@Agatio NBFC is an excellent idea. Can you (and anyone else who also got it working, even partially) share their register values (or config name/file)?
Comparing the 21 working config files for different Lenovo-branded laptops posted in the NBFC repository, it seems they can be categorized in 3 groups -- with some outliers, I can post the full results if anyone is interested -- but briefly:
- (A) Read from 0x06, write to 0xB0 or 0x56/0x57/0x5F,
- (B) Read from 0x95, write to 0x94, also set 0x93 to 0x20 beforehand for manual fan control,
- (C) Read and write to 0x47 -- this last one is only for ThinkPads, and not even the badge-engineered ones, so irrelevant here.
After some fiddling (I decompiled DSDT to look at AML bytecode and ran monitoring with ec-probe), it seems the Y700 belongs in group (A). Specifically:
- 0x06 is FANS - Fan [#1] Speed (ReadRegister)
- 0xFE is FA2S - Fan #2 Speed (ReadRegister)
These values are indeed changing rapidly, alongside some other ones that can be identified via DSDT:
- Temperature readings: 0x0D, RTMP; 0x0E, VTMP; 0xB0, CPUT.
- Battery state: 0xC6, B1FV; 0xE2, B1VA.
The missing bit of information is the WriteRegister. Most of the profiles in group (A) write to 0xB0 but on the Y700 this is the CPU temperature sensor. Perhaps faking the CPU temperature had the indirect effect of modifying fan speed?
The registers 0x53, 0x56 and 0xB4 also change often but are not referenced in the DSDT. Separately, 0xAB holds some fan-related flags: FAN1, FAN2, FAOK. Also, I saw in a discussion that someone discovered 0x39 changes to 0x01 when Max Fan Speed is switched on with a Lenovo utility on an Y520, and goes back to 0x00 when switched off.
For people who have the Lenovo utilities installed, can you run ec-probe monitor -c (comes with NBFC) and see which registers change when you toggle the Dust Clean mode and/or Max Speed mode on/off?
If someone also wants to look at their DSDT, here's a link to the utility (Java-based unfortunately, another way is to use Linux): https://github.com/hirschmann/nbfc/wiki/bin/DSDTEditor.zip
While on the Y700 the DSDT structure references system memory, not the embedded controller's:
OperationRegion (EMMP, SystemMemory, 0xFF00D400, 0xFF)
Field (ERAM, ByteAcc, Lock, Preserve)
{
Offset (0x01),
VDAT, 8,
VSTA, 8,
Offset (0x06),
FANS, 8,
[...]
It seems the structure matches what's in the EC. For example I can observe the GATY (Graphics Adapter Type) flag changing after starting a process that uses dGPU. I also confirmed the EC can be written to, and used to modify some settings: I can switch keyboard backlight on/off by writing KBLO | KLCH (Keyboard Backlight On and Keyboard Light Change), i.e. setting bits 0 and 2 at 0x8A. It's just that the fan control routines seem absent from DSDT so they have to be discovered another way.
For the record, the EC chip on the Y700 is an ITE IT8371E-128 but as far as I know there is no publicly available datasheet for it.