0001 ===============
0002 uGuru datasheet
0003 ===============
0004
0005 First of all, what I know about uGuru is no fact based on any help, hints or
0006 datasheet from Abit. The data I have got on uGuru have I assembled through
0007 my weak knowledge in "backwards engineering".
0008 And just for the record, you may have noticed uGuru isn't a chip developed by
0009 Abit, as they claim it to be. It's really just an microprocessor (uC) created by
0010 Winbond (W83L950D). And no, reading the manual for this specific uC or
0011 mailing Windbond for help won't give any useful data about uGuru, as it is
0012 the program inside the uC that is responding to calls.
0013
0014 Olle Sandberg <ollebull@gmail.com>, 2005-05-25
0015
0016
0017 Original version by Olle Sandberg who did the heavy lifting of the initial
0018 reverse engineering. This version has been almost fully rewritten for clarity
0019 and extended with write support and info on more databanks, the write support
0020 is once again reverse engineered by Olle the additional databanks have been
0021 reverse engineered by me. I would like to express my thanks to Olle, this
0022 document and the Linux driver could not have been written without his efforts.
0023
0024 Note: because of the lack of specs only the sensors part of the uGuru is
0025 described here and not the CPU / RAM / etc voltage & frequency control.
0026
0027 Hans de Goede <j.w.r.degoede@hhs.nl>, 28-01-2006
0028
0029
0030 Detection
0031 =========
0032
0033 As far as known the uGuru is always placed at and using the (ISA) I/O-ports
0034 0xE0 and 0xE4, so we don't have to scan any port-range, just check what the two
0035 ports are holding for detection. We will refer to 0xE0 as CMD (command-port)
0036 and 0xE4 as DATA because Abit refers to them with these names.
0037
0038 If DATA holds 0x00 or 0x08 and CMD holds 0x00 or 0xAC an uGuru could be
0039 present. We have to check for two different values at data-port, because
0040 after a reboot uGuru will hold 0x00 here, but if the driver is removed and
0041 later on attached again data-port will hold 0x08, more about this later.
0042
0043 After wider testing of the Linux kernel driver some variants of the uGuru have
0044 turned up which will hold 0x00 instead of 0xAC at the CMD port, thus we also
0045 have to test CMD for two different values. On these uGuru's DATA will initially
0046 hold 0x09 and will only hold 0x08 after reading CMD first, so CMD must be read
0047 first!
0048
0049 To be really sure an uGuru is present a test read of one or more register
0050 sets should be done.
0051
0052
0053 Reading / Writing
0054 =================
0055
0056 Addressing
0057 ----------
0058
0059 The uGuru has a number of different addressing levels. The first addressing
0060 level we will call banks. A bank holds data for one or more sensors. The data
0061 in a bank for a sensor is one or more bytes large.
0062
0063 The number of bytes is fixed for a given bank, you should always read or write
0064 that many bytes, reading / writing more will fail, the results when writing
0065 less then the number of bytes for a given bank are undetermined.
0066
0067 See below for all known bank addresses, numbers of sensors in that bank,
0068 number of bytes data per sensor and contents/meaning of those bytes.
0069
0070 Although both this document and the kernel driver have kept the sensor
0071 terminology for the addressing within a bank this is not 100% correct, in
0072 bank 0x24 for example the addressing within the bank selects a PWM output not
0073 a sensor.
0074
0075 Notice that some banks have both a read and a write address this is how the
0076 uGuru determines if a read from or a write to the bank is taking place, thus
0077 when reading you should always use the read address and when writing the
0078 write address. The write address is always one (1) more than the read address.
0079
0080
0081 uGuru ready
0082 -----------
0083
0084 Before you can read from or write to the uGuru you must first put the uGuru
0085 in "ready" mode.
0086
0087 To put the uGuru in ready mode first write 0x00 to DATA and then wait for DATA
0088 to hold 0x09, DATA should read 0x09 within 250 read cycles.
0089
0090 Next CMD _must_ be read and should hold 0xAC, usually CMD will hold 0xAC the
0091 first read but sometimes it takes a while before CMD holds 0xAC and thus it
0092 has to be read a number of times (max 50).
0093
0094 After reading CMD, DATA should hold 0x08 which means that the uGuru is ready
0095 for input. As above DATA will usually hold 0x08 the first read but not always.
0096 This step can be skipped, but it is undetermined what happens if the uGuru has
0097 not yet reported 0x08 at DATA and you proceed with writing a bank address.
0098
0099
0100 Sending bank and sensor addresses to the uGuru
0101 ----------------------------------------------
0102
0103 First the uGuru must be in "ready" mode as described above, DATA should hold
0104 0x08 indicating that the uGuru wants input, in this case the bank address.
0105
0106 Next write the bank address to DATA. After the bank address has been written
0107 wait for to DATA to hold 0x08 again indicating that it wants / is ready for
0108 more input (max 250 reads).
0109
0110 Once DATA holds 0x08 again write the sensor address to CMD.
0111
0112
0113 Reading
0114 -------
0115
0116 First send the bank and sensor addresses as described above.
0117 Then for each byte of data you want to read wait for DATA to hold 0x01
0118 which indicates that the uGuru is ready to be read (max 250 reads) and once
0119 DATA holds 0x01 read the byte from CMD.
0120
0121 Once all bytes have been read data will hold 0x09, but there is no reason to
0122 test for this. Notice that the number of bytes is bank address dependent see
0123 above and below.
0124
0125 After completing a successful read it is advised to put the uGuru back in
0126 ready mode, so that it is ready for the next read / write cycle. This way
0127 if your program / driver is unloaded and later loaded again the detection
0128 algorithm described above will still work.
0129
0130
0131
0132 Writing
0133 -------
0134
0135 First send the bank and sensor addresses as described above.
0136 Then for each byte of data you want to write wait for DATA to hold 0x00
0137 which indicates that the uGuru is ready to be written (max 250 reads) and
0138 once DATA holds 0x00 write the byte to CMD.
0139
0140 Once all bytes have been written wait for DATA to hold 0x01 (max 250 reads)
0141 don't ask why this is the way it is.
0142
0143 Once DATA holds 0x01 read CMD it should hold 0xAC now.
0144
0145 After completing a successful write it is advised to put the uGuru back in
0146 ready mode, so that it is ready for the next read / write cycle. This way
0147 if your program / driver is unloaded and later loaded again the detection
0148 algorithm described above will still work.
0149
0150
0151 Gotchas
0152 -------
0153
0154 After wider testing of the Linux kernel driver some variants of the uGuru have
0155 turned up which do not hold 0x08 at DATA within 250 reads after writing the
0156 bank address. With these versions this happens quite frequent, using larger
0157 timeouts doesn't help, they just go offline for a second or 2, doing some
0158 internal calibration or whatever. Your code should be prepared to handle
0159 this and in case of no response in this specific case just goto sleep for a
0160 while and then retry.
0161
0162
0163 Address Map
0164 ===========
0165
0166 Bank 0x20 Alarms (R)
0167 --------------------
0168 This bank contains 0 sensors, iow the sensor address is ignored (but must be
0169 written) just use 0. Bank 0x20 contains 3 bytes:
0170
0171 Byte 0:
0172 This byte holds the alarm flags for sensor 0-7 of Sensor Bank1, with bit 0
0173 corresponding to sensor 0, 1 to 1, etc.
0174
0175 Byte 1:
0176 This byte holds the alarm flags for sensor 8-15 of Sensor Bank1, with bit 0
0177 corresponding to sensor 8, 1 to 9, etc.
0178
0179 Byte 2:
0180 This byte holds the alarm flags for sensor 0-5 of Sensor Bank2, with bit 0
0181 corresponding to sensor 0, 1 to 1, etc.
0182
0183
0184 Bank 0x21 Sensor Bank1 Values / Readings (R)
0185 --------------------------------------------
0186 This bank contains 16 sensors, for each sensor it contains 1 byte.
0187 So far the following sensors are known to be available on all motherboards:
0188
0189 - Sensor 0 CPU temp
0190 - Sensor 1 SYS temp
0191 - Sensor 3 CPU core volt
0192 - Sensor 4 DDR volt
0193 - Sensor 10 DDR Vtt volt
0194 - Sensor 15 PWM temp
0195
0196 Byte 0:
0197 This byte holds the reading from the sensor. Sensors in Bank1 can be both
0198 volt and temp sensors, this is motherboard specific. The uGuru however does
0199 seem to know (be programmed with) what kindoff sensor is attached see Sensor
0200 Bank1 Settings description.
0201
0202 Volt sensors use a linear scale, a reading 0 corresponds with 0 volt and a
0203 reading of 255 with 3494 mV. The sensors for higher voltages however are
0204 connected through a division circuit. The currently known division circuits
0205 in use result in ranges of: 0-4361mV, 0-6248mV or 0-14510mV. 3.3 volt sources
0206 use the 0-4361mV range, 5 volt the 0-6248mV and 12 volt the 0-14510mV .
0207
0208 Temp sensors also use a linear scale, a reading of 0 corresponds with 0 degree
0209 Celsius and a reading of 255 with a reading of 255 degrees Celsius.
0210
0211
0212 Bank 0x22 Sensor Bank1 Settings (R) and Bank 0x23 Sensor Bank1 Settings (W)
0213 ---------------------------------------------------------------------------
0214
0215 Those banks contain 16 sensors, for each sensor it contains 3 bytes. Each
0216 set of 3 bytes contains the settings for the sensor with the same sensor
0217 address in Bank 0x21 .
