[GH-ISSUE #356] Discovering config for HP 250 G5 #321

New issue

Closed

opened 2026-02-26 00:32:20 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 00:32:20 +03:00

Owner

Originally created by @Mellimalo on GitHub (Oct 10, 2017).
Original GitHub issue: https://github.com/hirschmann/nbfc/issues/356

I'm trying to discover a config for my HP 250 G5; here are my study:

None of the available configs works. There is only one that helps me... HP ENVY m6 SleekBook.

Registers:

0xB0 (176 decimal) - temperature readings
0x11 (17 decimal) - Current fan speed. Values: 00, 1B (27 decimal), 1F (31 decimal), 23 (35 decimal), 25 (37 decimal), 28 (40 decimal).
Each one correspond to one velocity of the fan.

From "HP ENVY m6 SleekBook" config, register 0x0F (15 decimal); when I write value 0D on it, I assume take control of the fan. Value 5 is for EC control,
value 5 OR 8 = 0D let me write in register 0x14 (20 decimal), which put the same value in register 0x11 (17 decimal - current fan speed), but fan doesn't respond.

There is something else that i can't discover. Maybe another register...

I can't guess anything reading the DSDT, and I don't know which is the chip. Any idea?? thanks.

Here is I consider more relevant for my DSDT:

Device (EC0)
        {
            Name (_HID, EisaId ("PNP0C09"))
            Name (_GPE, 0x50)
            Name (OKEC, One)
            Name (_CRS, ResourceTemplate ()
            {
                IO (Decode16,
                    0x0062,             // Range Minimum
                    0x0062,             // Range Maximum
                    0x01,               // Alignment
                    0x01,               // Length
                    )
                IO (Decode16,
                    0x0066,             // Range Minimum
                    0x0066,             // Range Maximum
                    0x01,               // Alignment
                    0x01,               // Length
                    )
            })
            Method (_REG, 2, NotSerialized)
            {
                If (LEqual (Arg0, 0x03))
                {
                    Store (Arg1, OKEC)
                    OSTP ()
                    ECFG (One)
                }
                If (LEqual (^^^^WLBU._STA (), Zero))
                {
                    CHWL ()
                }
            }
            Method (CMDW, 2, NotSerialized)
            {
                Name (TEMP, One)
                Name (RTEM, Zero)
                While (TEMP)
                {
                    Store (Zero, ECPC)
                    Store (ECPC, TEMP)
                }
                Store (One, ECPC)
                Store (Arg0, ECMB)
                Store (Arg1, EDTB)
                Store (One, ECST)
                Store (One, TEMP)
                While (TEMP)
                {
                    Store (ECST, TEMP)
                }
                Store (Zero, ECPC)
            }

========================

        OperationRegion (ECRM, EmbeddedControl, Zero, 0xFF)
        Field (ECRM, ByteAcc, Lock, Preserve)
        {
            Offset (0x5D), 
            ERIB,   16, 
            ERBD,   8, 
            Offset (0xAA), 
            Offset (0xAB), 
            Offset (0xAD), 
                ,   4, 
            Offset (0xAE), 
            PTVL,   4, 
            Offset (0xB0), 
            Offset (0xB1), 
            Offset (0xB2), 
            Offset (0xB3), 
            Offset (0xB4), 
            Offset (0xB5), 
            Offset (0xBC), 
            Offset (0xBD)
        }
        Mutex (FAMX, 0x00)
        Method (FANG, 1, NotSerialized)
        {
            Acquire (FAMX, 0xFFFF)
            Store (Arg0, ERIB)
            Store (ERBD, Local0)
            Release (FAMX)
            Return (Local0)
        }
        Method (FANW, 2, NotSerialized)
        {
            Acquire (FAMX, 0xFFFF)
            Store (Arg0, ERIB)
            Store (Arg1, ERBD)
            Release (FAMX)
            Return (Arg1)
        }
        Method (TUVR, 1, NotSerialized)
        {
            Return (0x04)
        }
        Method (THRO, 1, NotSerialized)
        {
            ITHR (Arg0)
        }
        Method (CLCK, 1, NotSerialized)
        {
            If (LEqual (Arg0, Zero))
            {
                Store (Zero, THEN)
                Store (Zero, FTT)
            }
            Else
            {
                Store (Arg0, DUTY)
                Store (One, THEN)
            }
            Return (THEN)
        }

.....

