Skip to content

Add IntelOOBMSM module and ARL-S Mailbox MSRs (0x607 / 0x608)#57

Closed
DevTechProfile wants to merge 1 commit into
namazso:mainfrom
DevTechProfile:main
Closed

Add IntelOOBMSM module and ARL-S Mailbox MSRs (0x607 / 0x608)#57
DevTechProfile wants to merge 1 commit into
namazso:mainfrom
DevTechProfile:main

Conversation

@DevTechProfile

Copy link
Copy Markdown
Contributor

1. New IntelOOBMSM module. Same pattern as IntelMCHBAR.p, probes
the OOBMSM PCI device at 00:0A.0, maps BAR0 (64 KiB) with
io_space_map once, and exposes three IOCTLs (PCI-config DWORD read,
BAR-relative DWORD read, identity). Cap discovery, BAR-base resolution,
and per-platform telemetry-layout decoding stay in the user-mode
consumer.

Verified on Panther Lake: NCLK 550–1200 MHz dynamic and D2D 300 MHz
boot-fixed, matching HWiNFO64 v8.46+ on the same hardware.

2. Adds MSR 0x607 (interface) and MSR 0x608 (data) to the IntelMSR
allow-list.
On Arrow Lake-S desktop the Intel OC Mailbox moved off
the legacy MSR 0x150 onto this new pair: 0x607 carries the command
word with the run bit (bit 31), 0x608 carries the input/output data
word. Same risk class as the legacy MSR_OC_MAILBOX (0x150) entry,
which the allow-list already carries.

Verified on Core Ultra 9 285K: command 0x1237 returns the D2D ratio
in bits 0..14, command 0x0022 returns the NGU ratio in bits 8..15,
both with ×100 MHz scale — matching HWiNFO64 v8.32+ output. The
protocol (WrMSR 0x607 → poll RdMSR 0x607RdMSR 0x608) is
implemented in CapFrameX hardware lib.

Two related changes:

1. New IntelOOBMSM module. Same pattern as IntelMCHBAR.p - probes the
   OOBMSM PCI device at 00:0A.0, maps BAR0 (64 KiB) with io_space_map
   once, and exposes three IOCTLs (PCI-config DWORD read, BAR-relative
   DWORD read, identity). Cap discovery, BAR-base resolution, and
   per-platform telemetry-layout decoding stay in the user-mode
   consumer.

   Verified on Panther Lake: NCLK 550-1200 MHz dynamic and D2D 300 MHz
   boot-fixed, matching HWiNFO64 v8.46+.

2. Adds MSR 0x607 (interface) and MSR 0x608 (data) to the IntelMSR
   allow-list. On Arrow Lake-S desktop the Intel OC Mailbox relocated
   off the legacy MSR 0x150 onto this new pair: 0x607 carries the
   command word with the run bit (bit 31), 0x608 carries the input /
   output data word. Same risk class as the legacy MSR_OC_MAILBOX
   (0x150) entry, which the allow-list already carries.

   Verified on Core Ultra 9 285K: command 0x1237 returns the D2D
   ratio (bits 0..14), command 0x0022 returns the NGU ratio
   (bits 8..15), both x100 MHz - matching HWiNFO64 v8.32+ output.
   The protocol (WrMSR 0x607 -> poll RdMSR 0x607 -> RdMSR 0x608) is
   implemented in the user-mode consumer.
@namazso

namazso commented Jun 2, 2026

Copy link
Copy Markdown
Owner

I'm still yet to review the new module, linking the resources / reference would be helpful.

The IntelMSR stuff ended up conflicting with another PR, but I just added it manually since your commits are squashed so it's not a clean cherry pick. That part is out as of 0.2.7

@DevTechProfile

Copy link
Copy Markdown
Contributor Author

Best sources I could find for the module. Strongest argument is the cross validation against HWiNFO64!

@namazso namazso closed this in db5abc6 Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants