1/* 2 * Host communication command constants for ChromeOS EC 3 * 4 * Copyright (C) 2012 Google, Inc 5 * 6 * This software is licensed under the terms of the GNU General Public 7 * License version 2, as published by the Free Software Foundation, and 8 * may be copied, distributed, and modified under those terms. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * The ChromeOS EC multi function device is used to mux all the requests 16 * to the EC device for its multiple features: keyboard controller, 17 * battery charging and regulator control, firmware update. 18 * 19 * NOTE: This file is copied verbatim from the ChromeOS EC Open Source 20 * project in an attempt to make future updates easy to make. 21 */ 22 23#ifndef __CROS_EC_COMMANDS_H 24#define __CROS_EC_COMMANDS_H 25 26/* 27 * Current version of this protocol 28 * 29 * TODO(crosbug.com/p/11223): This is effectively useless; protocol is 30 * determined in other ways. Remove this once the kernel code no longer 31 * depends on it. 32 */ 33#define EC_PROTO_VERSION 0x00000002 34 35/* Command version mask */ 36#define EC_VER_MASK(version) (1UL << (version)) 37 38/* I/O addresses for ACPI commands */ 39#define EC_LPC_ADDR_ACPI_DATA 0x62 40#define EC_LPC_ADDR_ACPI_CMD 0x66 41 42/* I/O addresses for host command */ 43#define EC_LPC_ADDR_HOST_DATA 0x200 44#define EC_LPC_ADDR_HOST_CMD 0x204 45 46/* I/O addresses for host command args and params */ 47/* Protocol version 2 */ 48#define EC_LPC_ADDR_HOST_ARGS 0x800 /* And 0x801, 0x802, 0x803 */ 49#define EC_LPC_ADDR_HOST_PARAM 0x804 /* For version 2 params; size is 50 * EC_PROTO2_MAX_PARAM_SIZE */ 51/* Protocol version 3 */ 52#define EC_LPC_ADDR_HOST_PACKET 0x800 /* Offset of version 3 packet */ 53#define EC_LPC_HOST_PACKET_SIZE 0x100 /* Max size of version 3 packet */ 54 55/* The actual block is 0x800-0x8ff, but some BIOSes think it's 0x880-0x8ff 56 * and they tell the kernel that so we have to think of it as two parts. */ 57#define EC_HOST_CMD_REGION0 0x800 58#define EC_HOST_CMD_REGION1 0x880 59#define EC_HOST_CMD_REGION_SIZE 0x80 60 61/* EC command register bit functions */ 62#define EC_LPC_CMDR_DATA (1 << 0) /* Data ready for host to read */ 63#define EC_LPC_CMDR_PENDING (1 << 1) /* Write pending to EC */ 64#define EC_LPC_CMDR_BUSY (1 << 2) /* EC is busy processing a command */ 65#define EC_LPC_CMDR_CMD (1 << 3) /* Last host write was a command */ 66#define EC_LPC_CMDR_ACPI_BRST (1 << 4) /* Burst mode (not used) */ 67#define EC_LPC_CMDR_SCI (1 << 5) /* SCI event is pending */ 68#define EC_LPC_CMDR_SMI (1 << 6) /* SMI event is pending */ 69 70#define EC_LPC_ADDR_MEMMAP 0x900 71#define EC_MEMMAP_SIZE 255 /* ACPI IO buffer max is 255 bytes */ 72#define EC_MEMMAP_TEXT_MAX 8 /* Size of a string in the memory map */ 73 74/* The offset address of each type of data in mapped memory. */ 75#define EC_MEMMAP_TEMP_SENSOR 0x00 /* Temp sensors 0x00 - 0x0f */ 76#define EC_MEMMAP_FAN 0x10 /* Fan speeds 0x10 - 0x17 */ 77#define EC_MEMMAP_TEMP_SENSOR_B 0x18 /* More temp sensors 0x18 - 0x1f */ 78#define EC_MEMMAP_ID 0x20 /* 0x20 == 'E', 0x21 == 'C' */ 79#define EC_MEMMAP_ID_VERSION 0x22 /* Version of data in 0x20 - 0x2f */ 80#define EC_MEMMAP_THERMAL_VERSION 0x23 /* Version of data in 0x00 - 0x1f */ 81#define EC_MEMMAP_BATTERY_VERSION 0x24 /* Version of data in 0x40 - 0x7f */ 82#define EC_MEMMAP_SWITCHES_VERSION 0x25 /* Version of data in 0x30 - 0x33 */ 83#define EC_MEMMAP_EVENTS_VERSION 0x26 /* Version of data in 0x34 - 0x3f */ 84#define EC_MEMMAP_HOST_CMD_FLAGS 0x27 /* Host cmd interface flags (8 bits) */ 85/* Unused 0x28 - 0x2f */ 86#define EC_MEMMAP_SWITCHES 0x30 /* 8 bits */ 87/* Unused 0x31 - 0x33 */ 88#define EC_MEMMAP_HOST_EVENTS 0x34 /* 32 bits */ 89/* Reserve 0x38 - 0x3f for additional host event-related stuff */ 90/* Battery values are all 32 bits */ 91#define EC_MEMMAP_BATT_VOLT 0x40 /* Battery Present Voltage */ 92#define EC_MEMMAP_BATT_RATE 0x44 /* Battery Present Rate */ 93#define EC_MEMMAP_BATT_CAP 0x48 /* Battery Remaining Capacity */ 94#define EC_MEMMAP_BATT_FLAG 0x4c /* Battery State, defined below */ 95#define EC_MEMMAP_BATT_DCAP 0x50 /* Battery Design Capacity */ 96#define EC_MEMMAP_BATT_DVLT 0x54 /* Battery Design Voltage */ 97#define EC_MEMMAP_BATT_LFCC 0x58 /* Battery Last Full Charge Capacity */ 98#define EC_MEMMAP_BATT_CCNT 0x5c /* Battery Cycle Count */ 99/* Strings are all 8 bytes (EC_MEMMAP_TEXT_MAX) */ 100#define EC_MEMMAP_BATT_MFGR 0x60 /* Battery Manufacturer String */ 101#define EC_MEMMAP_BATT_MODEL 0x68 /* Battery Model Number String */ 102#define EC_MEMMAP_BATT_SERIAL 0x70 /* Battery Serial Number String */ 103#define EC_MEMMAP_BATT_TYPE 0x78 /* Battery Type String */ 104#define EC_MEMMAP_ALS 0x80 /* ALS readings in lux (2 X 16 bits) */ 105/* Unused 0x84 - 0x8f */ 106#define EC_MEMMAP_ACC_STATUS 0x90 /* Accelerometer status (8 bits )*/ 107/* Unused 0x91 */ 108#define EC_MEMMAP_ACC_DATA 0x92 /* Accelerometer data 0x92 - 0x9f */ 109#define EC_MEMMAP_GYRO_DATA 0xa0 /* Gyroscope data 0xa0 - 0xa5 */ 110/* Unused 0xa6 - 0xfe (remember, 0xff is NOT part of the memmap region) */ 111 112 113/* Define the format of the accelerometer mapped memory status byte. */ 114#define EC_MEMMAP_ACC_STATUS_SAMPLE_ID_MASK 0x0f 115#define EC_MEMMAP_ACC_STATUS_BUSY_BIT (1 << 4) 116#define EC_MEMMAP_ACC_STATUS_PRESENCE_BIT (1 << 7) 117 118/* Number of temp sensors at EC_MEMMAP_TEMP_SENSOR */ 119#define EC_TEMP_SENSOR_ENTRIES 16 120/* 121 * Number of temp sensors at EC_MEMMAP_TEMP_SENSOR_B. 122 * 123 * Valid only if EC_MEMMAP_THERMAL_VERSION returns >= 2. 124 */ 125#define EC_TEMP_SENSOR_B_ENTRIES 8 126 127/* Special values for mapped temperature sensors */ 128#define EC_TEMP_SENSOR_NOT_PRESENT 0xff 129#define EC_TEMP_SENSOR_ERROR 0xfe 130#define EC_TEMP_SENSOR_NOT_POWERED 0xfd 131#define EC_TEMP_SENSOR_NOT_CALIBRATED 0xfc 132/* 133 * The offset of temperature value stored in mapped memory. This allows 134 * reporting a temperature range of 200K to 454K = -73C to 181C. 135 */ 136#define EC_TEMP_SENSOR_OFFSET 200 137 138/* 139 * Number of ALS readings at EC_MEMMAP_ALS 140 */ 141#define EC_ALS_ENTRIES 2 142 143/* 144 * The default value a temperature sensor will return when it is present but 145 * has not been read this boot. This is a reasonable number to avoid 146 * triggering alarms on the host. 147 */ 148#define EC_TEMP_SENSOR_DEFAULT (296 - EC_TEMP_SENSOR_OFFSET) 149 150#define EC_FAN_SPEED_ENTRIES 4 /* Number of fans at EC_MEMMAP_FAN */ 151#define EC_FAN_SPEED_NOT_PRESENT 0xffff /* Entry not present */ 152#define EC_FAN_SPEED_STALLED 0xfffe /* Fan stalled */ 153 154/* Battery bit flags at EC_MEMMAP_BATT_FLAG. */ 155#define EC_BATT_FLAG_AC_PRESENT 0x01 156#define EC_BATT_FLAG_BATT_PRESENT 0x02 157#define EC_BATT_FLAG_DISCHARGING 0x04 158#define EC_BATT_FLAG_CHARGING 0x08 159#define EC_BATT_FLAG_LEVEL_CRITICAL 0x10 160 161/* Switch flags at EC_MEMMAP_SWITCHES */ 162#define EC_SWITCH_LID_OPEN 0x01 163#define EC_SWITCH_POWER_BUTTON_PRESSED 0x02 164#define EC_SWITCH_WRITE_PROTECT_DISABLED 0x04 165/* Was recovery requested via keyboard; now unused. */ 166#define EC_SWITCH_IGNORE1 0x08 167/* Recovery requested via dedicated signal (from