Back to home page

OSCL-LXR

 
 

    


0001 ===============
0002 uGuru datasheet
0003 ===============
0004 
0005 First of all, what I know about uGuru is no fact based on any help, hints or
0006 datasheet from Abit. The data I have got on uGuru have I assembled through
0007 my weak knowledge in "backwards engineering".
0008 And just for the record, you may have noticed uGuru isn't a chip developed by
0009 Abit, as they claim it to be. It's really just an microprocessor (uC) created by
0010 Winbond (W83L950D). And no, reading the manual for this specific uC or
0011 mailing  Windbond for help won't give any useful data about uGuru, as it is
0012 the program inside the uC that is responding to calls.
0013 
0014 Olle Sandberg <ollebull@gmail.com>, 2005-05-25
0015 
0016 
0017 Original version by Olle Sandberg who did the heavy lifting of the initial
0018 reverse engineering. This version has been almost fully rewritten for clarity
0019 and extended with write support and info on more databanks, the write support
0020 is once again reverse engineered by Olle the additional databanks have been
0021 reverse engineered by me. I would like to express my thanks to Olle, this
0022 document and the Linux driver could not have been written without his efforts.
0023 
0024 Note: because of the lack of specs only the sensors part of the uGuru is
0025 described here and not the CPU / RAM / etc voltage & frequency control.
0026 
0027 Hans de Goede <j.w.r.degoede@hhs.nl>, 28-01-2006
0028 
0029 
0030 Detection
0031 =========
0032 
0033 As far as known the uGuru is always placed at and using the (ISA) I/O-ports
0034 0xE0 and 0xE4, so we don't have to scan any port-range, just check what the two
0035 ports are holding for detection. We will refer to 0xE0 as CMD (command-port)
0036 and 0xE4 as DATA because Abit refers to them with these names.
0037 
0038 If DATA holds 0x00 or 0x08 and CMD holds 0x00 or 0xAC an uGuru could be
0039 present. We have to check for two different values at data-port, because
0040 after a reboot uGuru will hold 0x00 here, but if the driver is removed and
0041 later on attached again data-port will hold 0x08, more about this later.
0042 
0043 After wider testing of the Linux kernel driver some variants of the uGuru have
0044 turned up which will hold 0x00 instead of 0xAC at the CMD port, thus we also
0045 have to test CMD for two different values. On these uGuru's DATA will initially
0046 hold 0x09 and will only hold 0x08 after reading CMD first, so CMD must be read
0047 first!
0048 
0049 To be really sure an uGuru is present a test read of one or more register
0050 sets should be done.
0051 
0052 
0053 Reading / Writing
0054 =================
0055 
0056 Addressing
0057 ----------
0058 
0059 The uGuru has a number of different addressing levels. The first addressing
0060 level we will call banks. A bank holds data for one or more sensors. The data
0061 in a bank for a sensor is one or more bytes large.
0062 
0063 The number of bytes is fixed for a given bank, you should always read or write
0064 that many bytes, reading / writing more will fail, the results when writing
0065 less then the number of bytes for a given bank are undetermined.
0066 
0067 See below for all known bank addresses, numbers of sensors in that bank,
0068 number of bytes data per sensor and contents/meaning of those bytes.
0069 
0070 Although both this document and the kernel driver have kept the sensor
0071 terminology for the addressing within a bank this is not 100% correct, in
0072 bank 0x24 for example the addressing within the bank selects a PWM output not
0073 a sensor.
0074 
0075 Notice that some banks have both a read and a write address this is how the
0076 uGuru determines if a read from or a write to the bank is taking place, thus
0077 when reading you should always use the read address and when writing the
0078 write address. The write address is always one (1) more than the read address.
0079 
0080 
0081 uGuru ready
0082 -----------
0083 
0084 Before you can read from or write to the uGuru you must first put the uGuru
0085 in "ready" mode.
0086 
0087 To put the uGuru in ready mode first write 0x00 to DATA and then wait for DATA
0088 to hold 0x09, DATA should read 0x09 within 250 read cycles.
0089 
0090 Next CMD _must_ be read and should hold 0xAC, usually CMD will hold 0xAC the
0091 first read but sometimes it takes a while before CMD holds 0xAC and thus it
0092 has to be read a number of times (max 50).
0093 
0094 After reading CMD, DATA should hold 0x08 which means that the uGuru is ready
0095 for input. As above DATA will usually hold 0x08 the first read but not always.
0096 This step can be skipped, but it is undetermined what happens if the uGuru has
0097 not yet reported 0x08 at DATA and you proceed with writing a bank address.
0098 
0099 
0100 Sending bank and sensor addresses to the uGuru
0101 ----------------------------------------------
0102 
0103 First the uGuru must be in "ready" mode as described above, DATA should hold
0104 0x08 indicating that the uGuru wants input, in this case the bank address.
