Please or Register to create posts and topics.

NCP81203P (ON Semiconductor) VRM controller

Hello Elmor Team

My motherboard has a NCP81203P (ON Semiconductor) VRM controller. I read that it has SMBus support. Unfortunately I don't find this pinout. Can you help me?

HP EliteDesk 800 G3-Tower-Business-PC Mainboard

Greetings Merlin

Uploaded files:
  • IMG_2020-08-12_13-11-07.96.jpeg

I found this interface (ME_Debug) and soldered in a connector. can i use it?

Uploaded files:
  • IMG_2020-08-12_16-52-50.47.jpeg

The remaining connections of the mainboard.

Uploaded files:
  • IMG_2020-08-12_16-53-16.06.jpeg
  • IMG_2020-08-12_16-54-55.36.jpeg

Hello 🙂

I can't seem to find any datasheet for this part which makes it very difficult. I'm also not familiar with the ME_Debug header you found.  Usually an I2C/SMBus debug header should have 2 pins at 3.3V (SDA and SCL) and 1 at 0V (GND). If you're able to, you can check the voltages of the pins on the ME_Debug header and see if the voltages match. If so it should be safe to try to connect to it and see if you find any addresses. 

Now I am a happy owner of a jtagulator 🙂 First try brute force ME_Debug. Second try brute force all vrm pins. still have an identical mainboard. no risk, no fun 😉 let's see if the jtagulator does what it promises. will share my results. should i upload a picture of the test setup?

Excuse my English. I'm from Switzerland...

Good day

Now I have connected ME_DEBUG to the EVC2. "find devices" has found 8 addresses. Further I have connected the EVC2 with the SMBus via pcie. The same addresses were output. Apparently the ME_DEBUG interface is probably an SMBus interface. Unfortunately I don't know anything about i2c. Do I have to find out the parameters of the VRM controller to use the EVC2? Is it possible to draw conclusions from the dump? Probably the vrm chip can be determined by resolving the housing. Is it difficult to program the EVC2 for a new chip?

Uploaded files:

No problems with your English. As you say it seems the ME_DEBUG header is connected to the on-board SMBus.

What I can see in the log:

  • Addr 0x08: All reads fails
  • Addr 0x36: All data = 0xFF
  • Addr 0x37: All reads fail (Result = False)
  • Addr 0x44: Some data at Cmd = 0x00 - 0x0F, the rest is 0x00
  • Addr 0x50: Data between 0x40 - 0x7F
  • Addr 0x51: Data between 0x40 - 0x7F
  • Addr 0x52: Data between 0x40 - 0x7F
  • Addr 0x53: Data between 0x40 - 0x7F

The 0x50-0x53 readings should be DDR4 SPD reading the page 1 data (byte 256 - 511, with 0x40 - 0x7F being manufacturer data) meaning you have 4 DIMMs in your system? Byte 0x321 Manufacturer Id's indicate Kingston/SK Hynix/Samsung/SK Hynix. In that case the 0x36 address is actually the command for setting SPD page 0 (SPA0) and 0x37 is setting SPD page 1 (SPA1). That makes sense since we're seeing the page 1 data after reading from 0x37.

I've seen addr 0x08 in the past and it's usually some chipset slave function, possibly disabled because it doesn't allow any reads. That leaves 0x44 which could possibly be the NCP chip. On other NCP chips there is usually a MFR_ID register which will return 0x1A for ON Semi which isn't there. That plus the limited amount of registers reporting any data leads me to suspect that isn't the VRM controller.

Yes I have installed four ram modules. Now I have desoldered the VRM chip. It must bathe in the concentrated sulfuric acid for a while. I hope that I can find a useful type designation on it. Is it possible to overclock the CPU via the bios image or undervolting? This project is for learning. for me the Undervolting of mobile devices is interesting in the future. i have some years ago on my samsung galaxy s3 the CPU and GPU Undervolting. i was fascinated by the energy saving with the same stability. i think this effect can also be achieved on notebooks. i uploaded the dump from the SMBus. looks for me at first glance identical to ME_DEBUG.

thanks for your effort

Uploaded files:

have some more dumps here. don't know if they are useful. try to change some more intel me settings. thanks to intels data failure you can now track the parameters. have already seen that the SMBus is not fully enabled.

Uploaded files: