> I also found that EC can be accessed via 0xFF2C-0xFF2F ports
>> Using the data sheet I was able to download all EC memory to a file, now
>> I want to have fun and disassemble some of it.
>> but I face a problem now that I almost solved brute-force way.
>> I found that dump of 0x0000-0x4000 isn't consistent nor makes any
>> sense in disassembly (and this part is the most interesting part
>> because it contains interrupts and initialization vectors)
>> Reading at those addresses returns different values all the time, and
>> I feel I know why, I think there is a race accessing memory between
>> debug port and controller itself.
>> So I wrote a program that reads this range 64 bytes a time are gathers
>> statistics about which value is returned most frequently for each
> :) good work !)
>> And resulting memory dump looks very good, it has sane assembly (all
>> interrupt vectors start with jump instruction, and overall it looks
>> like good assembly, for example there are lots of accesses to
>> 0xF400-0xFFFF range.
>> Also resulting dump has large range of all zeros (unused area I think)
>> Do you know anything about this?
>> Does this chip have ram (I don't mean 128 bytes of standard ram, but
>> some large range of it like maybe this 0x0000-0x4000 range?) ?
> I do not know but if the KB3926 closely resembles the KB3700 then
> the different readings you are observing might be related to a
> bank switching mechanism:
> There is a register XBISEG0 mentioned in the KB3700 documentation
> which can be used to map the 8051 code memory within the SPI flash.
> Maybe you can index your statistics by the readings of XBISEG0 at
> 0xfea0? - (this might still be racy though)
Thanks a million.
Now I got perfect memory dumps of first 4K of memory.
It turns out that 4 segments are mapped there : XBISEG=0x00 0x84 0x85 0x86
I got dump of all of them, and I did the dump several times and got
exactly the same result
(I first wait for XBISEG to be non-correct value, then wait for it to be
correct value, so I am at beginning of window, and I repeat this process
4 times until I got same results all 4 times.
Btw, I probably will extract EC firmware from bios now since I know its
contents I can just search in bios range (last few megabytes of 4GB range).
I also know now whenever this chip has ram, it has it at SRAM window on
top of registers.
> (OpenEC makes use of XBISEG1 to access memory outside of its usual window.
> http://dev.laptop.org/git?p=projects/openec;a=blob;f=flash.c;hb=HEAD )
>> All addition information is welcome
> you might be interested in the file openec.ctl at the above location
> which is used to check the infamous openec.do_not_use.bin
> file and contains a list of KB3700 registers and IRQ vectors.
I have seen on your website that you still can't power the XO.
Can you disassemble the EC firmware for that? Or there are legal problems?
More information about the Openec