[GH-ISSUE #316] Feedback on attempt at getting Lenovo Y520 to work with nbfc

kerem commented

2026-02-26 00:32:14 +03:00

Owner

Originally created by @johnneren on GitHub (Aug 18, 2017).
Original GitHub issue: https://github.com/hirschmann/nbfc/issues/316

Hi hirschmann.

First of all, thanks for this program and the very nicely written 'how to create configs for nbfc'

I decided to spend a few hours trying to create a profile for my Lenovo Y520. with 1.5.3 - beta
First I tried to decrypt the DSDT but all the programs I tried either crashed or went into a while(1) so I continued on to trying EC probing.

I figured out that there was a 90% chance the fan speed was located at 0x6 and fan target speed was at 0xFE based on the behavior when using prime95.

I also noticed that when using Lenovos sense software to set 'max fan speed' that register 0x39 was set to 1 and cleared when max speed was disabled in the lenovo software.
I thought that this might be a 'allow manual control' flag as you mentioned in the guide.

Using ec-probe I can write 1 or 0 to 0x39 without any issue and see the value through the monitor but writing to 0xFE has no effect.
Neither via the monitor or on the fan speed.

So I continued and created a ubunto live USB pen which allowed me to dump the DSDT and all ACPI data.

        Device (EC0)
        {
            Name (_HID, EisaId ("PNP0C09") /* Embedded Controller Device */)  // _HID: Hardware ID
            Name (_UID, One)  // _UID: Unique ID
            Name (ECAV, Zero)
            Mutex (LFCM, 0x00)
            Mutex (HGCT, 0x00)
            Method (_GPE, 0, NotSerialized)  // _GPE: General Purpose Events
            {
                Local0 = GGPE (0x01060002)
                Return (Local0)
            }
....................
           OperationRegion (ERAM, EmbeddedControl, Zero, 0xFF)
            Field (ERAM, ByteAcc, Lock, Preserve)
            {
                VCMD,   8, 
                Offset (0x60), 
                SMPR,   8
            }

            OperationRegion (ERAX, SystemMemory, 0xFF00D400, 0xFF)
            Field (ERAX, ByteAcc, Lock, Preserve)
            {
                Offset (0x01), 
                VDAT,   8, 
                VSTA,   8, 
                Offset (0x06), 
                FANS,   8,   //<-- Suspected FAN speed %
                BUSG,   1, 
                BLEG,   1, 
                BATF,   1, 
                BNSM,   1, 
                BTST,   1, 
                BBAD,   1, 
                AUTO,   1, 
.....................
                KIRT,   8, 
                IRTI,   8, 
                Offset (0x36), 
                DGPU,   8, 
                GUST,   8, 
                GDST,   8, 
                FCST,   8, //<-- Suspected force manual control of fan
                Offset (0x43), 
                ECTP,   8, 
                Offset (0x4A), 
......................
                Offset (0xF4), 
                B1DA,   16, 
                Offset (0xF8), 
                B1CN,   8, 
                Offset (0xFB), 
                HHDP,   1, 
                Offset (0xFE), 
                FA2S,   8  //<-- Suspected FAN target setpoint
            }

I also tried to search for where these variables are used which kinda confirmed that FAN (0x06) and FA2S (0xFE) shared something because their get methods was located next to each other.

                    If ((Arg1 == 0x08))
                      {
                          If (^^PCI0.LPCB.EC0.ECAV)
                          {
                              If ((Acquire (^^PCI0.LPCB.EC0.LFCM, 0xA000) == Zero))
                              {
                                  Local0 = ^^PCI0.LPCB.EC0.FANS /* \_SB_.PCI0.LPCB.EC0_.FANS */
                                  Local0 *= 0x64
                                  Return (Local0)
                              }
                          }
                      }

                      If ((Arg1 == 0x09))
                      {
                          If (^^PCI0.LPCB.EC0.ECAV)
                          {
                              If ((Acquire (^^PCI0.LPCB.EC0.LFCM, 0xA000) == Zero))
                              {
                                  Local0 = ^^PCI0.LPCB.EC0.FA2S /* \_SB_.PCI0.LPCB.EC0_.FA2S */
                                  Local0 *= 0x64
                                  Return (Local0)
                              }
                          }
                      }

But I was not able to find any 'If (manual_control) type of check so I'm not 100% sure about that.

Any input/feedback is appreciated!
Minor thought: Does nbfc have some kind of size check on the address that might have a offset error so 0xFE is not possible to write or something?

Thanks

Originally created by @johnneren on GitHub (Aug 18, 2017). Original GitHub issue: https://github.com/hirschmann/nbfc/issues/316 Hi hirschmann. First of all, thanks for this program and the very nicely written 'how to create configs for nbfc' I decided to spend a few hours trying to create a profile for my Lenovo Y520. with 1.5.3 - beta First I tried to decrypt the DSDT but all the programs I tried either crashed or went into a while(1) so I continued on to trying EC probing. I figured out that there was a 90% chance the fan speed was located at 0x6 and fan target speed was at 0xFE based on the behavior when using prime95. I also noticed that when using Lenovos sense software to set 'max fan speed' that register 0x39 was set to 1 and cleared when max speed was disabled in the lenovo software. I thought that this might be a 'allow manual control' flag as you mentioned in the guide. Using ec-probe I can write 1 or 0 to 0x39 without any issue and see the value through the monitor but writing to 0xFE has no effect. Neither via the monitor or on the fan speed. So I continued and created a ubunto live USB pen which allowed me to dump the DSDT and all ACPI data. ``` Device (EC0) { Name (_HID, EisaId ("PNP0C09") /* Embedded Controller Device */) // _HID: Hardware ID Name (_UID, One) // _UID: Unique ID Name (ECAV, Zero) Mutex (LFCM, 0x00) Mutex (HGCT, 0x00) Method (_GPE, 0, NotSerialized) // _GPE: General Purpose Events { Local0 = GGPE (0x01060002) Return (Local0) } .................... OperationRegion (ERAM, EmbeddedControl, Zero, 0xFF) Field (ERAM, ByteAcc, Lock, Preserve) { VCMD, 8, Offset (0x60), SMPR, 8 } OperationRegion (ERAX, SystemMemory, 0xFF00D400, 0xFF) Field (ERAX, ByteAcc, Lock, Preserve) { Offset (0x01), VDAT, 8, VSTA, 8, Offset (0x06), FANS, 8, //<-- Suspected FAN speed % BUSG, 1, BLEG, 1, BATF, 1, BNSM, 1, BTST, 1, BBAD, 1, AUTO, 1, ..................... KIRT, 8, IRTI, 8, Offset (0x36), DGPU, 8, GUST, 8, GDST, 8, FCST, 8, //<-- Suspected force manual control of fan Offset (0x43), ECTP, 8, Offset (0x4A), ...................... Offset (0xF4), B1DA, 16, Offset (0xF8), B1CN, 8, Offset (0xFB), HHDP, 1, Offset (0xFE), FA2S, 8 //<-- Suspected FAN target setpoint } ``` I also tried to search for where these variables are used which kinda confirmed that FAN (0x06) and FA2S (0xFE) shared something because their get methods was located next to each other. ``` If ((Arg1 == 0x08)) { If (^^PCI0.LPCB.EC0.ECAV) { If ((Acquire (^^PCI0.LPCB.EC0.LFCM, 0xA000) == Zero)) { Local0 = ^^PCI0.LPCB.EC0.FANS /* \_SB_.PCI0.LPCB.EC0_.FANS */ Local0 *= 0x64 Return (Local0) } } } If ((Arg1 == 0x09)) { If (^^PCI0.LPCB.EC0.ECAV) { If ((Acquire (^^PCI0.LPCB.EC0.LFCM, 0xA000) == Zero)) { Local0 = ^^PCI0.LPCB.EC0.FA2S /* \_SB_.PCI0.LPCB.EC0_.FA2S */ Local0 *= 0x64 Return (Local0) } } } ``` But I was not able to find any 'If (manual_control) type of check so I'm not 100% sure about that. Any input/feedback is appreciated! Minor thought: Does nbfc have some kind of size check on the address that might have a offset error so 0xFE is not possible to write or something? Thanks

kerem closed this issue

2026-02-26 00:32:14 +03:00

kerem commented

2026-02-26 00:32:15 +03:00

Author

Owner

@hirschmann commented on GitHub (Aug 21, 2017):

Your DSDT only defines 2 offsets in the EmbeddedControl space (=EC registers).
The field which you're trying to access is in the SystemMemory space (= hardware reserved RAM):

OperationRegion (ERAM, EmbeddedControl, Zero, 0xFF)
Field (ERAM, ByteAcc, Lock, Preserve)
{
    VCMD,   8, 
    Offset (0x60), 
    SMPR,   8
}

OperationRegion (ERAX, SystemMemory, 0xFF00D400, 0xFF)
Field (ERAX, ByteAcc, Lock, Preserve)
{
     // ....

Unfortunately, NBFC can address only the EmbeddedControl-space. Controlling the fan by manipulating the SystemMemory-space would be too unstable and also a potential security risk.

You could give ec-probe.exe monitor another try and try to reverse-engineer the EC's register set. I know this answer is not particularly useful, but the only option if you don't want to poke around in the kernel address space.

If a register doesn't change after a call to ec-probe write, it's either read-only, or the EC cleared it before your call to ec-probe read.
ec-probe interprets all input values as 8-bit unsigned integer, therefore values from 0x00-0xFF (0-255) are supported.

@hirschmann commented on GitHub (Aug 21, 2017): Your DSDT only defines 2 offsets in the EmbeddedControl space (=EC registers). The field which you're trying to access is in the SystemMemory space (= hardware reserved RAM): ``` js OperationRegion (ERAM, EmbeddedControl, Zero, 0xFF) Field (ERAM, ByteAcc, Lock, Preserve) { VCMD, 8, Offset (0x60), SMPR, 8 } OperationRegion (ERAX, SystemMemory, 0xFF00D400, 0xFF) Field (ERAX, ByteAcc, Lock, Preserve) { // .... ``` Unfortunately, NBFC can address only the EmbeddedControl-space. Controlling the fan by manipulating the SystemMemory-space would be too unstable and also a potential security risk. You could give `ec-probe.exe monitor` another try and try to reverse-engineer the EC's register set. I know this answer is not particularly useful, but the only option if you don't want to poke around in the kernel address space. If a register doesn't change after a call to `ec-probe write`, it's either read-only, or the EC cleared it before your call to `ec-probe read`. ec-probe interprets all input values as 8-bit unsigned integer, therefore values from 0x00-0xFF (0-255) are supported.

kerem commented

2026-02-26 00:32:15 +03:00

Author

Owner

@johnneren commented on GitHub (Sep 4, 2017):

Hi hirschmann.

I have tried looping through EC register 0-255 and writing them all to different values such as, 0, 35, 45, 90 , 255 but I didn't find any pattern for the speed control.

I did find display brightness, keyboard brightness and speed stepping control :P

I also managed to get the fan to run at a constant speed at one point... but I never figured out which combination did it.

I'm 'throwing in the towel' and accepting I will need to use my noise canceling headset with this laptop :)

You can close this issue now.
Cheers.

@johnneren commented on GitHub (Sep 4, 2017): Hi hirschmann. I have tried looping through EC register 0-255 and writing them all to different values such as, 0, 35, 45, 90 , 255 but I didn't find any pattern for the speed control. I did find display brightness, keyboard brightness and speed stepping control :P I also managed to get the fan to run at a constant speed at one point... but I never figured out which combination did it. I'm 'throwing in the towel' and accepting I will need to use my noise canceling headset with this laptop :) You can close this issue now. Cheers.

kerem commented

2026-02-26 00:32:15 +03:00

Author

Owner

@hirschmann commented on GitHub (Sep 4, 2017):

Good job, even if you couldn't solve the problem. :)
I'm sorry I couldn't be more helpful.

@hirschmann commented on GitHub (Sep 4, 2017): Good job, even if you couldn't solve the problem. :) I'm sorry I couldn't be more helpful.

Rows
Columns

[GH-ISSUE #316] Feedback on attempt at getting Lenovo Y520 to work with nbfc #283