Alternative Analyzation Of The Firmware

This page describes an alternative way of analyzing the ACPI firmware by using the acpica tools directly.

Extracting the Firmware
Get a list of ACPI methods
Get a list of ACPI operation regions
Get a list of ACPI registers

Extracting the Firmware

Extract the binary ACPI tables

This will create the file dsdt.dat

sudo cat /sys/firmware/acpi/tables/DSDT > dsdt.dat

Generate the DSL file

This will create the file dsdt.dsl. You can view it with your favorite text editor.

iasl -d dsdt.dat

Get a list of ACPI methods

acpiexec -b Methods dsdt.dat

Example Output

[...]
\_SB.PC00.LPCB.EC0._REG Method       0x5e8056d96f60 001 Args 2 Len 002D Aml 0x7564f4170c19
\_SB.PC00.LPCB.EC0.CMDW Method       0x5e8056d97050 001 Args 2 Len 004E Aml 0x7564f4170c4e
\_SB.PC00.LPCB.EC0.FANG Method       0x5e8056da2610 001 Args 1 Len 0009 Aml 0x7564f4171377
\_SB.PC00.LPCB.EC0.FANW Method       0x5e8056da2780 001 Args 2 Len 0008 Aml 0x7564f4171387
\_SB.PC00.LPCB.EC0.TUVR Method       0x5e8056da9940 001 Args 1 Len 0003 Aml 0x7564f4171396
\_SB.PC00.LPCB.EC0.THRO Method       0x5e8056da9a30 001 Args 1 Len 0005 Aml 0x7564f41713a0
\_SB.PC00.LPCB.EC0.CLCK Method       0x5e8056da9b20 001 Args 1 Len 0024 Aml 0x7564f41713ac
\_SB.PC00.LPCB.EC0.PCLK Method       0x5e8056da9c10 001 Args 0 Len 0004 Aml 0x7564f41713d7
\_SB.PC00.LPCB.EC0.ITHR Method       0x5e8056da9d00 001 Args 1 Len 0026 Aml 0x7564f41713e2
\_SB.PC00.LPCB.EC0.IPCL Method       0x5e8056da9df0 001 Args 0 Len 0010 Aml 0x7564f417140f
[...]

Get a list of operation regions

acpiexec -b 'Objects Region' dsdt.dat

The regions that have the type EmbeddedControl are exposed via the embedded controller.

Example Output

[...]
\_SB.PC00.LPCB.EC0.ERAM Region       0x620cececfac0 001 [EmbeddedControl] Addr 0000000000000000 Len 00FF
\_SB.PC00.LPCB.EC0.ECRM Region       0x620ceced0250 001 [EmbeddedControl] Addr 0000000000000000 Len 00FF
\_SB.PC00.LPCB.EC0.SSRM Region       0x620ceced0620 001 [EmbeddedControl] Addr 0000000000000050 Len 000A
\_SB.PC00.LPCB.EC0.MAIO Region       0x620ceced2520 001 [SystemMemory] Addr 0000000000000000 Len 00FF
    \_SB.PC00.LPCB.PKBS Region       0x620cecee2de0 001 [SystemIO] Addr 0000000000000060 Len 0005
    \_SB.PC00.XHCI.XPRT Region       0x620cece7b800 001 [PCI_Config] Addr 0000000000000000 Len 0100
    \_SB.PC00.XDCI.OTGD Region       0x620cece7e6d0 001 [PCI_Config] Addr 0000000000000000 Len 0100
    \_SB.PC00.HDAS.HDAR Region       0x620cece7f4c0 001 [PCI_Config] Addr 0000000000000000 Len 0100
    \_SB.PC00.RP01.PXCS Region       0x620cece892f0 001 [SystemMemory] Addr 00000000000E0000 Len 0C80
[...]

Get a list of registers

acpiexec -b 'Objects RegionField' dsdt.dat

Note: Only registers with an operation region of the type EmbeddedControl are actually embedded controller registers. In this example, these are ERAM and ECRM.

Example Output

[...]
\_SB.PC00.LPCB.EC0.INDI RegionField  0x5ac2ebacbd30 001 Rgn [ERAM] Off 0E8 Len 08 Acc 01
\_SB.PC00.LPCB.EC0.DMEE RegionField  0x5ac2ebacbda0 001 Rgn [ERAM] Off 100 Len 08 Acc 01
\_SB.PC00.LPCB.EC0.VBPS RegionField  0x5ac2ebacbe10 001 Rgn [ERAM] Off 7A8 Len 08 Acc 01
\_SB.PC00.LPCB.EC0.PMCD RegionField  0x5ac2ebace740 001 Rgn [ECRM] Off 000 Len 20 Acc 04
\_SB.PC00.LPCB.EC0.S0FL RegionField  0x5ac2ebace7b0 001 Rgn [ECRM] Off 020 Len 08 Acc 01
\_SB.PC00.LPCB.EC0.SXF0 RegionField  0x5ac2ebace820 001 Rgn [ECRM] Off 028 Len 08 Acc 01
\_SB.PC00.LPCB.EC0.SXF1 RegionField  0x5ac2ebace890 001 Rgn [ECRM] Off 030 Len 08 Acc 01
                  \EFCT RegionField  0x5ac2eb9f64f0 001 Rgn [GNVS] Off 460 Len 08 Acc 01
                  \EFHT RegionField  0x5ac2eb9f6560 001 Rgn [GNVS] Off 468 Len 08 Acc 01
                  \VRDE RegionField  0x5ac2eb9f65d0 001 Rgn [GNVS] Off 470 Len 08 Acc 01
                  \VRAT RegionField  0x5ac2eb9f6640 001 Rgn [GNVS] Off 478 Len 08 Acc 01
                  \VRPT RegionField  0x5ac2eb9f66b0 001 Rgn [GNVS] Off 480 Len 08 Acc 01
[...]

The offset (Off) is specified in bits (hexadecimal). To convert the bit offset into a byte offset and bit position, we open python or ipython and divide the bit offset by 8 to obtain the byte offset, and use modulo 8 to determine the bit position:

~ > python
Python 3.13.5 (main, Jun 21 2025, 09:35:00) [GCC 15.1.1 20250425] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> 0x2E8 // 8
93
>>> 0x2E8 % 8
0

This yields register number 93 and a bit offset of 0.