Originally created by @Mellimalo on GitHub (Oct 10, 2017). Original GitHub issue: https://github.com/hirschmann/nbfc/issues/356 I'm trying to discover a config for my HP 250 G5; here are my study: None of the available configs works. There is only one that helps me... HP ENVY m6 SleekBook. Registers: 0xB0 (176 decimal) - temperature readings 0x11 (17 decimal) - Current fan speed. Values: 00, 1B (27 decimal), 1F (31 decimal), 23 (35 decimal), 25 (37 decimal), 28 (40 decimal). Each one correspond to one velocity of the fan. From "HP ENVY m6 SleekBook" config, register 0x0F (15 decimal); when I write value 0D on it, I assume take control of the fan. Value 5 is for EC control, value 5 OR 8 = 0D let me write in register 0x14 (20 decimal), which put the same value in register 0x11 (17 decimal - current fan speed), but fan doesn't respond. There is something else that i can't discover. Maybe another register... I can't guess anything reading the DSDT, and I don't know which is the chip. Any idea?? thanks. Here is I consider more relevant for my DSDT: `` ``` Device (EC0) { Name (_HID, EisaId ("PNP0C09")) Name (_GPE, 0x50) Name (OKEC, One) Name (_CRS, ResourceTemplate () { IO (Decode16, 0x0062, // Range Minimum 0x0062, // Range Maximum 0x01, // Alignment 0x01, // Length ) IO (Decode16, 0x0066, // Range Minimum 0x0066, // Range Maximum 0x01, // Alignment 0x01, // Length ) }) Method (_REG, 2, NotSerialized) { If (LEqual (Arg0, 0x03)) { Store (Arg1, OKEC) OSTP () ECFG (One) } If (LEqual (^^^^WLBU._STA (), Zero)) { CHWL () } } Method (CMDW, 2, NotSerialized) { Name (TEMP, One) Name (RTEM, Zero) While (TEMP) { Store (Zero, ECPC) Store (ECPC, TEMP) } Store (One, ECPC) Store (Arg0, ECMB) Store (Arg1, EDTB) Store (One, ECST) Store (One, TEMP) While (TEMP) { Store (ECST, TEMP) } Store (Zero, ECPC) } ``` ======================== OperationRegion (ECRM, EmbeddedControl, Zero, 0xFF) Field (ECRM, ByteAcc, Lock, Preserve) { Offset (0x5D), ERIB, 16, ERBD, 8, Offset (0xAA), Offset (0xAB), Offset (0xAD), , 4, Offset (0xAE), PTVL, 4, Offset (0xB0), Offset (0xB1), Offset (0xB2), Offset (0xB3), Offset (0xB4), Offset (0xB5), Offset (0xBC), Offset (0xBD) } Mutex (FAMX, 0x00) Method (FANG, 1, NotSerialized) { Acquire (FAMX, 0xFFFF) Store (Arg0, ERIB) Store (ERBD, Local0) Release (FAMX) Return (Local0) } Method (FANW, 2, NotSerialized) { Acquire (FAMX, 0xFFFF) Store (Arg0, ERIB) Store (Arg1, ERBD) Release (FAMX) Return (Arg1) } Method (TUVR, 1, NotSerialized) { Return (0x04) } Method (THRO, 1, NotSerialized) { ITHR (Arg0) } Method (CLCK, 1, NotSerialized) { If (LEqual (Arg0, Zero)) { Store (Zero, THEN) Store (Zero, FTT) } Else { Store (Arg0, DUTY) Store (One, THEN) } Return (THEN) } .....

kerem

2026-02-26 00:32:20 +03:00

closed this issue
added the
Stale
label

kerem commented

2026-02-26 00:32:20 +03:00

Author

Owner

@hirschmann commented on GitHub (Oct 11, 2017):

The methods FANG and FANW read from/write to ERBD (address: 0x5F, width: 8 bits), so this register probably holds some kind of fan speed.
Also, both methods set ERIB (address: 0x5D, width: 16 bits), so I guess this register is either used to set the fan index or to unlock ERBD.

You can emulate both methods in a NBFC config. Unfortunately they also both acquire a mutex before trying to access ERIB and ERBD, which could be a problem because NBFC has no way to acquire a ACPI mutex.

@hirschmann commented on GitHub (Oct 11, 2017): The methods _FANG_ and _FANW_ read from/write to _ERBD_ (address: 0x5F, width: 8 bits), so this register probably holds some kind of fan speed. Also, both methods set _ERIB_ (address: 0x5D, width: 16 bits), so I guess this register is either used to set the fan index or to unlock _ERBD_. You can emulate both methods in a NBFC config. Unfortunately they also both acquire a mutex before trying to access _ERIB_ and _ERBD_, which could be a problem because NBFC has no way to acquire a ACPI mutex.

kerem commented

2026-02-26 00:32:20 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 8, 2019):

This issue is stale because it has been open more than 180 days with no activity. If nobody comments within 7 days, this issue will be closed

@github-actions[bot] commented on GitHub (Dec 8, 2019): This issue is stale because it has been open more than 180 days with no activity. If nobody comments within 7 days, this issue will be closed