AMD IMC - Revision history

Ruik: /* SuperIO Register space */

2011-12-16T20:26:16Z

‎SuperIO Register space

Ruik: extr reg space

2011-12-16T20:23:15Z

extr reg space

Ruik: Draft2

2011-12-16T20:03:08Z

Draft2

Ruik: draft

2011-12-16T19:47:01Z

draft

New page

== AMD IMC ==

The AMD IMC register interface visible from PCI space is documented in the AMD reference guides. This page tries to cover everything else which is not documented elsewhere.

The embedded controller is an 8051 CPU most likely derived from SMSC LPC47N350 Data Sheet or any recent SMSC embedded controller core. As the 8051, it has 3 memory spaces. The SFR, internal RAM and external space where the hardware has specific registers mapped. The code is fetched from 16KB? region of flash the base address is set to 0xFFF20000 (in SB710).

The EC is turned on if the soft straps are set to on during the init of the southbridge, this is documented in the SB datasheet. To make it operational you will need to modify the strap bits
and include the IMC firmware in the coreboot image. The 8051 reset vector is first instruction. The firmware itself contains a magic _AMD_IMC_C and you can check validateImcFirmware() how it works.

To check if IMC is active check if PCI 0:14.3 0x40 bit7 set.

=== Register spaces ===

@@ Line 23: / Line 23: @@
 * 0x7 - change logical device (LDN)
 * 0x26, 0x27 - the base address again, unclear if the base could be changed using this regs.
+** The LDN 3 registers
-The LDN 3 registers
+** EC Channel 0?
+* The LDN 5 - Irda:
-* EC Channel 0?
+** 0x30 bit0 enable device
+** 0x60 BASE >> 8
-The LDN 5 - Irda:
+** 0x61 BASE & 0xff
+** 0x70 IRQ
-* 0x30 bit0 enable device
+** BASE + 0 - offset? 0xAB write config?   (something is mentioned in recent SB800?)
-* 0x60 BASE >> 8
+** BASE + 1 - get data?
-* 0x61 BASE & 0xff
+* The LDN 7:
-* 0x70 IRQ
+** Keyboard controller?
+* The LDN 9 - Mailbox:
-* BASE + 0 - offset? 0xAB write config?   (something is mentioned in recent SB800?)
+** 0x30 bit0 enable device
-* BASE + 1 - get data?
+** 0x60 BASE >> 8
+** 0x61 BASE & 0xff
-The LDN 7:
+** BASE + 0: offset
+** BASE + 1: data
-* Keyboard controller?
+*** Offsets defined:
+*** 0x80 SYS_TO_IMC -> put message to IMC here
-The LDN 9 - Mailbox:
+*** 0x81 IMC_TO_SYS -> get message from IMC
+*** 0x82 MSG_REG0
-* 0x30 bit0 enable device
+*** 0x83 REG1
-* 0x60 BASE >> 8
+*** 0x84 REG2
-* 0x61 BASE & 0xff
+*** 0x85 REG3
+*** ...
-* BASE + 0: offset
+*** 0x8f last MSG_REG 0xD
-* BASE + 1: data
+*** If you write to mailbox: prepare all regs then write FUNC to 0x80 and wait until 0xFA is in 0x82 -> EC acked transaction, wait 100ms when polling this reg
+*** To execute a function and send data:
-Offsets defined:
+*** clear 0x82
+*** setup 0x82-0x8f
-* 0x80 SYS_TO_IMC -> put message to IMC here
+*** setup 0x80
-* 0x81 IMC_TO_SYS -> get message from IMC
+*** wait for 0xfa in 0x82
 * 0x82 MSG_REG0
 * 0x83 REG1
 * 0x84 REG2
 * 0x85 REG3
 * ...
 * 0x8f last MSG_REG 0xD
-−
 If you write to mailbox: prepare all regs then write FUNC to 0x80 and wait until 0xFA is in 0x82 -> EC acked transaction, wait 100ms when polling this reg
-−
 To execute a function and send data:
-−
 * clear 0x82
-−
 * setup 0x82-0x8f
 * setup 0x80
 * wait for 0xfa in 0x82
 === Firmware commands ===

