[Openec] Few questions about KB3700/3926

[Richard A. Smith]

Maxim Levitsky wrote:

>> I don't think you would need to destroy an XO for the purposes of 
>> figuring out how the EC is wired.  It would just take a lot of
>> care.

> Maybe, but I once tried to trace wires on a TV card, and figured out
>  that that is impossible unless I unsolder the parts, and I don't
> think it is easy to unsolder a ~100 pins chip without damaging it.

Right but you had zero knowledge of the card.  I have detailed knowledge
of how the EC is hooked up and there is an old version of part of the
schematic available.  Using that and my suggestion that if you beep out
the EC IO pins to the enables for the voltage regulators that you can
get a good map of whats hooked to what.

> No, I figured that out. First bank (0x0000-0x4000) is switched
> between 4 areas in SPI flash chip 00K, 64K, 80K, 96K
> 
> other banks are mapped normally.

> Or in other words 00-64K contains regular firmware, and 3 additional
>  areas on top of that are mapped at 0x0000 (each area has to be 16K
> since this is limitation of XSEGn)

This is really good news.  Frieder said that he thought this would work
but now we have a real world example.  I think if I structure things 
right that I can create some EC code that is brick proof.  Where the 1st 
64k segment gets programmed at the factory and then never erased.  The 
rest of the code gets split into various 16k chunks and the bank 
register(s) massaged accordingly.

I'll have to use a bounce table for the interrupt vectors and the end 
result may be a bit confusing but I think it can work.

> Thanks for the pointer, but I don't want to poke at EC yet. What
> happens if I reset it? Could it be confused? The EC is very powerful,
> since it can toggle several GPIO lines that can damage the system if
> used incorrectly.

Depends.  The 3700 does not change the state of the IO lines when you 
put it in reset so nothing changes.  When you bring it out of reset it 
won't be any different than if you removed all external power and your 
battery.  On the XO that causes a power off because on boot the EC turns 
off all the regulators and waits for the power button.

>> If your laptop chipset has the entire EC space decoded via the LPC
>>  buss then you may be able to just read it via mmap().
> Exactly, it is mapped, this probably the best way.
>  
> Btw, does flash have a limit on number of reads?

Not NOR flash which is what most SPI flash is.  The EC executes code 
from the SPI so its constantly reading it.

-- 
Richard Smith  <richard at laptop.org>
One Laptop Per Child