0218
0219 Byte 0:
0220 Alarm behaviour for the selected sensor. A 1 enables the described
0221 behaviour.
0222
0223 Bit 0:
0224 Give an alarm if measured temp is over the warning threshold (RW) [1]_
0225
0226 Bit 1:
0227 Give an alarm if measured volt is over the max threshold (RW) [2]_
0228
0229 Bit 2:
0230 Give an alarm if measured volt is under the min threshold (RW) [2]_
0231
0232 Bit 3:
0233 Beep if alarm (RW)
0234
0235 Bit 4:
0236 1 if alarm cause measured temp is over the warning threshold (R)
0237
0238 Bit 5:
0239 1 if alarm cause measured volt is over the max threshold (R)
0240
0241 Bit 6:
0242 1 if alarm cause measured volt is under the min threshold (R)
0243
0244 Bit 7:
0245 - Volt sensor: Shutdown if alarm persist for more than 4 seconds (RW)
0246 - Temp sensor: Shutdown if temp is over the shutdown threshold (RW)
0247
0248 .. [1] This bit is only honored/used by the uGuru if a temp sensor is connected
0249
0250 .. [2] This bit is only honored/used by the uGuru if a volt sensor is connected
0251 Note with some trickery this can be used to find out what kinda sensor
0252 is detected see the Linux kernel driver for an example with many
0253 comments on how todo this.
0254
0255 Byte 1:
0256 - Temp sensor: warning threshold (scale as bank 0x21)
0257 - Volt sensor: min threshold (scale as bank 0x21)
0258
0259 Byte 2:
0260 - Temp sensor: shutdown threshold (scale as bank 0x21)
0261 - Volt sensor: max threshold (scale as bank 0x21)
0262
0263
0264 Bank 0x24 PWM outputs for FAN's (R) and Bank 0x25 PWM outputs for FAN's (W)
0265 ---------------------------------------------------------------------------
0266
0267 Those banks contain 3 "sensors", for each sensor it contains 5 bytes.
0268 - Sensor 0 usually controls the CPU fan
0269 - Sensor 1 usually controls the NB (or chipset for single chip) fan
0270 - Sensor 2 usually controls the System fan
0271
0272 Byte 0:
0273 Flag 0x80 to enable control, Fan runs at 100% when disabled.
0274 low nibble (temp)sensor address at bank 0x21 used for control.
0275
0276 Byte 1:
0277 0-255 = 0-12v (linear), specify voltage at which fan will rotate when under
0278 low threshold temp (specified in byte 3)
0279
0280 Byte 2:
0281 0-255 = 0-12v (linear), specify voltage at which fan will rotate when above
0282 high threshold temp (specified in byte 4)
0283
0284 Byte 3:
0285 Low threshold temp (scale as bank 0x21)
0286
0287 byte 4:
0288 High threshold temp (scale as bank 0x21)
0289
0290
0291 Bank 0x26 Sensors Bank2 Values / Readings (R)
0292 ---------------------------------------------
0293
0294 This bank contains 6 sensors (AFAIK), for each sensor it contains 1 byte.
0295
0296 So far the following sensors are known to be available on all motherboards:
0297 - Sensor 0: CPU fan speed
0298 - Sensor 1: NB (or chipset for single chip) fan speed
0299 - Sensor 2: SYS fan speed
0300
0301 Byte 0:
0302 This byte holds the reading from the sensor. 0-255 = 0-15300 (linear)
0303
0304
0305 Bank 0x27 Sensors Bank2 Settings (R) and Bank 0x28 Sensors Bank2 Settings (W)
0306 -----------------------------------------------------------------------------
0307
0308 Those banks contain 6 sensors (AFAIK), for each sensor it contains 2 bytes.
0309
0310 Byte 0:
0311 Alarm behaviour for the selected sensor. A 1 enables the described behaviour.
0312
0313 Bit 0:
0314 Give an alarm if measured rpm is under the min threshold (RW)
0315
0316 Bit 3:
0317 Beep if alarm (RW)
0318
0319 Bit 7:
0320 Shutdown if alarm persist for more than 4 seconds (RW)
0321
0322 Byte 1:
0323 min threshold (scale as bank 0x26)
0324
0325
0326 Warning for the adventurous
0327 ===========================
0328
0329 A word of caution to those who want to experiment and see if they can figure
0330 the voltage / clock programming out, I tried reading and only reading banks
0331 0-0x30 with the reading code used for the sensor banks (0x20-0x28) and this
0332 resulted in a _permanent_ reprogramming of the voltages, luckily I had the
0333 sensors part configured so that it would shutdown my system on any out of spec
0334 voltages which probably safed my computer (after a reboot I managed to
0335 immediately enter the bios and reload the defaults). This probably means that
0336 the read/write cycle for the non sensor part is different from the sensor part.