Very interesting. So the SMU has to talk with the settings parts in BiOS probably. But I don't know the arch of SMU. Just know what is interesting after looking in
I suggest looking into:
- 'Communication Protcol'
- 'A table of request ID for MP1' and
- 'A table of SMU Feature ID' - maybe here is read from BIOS that >1300 not possible
Since 1300 is valid, is will be accepted
Edit: please look into SMU feature ID' such as: "OC_Disable" / "SetSoftMaxGfxClk" and so on
On Power on (before or after post) all the BIOS flash gets copied to memory (you could change your BIOS chip, once your system is up and running - this was possbile on earlier days) So the SMU part must be in memory. Those values could be passed to "SMU Features". There are some interesting flags - I think - even frq. limit. See for yourself.
3.60R has SMU FW v0.30.92.0
3.60S has also the same SMU FW version.
What I would do is - search on SMU, compare BIOS 3.60N vs 3.60O vs 3.60R.
Find SMU FW at offset <?> in the BIOS file, extract 2^x bytes thinking I got the partiall SMU
Found outdated info (2014) in "search on SMU, ccc.de" - look yourself:
Working place of developing such an SMU Intelectually Property:
I cannt anymore. Read for yourself: https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2503/original/ccc-final.pdf
I've looked inside of 3.60H (forgot the AGESA version) - look it yourself.
The section "SMU Rules" could contain O/C flasg and SOC/VID flags
Can you give me hint? I need to compare a version with and without SOC VID for example - but of the same AGESAv1 or AGESAv2. Which 2 BIOS was it again? 3.60R&3.60S? - but I think they changed more in the o/c section - if not let me know.
Edit >3: Now dowloaded all N, R, S - all AGESAv2, and some with SOC VID and without.
Maybe there is aspecific change in the config block. Let see.
Here is how 3.60R looks vs 3.60S:
I don't promise anything. But my goal (to begin with) would be "re-enable SOC VID in 3.60S"
Even the entropy of this 2 files looks the same. So even more indication for SOC VID to be a status bit, which (enabled) will should up or not.
DIfference at offset: 0x00037090+0x04 - 3.60R(value) = 88; 3.60S(value) = 90, there is some ASCII after "StdDefaults.NVAR"
ans so on
It could look like this (3.60R,enabled -> 3.60S,disabled):
I've extracted the strings from the 3.60R BIOS,
If you want I can upload them, so you can see something like
- "Loading SMU FW to SRAM Start..." or
- "Received SmuCmd: 0x%X and completed with Status: 0x%X" or
- "LoadSMUFWToDram"
Further more the BIOS is packed intern into "modules/subsystems"
e.g. 0x000E8000 = PSP (Platform Secure Processor) -- seems to be config data
e.g. 0x000E8400 = CLk (Clock settings?)
e.g. 0x000E8710 = PS1? ... large block... Platform Security? TPM?
Additionaly it is able to see, which code has been edited from R->S.. There are blob regions which just differ.
PS: Where can I get the 1.40 BIOS of X300? Can someone please provide a link in case of availability? Thanks
I see 2 possible ways of processing this issue:
Finding the FW of the SMU, dump it and try to understand how it works. (try to find references to addresses. maybe "ryzen_nb_smu", and alter the values)
Or try to find changes using diff between 2 versions like 3.60S and 1.40(X300) so we know at which offset is the according bit.
Then try to patch the latest official BIOS
Edit: -- search here for "SOC VID" or "GFX" and see for yourself - it should be the inner-things of AGESA!
Edit: Just found a guide by 1usmus to extract existing BIOS!
Greetings. If you want to work on this subject more than only, "ah, well" - we could create a discord or something similar and try to take it apart
GitHub - FlyGoat/ryzen_nb_smu: A fight against Ryzen NorthBridge SMU
A fight against Ryzen NorthBridge SMU. Contribute to FlyGoat/ryzen_nb_smu development by creating an account on GitHub.
github.com
I suggest looking into:
- 'Communication Protcol'
- 'A table of request ID for MP1' and
- 'A table of SMU Feature ID' - maybe here is read from BIOS that >1300 not possible
Since 1300 is valid, is will be accepted
Edit: please look into SMU feature ID' such as: "OC_Disable" / "SetSoftMaxGfxClk" and so on
On Power on (before or after post) all the BIOS flash gets copied to memory (you could change your BIOS chip, once your system is up and running - this was possbile on earlier days) So the SMU part must be in memory. Those values could be passed to "SMU Features". There are some interesting flags - I think - even frq. limit. See for yourself.
3.60R has SMU FW v0.30.92.0
3.60S has also the same SMU FW version.
What I would do is - search on SMU, compare BIOS 3.60N vs 3.60O vs 3.60R.
Find SMU FW at offset <?> in the BIOS file, extract 2^x bytes thinking I got the partiall SMU
Found outdated info (2014) in "search on SMU, ccc.de" - look yourself:
Aha! SMU has a microcontroller!AMD BIOS and Kernel Developers Guide (BKDG) ● for fam15h & fam16h “The system management unit (SMU) is a subcomponent of the northbridge that is responsible for a variety of system and power management tasks during boot and runtime. The SMU contains a microcontroller to assist” – The Northbridge is part of the CPU – a processor inside a processor (or SoC) - matroshka processor!
Working place of developing such an SMU Intelectually Property:
Speaking of LatticeMico lm32:Developed a NLMS Adaptive Filter in firmware C for an embedded Lattice LM32 microprocessor in the SMU IP, to dynamically compute the coefficients used for calculating the GPU dynamic power consumption. This also includes creating a Matlab model of the adaptive filter and running simulations with real silicon data to verify the algorithm functionality.
LatticeMico lm32 ● LatticeMico32 Open, Free 32-Bit Soft Processor ● Check “LatticeMico32 Processor Reference Manual” ● SDK from LatticeMico System for Diamond 3.3 ● You can compile own toolchain: – gcc, objdump, as, gdb... ● http://www.latticesemi.com/en/Products/DesignSoftware AndIP/IntellectualProperty/IPCore/IPCores02/LatticeMico 32.aspx
I cannt anymore. Read for yourself: https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2503/original/ccc-final.pdf
I've looked inside of 3.60H (forgot the AGESA version) - look it yourself.
The section "SMU Rules" could contain O/C flasg and SOC/VID flags
Can you give me hint? I need to compare a version with and without SOC VID for example - but of the same AGESAv1 or AGESAv2. Which 2 BIOS was it again? 3.60R&3.60S? - but I think they changed more in the o/c section - if not let me know.
Edit >3: Now dowloaded all N, R, S - all AGESAv2, and some with SOC VID and without.
Maybe there is aspecific change in the config block. Let see.
Here is how 3.60R looks vs 3.60S:
I don't promise anything. But my goal (to begin with) would be "re-enable SOC VID in 3.60S"
Even the entropy of this 2 files looks the same. So even more indication for SOC VID to be a status bit, which (enabled) will should up or not.
DIfference at offset: 0x00037090+0x04 - 3.60R(value) = 88; 3.60S(value) = 90, there is some ASCII after "StdDefaults.NVAR"
ans so on
It could look like this (3.60R,enabled -> 3.60S,disabled):
I've extracted the strings from the 3.60R BIOS,
If you want I can upload them, so you can see something like
- "Loading SMU FW to SRAM Start..." or
- "Received SmuCmd: 0x%X and completed with Status: 0x%X" or
- "LoadSMUFWToDram"
Further more the BIOS is packed intern into "modules/subsystems"
e.g. 0x000E8000 = PSP (Platform Secure Processor) -- seems to be config data
e.g. 0x000E8400 = CLk (Clock settings?)
e.g. 0x000E8710 = PS1? ... large block... Platform Security? TPM?
Additionaly it is able to see, which code has been edited from R->S.. There are blob regions which just differ.
PS: Where can I get the 1.40 BIOS of X300? Can someone please provide a link in case of availability? Thanks
I see 2 possible ways of processing this issue:
Finding the FW of the SMU, dump it and try to understand how it works. (try to find references to addresses. maybe "ryzen_nb_smu", and alter the values)
Or try to find changes using diff between 2 versions like 3.60S and 1.40(X300) so we know at which offset is the according bit.
Then try to patch the latest official BIOS
Edit: -- search here for "SOC VID" or "GFX" and see for yourself - it should be the inner-things of AGESA!
Edit: Just found a guide by 1usmus to extract existing BIOS!
Greetings. If you want to work on this subject more than only, "ah, well" - we could create a discord or something similar and try to take it apart
Last edited: