Board Management SMBus SMC and GPIO

Board Management: SMBus, SMC & GPIO

This page follows the low-speed board-management path from guest I/O instructions to the Xbox System Management Controller, video encoder, temperature monitor, GPIO state, power/eject events, and host/UI side effects.

The central fidelity rule is that xemu models these devices mostly at the register/semantic boundary. It does not simulate motherboard trace voltages or execute the SMC's PIC firmware instruction-by-instruction.

Physical Xbox view

On the original Xbox, the MCPX southbridge exposes an SMBus used by low-speed board devices. Hardware documentation identifies devices including the SMC/PIC at 0x10, ADM1032 temperature monitor at 0x4c on applicable revisions, and revision-specific video encoders.

The SMC is a PIC-family microcontroller responsible for power/eject input, power control, A/V-pack reporting, tray state, fan and LED control, temperatures and boot challenge behavior.

Hardware references:

• XboxDevWiki — System Management Controller
• XboxDevWiki — SMBus
• XboxDevWiki — LPC Debug Port

xemu path

flowchart TD
    A[Guest IN/OUT to SMBus PCI I/O BAR] --> B[xbox_smb_ioport_*]
    B --> C[AMD756SMBus register state]
    C --> D{START bit written?}
    D -->|No| E[Store controller register]
    D -->|Yes| F[amd756_smb_transaction]
    F --> G{SMBus protocol}
    G --> H[QEMU SMBus helper]
    H --> I{Address}
    I -->|0x10| J[Xbox SMC]
    I -->|0x4c| K[ADM1032]
    I -->|0x45 / 0x6a / 0x70| L[Video encoder]
    J --> M[Register result / reset / shutdown / event]
    K --> N[Register result]
    L --> O[Register array]
    M --> P[Status / optional IRQ / external SMI]

Loading

The physical serial transfer over SCL/SDA is not timed bit by bit. The target callback runs synchronously from the guest controller-start write.

SMBus controller

hw/xbox/amd_smbus.c implements an AMD756-compatible host controller, matching the nForce lineage used by the Xbox chipset.

The guest programs controller registers such as address, command and data, chooses a protocol, then sets GE_HOST_STC. amd756_smb_transaction() immediately calls the corresponding QEMU SMBus helper.

Supported controller paths include:

Protocol	xemu action
QUICK	smbus_quick_command()
BYTE	send or receive one byte
BYTE DATA	command + byte read/write
WORD DATA	command + 16-bit read/write
BLOCK DATA	QEMU block read/write helper

On completion xemu sets host-cycle status; errors set protocol-error status. IRQ assertion is derived from status and the controller enable bits.

Timing fidelity

sequenceDiagram
    participant G as Guest driver
    participant C as SMBus controller model
    participant D as Target device model

    G->>C: Program address/command/data
    G->>C: Write START
    C->>D: Call SMBus helper synchronously
    D-->>C: Return value/status
    C->>C: Set completion/error bits
    C-->>G: Read status or receive IRQ

Loading

There is no emulated SCL frequency, bit arbitration, clock stretching, line rise time, or transfer duration. That is a deliberate abstraction unless guest-visible timing proves it is required.

SMC register model

hw/xbox/smbus_xbox_smc.c describes the device as PIC16LC-based hardware but implements the software-facing state directly.

Important defined registers include:

Register	Intended hardware role	Current xemu behavior
0x01	SMC version	Sequential bytes from configured 3-character version
0x02	reset/power control	Calls QEMU reset/power-cycle/shutdown requests
0x03	DVD tray state	Returns cached tray state derived from block backend
0x04	A/V pack	Returns selected machine avpack value
0x05	fan mode	Defined, physical fan action not implemented in write switch
0x06	fan speed	Defined, physical fan action not implemented in write switch
0x07	LED mode	Defined, physical LED action not implemented in write switch
0x08	LED sequence	Defined, physical LED action not implemented in write switch
0x09/0x0a	CPU/board temperature	Constants exist; SMC thermal system not physically simulated
0x0c	tray eject/load	Defined, current generic write path does not actuate tray
0x0e	error/scratch-like state	Stored
0x11	interrupt reason	Returned and currently cleared on read; source has a FIXME to verify
0x19	reset-on-eject	Defined; current write switch does not model effect
0x1a	interrupt enable	Defined; current write switch does not model full hardware behavior
0x1b	scratch	Stored and read back
0x1c..0x1f	boot challenge	Returns fixed bytes 52 72 ea 46
0x20..0x21	challenge response	Writes accepted with no cryptographic verification

Do not infer implementation from the existence of the register constant. The write switch is the authoritative current behavior.

Power and eject buttons

On hardware, the front-panel buttons are physical inputs to the SMC. xemu does not model that voltage/pin path.

sequenceDiagram
    participant UI as xemu UI/input
    participant S as SMC model
    participant A as ACPI/LPC
    participant C as Guest CPU

    UI->>S: xbox_smc_power_button()
    S->>S: INTSTATUS |= POWER
    S->>A: xbox_assert_extsmi()
    A->>C: Guest-visible external SMI/event path

Loading

The eject helper does the same pattern with the eject-button status bit. This is a semantic shortcut from a host UI event to the state the guest is expected to observe.

