flygoat / ryzen_nb_smu

A fight against Ryzen NorthBridge SMU

ryzen_nb_smu

A fight against Ryzen NorthBridge SMU

Further usage and other information is still under research.

PR and discussions are welcomed.

Background

Some how, I deterimined the method of commiunication between processor and SMU on northbridge of Ryzen processor, so it would be possible to change some power and frequency related settings in OS. Especially for Mobile Raven Ridge platform.

Utils

kmod_pp

Kernel Module to dump and modify pptable.

(Not working, under research)

TODO: Determine why we can't dump pptable

smu_test.c

A userspace tool to make smu service request

Communication Protcol

The registers, RAM and ROM of SMU is wrapped by a couple of register in NorthBridge PCI Config Space.

To communicate with SMU, the procossor need send a service request to SMU by write values to SMU registers.

There are 8 32-bit registers related with service register, MSG, 6×ARG and REP.

MSG is the ID of service request, 6*ARGS are arguments, REP is respond of service request.

Progress of a service request

• Clear the REP register
• Write the ARGs
• Write the MSG
• Poll the REP until it changed, means the request is proceeded
• Read back ARGs
• Check the REP if the request proceeded sucessfuly

A table of request ID for MP1

Name	ID	Note
TestMessage	0x1
GetSmuVersion	0x2
GetBiosIfVersion	0x3
GetNameString	0x4
EnableSmuFeatures	0x5
DisableSmuFeatures	0x6
DramLogSetDramAddrHigh	0x7
DramLogSetDramAddrLow	0x8
DramLogSetDramSize	0x9
DxioTestMessage	0xA
ReadCoreCacWeightRegister	0xB
SleepEntry	0xC
SetGbeStatus	0xD
PowerUpGfx	0xE
PowerUpSata	0xF
PowerDownSata	0x10
DisableSataController	0x11
SetBiosDramAddrHigh	0x12
SetBiosDramAddrLow	0x13
SetToolsDramAddrHigh	0x14
SetToolsDramAddrLow	0x15
TransferTableSmu2Dram	0x16
TransferTableDram2Smu	0x17
PowerSourceAC	0x18
PowerSourceDC	0x19
SetSustainedPowerLimit	0x1A
SetFastPPTLimit	0x1B
SetSlowPPTLimit	0x1C
SetSlowPPTTimeConstant	0x1D
SetStapmTimeConstant	0x1E
SetTctlMax	0x1F
SetVrmCurrentLimit	0x20
SetVrmSocCurrentLimit	0x21
SetVrmMaximumCurrentLimit	0x22
SetVrmSocMaximumCurrentLimit	0x23
SetPSI0CurrentLimit	0x24
SetPSI0SocCurrentLimit	0x25
SetProchotDeassertionRampTime	0x26
UpdateSkinTempError	0x27
SetGpuApertureLow	0x28
SetGpuApertureHigh	0x29
StartGpuLink	0x2A
StopGpuLink	0x2B
UsbD3Entry	0x2C
UsbD3Exit	0x2D
UsbInit	0x2E
AcBtcStartCal	0x2F
AcBtcStopCal	0x30
AcBtcEndCal	0x31
DcBtc	0x32
BtcRestoreOnS3Resume	0x33
SetGpuDeviceId	0x34
SetUlvVidOffset	0x35
DisablePSI	0x36
EnablePostCode	0x37
UsbConfigUpdate	0x38
SetupUSB31ControllerTrap	0x39
SetVddOffVid	0x3A
SetVminFrequency	0x3B
SetFrequencyMax	0x3C
SetGfxclkOverdriveByFreqVid	0x3D
PowerGateXgbe	0x3E
OC_Disable	0x3F
OC_VoltageMax	0x40
OC_FrequencyMax	0x41
EnableCC6Filter	0x42
GetSustainedPowerAndThmLimit	0x43
SetSoftMaxCCLK	0x44
SetSoftMinCCLK	0x45
SetSoftMaxGfxClk	0x46
SetSoftMinGfxClk	0x47
SetSoftMaxSocclkByFreq	0x48
SetSoftMinSocclkByFreq	0x49
SetSoftMaxFclkByFreq	0x4A
SetSoftMinFclkByFreq	0x4B
SetSoftMaxVcn	0x4C
SetSoftMinVcn	0x4D
SetSoftMaxLclk	0x4E
SetSoftMinLclk	0x4F
Message_Count	0x50

A table of REP code

Name	ID
OK	0x1
Failed	0xFF
UnknownCmd	0xFE
CmdRejectedPrereq	0xFD
CmdRejectedBusy	0xFC

A table of SMU Feature ID

Name	Bit	Note
CCLK_CONTROLLER	0
FAN_CONTROLLER	1
DATA_CALCULATION	2
PPT	3
TDC	4
THERMAL	5
FIT	6
EDC	7
PLL_POWER_DOWN	8
ULV	9
VDDOFF	10
VCN_DPM	11
ACP_DPM	12
ISP_DPM	13
FCLK_DPM	14
SOCCLK_DPM	15
MP0CLK_DPM	16
LCLK_DPM	17
SHUBCLK_DPM	18
DCEFCLK_DPM	19
GFX_DPM	20
DS_GFXCLK	21
DS_SOCCLK	22
DS_LCLK	23
DS_DCEFCLK	24
DS_SHUBCLK	25
RM	26
S0i2	27
WHISPER_MODE	28
DS_FCLK	29
DS_SMNCLK	30
DS_MP1CLK	31
DS_MP0CLK	32
MGCG	33
DS_FUSE_SRAM	34
GFX_CKS	35
PSI0	36
PROCHOT	37
CPUOFF	38
STAPM	39
CORE_CSTATES	40
GFX_DUTY_CYCLE	41
AA_MODE	42
LIVMIN	43
RLC_PACE	44

-These can be enabled with EnableSmuFeatures (0x5) or disabled with DisableSmuFeatures (0x6)

PPtable

PowerPlay Table

A table to storage power management information

See AMDGPU Powerplay for more information

Firmware

Grab from BIOS, reverse engineering in progesss.(Help wanted)

Credit

• zamaudio/smutool
• Linux Kernel - amdgpu
• Internet
• My ThinkPad E485 with R7-2700U

ryzen_nb_smu's Issues

所以说移动端锐龙是完成没办法降压的吗？

或者是否可以修改睿频模式，让温度不要那么跳

Find a way to adjust prochot or pbo scalar

I like to undervolt a bit with pbo scalar or try to adjust the extrem limit during prochot because PPT Slow and PPT settings are not good enough.
I can't adjust the cooldown timer: time to wait until next boost is allowed, currently very little time without any load does allow way too much of my 30s boost time.
Which means the boost time is either to short for a cold CPU or is too long for a hot CPU.

here's what I've started to document, although I have more commands as well (found mostly experimentally).

https://docs.google.com/spreadsheets/d/15qC2GlLiF3gpW5d9pVMP4npJ14yDv_yP2zT6QGEWseg/edit?usp=sharing

Originally posted by @irusanov in #3 (comment)

@irusanov based on this documentation you found prochot and pbo scalar adjustments.
I like to test them on renoir, but your values are looking odd.

For example your Picasso value have an offset of 0x13 to what I use to apply these values
And your Renoir values doesn't match my values at all.

Could you or somebody else describe what the difference between your values and the SMU Message Type Value is which I am using?

Picasso seem to have offset of 0x13

Command	google doc value	my value
Set PPT Slow	0x2F	0x1C
Set EDC	0x35	0x22
Set EDC SOC	0x36	0x23
GetPBOScalar	0x62	?
SetPBOScalar	0x7C	?

Renoir doesn't align at all

Command	google doc value	my value
Set TDC	0x3A	0x1A
Set TDC SOC	0x3B	0x1B
Set EDC	0x38	0x1C
Set EDC SOC	0x37	0x1D
GetPBOScalar	0xF	?
SetPBOScalar	0x3F	?
IsDisableProcHOTAvailable	0x8b	?
DisablePROCHOT	0x17	?
EnablePROCHOT	0x18	?

Different SMU message IDs for different platforms?

Hi, at the time of writing I found another tool called Zenstates. Referring to his readme, I can see that there are a few SMU message IDs that doesn't seem to match yours, notably:

• SetOverclockFreqAllCores (0x26)
• SetOverclockFreqPerCores (0x27)
• SetBoostLimitFrequency (0x29)
• SetBoostLimitFrequencyAllCores (0x2B)

as well as some others. The author didn't mention what CPU he is using when reverse engineering the SMU, but he was on SMU version 64.40.00. Testing his app already send my device (Nitro 5 2500U) to 400MHz hell so I won't step further without proper documentation. So this somehow made me to question:

1. Do SMU message ID differs by platform? As you are testing your code on FP5 platform while the other one seems to be on AM4.
2. Has AMD updated SMU version to scramble the message ID? Recall that AMD recommends to update to AGESA 1.0.04 even for older Zen/Zen+ which we know that there are no issues like RDRAND on Zen2

Sorry that I have to ask using the issues section as for some reason I couldn't contact you over Discord. I tried to ask for explanation from the Zenstates author but seems like he didn't reply

Add on Power Limit

Would you add on Power Limit decode?

SMU messaage ids documentation

hi! Excellent info on SMU message IDs, I was looking for such info for long time! Can you please share where did get the information from?

How can one query the default values for various parameters, for example; UlvVidOffset or VddOffVid?

老哥我想，请问这是对锐龙笔记本的一个什么样的工具？

有QQ群吗？