AMD IMC

AMD IMC

The AMD IMC register interface visible from PCI space is documented in the AMD reference guides. This page tries to cover everything else which is not documented elsewhere.

The embedded controller is an 8051 CPU most likely derived from SMSC LPC47N350 Data Sheet or any recent SMSC embedded controller core. As the 8051, it has 3 memory spaces. The SFR, internal RAM and external space where the hardware has specific registers mapped. The code is fetched from 16KB? region of flash the base address is set to 0xFFF20000 (in SB710).

The EC is turned on if the soft straps are set to on during the init of the southbridge, this is documented in the SB datasheet. To make it operational you will need to modify the strap bits and include the IMC firmware in the coreboot image. The 8051 reset vector is first instruction. The firmware itself contains a magic _AMD_IMC_C and you can check validateImcFirmware() how it works.

To check if IMC is active check if PCI 0:14.3 0x40 bit7 set.

SuperIO Register space

The IMC presents itself as an multifunction superIO device. You can read the sioport base in the following register PCI 14.3 0xa4 & ~0x1. The access pattern is same as for any other superio. The superiotool has some basic routines implemented. In general, there is a "password" to unlock the SIO part - 0x5a and lock it with 0xa5 again.

The known global registers:

• 0x0 - device ID register 0xb7 for SB710
• 0x1 - revision ID?
• 0x2 - WO btt0 reset?
• 0x7 - change logical device (LDN)
• 0x26, 0x27 - the base address again, unclear if the base could be changed using this regs.

The LDN 3 registers

• EC Channel 0?

The LDN 5 - Irda:

• 0x30 bit0 enable device
• 0x60 BASE >> 8
• 0x61 BASE & 0xff
• 0x70 IRQ

• BASE + 0 - offset? 0xAB write config? (something is mentioned in recent SB800?)
• BASE + 1 - get data?

The LDN 7:

• Keyboard controller?

The LDN 9 - Mailbox:

• 0x30 bit0 enable device
• 0x60 BASE >> 8
• 0x61 BASE & 0xff

• BASE + 0: offset
• BASE + 1: data

Offsets defined:

• 0x80 SYS_TO_IMC -> put message to IMC here
• 0x81 IMC_TO_SYS -> get message from IMC
• 0x82 MSG_REG0
• 0x83 REG1
• 0x84 REG2
• 0x85 REG3
• ...
• 0x8f last MSG_REG 0xD

If you write to mailbox: prepare all regs then write FUNC to 0x80 and wait until 0xFA is in 0x82 -> EC acked transaction, wait 100ms when polling this reg

To execute a function and send data:

• clear 0x82

• setup 0x82-0x8f
• setup 0x80
• wait for 0xfa in 0x82