Tray state

xbox_smc_update_tray_state() looks up QEMU block backend ide0-cd1, checks whether the tray is open and whether media is present, updates the SMC tray-state register, sets a tray-opening/closed interrupt reason, and raises an external SMI.

flowchart LR
    A[UI changes optical tray] --> B[QEMU block backend]
    B --> C[xbox_smc_update_tray_state]
    C --> D[SMC traystate + INTSTATUS]
    D --> E[External SMI]

Loading

The source explicitly notes that this should ideally be a tray-state callback; current code calls it explicitly from UI interaction. A non-UI path that changes block tray state is therefore an important compatibility edge to test.

A/V pack

The rear Xbox A/V connector uses hardware identification pins. xemu collapses that physical sensing into the machine avpack property. The SMC register returns a value derived from the configured string (composite, scart, svideo, vga, rfu, hdtv, none).

Physical console:
connector pin state → SMC input → AV-pack register

xemu:
machine setting → SMC register

There is no simulated resistance/pin sensing behind this setting.

Temperature monitor

hw/xbox/smbus_adm1032.c is intentionally minimal. Command selection is tracked, but reads of the two implemented temperature registers return a fixed value of 50; unhandled reads return zero.

This means xemu currently has no closed-loop thermal model:

host load ─X→ emulated silicon temperature ─X→ fan controller

Fan writes and temperature reads should therefore not be used to judge thermal behavior of physical hardware.

Video encoders

Current SMBus implementations for Conexant CX25871, Focus FS454 and Microsoft Xcalibur are primarily register stores:

flowchart LR
    A[Guest encoder command] --> B[SMBus device]
    B --> C[256-byte register array]
    C --> D[Later register read]

Loading

Writes copy bytes into the array; reads return the selected register and increment the command pointer. Analog encoding, DAC output, line timing and cable electrical behavior are not implemented in these device files.

The visible picture is produced by NV2A renderer/display logic, not by passing pixels through an analog encoder simulation.

ACPI/PM GPIO

hw/xbox/acpi_xbox.c creates a GPIO region within the Xbox PM I/O BAR.

Field pin

GPIO offset 0 is commented as a probable TV-encoder field pin. Current behavior simply toggles a static bit on every read:

read #1 → bit 5 = 1
read #2 → bit 5 = 0
read #3 → bit 5 = 1
...

flowchart LR
    A[Guest polls GPIO 0] --> B[xbox_pm_gpio_read]
    B --> C[field_pin = field_pin XOR 1]
    C --> D[Return field_pin << 5]

Loading

It is therefore read-count driven, not raster-time driven. A guest polling loop can observe behavior different from a real encoder field signal.

Aspect-ratio GPIO

A write to GPIO offset 0x16 calls:

xemu_set_widescreen(val == 5)

This directly crosses from a guest register write into xemu presentation/UI state.

The source contains FIXME: Add GPIO to VM state; snapshot/restore tests should include GPIO-dependent behavior because the static/derived state is not all represented in the PM VMState block.

LPC debug header and physical pins

The physical motherboard LPC debug footprint exposes logical bus signals and SMBus. Some motherboard revisions disconnect specific pins such as LFRAME#, and v1.6 changes some supply/power-pin behavior. xemu does not create per-pin electrical nets for these traces.

Instead:

LAD/LFRAME/LCLK physical protocol
        ↓ abstracted to
QEMU PCI/LPC I/O and device callbacks

SCL/SDA physical protocol
        ↓ abstracted to
QEMU SMBus transaction helpers

Hardware reference: XboxDevWiki — LPC Debug Port.

Compatibility and performance boundaries

Boundary	Consequence
SMBus transaction completes synchronously	Host profile omits real wire-transfer time
SMC is semantic, not PIC-firmware emulation	Exact microcontroller timing/internal firmware behavior absent
Fan/LED/eject writes largely no-op	Software probing may pass while physical side effects are absent
Fixed SMC challenge	Security timing/randomness not faithfully represented
Constant ADM1032 temperature	Thermal-control software sees deterministic synthetic values
Encoder register bags	Register programming can succeed without analog/video-chip behavior
Field pin toggles per read	Tight polling changes apparent field frequency
GPIO VMState FIXME	Snapshot fidelity needs targeted testing

Debugging checklist

When board-management behavior is wrong, identify the boundary before changing timing:

1. Which guest port/register is accessed?
2. Is the access handled by the AMD756 controller, SMC, GPIO, sensor or encoder model?
3. Is the current device functional or only a register façade?
4. Is the expected hardware effect represented as a direct host/QEMU call?
5. Does an IRQ/SMI/status bit become visible at the correct guest point?
6. Is there a source FIXME, no-op register path or fixed response covering this case?
7. Does the behavior survive reset and snapshot/restore?

Source map

Source	Role
hw/xbox/amd_smbus.c	SMBus host-controller registers and synchronous transaction dispatch
hw/xbox/smbus_xbox_smc.c	SMC register behavior, power/eject/tray events
hw/xbox/smbus_adm1032.c	Minimal temperature monitor
hw/xbox/smbus_cx25871.c	Conexant register façade
hw/xbox/smbus_fs454.c	Focus register façade
hw/xbox/smbus_xcalibur.c	Xcalibur register façade
hw/xbox/acpi_xbox.c	PM/GPE/GPIO behavior and field/aspect-ratio shortcuts
hw/xbox/xbox.c	Device selection and machine properties

Related pages

• Xyclops serial freeze and chip variants — A-A02/A-B01 flashing distinction and debug-mode board-management state.
• TV scanout alongside CRTC — reported display-generation path requiring register-level reproduction.
• Platform & I/O
• Hardware Fidelity & Emulation Boundaries
• Clocks & Timers
• Firmware, Boot & ROM