Difference between revisions of "Embedded Controller Firmware"

From ThinkWiki
Jump to: navigation, search
(→‎ThinkPad Embedded Controller Firmware: mention BIOS/ec types)
(→‎See also: added details)
 
(27 intermediate revisions by 3 users not shown)
Line 5: Line 5:
 
The ThinkPad has an embedded microcontroller (EC) which is responsible for many of the background tasks on a laptop.  [[Embedded Controller Chips]] lists the different embedded microcontrollers found on various ThinkPads.  This page concerns itself with the various embedded controller firmwares.
 
The ThinkPad has an embedded microcontroller (EC) which is responsible for many of the background tasks on a laptop.  [[Embedded Controller Chips]] lists the different embedded microcontrollers found on various ThinkPads.  This page concerns itself with the various embedded controller firmwares.
  
−
The correct way to refer to a particular instance of a firmware is not the ThinkPad name (ThinkPad T43) or model number (2668-XXX), but rather by the ACPI OEM ID (aka BIOS/EC type) which is unique to BIOS-and-firmware-image-compatible.  There is a list of them in the [[BIOS Upgrade Downloads]] page.
+
The more precise way to refer to a particular instace of the ThinkPad firmware is not the ThinkPad name (ThinkPad T43) or model number (2668-XXX), but rather by the firmware model string, which is unique to BIOS-and-firmware-image-compatible ThinkPads.  E.g. there are both R52 and T43 ThinkPads with firmware model TP-70: they share the same BIOS and EC firmware, and also the same bugs...  There is a list of the ThinkPad BIOS/EC types in the [[BIOS Upgrade Downloads]] page.
 +
 
 +
The firmware model string is "TP-" and the two first characters of the BIOS/EC version strings (e.g. BIOS 1YET29WW and EC 1YHT29WW are for the firmware model TP-1Y, which happens to be some of the T43, and the T43p).
  
 
{{WARN|As a rule, if you are not using the latest available firmware for your ThinkPad, you are likely to be the unlucky chap that will find out some new code hits a firmware bug that was fixed by IBM or Lenovo.  Do yourself a favour and always keep your ThinkPad's firmware up-to-date.}}
 
{{WARN|As a rule, if you are not using the latest available firmware for your ThinkPad, you are likely to be the unlucky chap that will find out some new code hits a firmware bug that was fixed by IBM or Lenovo.  Do yourself a favour and always keep your ThinkPad's firmware up-to-date.}}
Line 11: Line 13:
 
== Old-style ThinkPad EC firmware ==
 
== Old-style ThinkPad EC firmware ==
  
−
Not much is known about the ECs on the older numeric-series ThinkPads, or the early A, X and T-series models.  These microcontrollers don't seem to support field-upgradeable firmware, and only the BIOS SMAPI and DSDT ACPI interfaces are really available for driver writers.
+
Not much is known about the ECs on the older numeric-series ThinkPads, or the early A, X and T-series models.  These microcontrollers do support field-upgradeable firmware which is distributed along with the BIOS upgrades. The BIOS SMAPI, DSDT ACPI and a very small subset of the EC ACPI interfaces are available for driver writers.
  
 
* Interfaces:
 
* Interfaces:
−
** EC register map
+
** EC register map (very model-specific)
 
** ACPI DSDT / APM
 
** ACPI DSDT / APM
 
** SMAPI
 
** SMAPI
Line 20: Line 22:
  
 
* Drivers:
 
* Drivers:
−
** [[ibm-acpi]]
+
** [[thinkpad-acpi]]
 
** Generic kernel ACPI and APM
 
** Generic kernel ACPI and APM
 
** [[tpctl]]
 
** [[tpctl]]
Line 38: Line 40:
  
 
* Drivers:
 
* Drivers:
−
** [[ibm-acpi]]
+
** [[thinkpad-acpi]]
 
** generic ACPI
 
** generic ACPI
 
** [[tp_smapi]]
 
** [[tp_smapi]]
Line 51: Line 53:
 
* Linux annoyance level: harmless
 
* Linux annoyance level: harmless
 
* Windows annoyance level: unknown
 
* Windows annoyance level: unknown
−
* Fix: available from IBM, but not for all affected models
+
* Fix: available from IBM, but only for T43 and R52
 
* Information: [http://thread.gmane.org/gmane.linux.hardware.thinkpad/27484/ thread in linux-thinkpad ML]
 
* Information: [http://thread.gmane.org/gmane.linux.hardware.thinkpad/27484/ thread in linux-thinkpad ML]
  
 
* Models affected:
 
* Models affected:
−
** {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}: all models affected, no fix available
+
** TP-1R ({{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}): no fix available
−
** {{T43}} 26xx, {{T43p}}: fixed on firmware 1YHT28WW (1.05) and newer
+
*** Versions with the bug: 1RHT69WW (3.02) and later.  Older versions do not have EC LPC3B 0x0A or 0x0B, so they are safe
−
** {{T43}} 18xx, {{R52}}: likely buggy, unknown status (might be fixed in latest firmwares)
+
*** Entry in IBM public changelog for 1RHT69WW says: "(New) Support for Battery data logging and cell voltage check"
−
** other ThinkPads featuring advanced battery queries: unknown status; every model supported by [[tp_smapi]] advanced battery information is a candidate for this bug
+
** TP-1Y ({{T43}} 26xx, {{T43p}}): fixed by firmware 1YHT28WW (1.05) and newer
 +
*** All versions before 1YHT28WW (1.05) have the bug
 +
*** Entry in IBM public changelog for 1YHT28WW says: "(Fix) Fix for battery information query processing"
 +
** TP-70 ({{T43}} 18xx, {{R52}}): fixed by firmware 70HT27WW (1.04) and newer
 +
*** All versions before 70HT27WW (1.04) have the bug
 +
** TP-76 ({{R52}}): fixed by firmware 76HT15WW (1.05) and newer
 +
*** All versions before 76HT15WW (1.05) have the bug
 +
** other IBM ThinkPads featuring advanced battery queries (are there any?): unknown status; every model supported by [[tp_smapi]] advanced battery information is a candidate for this bug
  
−
The EC LPC3B advanced battery query function 0x0B (only used by [[tp_smapi]]) has a hideous bug that
+
The EC LPC3B advanced battery query function 0x0B (acessed by earlier versions of [[tp_smapi]]) has a hideous bug that causes the EC to misbehave and crash (usually hanging the entire ThinkPad).  This function must never be called on a buggy firmware: after you called it even once, all is lost: the the box will crash and burn shortly.  A full power down is the only thing that will fix it, as we don't know how to cause an immediate EC reboot.
−
causes the EC to misbehave and crash (usually hanging the entire ThinkPad).  This function must never
 
−
be called on a buggy firmware.
 
  
−
No Linux drivers use this function, as its purpose is currently unknown.
+
No Linux drivers use this function, as the meaning of the data it returns is currently unknown.
  
 
=== Bug: Fan control loop status is not initialized ===
 
=== Bug: Fan control loop status is not initialized ===
Line 73: Line 80:
 
* Information: [http://forum.thinkpads.com/viewforum.php?f=27 thinkpads.com fan control programs forum], [http://thread.gmane.org/gmane.linux.hardware.thinkpad/28326 linux-thinkpad ML thread 1], [http://thread.gmane.org/gmane.linux.hardware.thinkpad/28554 linux-thinkpad ML thread 2]
 
* Information: [http://forum.thinkpads.com/viewforum.php?f=27 thinkpads.com fan control programs forum], [http://thread.gmane.org/gmane.linux.hardware.thinkpad/28326 linux-thinkpad ML thread 1], [http://thread.gmane.org/gmane.linux.hardware.thinkpad/28554 linux-thinkpad ML thread 2]
  
−
* Models affected (no ACPI workaround):
+
* Models affected (confirmed):
−
** {{T43}} TP-1Y, {{T43p}}, {{R51e}} TP-78
+
** TP-1Y ({{T43}}, {{T43p}}), TP-78 ({{R51e}}), TP-76 ({{R52}}), TP-70({{R52}}, {{T43}})
−
* Models NOT affected (confirmed by reports):
+
* Models NOT affected (confirmed):
−
** R60 TP-7C, T60/p TP-79, T23 TP-1A, A31 TP-1G, R51 TP-1V, T40/p,T41/p,T42/p,R50/p,R51 TP-1R
+
** TP-7C (R60), TP-79 (T60/p), TP-7B (X60/s), TP-1A (T23), TP-1G (A31), TP-1V (R51), TP-1R (T40/p,T41/p,T42/p,R50/p,R51)
−
* Models that are probably affected (need reports):
 
−
** {{T43}} TP-70, {{R52}} TP-76, TP-70
 
−
* Models that are probably not affected (some reports would be nice):
 
−
** T3x, X3x, T42, anything newer than the T43, R52.
 
  
−
The EC does not correctly initializes its 0x2f (fan control) register, so [[ibm-acpi]] cannot determine the correct status of the fan control until something writes to the fan control register for the first time.
+
The EC does not correctly initializes its 0x2f (fan control) register, so [[thinkpad-acpi]] cannot determine the correct status of the fan control until something writes to the fan control register for the first time.
  
−
Many models do write to the fan control register in their ACPI DSDT methods, which provides a work-around.  This usually fixes the issue during suspend and wakeup.
+
Writes to the fan control register in their ACPI DSDT methods provides a work-around.  This usually fixes the issue during suspend and wakeup.
  
 
So far, there are only reports of wrong readings of 0x07, no other wrong value has been observed.  Note that 0x07 might be a correct value if the system is in emergency fan mode (level 7).
 
So far, there are only reports of wrong readings of 0x07, no other wrong value has been observed.  Note that 0x07 might be a correct value if the system is in emergency fan mode (level 7).
Line 90: Line 93:
 
=== Bug: Fan control loop pulses the fan in an annoying pattern ===
 
=== Bug: Fan control loop pulses the fan in an annoying pattern ===
 
* Severity: low
 
* Severity: low
−
* Linux annoyance level: '''critical'''
+
* Linux annoyance level: '''severe'''
−
* Windows annoyance level: '''critical'''
+
* Windows annoyance level: '''severe'''
 
* Fix: available from IBM, but incorrectly fixed on some models.  Unofficial fix available for firmware hackers.
 
* Fix: available from IBM, but incorrectly fixed on some models.  Unofficial fix available for firmware hackers.
 
* Workaround: A software workaround is available using an [[ACPI fan control script]], but this overrides the embedded controller's fan control algorithm.
 
* Workaround: A software workaround is available using an [[ACPI fan control script]], but this overrides the embedded controller's fan control algorithm.
−
* Information: [http://forum.thinkpads.com/viewtopic.php?t=20958 thinkpads.com forum thread], [http://forum.thinkpads.com/viewtopic.php?t=1670 thinkpads.com forum thread], [[Problem with fan noise]]
+
* Information: [http://forum.thinkpads.com/viewtopic.php?t=20958 thinkpads.com forum thread 1], [http://forum.thinkpads.com/viewtopic.php?t=1670 thinkpads.com forum thread 2], [[Problem with fan noise]]
  
 
* Models affected:
 
* Models affected:
−
** {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}: fixed by firmware 1RHT70WW (3.03) and later
+
** TP-1R ({{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}): fixed by firmware 1RHT70WW (3.03) and later
−
** {{T43}}, {{T43p}}, {{R52}}: IBM provided a '''broken''' firmware fix, so they are all affected
+
** TP-1Y, TP-70, TP-76 ({{T43}}, {{T43p}}, {{R52}}): IBM provided a '''broken''' firmware fix, so they are all affected
 
** other newer models: unknown status
 
** other newer models: unknown status
  
−
The fan control loop will vary the fan speed quite a lot, in a very annoying pattern.  The broken fix on the T43 firmware causes very loud and annoying pulses every 30s.
+
The fan control loop will vary the fan speed quite a lot, in a very annoying pattern.  The broken fix on the T43/R52 firmware causes very loud and annoying pulses every 30s.
  
 
People have reportedly returned ThinkPads because of this bug.
 
People have reportedly returned ThinkPads because of this bug.
 +
 +
=== Bug: Tachometer registers not updated when entering or exiting disengaged mode ===
 +
* Severity: very low
 +
* Linux annoyance level: very low
 +
* Windows annoyance level: very low
 +
* Workaround: wait for a while for the fan to fully switch to the new mode
 +
* Fix: none available
 +
 +
* Models affected:
 +
** TP-1Y ({{T43}}, {{T43p}}), TP-79 ({{T60}}, {{T60p}}) and others (disengaged mode might not be supported on all ThinkPads)
 +
* Models not affected:
 +
** TP-1G, TP-1N ({{A31}}, {{A31p}})
 +
 +
When the fan control loop is placed in disengaged mode (bit 6 of EC register 0x2f transitions to set), some ThinkPads will not read the tachometer while the fan is speeding up.  It takes quite a while for the fan to speed up, so the tachometer can be stale for a long time, close to a full minute.  The same also happens when exiting disengaged mode (bit 6 of EC register 0x2f transitions to clear).
 +
 +
During this time window, fan monitoring applets will report incorrect speeds.
  
 
=== Bug: Tachometer registers not invalidated in disengaged mode ===
 
=== Bug: Tachometer registers not invalidated in disengaged mode ===
 
* Severity: low
 
* Severity: low
−
* Linux annoyance level: minor
+
* Linux annoyance level: none - it is a feature
−
* Windows annoyance level: minor
+
* Windows annoyance level: none - it is a feature
 
* Fix: none available
 
* Fix: none available
  
 
* Models affected:
 
* Models affected:
−
** Unknown (disengaged mode might not be supported on all ThinkPads)
+
** TP-1Y ({{T43}}, {{T43p}}), TP-79 ({{T60}}, {{T60p}}) and others (disengaged mode might not be supported on all ThinkPads)
−
 
+
* Models not affected:
−
When the fan control loop is placed in disengaged mode (bit 6 of EC register 0x2f is set) where no tachometer readings take place, the EC does not set the tachometer registers (0x84, 0x85) to 0xFF to signal an invalid reading.  Instead, the registers are simply not updated anymore and retain the last tachometer reading that took place.
+
** TP-1G, TP-1N ({{A31}}, {{A31p}})
  
−
This bug can be easily worked around in drivers.
+
When the fan control loop is entering or leaving disengaged mode (bit 6 of EC register 0x2f changed state), some ThinkPads will not update the tachometer for quite a while.  On those ThinkPads, the EC does not set the tachometer registers (0x84, 0x85) to 0xFF to signal an invalid reading.  Instead, the registers are simply not updated and retain the last valid tachometer reading.
  
 
= See also =
 
= See also =
 
* [[BIOS Upgrade|BIOS and firmware upgrade information]]
 
* [[BIOS Upgrade|BIOS and firmware upgrade information]]
 
* [[tp_smapi|tp_smapi Linux driver]]
 
* [[tp_smapi|tp_smapi Linux driver]]
−
* [[ibm-acpi|ibm-acpi Linux ACPI driver]]
+
* [[thinkpad-acpi|thinkpad-acpi Linux ACPI driver]]
 +
* [http://forum.thinkpads.com/viewtopic.php?t=20958 T43p Embedded Controller Internals]

Latest revision as of 13:47, 14 November 2020

ThinkPad Embedded Controller Firmware

The ThinkPad has an embedded microcontroller (EC) which is responsible for many of the background tasks on a laptop. Embedded Controller Chips lists the different embedded microcontrollers found on various ThinkPads. This page concerns itself with the various embedded controller firmwares.

The more precise way to refer to a particular instace of the ThinkPad firmware is not the ThinkPad name (ThinkPad T43) or model number (2668-XXX), but rather by the firmware model string, which is unique to BIOS-and-firmware-image-compatible ThinkPads. E.g. there are both R52 and T43 ThinkPads with firmware model TP-70: they share the same BIOS and EC firmware, and also the same bugs... There is a list of the ThinkPad BIOS/EC types in the BIOS Upgrade Downloads page.

The firmware model string is "TP-" and the two first characters of the BIOS/EC version strings (e.g. BIOS 1YET29WW and EC 1YHT29WW are for the firmware model TP-1Y, which happens to be some of the T43, and the T43p).

ATTENTION!
As a rule, if you are not using the latest available firmware for your ThinkPad, you are likely to be the unlucky chap that will find out some new code hits a firmware bug that was fixed by IBM or Lenovo. Do yourself a favour and always keep your ThinkPad's firmware up-to-date.

Old-style ThinkPad EC firmware

Not much is known about the ECs on the older numeric-series ThinkPads, or the early A, X and T-series models. These microcontrollers do support field-upgradeable firmware which is distributed along with the BIOS upgrades. The BIOS SMAPI, DSDT ACPI and a very small subset of the EC ACPI interfaces are available for driver writers.

  • Interfaces:
    • EC register map (very model-specific)
    • ACPI DSDT / APM
    • SMAPI
    • CMOS memory map

New-style ThinkPad EC firmware

Apparently, all newer ThinkPad ECs are a Renesas H8S/2161BV or another compatible H8S/300 microcontroller with very similar firmware.

  • Interfaces:
    • Forward-compatible EC register map
    • ACPI DSDT, APM (deprecated in newer models)
    • Renesas H8S LPC3A (?), LPC3B (HDAPS firmware, Battery information)
    • ACPI SMAPI methods
    • SMAPI
    • CMOS memory map
FIXME
tpctl, tpb and other drivers, please someone expand on how well they work with the new ThinkPads

Firmware issues

Various bugs have been observed in the ThinkPad EC firmware of various models. Most of them were fixed in later revisions, but a few are either very dangerous and driver writers need to always work around them, or have never been fixed. One must keep in mind that many of the bugs fixed by IBM or Lenovo could cause serious problems, but might never be noticed by driver developers, because they usually keep their ThinkPads up-to-date. People that don't keep their ThinkPad firmware up-to-date are excellent guinea pigs...

Bug: Advanced battery query causes EC hang

  • Severity: critical
  • Linux annoyance level: harmless
  • Windows annoyance level: unknown
  • Fix: available from IBM, but only for T43 and R52
  • Information: thread in linux-thinkpad ML
  • Models affected:
    • TP-1R (T40, T40p, T41, T41p, T42, T42p): no fix available
      • Versions with the bug: 1RHT69WW (3.02) and later. Older versions do not have EC LPC3B 0x0A or 0x0B, so they are safe
      • Entry in IBM public changelog for 1RHT69WW says: "(New) Support for Battery data logging and cell voltage check"
    • TP-1Y (T43 26xx, T43p): fixed by firmware 1YHT28WW (1.05) and newer
      • All versions before 1YHT28WW (1.05) have the bug
      • Entry in IBM public changelog for 1YHT28WW says: "(Fix) Fix for battery information query processing"
    • TP-70 (T43 18xx, R52): fixed by firmware 70HT27WW (1.04) and newer
      • All versions before 70HT27WW (1.04) have the bug
    • TP-76 (R52): fixed by firmware 76HT15WW (1.05) and newer
      • All versions before 76HT15WW (1.05) have the bug
    • other IBM ThinkPads featuring advanced battery queries (are there any?): unknown status; every model supported by tp_smapi advanced battery information is a candidate for this bug

The EC LPC3B advanced battery query function 0x0B (acessed by earlier versions of tp_smapi) has a hideous bug that causes the EC to misbehave and crash (usually hanging the entire ThinkPad). This function must never be called on a buggy firmware: after you called it even once, all is lost: the the box will crash and burn shortly. A full power down is the only thing that will fix it, as we don't know how to cause an immediate EC reboot.

No Linux drivers use this function, as the meaning of the data it returns is currently unknown.

Bug: Fan control loop status is not initialized

  • Models affected (confirmed):
  • Models NOT affected (confirmed):
    • TP-7C (R60), TP-79 (T60/p), TP-7B (X60/s), TP-1A (T23), TP-1G (A31), TP-1V (R51), TP-1R (T40/p,T41/p,T42/p,R50/p,R51)

The EC does not correctly initializes its 0x2f (fan control) register, so thinkpad-acpi cannot determine the correct status of the fan control until something writes to the fan control register for the first time.

Writes to the fan control register in their ACPI DSDT methods provides a work-around. This usually fixes the issue during suspend and wakeup.

So far, there are only reports of wrong readings of 0x07, no other wrong value has been observed. Note that 0x07 might be a correct value if the system is in emergency fan mode (level 7).

Bug: Fan control loop pulses the fan in an annoying pattern

  • Models affected:
    • TP-1R (T40, T40p, T41, T41p, T42, T42p): fixed by firmware 1RHT70WW (3.03) and later
    • TP-1Y, TP-70, TP-76 (T43, T43p, R52): IBM provided a broken firmware fix, so they are all affected
    • other newer models: unknown status

The fan control loop will vary the fan speed quite a lot, in a very annoying pattern. The broken fix on the T43/R52 firmware causes very loud and annoying pulses every 30s.

People have reportedly returned ThinkPads because of this bug.

Bug: Tachometer registers not updated when entering or exiting disengaged mode

  • Severity: very low
  • Linux annoyance level: very low
  • Windows annoyance level: very low
  • Workaround: wait for a while for the fan to fully switch to the new mode
  • Fix: none available
  • Models affected:
    • TP-1Y (T43, T43p), TP-79 (T60, T60p) and others (disengaged mode might not be supported on all ThinkPads)
  • Models not affected:

When the fan control loop is placed in disengaged mode (bit 6 of EC register 0x2f transitions to set), some ThinkPads will not read the tachometer while the fan is speeding up. It takes quite a while for the fan to speed up, so the tachometer can be stale for a long time, close to a full minute. The same also happens when exiting disengaged mode (bit 6 of EC register 0x2f transitions to clear).

During this time window, fan monitoring applets will report incorrect speeds.

Bug: Tachometer registers not invalidated in disengaged mode

  • Severity: low
  • Linux annoyance level: none - it is a feature
  • Windows annoyance level: none - it is a feature
  • Fix: none available
  • Models affected:
    • TP-1Y (T43, T43p), TP-79 (T60, T60p) and others (disengaged mode might not be supported on all ThinkPads)
  • Models not affected:

When the fan control loop is entering or leaving disengaged mode (bit 6 of EC register 0x2f changed state), some ThinkPads will not update the tachometer for quite a while. On those ThinkPads, the EC does not set the tachometer registers (0x84, 0x85) to 0xFF to signal an invalid reading. Instead, the registers are simply not updated and retain the last valid tachometer reading.

See also

Retrieved from "https://www.thinkwiki.org/w/index.php?title=Embedded_Controller_Firmware&oldid=61110"