KB38xx/KB39xx: Difference between revisions

From flashrom
Jump to navigation Jump to search
(Created page with "For KBC38xx/39xx: a) The system host communicates with 8051 via ECPCMD, ECPARG1, ECPARG2, and ECPARG3 registers in EC space offset 10h, 11h, 12h and 13h. A non-zero value of PC...")
 
mNo edit summary
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
For KBC38xx/39xx:
Here are summarized info from [http://wiki.laptop.org/images/a/ab/KB3700-ds-01.pdf Ene KB3700 datasheet] and from output of INDX RAM from ectool
a) The system host communicates with 8051 via  ECPCMD, ECPARG1, ECPARG2, and ECPARG3 registers in EC space offset 10h, 11h, 12h
and 13h. A non-zero value of PCMD will cause the 8051 P0IE.0 interrupt to take place
informing the 8051 firmware, and the 8051 firmware will take the responsibility to carry this
command.


PCMD:
== Command ==


'''01h''' Query 8051 Status
Usual legacy EC commands over 62h/64h port - widely known
'''02h''' Idle
'''03h''' Power down
'''04h''' Init flash write - The 8051 should return OK status to grant host system to write flash. After the completion
of this command, the 8051 should enter IDLE mode or reset condition (set EC_PXCFG bit 0 = 1) to prevent from 8051 fetching instruction code.


entry: argument_1 - if 01 - update all flash content, including 8051 code region.
Extended EC commands:
if 02 - update system BIOS, not including 8051 code region.


exit: cmd 00h argument_1 if 00h: OK, the host can write flash now.
You may use EC Index IO mode to access the EC register space (F400h ~FFFFh). The
if 01h: Error, no AC Adapter (the AC should be plugged during
EC Index IO base is set in LPC register FE92h, FE93h. The base address + 1 is index high
update flash).
byte address. The base address + 2 is index low byte address. The base address + 3 is data
if 02h: Error, unknown condition.
port for reading from or writing to EC internal register space.


LPC bus:
Extended commands:


There are two memory address segments that are decoded by KB3910.
The system host communicates with 8051 via  CMD (0x10h offset), ARG1 (0x11h offset), ARG2 (0x12h offset), and ARG3 (ox13 offset) registers in EC space. A non-zero value of CMD will cause the 8051 P0IE.0 interrupt to take place informing the 8051 firmware, and the 8051 firmware will take the responsibility to carry this command.
1.000Y_0000h ~ 000F_FFFFh, where Y is selectable to C/E/Fh in register LFMSM(FE91h)
 
2.FFXX_0000h~FFFF_FFFFh, where XX is selectable to FE/FC/F8/F0/E0/C0/80h in register
Valid CMDs :
LFMSM(FE91h).
 
* '''01h''' Query Status
* '''02h''' Idle
* '''03h''' Power down
* '''04h''' Init flash write - The 8051 should return OK status to grant host system to write flash. After the completion of this command, the 8051 should enter IDLE mode or reset condition (set CFG (offset 0x14h) bit 0 = 1) to prevent from 8051 fetching instruction code. CFG (offset 0x14h bit 6 - Enable 8051 memory write cycle to off-chip The purpose of this bit is to prevent 8051 firmware from writing to BIOS If not enabled, the 8051 can only access to on-chip peripherals in EC Space.
 
* '''enter''' : ARG1 - if 01 - update all flash content, including 8051 code region, if 02 - update system BIOS, not including 8051 code region.
 
* '''exit''' : CMD 00h ARG1 if 00h - OK, the host can write flash now, if 01h - Error, no AC Adapter (the AC should be plugged during update flash), if 02h - Error, unknown condition.
 
== LPC ==
 
There are two memory address segments that are decoded by KB38xx/39xx
 
# 000Y_0000h ~ 000F_FFFFh, where Y is selectable to C/E/Fh in register LPC/FWH BASE (FE91h)
# FFXX_0000h~FFFF_FFFFh, where XX is selectable to FE/FC/F8/F0/E0/C0/80h in register LPC/FWH BASE (FE91h).

Latest revision as of 16:37, 26 September 2010

Here are summarized info from Ene KB3700 datasheet and from output of INDX RAM from ectool

Command

Usual legacy EC commands over 62h/64h port - widely known

Extended EC commands:

You may use EC Index IO mode to access the EC register space (F400h ~FFFFh). The EC Index IO base is set in LPC register FE92h, FE93h. The base address + 1 is index high byte address. The base address + 2 is index low byte address. The base address + 3 is data port for reading from or writing to EC internal register space.

Extended commands:

The system host communicates with 8051 via CMD (0x10h offset), ARG1 (0x11h offset), ARG2 (0x12h offset), and ARG3 (ox13 offset) registers in EC space. A non-zero value of CMD will cause the 8051 P0IE.0 interrupt to take place informing the 8051 firmware, and the 8051 firmware will take the responsibility to carry this command.

Valid CMDs :

  • 01h Query Status
  • 02h Idle
  • 03h Power down
  • 04h Init flash write - The 8051 should return OK status to grant host system to write flash. After the completion of this command, the 8051 should enter IDLE mode or reset condition (set CFG (offset 0x14h) bit 0 = 1) to prevent from 8051 fetching instruction code. CFG (offset 0x14h bit 6 - Enable 8051 memory write cycle to off-chip The purpose of this bit is to prevent 8051 firmware from writing to BIOS If not enabled, the 8051 can only access to on-chip peripherals in EC Space.
  • enter : ARG1 - if 01 - update all flash content, including 8051 code region, if 02 - update system BIOS, not including 8051 code region.
  • exit : CMD 00h ARG1 if 00h - OK, the host can write flash now, if 01h - Error, no AC Adapter (the AC should be plugged during update flash), if 02h - Error, unknown condition.

LPC

There are two memory address segments that are decoded by KB38xx/39xx

  1. 000Y_0000h ~ 000F_FFFFh, where Y is selectable to C/E/Fh in register LPC/FWH BASE (FE91h)
  2. FFXX_0000h~FFFF_FFFFh, where XX is selectable to FE/FC/F8/F0/E0/C0/80h in register LPC/FWH BASE (FE91h).
Retrieved from "https://wiki.flashrom.org/index.php?title=KB38xx/KB39xx&oldid=1221"