Permalink
Cannot retrieve contributors at this time
Fetching contributors…
Cannot retrieve contributors at this time
| The EC firmware has at least two tables that control the Fn+key combinations. | |
| There is some evidence that there is a third table, but the table itself has | |
| not been found. | |
| Simple Key Replacements table: | |
| ------------------------------ | |
| This table is a simple array of key replacement entries - if Fn is held | |
| down at the same time as the keycode from the first byte, then the | |
| keycode from the second byte is substituted (with possible modifier | |
| keys from the third byte) | |
| The table is big enough to hold 11 key replacements, and in the standard | |
| firmware all but one of these are already used. | |
| This structure of this table was identical in both the x220 and x230 | |
| firmware, just the contents differed. The classic keyboard patch simply | |
| patched the exact values from the x220 firmware into place. | |
| ; this three byte entry is repeated as needed | |
| db ORIG_key | |
| db NEW_key | |
| db modifiers ; only 0x01 for Alt_L and 0x02 for Ctrl_L were seen | |
| (source: x220 EC firmware version 8DHT34WW, offset 0x1f05e) | |
| (source: x230 EC firmware version G2HT35WW, offset 0x21898) | |
| The address of this table and the number of entries contained in it are | |
| located in a pointer object. | |
| ; x220 simple replacement table ptr | |
| org 0x1f058 | |
| dw 11 ; number of entries | |
| dd 0x1f05e ; address of simple replacement table | |
| (source: x220 EC firmware version 8DHT34WW, offset 0x1f058) | |
| ; x230 simple replacement table ptr | |
| org 0x218d0 | |
| dd 11 ; number of entries | |
| dd 0x21898 ; address of simple replacement table | |
| (source: x230 EC firmware version G2HT35WW, offset 0x218d0) | |
| Complex Key Handling Table: | |
| --------------------------- | |
| I call this table complex only because it appears to call special handler | |
| functions for the key replacements. The actual difference is probably | |
| that the "simple" replacements are still generating normal key-presses and | |
| this "complex" table is generating ACPI events. | |
| The size of this table is big enough for 27 keys to be described and in the | |
| standard x230 firmware, there are 14 entries that are clearly used and three | |
| entries that may be used for something. | |
| ; this two byte entry is repeated as needed | |
| db magic_code | |
| db key | |
| (source: x220 EC firmware version 8DHT34WW, offset 0x1ee36) | |
| (source: x230 EC firmware version G2HT35WW, offset 0x2166c) | |
| The magic_code appears to specify which handler to call and the key is the | |
| key pressed to match this entry. | |
| The following magic_codes have been seen in the firmware tables. Due to the | |
| risk of bricking the laptop, no experimentation on what other codes do has | |
| been done. | |
| x220 x230 Action | |
| ---- ---- ------ | |
| 0x03 0xc0 Function handled by OS, sends a modified keypress | |
| 0x3b 0xc7 Sleep | |
| 0x27 0xe4 Brightness+ | |
| 0x2f 0xe5 Brightness- | |
| 0x43 na Hibernate | |
| 0x33 0xc6 ThinkLight | |
| Similar to the previous table, the address of this table and the number of | |
| entries is located in a pointer object: | |
| org 0x216a4 | |
| dd 8 ; number of entries in the jump table | |
| dd 0x2164c ; pointer to a list of function pointers | |
| dd 0x1b ; number of entries in the complex replacement table | |
| dd 0x2166c ; pointer to the complex replacement table. | |
| Since this pointer object also contains a pointer to a jump table, I have | |
| assumed that the various codes in the replacement table end up indicating | |
| the specific function used to handle that keypress. | |
| (source: x230 EC firmware version G2HT35WW, offset 0x2166c) | |