← Older revision		Revision as of 20:23, 16 December 2011
Line 71:		Line 71:
	* setup 0x80		* setup 0x80
	* wait for 0xfa in 0x82		* wait for 0xfa in 0x82
		+
		+	=== Firmware commands ===
		+
		+	The firmware accepts variety of commands through the mailbox interface. The command is passed in 0x80 (SYS_TO_IMC) and data in 0x83 REG1, REG2 ... The format of the commands is: [fn in 0x80]: [data in REG1, REG2 ... ].
		+
		+	* unknown command: [0x50] [Unknown]
		+	* Zone and Fan setup: [0x80] [0x0, zone NR]
		+	* Zone enable?: [0x81] [zone NR, bit0=enable]
		+	* Fan related 0x81, 0x83, 0x85, 0x89 (TODO)
		+	* Read the memory spaces [0x90] [REG1, REG2, REG3] output in REG4, REG2:REG1 is address, REG3 tells what space it is. Intmem is 0, extmem is 1 and codemem is 2.
		+	* Write the memory spaces [0x91] [same as above]
		+	* Read SFR [0x92] [FIXME]
		+	* Write SFR [0x93] [FIXME]
		+	* Sureboot watchdog [0x94] [0x1 REG2] REG2 == 0, disable or timeout value.
		+	* IMC Sleep [0x96] [REG1 0x00] REG1 == 0xb4, put IMC to sleep. 0xb5 wakeup.
		+	* System Sleep/Wakeup [0x98] [REG1 REG2], REG1 == 0x2 was wakeup? REG2 timeout???
		+	* unknown command [0xa0] [Unknown]
		+
		+	=== External memory (DPTR access) ===
		+
		+	* 0x134 -> looks like RAM scratchpad
		+	* 0x8055 -> some bits for IRQs?
		+	* 0x80xx -> unknown
		+	* 0x8065 -> bit0 -> mailbox IRQ ack?
		+	* 0x81xx (maybe 256 bytes of what IO mbox is doing??? )
		+	* 0x8180 -> message registers (first one)
		+	* 0x82xx -> unknown
		+
		+	* 0x9000-0x9c00 - 0x9c00 SBResource MMIO, follows the RRG MMIO layout
		+	** 000: 0FF SMBUS PCI configuration registers
		+	** 100: 1FF SMBUS extended registers?
		+	** 200: 2FF CM (client management registers)
		+	** 300: 3FF PMIO
		+	** 400: 4FF PMIO2
		+	** 500: 5FF BIOS_RAM
		+	** 600: 6FF CMOS_RAM
		+	** 700: 7FF CMOS
		+	** 800: 8FF Not used
		+	** 900: 9FF ASF registers
		+	** A00: AFF Smbus registers
		+	** B00: BFF WatchDogTimer registers
		+	* 0x9f00-0x9fff - LPC PCI device 14.3

← Older revision		Revision as of 20:03, 16 December 2011
Line 10:		Line 10:
	To check if IMC is active check if PCI 0:14.3 0x40 bit7 set.		To check if IMC is active check if PCI 0:14.3 0x40 bit7 set.

−	=== Register ~~spaces~~ ===	+	=== SuperIO Register space ===
		+
		+	The IMC presents itself as an multifunction superIO device. You can read the sioport base in the following register PCI 14.3 0xa4 & ~0x1.
		+	The access pattern is same as for any other superio. The superiotool has some basic routines implemented. In general, there is a "password"
		+	to unlock the SIO part - 0x5a and lock it with 0xa5 again.
		+
		+	The known global registers:
		+
		+	* 0x0 - device ID register 0xb7 for SB710
		+	* 0x1 - revision ID?
		+	* 0x2 - WO btt0 reset?
		+	* 0x7 - change logical device (LDN)
		+	* 0x26, 0x27 - the base address again, unclear if the base could be changed using this regs.
		+
		+	The LDN 3 registers
		+
		+	* EC Channel 0?
		+
		+	The LDN 5 - Irda:
		+
		+	* 0x30 bit0 enable device
		+	* 0x60 BASE >> 8
		+	* 0x61 BASE & 0xff
		+	* 0x70 IRQ
		+
		+	* BASE + 0 - offset? 0xAB write config? (something is mentioned in recent SB800?)
		+	* BASE + 1 - get data?
		+
		+	The LDN 7:
		+
		+	* Keyboard controller?
		+
		+	The LDN 9 - Mailbox:
		+
		+	* 0x30 bit0 enable device
		+	* 0x60 BASE >> 8
		+	* 0x61 BASE & 0xff
		+
		+	* BASE + 0: offset
		+	* BASE + 1: data
		+
		+	Offsets defined:
		+
		+	* 0x80 SYS_TO_IMC -> put message to IMC here
		+	* 0x81 IMC_TO_SYS -> get message from IMC
		+	* 0x82 MSG_REG0
		+	* 0x83 REG1
		+	* 0x84 REG2
		+	* 0x85 REG3
		+	* ...
		+	* 0x8f last MSG_REG 0xD
		+
		+	If you write to mailbox: prepare all regs then write FUNC to 0x80 and wait until 0xFA is in 0x82 -> EC acked transaction, wait 100ms when polling this reg
		+
		+	To execute a function and send data:
		+
		+	* clear 0x82
		+
		+	* setup 0x82-0x8f
		+	* setup 0x80
		+	* wait for 0xfa in 0x82