servo board) */ 168#define EC_SWITCH_DEDICATED_RECOVERY 0x10 169/* Was fake developer mode switch; now unused. Remove in next refactor. */ 170#define EC_SWITCH_IGNORE0 0x20 171 172/* Host command interface flags */ 173/* Host command interface supports LPC args (LPC interface only) */ 174#define EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED 0x01 175/* Host command interface supports version 3 protocol */ 176#define EC_HOST_CMD_FLAG_VERSION_3 0x02 177 178/* Wireless switch flags */ 179#define EC_WIRELESS_SWITCH_ALL ~0x00 /* All flags */ 180#define EC_WIRELESS_SWITCH_WLAN 0x01 /* WLAN radio */ 181#define EC_WIRELESS_SWITCH_BLUETOOTH 0x02 /* Bluetooth radio */ 182#define EC_WIRELESS_SWITCH_WWAN 0x04 /* WWAN power */ 183#define EC_WIRELESS_SWITCH_WLAN_POWER 0x08 /* WLAN power */ 184 185/* 186 * This header file is used in coreboot both in C and ACPI code. The ACPI code 187 * is pre-processed to handle constants but the ASL compiler is unable to 188 * handle actual C code so keep it separate. 189 */ 190#ifndef __ACPI__ 191 192/* 193 * Define __packed if someone hasn't beat us to it. Linux kernel style 194 * checking prefers __packed over __attribute__((packed)). 195 */ 196#ifndef __packed 197#define __packed __attribute__((packed)) 198#endif 199 200/* LPC command status byte masks */ 201/* EC has written a byte in the data register and host hasn't read it yet */ 202#define EC_LPC_STATUS_TO_HOST 0x01 203/* Host has written a command/data byte and the EC hasn't read it yet */ 204#define EC_LPC_STATUS_FROM_HOST 0x02 205/* EC is processing a command */ 206#define EC_LPC_STATUS_PROCESSING 0x04 207/* Last write to EC was a command, not data */ 208#define EC_LPC_STATUS_LAST_CMD 0x08 209/* EC is in burst mode. Unsupported by Chrome EC, so this bit is never set */ 210#define EC_LPC_STATUS_BURST_MODE 0x10 211/* SCI event is pending (requesting SCI query) */ 212#define EC_LPC_STATUS_SCI_PENDING 0x20 213/* SMI event is pending (requesting SMI query) */ 214#define EC_LPC_STATUS_SMI_PENDING 0x40 215/* (reserved) */ 216#define EC_LPC_STATUS_RESERVED 0x80 217 218/* 219 * EC is busy. This covers both the EC processing a command, and the host has 220 * written a new command but the EC hasn't picked it up yet. 221 */ 222#define EC_LPC_STATUS_BUSY_MASK \ 223 (EC_LPC_STATUS_FROM_HOST | EC_LPC_STATUS_PROCESSING) 224 225/* Host command response codes */ 226enum ec_status { 227 EC_RES_SUCCESS = 0, 228 EC_RES_INVALID_COMMAND = 1, 229 EC_RES_ERROR = 2, 230 EC_RES_INVALID_PARAM = 3, 231 EC_RES_ACCESS_DENIED = 4, 232 EC_RES_INVALID_RESPONSE = 5, 233 EC_RES_INVALID_VERSION = 6, 234 EC_RES_INVALID_CHECKSUM = 7, 235 EC_RES_IN_PROGRESS = 8, /* Accepted, command in progress */ 236 EC_RES_UNAVAILABLE = 9, /* No response available */ 237 EC_RES_TIMEOUT = 10, /* We got a timeout */ 238 EC_RES_OVERFLOW = 11, /* Table / data overflow */ 239 EC_RES_INVALID_HEADER = 12, /* Header contains invalid data */ 240 EC_RES_REQUEST_TRUNCATED = 13, /* Didn't get the entire request */ 241 EC_RES_RESPONSE_TOO_BIG = 14 /* Response was too big to handle */ 242}; 243 244/* 245 * Host event codes. Note these are 1-based, not 0-based, because ACPI query 246 * EC command uses code 0 to mean "no event pending". We explicitly specify 247 * each value in the enum listing so they won't change if we delete/insert an 248 * item or rearrange the list (it needs to be stable across platforms, not 249 * just within a single compiled instance). 250 */ 251enum host_event_code { 252 EC_HOST_EVENT_LID_CLOSED = 1, 253 EC_HOST_EVENT_LID_OPEN = 2, 254 EC_HOST_EVENT_POWER_BUTTON = 3, 255 EC_HOST_EVENT_AC_CONNECTED = 4, 256 EC_HOST_EVENT_AC_DISCONNECTED = 5, 257 EC_HOST_EVENT_BATTERY_LOW = 6, 258 EC_HOST_EVENT_BATTERY_CRITICAL = 7, 259 EC_HOST_EVENT_BATTERY = 8, 260 EC_HOST_EVENT_THERMAL_THRESHOLD = 9, 261 EC_HOST_EVENT_THERMAL_OVERLOAD = 10, 262 EC_HOST_EVENT_THERMAL = 11, 263 EC_HOST_EVENT_USB_CHARGER = 12, 264 EC_HOST_EVENT_KEY_PRESSED = 13, 265 /* 266 * EC has finished initializing the host interface. The host can check 267 * for this event following sending a EC_CMD_REBOOT_EC command to 268 * determine when the EC is ready to accept subsequent commands. 269 */ 270 EC_HOST_EVENT_INTERFACE_READY = 14, 271 /* Keyboard recovery combo has been pressed */ 272 EC_HOST_EVENT_KEYBOARD_RECOVERY = 15, 273 274 /* Shutdown due to thermal overload */ 275 EC_HOST_EVENT_THERMAL_SHUTDOWN = 16, 276 /* Shutdown due to battery level too low */ 277 EC_HOST_EVENT_BATTERY_SHUTDOWN = 17, 278 279 /* Suggest that the AP throttle itself */ 280 EC_HOST_EVENT_THROTTLE_START = 18, 281 /* Suggest that the AP resume normal speed */ 282 EC_HOST_EVENT_THROTTLE_STOP = 19, 283 284 /* Hang detect logic detected a hang and host event timeout expired */ 285 EC_HOST_EVENT_HANG_DETECT = 20, 286 /* Hang detect logic detected a hang and warm rebooted the AP */ 287 EC_HOST_EVENT_HANG_REBOOT = 21, 288 289 /* 290 * The high bit of the event mask is not used as a host event code. If 291 * it reads back as set, then the entire event mask should be 292 * considered invalid by the host. This can happen when reading the 293 * raw event status via EC_MEMMAP_HOST_EVENTS but the LPC interface is 294 * not initialized on the EC, or improperly configured on the host. 295 */ 296 EC_HOST_EVENT_INVALID = 32 297}; 298/* Host event mask */ 299#define EC_HOST_EVENT_MASK(event_code) (1UL << ((event_code) - 1)) 300 301/* Arguments at EC_LPC_ADDR_HOST_ARGS */ 302struct ec_lpc_host_args { 303 uint8_t flags; 304 uint8_t command_version; 305 uint8_t data_size; 306 /* 307 * Checksum; sum of command + flags + command_version + data_size + 308 * all params/response data bytes. 309 */ 310 uint8_t checksum; 311} __packed; 312 313/* Flags for ec_lpc_host_args.flags */ 314/* 315 * Args are from host. Data area at EC_LPC_ADDR_HOST_PARAM contains command 316 * params. 317 * 318 * If EC gets a command and this flag is not set, this is an old-style command. 319 * Command version is 0 and params from host are at EC_LPC_ADDR_OLD_PARAM with 320 * unknown length. EC must respond with an old-style response (that is, 321 * withouth setting EC_HOST_ARGS_FLAG_TO_HOST). 322 */ 323#define EC_HOST_ARGS_FLAG_FROM_HOST 0x01 324/* 325 * Args are from EC. Data area at EC_LPC_ADDR_HOST_PARAM contains response. 326 * 327 * If EC responds to a command and this flag is not set, this is an old-style 328 * response. Command version is 0 and response data from EC is at 329 * EC_LPC_ADDR_OLD_PARAM with unknown length. 330 */ 331#define EC_HOST_ARGS_FLAG_TO_HOST 0x02 332 333/*****************************************************************************/ 334/* 335 * Byte codes returned by EC over SPI interface. 