0105 
0106 Next write the bank address to DATA. After the bank address has been written
0107 wait for to DATA to hold 0x08 again indicating that it wants / is ready for
0108 more input (max 250 reads).
0109 
0110 Once DATA holds 0x08 again write the sensor address to CMD.
0111 
0112 
0113 Reading
0114 -------
0115 
0116 First send the bank and sensor addresses as described above.
0117 Then for each byte of data you want to read wait for DATA to hold 0x01
0118 which indicates that the uGuru is ready to be read (max 250 reads) and once
0119 DATA holds 0x01 read the byte from CMD.
0120 
0121 Once all bytes have been read data will hold 0x09, but there is no reason to
0122 test for this. Notice that the number of bytes is bank address dependent see
0123 above and below.
0124 
0125 After completing a successful read it is advised to put the uGuru back in
0126 ready mode, so that it is ready for the next read / write cycle. This way
0127 if your program / driver is unloaded and later loaded again the detection
0128 algorithm described above will still work.
0129 
0130 
0131 
0132 Writing
0133 -------
0134 
0135 First send the bank and sensor addresses as described above.
0136 Then for each byte of data you want to write wait for DATA to hold 0x00
0137 which indicates that the uGuru is ready to be written (max 250 reads) and
0138 once DATA holds 0x00 write the byte to CMD.
0139 
0140 Once all bytes have been written wait for DATA to hold 0x01 (max 250 reads)
0141 don't ask why this is the way it is.
0142 
0143 Once DATA holds 0x01 read CMD it should hold 0xAC now.
0144 
0145 After completing a successful write it is advised to put the uGuru back in
0146 ready mode, so that it is ready for the next read / write cycle. This way
0147 if your program / driver is unloaded and later loaded again the detection
0148 algorithm described above will still work.
0149 
0150 
0151 Gotchas
0152 -------
0153 
0154 After wider testing of the Linux kernel driver some variants of the uGuru have
0155 turned up which do not hold 0x08 at DATA within 250 reads after writing the
0156 bank address. With these versions this happens quite frequent, using larger
0157 timeouts doesn't help, they just go offline for a second or 2, doing some
0158 internal calibration or whatever. Your code should be prepared to handle
0159 this and in case of no response in this specific case just goto sleep for a
0160 while and then retry.
0161 
0162 
0163 Address Map
0164 ===========
0165 
0166 Bank 0x20 Alarms (R)
0167 --------------------
0168 This bank contains 0 sensors, iow the sensor address is ignored (but must be
0169 written) just use 0. Bank 0x20 contains 3 bytes:
0170 
0171 Byte 0:
0172   This byte holds the alarm flags for sensor 0-7 of Sensor Bank1, with bit 0
0173   corresponding to sensor 0, 1 to 1, etc.
0174 
0175 Byte 1:
0176   This byte holds the alarm flags for sensor 8-15 of Sensor Bank1, with bit 0
0177   corresponding to sensor 8, 1 to 9, etc.
0178 
0179 Byte 2:
0180   This byte holds the alarm flags for sensor 0-5 of Sensor Bank2, with bit 0
0181   corresponding to sensor 0, 1 to 1, etc.
0182 
0183 
0184 Bank 0x21 Sensor Bank1 Values / Readings (R)
0185 --------------------------------------------
0186 This bank contains 16 sensors, for each sensor it contains 1 byte.
0187 So far the following sensors are known to be available on all motherboards:
0188 
0189 - Sensor  0 CPU temp
0190 - Sensor  1 SYS temp
0191 - Sensor  3 CPU core volt
0192 - Sensor  4 DDR volt
0193 - Sensor 10 DDR Vtt volt
0194 - Sensor 15 PWM temp
0195 
0196 Byte 0:
0197   This byte holds the reading from the sensor. Sensors in Bank1 can be both
0198   volt and temp sensors, this is motherboard specific. The uGuru however does
0199   seem to know (be programmed with) what kindoff sensor is attached see Sensor
0200   Bank1 Settings description.
0201 
0202 Volt sensors use a linear scale, a reading 0 corresponds with 0 volt and a
0203 reading of 255 with 3494 mV. The sensors for higher voltages however are
0204 connected through a division circuit. The currently known division circuits
0205 in use result in ranges of: 0-4361mV, 0-6248mV or 0-14510mV. 3.3 volt sources
0206 use the 0-4361mV range, 5 volt the 0-6248mV and 12 volt the 0-14510mV .
0207 
0208 Temp sensors also use a linear scale, a reading of 0 corresponds with 0 degree
0209 Celsius and a reading of 255 with a reading of 255 degrees Celsius.
0210 
0211 
0212 Bank 0x22 Sensor Bank1 Settings (R) and Bank 0x23 Sensor Bank1 Settings (W)
0213 ---------------------------------------------------------------------------
0214 
0215 Those banks contain 16 sensors, for each sensor it contains 3 bytes. Each
0216 set of 3 bytes contains the settings for the sensor with the same sensor
0217 address in Bank 0x21 .
0218 
0219 Byte 0:
0220   Alarm behaviour for the selected sensor. A 1 enables the described
0221   behaviour.
0222 
0223 Bit 0:
0224   Give an alarm if measured temp is over the warning threshold          (RW) [1]_
0225 
0226 Bit 1:
0227   Give an alarm if measured volt is over the max threshold              (RW) [2]_
0228 
0229 Bit 2:
0230   Give an alarm if measured volt is under the min threshold             (RW) [2]_
0231 
0232 Bit 3:
0233   Beep if alarm                                                         (RW)
0234 
0235 Bit 4:
0236   1 if alarm cause measured temp is over the warning threshold          (R)
0237 
0238 Bit 5:
0239   1 if alarm cause measured volt is over the max threshold              (R)
0240 
0241 Bit 6:
0242   1 if alarm cause measured volt is under the min threshold             (R)
0243 
0244 Bit 7:
0245   - Volt sensor: Shutdown if alarm persist for more than 4 seconds      (RW)
0246   - Temp sensor: Shutdown if temp is over the shutdown threshold        (RW)
0247 
0248 .. [1] This bit is only honored/used by the uGuru if a temp sensor is connected
0249 
0250 .. [2] This bit is only honored/used by the uGuru if a volt sensor is connected
0251        Note with some trickery this can be used to find out what kinda sensor
0252        is detected see the Linux kernel driver for an example with many
0253        comments on how todo this.
0254 
0255 Byte 1:
0256   - Temp sensor: warning threshold  (scale as bank 0x21)
0257   - Volt sensor: min threshold      (scale as bank 0x21)
0258 
0259 Byte 2:
0260   - Temp sensor: shutdown threshold (scale as bank 0x21)
0261   - Volt sensor: max threshold      (scale as bank 0x21)
0262 
0263 
0264 Bank 0x24 PWM outputs for FAN's (R) and Bank 0x25 PWM outputs for FAN's (W)
0265 ---------------------------------------------------------------------------
0266 
0267 Those banks contain 3 "sensors", for each sensor it contains 5 bytes.
0268   - Sensor 0 usually controls the CPU fan
0269   - Sensor 1 usually controls the NB (or chipset for single chip) fan
0270   - Sensor 2 usually controls the System fan
0271 
0272 Byte 0:
0273   Flag 0x80 to enable control, Fan runs at 100% when disabled.
0274   low nibble (temp)sensor address at bank 0x21 used for control.
0275 
0276 Byte 1:
0277   0-255 = 0-12v (linear), specify voltage at which fan will rotate when under
0278   low threshold temp (specified in byte 3)
0279 
0280 Byte 2:
0281   0-255 = 0-12v (linear), specify voltage at which fan will rotate when above
0282   high threshold temp (specified in byte 4)
0283 
0284 Byte 3:
0285   Low threshold temp  (scale as bank 0x21)
0286 
0287 byte 4:
0288   High threshold temp (scale as bank 0x21)
0289 
0290 
0291 Bank 0x26 Sensors Bank2 Values / Readings (R)
0292 ---------------------------------------------
0293 
0294 This bank contains 6 sensors (AFAIK), for each sensor it contains 1 byte.
0295 
0296 So far the following sensors are known to be available on all motherboards:
0297   - Sensor 0: CPU fan speed
0298   - Sensor 1: NB (or chipset for single chip) fan speed
0299   - Sensor 2: SYS fan speed
0300 
0301 Byte 0:
0302   This byte holds the reading from the sensor. 0-255 = 0-15300 (linear)
0303 
0304 
0305 Bank 0x27 Sensors Bank2 Settings (R) and Bank 0x28 Sensors Bank2 Settings (W)
0306 -----------------------------------------------------------------------------
0307 
0308 Those banks contain 6 sensors (AFAIK), for each sensor it contains 2 bytes.
0309 
0310 Byte 0:
0311   Alarm behaviour for the selected sensor. A 1 enables the described behaviour.
0312 
0313 Bit 0:
0314   Give an alarm if measured rpm is under the min threshold      (RW)
0315 
0316 Bit 3:
0317   Beep if alarm                                                 (RW)
0318 
0319 Bit 7:
0320   Shutdown if alarm persist for more than 4 seconds             (RW)
0321 
0322 Byte 1:
0323   min threshold (scale as bank 0x26)
0324 
0325 
0326 Warning for the adventurous
0327 ===========================
0328 
0329 A word of caution to those who want to experiment and see if they can figure
0330 the voltage / clock programming out, I tried reading and only reading banks
0331 0-0x30 with the reading code used for the sensor banks (0x20-0x28) and this
0332 resulted in a _permanent_ reprogramming of the voltages, luckily I had the
0333 sensors part configured so that it would shutdown my system on any out of spec
0334 voltages which probably safed my computer (after a reboot I managed to
0335 immediately enter the bios and reload the defaults). This probably means that
0336 the read/write cycle for the non sensor part is different from the sensor part.