Thanks so much! I’ve been using Ghidra as well, with the ghidra-firmware-utils plugin. It maps known UEFI protocols/guids/types and scans the target for them. Really takes the hassle out.
This is all excellent stuff, and I appreciate it! I do have a couple questions and notes
I’m planning on releasing (and hopefully getting signed) the CrosEC driver [DISCLOSURE: GPLv2!] and a cross-platform userland tool for setting up things like the charge limit/keyboard mapping. Please don’t let its existence stop you from changing how these host commands work–it’s supposed to be informative, not normative, and I’m happy to adapt¹ it–as it’s your firmware at the end of the day.
What does the high bit in 3E03’s flags do? I saw that it propagates something to the charge limit value (High bit + charge limit 80 => 0xD0), but I can’t figure out what it does with that bit afterwards.
What’s the “ME Lock” (3E06 possibly toggles it?)
Do you actually read the chassis intrusion counters into a TPM PCR? That would be super cool from a platform security perspective, but I might have made it up!
Is the UEFI configured not to load DriverOrder/Driver#### entries? I wrote FrameworkKeyMapDriver [MIT] which, right now, remaps Caps to Esc, but it only works with a bootloader that loads auxiliary drivers.
This is a feature idea, not a question, which you are free to ignore. If the Fn key toggled the use of a different matrix->scancode map² instead of a hardcoded post-scancode lookup, folks could add additional Fn mappings . . . which might be a really neat power user feature.
¹ Especially if you’d be willing to coordinate updates but that’s a hope, not a request.
² Probably three maps, since it looks like there’s a table for “fn locked/always”, “fn held only” and “something after fn held, but I can’t figure out why it’s not part of the second lookup”.
@DHowett thanks again for the reverse-engineering! I have a question:
cross-platform userland tool for setting up things like the charge limit/keyboard [
Specifically for charge limits, do your upstream kernel driver changes enable the standard threshold API under /sys/class/power_supply/...? If so then tlp should also work as a charge threshold tool, correct?
Unfortunately, no. Since this EC uses a custom implementation of charge limiting, additional driver support would be required to expose it to the threshold API.
The proposed patch set only adds support for communicating with the EC to the existing EC driver.
I would also be interested in this, and keeping it GPLv2. If you want to coordinate/collaborate we could build on your work. I don’t have much experience with windows driver development. But would be interested in some collaboration as this is really useful. If you need help getting it signed we could do a code review and get some CI running on it, and release signed builds (I think we would need to clone the repo under the Framework org and setup some code review process for pull requests).
The high bit allows you to set a limit but allow the laptop to charge to 100%. The idea with this is if we had an os utility we could trigger a 1 time override to the limit. Eg if you knew you had a long day of meetings you could charge up the battery once to 100%.
ME lock sets the ME region CPU strap pin to lock or unlock the ME region on boot.
We don’t load them into the TPM. This only drives bios password behavior. Eg trigger a bios password on boot.
I will need to check on this.
I would like to add an additional layer to the keyboard that could remap any key. But I think it would be better to map a different scancode to this, as the Fn key has some behavior that mixes with Fn lock. Eg Fn+Esc triggers Fn lock, and this only applies to the top row keys on the keyboard layer. But there is also Fn+ keys in the character section which need to only be active when Fn is held down, even if Fn Lock is active. Eg
Fn+ Delete = Insert
Fn+K = Scroll Lock
Fn+S = Sysreq
Fn+Left,right, up, down = Home, End, PageUp, PageDown
The second function for Fn+ Mapping is for the following keys, and is separate because these keys require multiple scancodes to send the command to the host. Eg Pause is actually 8 bytes. If you look up scanset 2, these are kind of special multibyte key codes so they have a separate function PS2 Keyboard Scan Codes | Online Documentation for Altium Products.
Fn+B = Break
Fn+P = Pause
I’m really looking forward to having any way to adjust the charge level / one shot 100% on screen in windows.
Love that you are “slogging” through this, and the FW support of it. Every time I check the forum and see the progress going on, I am so happy I bought a Framework Laptop.
I’ve updated the post linked above to be true to the actual upstream code (yay!), and archived the original reverse engineered info. It also includes a section on ongoing work, which contains a blurb about the patches and the Windows CrosEC driver.
Thanks. The 80% charge setting will help extend the usable life of the battery for those who use the laptop plugged in more often than they do on battery. It’s a lot more flexible than the BIOS “battery disconnect” option, which requires a working AC adapter to revert back to normal operation, so if you happen to lose power, you’re shift out of luck. Still a useful option in some cases, maybe for a slightly expanded battery that you want to keep from getting worse until you can get to a better place to take it apart (i.e. if you’re on a trip but still able to get by with it only on plug power, not using the battery, but you don’t have a good place to unscrew the laptop and take the battery out until you’re done with the trip)
A “charge threshold” adjustment in the BIOS would have been better (so it would be in effect even when the computer was shut down but still plugged into power) i.e. still charging up to 100%, only if the battery has fallen below (insert threshold here) since you won’t be drawing power from it when you are using it plugged in, so the only reduction would be self-discharge.
Also, how about a simple “cooling mode” option, without having to adjust a whole curve but there were 2 predefined options, one of which was called “quiet/default” and the second being “Performance cooling” where the fan defaults to a higher value in idle as well as kicking up higher at a lower temperature, so the CPU could spend more time doing it’s “Mobile Turbo” thing. Suggestion for next Framework model?
This is already available, in Linux at least. Look higher up in this thread for details and exact commands to use for direct control of the fans or to restore automatic mode.
I’m unsure of the status of Winblows support for this at the moment, because I refuse to allow that degenerate OS within 100m of my framework but @DHowett said he was working on such a thing.
I’m thinking of making a quick little config profile for NoteBook Fan Control (Windows utility) - any chance someone has already done that? Given the state of things, seems like it takes 90% of the hard work out of coding (creating a driver, UI, etc) and just need to point it to the right commands and data to send to the EC. Hmm…
Its design is geared towards fan control (which doesn’t currently seem possible), but it could easily serve as a battery charge-limit utility in the interim, 'til fan control comes out (if anyone still needs it - honestly it seems to work admirably well as-is - I haven’t needed to boost the fans as it knows when to run full speed on its own! Uh, take that, Apple).
There is a limiter in the bios for battery max charge.
What fan control do you want? Surely you would want the CPU temp to decide that, and there are four settings already, in Windows, for CPU control which effectively control temperature.
Battery Saver: PL1 10-12W (I need to double check)
Best Battery: PL1 15W
Balanced: PL1 28W (with thermal throttling control to limit max temps)
Best performance: PL1 28W with higher thermal limits.
The point of much of this thread has been about user-land control. I try and avoid rebooting the computer… really, only when it crashes. Rest of the time, sleep and hibernate. So yeah, talking about user-land control here
I only ever want to control the fan to run faster for whatever reason I happen to have at the time.
It’s always such a nice feeling to have to reply in defense of what I’m asking for, instead of replying in collaboration of establishing a solution.
I actually did try to do this at one point, and I was reasonably confident about the EC register for fan speed (I think it was 0x21? I didn’t write it down so not 100% sure), but I couldn’t actually control the speed by writing to that register. I saw someone mention that there’s a separate command that needs to be used to first disable automatic fan control before the fan speed register does anything – that’s presumably the hang up here.
Fan control through NBFC would definitely be super nice to have. Even though the Framework has one of the overall best tuned fan curves I’ve used on a laptop, it would still be helpful to be able to manually set the fan speed (especially without needing to reboot). For example, the fan is super trigger happy when plugged in, even on the lowest Windows power mode, to the point where it spins when the package temperature is hovering around 50° C when watching a YouTube video. It would be nice to be able to manually turn off the fan in cases like these since the cooler is clearly capable of passively cooling the chip under low load, and this is exactly how it operates when on battery power anyway.
Honestly, I think this is because the fan is targeting more than just the CPU temp. When charging, the power conversion circuitry can get fairly toasty as it wolfs down a full 60 watts. That may be the cause there… maybe.
I dug into using NBFC for battery control and gave up after stumbling into a big roadblock: it only takes one arbitrary value, “register”, as an 8-bit value (0-255) and have single byte (or word, as an option) outputs. The values for EC are 16-bit addresses with variable length values, so it doesn’t make much sense, didn’t know how to convert it. Maybe NBFC is made for an earlier generation of laptops, prior to this whole Windows 11/“always connected”/new-world-ROM sort of thing. I suspect an entirely new generation of EC goes along with it.
All I really want is user-land battery control, but since I power my laptop solely by battery bank (OmniCharge 20+) and solar juice, I’m almost always running on battery anyway, and the battery inherently stays in its happy zone (anywhere under 90%) just by usage patterns. Been an EV nerd for over 10 years now, so the car and the laptop batteries both ought to last basically forever. haha
Ah okay, I never actually got to the point of looking at NBFC’s tools for making configs since I couldn’t even control the fan by writing to EC registers directly. I’m not super knowledgeable about either NBFC or firmware programming, but yeah from your analysis it does seem like NBFC might not be compatible with the Framework.
Maybe, although in my experience the fan speed seems unrelated to whether the laptop is actually charging or just maintaining the battery level while plugged in. Also, manually lowering the CPU boost aggressiveness by increasing the Speed Shift EPP makes it behave like it does on battery, i.e. the fan remains off even when streaming a high res video. This is the workaround I’m using right now, but it’s definitely not ideal because the fan sometimes still comes on (and stays on for a minute or two) if there’s a moment of high load.
Honestly, this particular thing is a very minor inconvenience, but the point is that it’s never bad to have more options because someone will have some way to make use of them. Having fan control – even through some custom utility if not through NBFC – would be in my opinion a very nice value add to the already extremely customizable nature of the Framework.
Honestly this would be a cool lever to have at my command, whether plugged-in or not. Often, when I’m processing something, I’ll slide the Windows power slider (another thing missing in Windows 11, yay regression) over to performance mode, then slide back when it’s done. Or, conversely, when there’s a background task or I’m running low on battery, I’ll slide it to power-saving. Even that isn’t enough sometimes - in desperate times, with prior laptops, I’d edit the power profile to cap the CPU at 25% when something I’m running has a poorly designed tight loop and doesn’t really need the performance it’s demanding.
With the Framework’s new-world architecture, something totally unusual has occurred: there’s no longer any CPU power settings at all available to me. Something wants to run-away? Yeah, it’ll goose the CPU to 3GHz in power-save mode, and ain’t a damn thing I can do to stop it.
It’d be nice to have a tool with such settings available. Especially for a laptop as nerd-friendly as Framework
but that’s a hope, not a request.
