[AMD] Raphael HSMP and SVI3 addresses

[mann1x]

Hi @cyring, any luck in accessing the HSMP mailbox and find the address for the SVI3 to read the VDDG voltages?

[cyring]

Hi @cyring, any luck in accessing the HSMP mailbox and find the address for the SVI3 to read the VDDG voltages?

No luck; unfortunately ; I don't have Zen4 neither to do R&D.

What Zen4 owners could try to do, using zencli, is to scan SMU addresses for low and high values related to CPU cases of idle and stressed processor. That would be a long and tedious reversing campaign but I believe one address will show up.

Once zencli compiled, peek value as root:

## whatever compiler you prefer: gcc, clang

cc zencli.c -o zencli

## peek a value at first common SMU address

./zencli smu 0x50000

## SMU should still be a 32-bits component on Zen4; thus add 4 bytes for next address

./zencli smu 0x50004

Off course, a script could better loop arround a range of addresses and outputs results in a text file. Making some stress at the second run, the text file will be compaired with the previous one for any significant change.

Once a register is guessed, its value might certainly be a voltage VID which a formula has to convert in plain voltage. Voltage will be validated if it remains between the known min, max bounds.

HSMP can also be queried with zencli. In source code, other HSMP port, or protocol mean, needs to be experimented.

I don't understand why HSMP doesn't work the same as Zen3. Need to debug this on hardware.

---

Hopefully AMD will provide specifications of voltage address(es) ... That was long with Zen1

[mann1x]

Thanks!

I don't have one as well but yes scanning was attempted with Ryzen SDT on Windows, no luck. Seems some commands get a rejected cmd error and it's really weird... cause the TestMessage doesn't work.

Probably easier to win lotto than getting docs from AMD... I didn't realize at the time what they meant about "Open Firmware". Seems we and AMD are from different universes :)

[cyring]

If it can help reading source code: amd_reg.h has a few registers addresses I had guessed. Rembrandt, which is also a DDR5 architecture, has voltage(s) answering at 0x0006f010

https://github.com/cyring/CoreFreq/blob/b7038862f0ca08e2a9a405173567a48b2ddea715/amd_reg.h#L2065

The value seems divided into four nibbles, one per SVI

https://github.com/cyring/CoreFreq/blob/b7038862f0ca08e2a9a405173567a48b2ddea715/amd_reg.h#L2102

This address and its adjacents have not been tested on Raphael. It's worth to try.

[irusanov]

@cyring I've tried that long time ago, the 0x60000 - 0xfffff range is mostly 0xffffff There are couple of small segments that have different values though, maybe worth checking. I didn't find the needed voltages on the usual 0x50000 - 0x5FFFFF range.

As for HSMP, it should have been the same as on Zen3, but a newer version with some additional commands. AMD has provided some stripped-down PPR and the addresses are exactly the same, however the mailbox doesn't respond. https://www.amd.com/en/support/tech-docs/processor-programming-reference-ppr-for-amd-family-19h-model-11h-revision-b1 (volume 3)

Attached is a dump from 0x50000 to 0x6ffff PCI_Scan_result_27929873.0812494.txt

[cyring]

Can anyone with Raphael try the kernel module drivers/platform/x86/amd/hsmp.c ?

[cyring]

Not enough specs to go further.

[mann1x]

HSMP seems to be disabled sadly. Maybe they will enable it in a future AGESA release but most likely is not going to happen.

[cyring]

HSMP seems to be disabled sadly. Maybe they will enable it in a future AGESA release but most likely is not going to happen.

Or it was enabled "by mistake" on previous Ryzen architectures but in fact reserved for EPYC for BMC purposes. (just speculating)