336 * 337 * These can be used by the AP to debug the EC interface, and to determine 338 * when the EC is not in a state where it will ever get around to responding 339 * to the AP. 340 * 341 * Example of sequence of bytes read from EC for a current good transfer: 342 * 1. - - AP asserts chip select (CS#) 343 * 2. EC_SPI_OLD_READY - AP sends first byte(s) of request 344 * 3. - - EC starts handling CS# interrupt 345 * 4. EC_SPI_RECEIVING - AP sends remaining byte(s) of request 346 * 5. EC_SPI_PROCESSING - EC starts processing request; AP is clocking in 347 * bytes looking for EC_SPI_FRAME_START 348 * 6. - - EC finishes processing and sets up response 349 * 7. EC_SPI_FRAME_START - AP reads frame byte 350 * 8. (response packet) - AP reads response packet 351 * 9. EC_SPI_PAST_END - Any additional bytes read by AP 352 * 10 - - AP deasserts chip select 353 * 11 - - EC processes CS# interrupt and sets up DMA for 354 * next request 355 * 356 * If the AP is waiting for EC_SPI_FRAME_START and sees any value other than 357 * the following byte values: 358 * EC_SPI_OLD_READY 359 * EC_SPI_RX_READY 360 * EC_SPI_RECEIVING 361 * EC_SPI_PROCESSING 362 * 363 * Then the EC found an error in the request, or was not ready for the request 364 * and lost data. The AP should give up waiting for EC_SPI_FRAME_START, 365 * because the EC is unable to tell when the AP is done sending its request. 366 */ 367 368/* 369 * Framing byte which precedes a response packet from the EC. After sending a 370 * request, the AP will clock in bytes until it sees the framing byte, then 371 * clock in the response packet. 372 */ 373#define EC_SPI_FRAME_START 0xec 374 375/* 376 * Padding bytes which are clocked out after the end of a response packet. 377 */ 378#define EC_SPI_PAST_END 0xed 379 380/* 381 * EC is ready to receive, and has ignored the byte sent by the AP. EC expects 382 * that the AP will send a valid packet header (starting with 383 * EC_COMMAND_PROTOCOL_3) in the next 32 bytes. 384 */ 385#define EC_SPI_RX_READY 0xf8 386 387/* 388 * EC has started receiving the request from the AP, but hasn't started 389 * processing it yet. 390 */ 391#define EC_SPI_RECEIVING 0xf9 392 393/* EC has received the entire request from the AP and is processing it. */ 394#define EC_SPI_PROCESSING 0xfa 395 396/* 397 * EC received bad data from the AP, such as a packet header with an invalid 398 * length. EC will ignore all data until chip select deasserts. 399 */ 400#define EC_SPI_RX_BAD_DATA 0xfb 401 402/* 403 * EC received data from the AP before it was ready. That is, the AP asserted 404 * chip select and started clocking data before the EC was ready to receive it. 405 * EC will ignore all data until chip select deasserts. 406 */ 407#define EC_SPI_NOT_READY 0xfc 408 409/* 410 * EC was ready to receive a request from the AP. EC has treated the byte sent 411 * by the AP as part of a request packet, or (for old-style ECs) is processing 412 * a fully received packet but is not ready to respond yet. 413 */ 414#define EC_SPI_OLD_READY 0xfd 415 416/*****************************************************************************/ 417 418/* 419 * Protocol version 2 for I2C and SPI send a request this way: 420 * 421 * 0 EC_CMD_VERSION0 + (command version) 422 * 1 Command number 423 * 2 Length of params = N 424 * 3..N+2 Params, if any 425 * N+3 8-bit checksum of bytes 0..N+2 426 * 427 * The corresponding response is: 428 * 429 * 0 Result code (EC_RES_*) 430 * 1 Length of params = M 431 * 2..M+1 Params, if any 432 * M+2 8-bit checksum of bytes 0..M+1 433 */ 434#define EC_PROTO2_REQUEST_HEADER_BYTES 3 435#define EC_PROTO2_REQUEST_TRAILER_BYTES 1 436#define EC_PROTO2_REQUEST_OVERHEAD (EC_PROTO2_REQUEST_HEADER_BYTES + \ 437 EC_PROTO2_REQUEST_TRAILER_BYTES) 438 439#define EC_PROTO2_RESPONSE_HEADER_BYTES 2 440#define EC_PROTO2_RESPONSE_TRAILER_BYTES 1 441#define EC_PROTO2_RESPONSE_OVERHEAD (EC_PROTO2_RESPONSE_HEADER_BYTES + \ 442 EC_PROTO2_RESPONSE_TRAILER_BYTES) 443 444/* Parameter length was limited by the LPC interface */ 445#define EC_PROTO2_MAX_PARAM_SIZE 0xfc 446 447/* Maximum request and response packet sizes for protocol version 2 */ 448#define EC_PROTO2_MAX_REQUEST_SIZE (EC_PROTO2_REQUEST_OVERHEAD + \ 449 EC_PROTO2_MAX_PARAM_SIZE) 450#define EC_PROTO2_MAX_RESPONSE_SIZE (EC_PROTO2_RESPONSE_OVERHEAD + \ 451 EC_PROTO2_MAX_PARAM_SIZE) 452 453/*****************************************************************************/ 454 455/* 456 * Value written to legacy command port / prefix byte to indicate protocol 457 * 3+ structs are being used. Usage is bus-dependent. 458 */ 459#define EC_COMMAND_PROTOCOL_3 0xda 460 461#define EC_HOST_REQUEST_VERSION 3 462 463/* Version 3 request from host */ 464struct ec_host_request { 465 /* Struct version (=3) 466 * 467 * EC will return EC_RES_INVALID_HEADER if it receives a header with a 468 * version it doesn't know how to parse. 469 */ 470 uint8_t struct_version; 471 472 /* 473 * Checksum of request and data; sum of all bytes including checksum 474 * should total to 0. 475 */ 476 uint8_t checksum; 477 478 /* Command code */ 479 uint16_t command; 480 481 /* Command version */ 482 uint8_t command_version; 483 484 /* Unused byte in current protocol version; set to 0 */ 485 uint8_t reserved; 486 487 /* Length of data which follows this header */ 488 uint16_t data_len; 489} __packed; 490 491#define EC_HOST_RESPONSE_VERSION 3 492 493/* Version 3 response from EC */ 494struct ec_host_response { 495 /* Struct version (=3) */ 496 uint8_t struct_version; 497 498 /* 499 * Checksum of response and data; sum of all bytes including checksum 500 * should total to 0. 501 */ 502 uint8_t checksum; 503 504 /* Result code (EC_RES_*) */ 505 uint16_t result; 506 507 /* Length of data which follows this header */ 508 uint16_t data_len; 509 510 /* Unused bytes in current protocol version; set to 0 */ 511 uint16_t reserved; 512} __packed; 513 514/*****************************************************************************/ 515/* 516 * Notes on commands: 517 * 518 * Each command is an 8-byte command value. Commands which take params or 519 * return response data specify structs for that data. If no struct is 520 * specified, the command does not input or output data, respectively. 521 * Parameter/response length is implicit in the structs. Some underlying 522 * communication protocols (I2C, SPI) may add length or checksum headers, but 523 * those are implementation-dependent and not defined here. 524 */ 525 526/*****************************************************************************/ 527/* General / test commands */ 528 529/* 530 * Get protocol version, used to deal with non-backward compatible protocol 531 * changes. 532 */ 533#define EC_CMD_PROTO_VERSION 0x00 534 535struct ec_response_proto_version { 536 uint32_t version; 537} __packed; 538 539/* 540 * Hello. This is a simple command to test the EC is responsive to 541 * commands. 542 */ 543#define EC_CMD_HELLO 0x01 544 545struct ec_params_hello { 546 uint32_t in_data; /* Pass anything here */ 547} __packed; 548 549struct ec_response_hello { 550 uint32_t out_data; /* Output will be in_data + 0x01020304 */ 551} __packed; 552 553/* Get version number */ 554#define EC_CMD_GET_VERSION 0x02 555 556enum ec_current_image { 557 EC_IMAGE_UNKNOWN = 0, 558 EC_IMAGE_RO, 559 EC_IMAGE_RW 560}; 561 562struct ec_response_get_version { 563 /* Null-terminated version strings for RO, RW */ 564 char version_string_ro[32]; 565 char version_string_rw[32]; 566 char reserved[32]; /* Was previously RW-B string */ 567 uint32_t current_image; /* One of ec_current_image */ 568} __packed; 569 570/* Read test */ 571#define EC_CMD_READ_TEST 0x03 572 573struct ec_params_read_test { 574 uint32_t offset; /* Starting value for read buffer */ 575 uint32_t size; /* Size to read in bytes */ 576} __packed; 577 578struct ec_response_read_test { 579 uint32_t data[32]; 580} __packed; 581 582/* 583 * Get build information 584 * 585 * Response is null-terminated string. 586 */ 587#define EC_CMD_GET_BUILD_INFO 0x04 588 589/* Get chip info */ 590#define EC_CMD_GET_CHIP_INFO 0x05 591 592struct ec_response_get_chip_info { 593 /* Null-terminated strings */ 594 char vendor[32]; 595 char name[32]; 596 char revision[32]; /* Mask version */ 597} __packed; 598 599/* Get board HW version */ 600#define EC_CMD_GET_BOARD_VERSION 0x06 601 602struct ec_response_board_version { 603 uint16_t board_version; /* A monotonously incrementing number. */ 604} __packed; 605 606/* 607 * Read memory-mapped data. 608 * 609 * This is an alternate interface to memory-mapped data for bus protocols 610 * which don't support direct-mapped memory - I2C, SPI, etc. 611 * 612 * Response is params.size bytes of data. 613 */ 614#define EC_CMD_READ_MEMMAP 0x07 615 616struct ec_params_read_memmap { 617 uint8_t offset; /* Offset in memmap (EC_MEMMAP_*) */ 618 uint8_t size; /* Size to read in bytes */ 619} __packed; 620 621/* Read versions supported for a command */ 622#define EC_CMD_GET_CMD_VERSIONS 0x08 623 624struct ec_params_get_cmd_versions { 625 uint8_t cmd; /* Command to check */ 626} __packed; 627 628struct ec_response_get_cmd_versions { 629 /* 630 * Mask of supported versions; use EC_VER_MASK() to compare with a 631 * desired version. 632 */ 633 uint32_t version_mask; 634} __packed; 635 636/* 637 * Check EC communcations status (busy). This is needed on i2c/spi but not 638 * on lpc since it has its own out-of-band busy indicator. 639 * 640 * lpc must read the status from the command register. Attempting this on 641 * lpc will overwrite the args/parameter space and corrupt its data. 642 */ 643#define EC_CMD_GET_COMMS_STATUS 0x09 644 645/* Avoid using ec_status which is for return values */ 646enum ec_comms_status { 647 EC_COMMS_STATUS_PROCESSING = 1 << 0, /* Processing cmd */ 648}; 649 650struct ec_response_get_comms_status { 651 uint32_t flags; /* Mask of enum ec_comms_status */ 652} __packed; 653 654/* Fake a variety of responses, purely for testing purposes. */ 655#define EC_CMD_TEST_PROTOCOL 0x0a 656 657/* Tell the EC what to send back to us. */ 658struct ec_params_test_protocol { 659 uint32_t ec_result; 660 uint32_t ret_len; 661 uint8_t buf[32]; 662} __packed; 663 664/* Here it comes... */ 665struct ec_response_test_protocol { 666 uint8_t buf[32]; 667} __packed; 668 669/* Get prococol information */ 670#define EC_CMD_GET_PROTOCOL_INFO 0x0b 671 672/* Flags for ec_response_get_protocol_info.flags */ 673/* EC_RES_IN_PROGRESS may be returned if a command is slow */ 674#define EC_PROTOCOL_INFO_IN_PROGRESS_SUPPORTED (1 << 0) 675 676struct ec_response_get_protocol_info { 677 /* Fields which exist if at least protocol version 3 supported */ 678 679 /* Bitmask of protocol versions supported (1 << n means version n)*/ 680 uint32_t protocol_versions; 681 682 /* Maximum request packet size, in bytes */ 683 uint16_t max_request_packet_size; 684 685 /* Maximum response packet size, in bytes */ 686 uint16_t max_response_packet_size; 687 688 /* Flags; see EC_PROTOCOL_INFO_* */ 689 uint32_t flags; 690} __packed; 691 692 693/*****************************************************************************/ 694/* Get/Set miscellaneous values */ 695 696/* The upper byte of .flags tells what to do (nothing means "get") */ 697#define EC_GSV_SET 0x80000000 698 699/* The lower three bytes of .flags identifies the parameter, if that has 700 meaning for an individual command. */ 701#define EC_GSV_PARAM_MASK 0x00ffffff 702 703struct ec_params_get_set_value { 704 uint32_t flags; 705 uint32_t value; 706} __packed; 707 708struct ec_response_get_set_value { 709 uint32_t flags; 710 uint32_t value; 711} __packed; 712 713/* More than one command can use these structs to get/set paramters. */ 714#define EC_CMD_GSV_PAUSE_IN_S5 0x0c 715 716 717/*****************************************************************************/ 718/* Flash commands */ 719 720/* Get flash info */ 721#define EC_CMD_FLASH_INFO 0x10 722 723/* Version 0 returns these fields */ 724struct ec_response_flash_info { 725 /* Usable flash size, in bytes */ 726 uint32_t flash_size; 727 /* 728 * Write block size. Write offset and size must be a multiple 729 * of this. 730 */ 731 uint32_t write_block_size; 732 /* 733 * Erase block size. Erase offset and size must be a multiple 734 * of this. 735 */ 736 uint32_t erase_block_size; 737 /* 738 * Protection block size. Protection offset and size must be a 739 * multiple of this. 740 */ 741 uint32_t protect_block_size; 742} __packed; 743 744/* Flags for version 1+ flash info command */ 745/* EC flash erases bits to 0 instead of 1 */ 746#define EC_FLASH_INFO_ERASE_TO_0 (1 << 0) 747 748/* 749 * Version 1 returns the same initial fields as version 0, with additional 750 * fields following. 751 * 752 * gcc anonymous structs don't seem to get along with the __packed directive; 753 * if they did we'd define the version 0 struct as a sub-struct of this one. 754 */ 755struct ec_response_flash_info_1 { 756 /* Version 0 fields; see above for description */ 757 uint32_t flash_size; 758 uint32_t write_block_size; 759 uint32_t erase_block_size; 760 uint32_t protect_block_size; 761 762 /* Version 1 adds these fields: */ 763 /* 764 * Ideal write size in bytes. Writes will be fastest if size is 765 * exactly this and offset is a multiple of this. For example, an EC 766 * may have a write buffer which can do half-page operations if data is 767 * aligned, and a slower word-at-a-time write mode. 768 */ 769 uint32_t write_ideal_size; 770 771 /* Flags; see EC_FLASH_INFO_* */ 772 uint32_t flags; 773} __packed; 774 775/* 776 * Read flash 777 * 778 * Response is params.size bytes of data. 779 */ 780#define EC_CMD_FLASH_READ 0x11 781 782struct ec_params_flash_read { 783 uint32_t offset; /* Byte offset to read */ 784 uint32_t size; /* Size to read in bytes */ 785} __packed; 786 787/* Write flash */ 788#define EC_CMD_FLASH_WRITE 0x12 789#define EC_VER_FLASH_WRITE 1 790 791/* Version 0 of the flash command supported only 64 bytes of data */ 792#define EC_FLASH_WRITE_VER0_SIZE 64 793 794struct ec_params_flash_write { 795 uint32_t offset; /* Byte offset to write */ 796 uint32_t size; /* Size to write in bytes */ 797 /* Followed by data to write */ 798} __packed; 799 800/* Erase flash */ 801#define EC_CMD_FLASH_ERASE 0x13 802 803struct ec_params_flash_erase { 804 uint32_t offset; /* Byte offset to erase */ 805 uint32_t size; /* Size to erase in bytes */ 806} __packed; 807 808/* 809 * Get/set flash protection. 810 * 811 * If mask!=0, sets/clear the requested bits of flags. Depending on the 812 * firmware write protect GPIO, not all flags will take effect immediately; 813 * some flags require a subsequent hard reset to take effect. Check the 814 * returned flags bits to see what actually happened. 815 * 816 * If mask=0, simply returns the current flags state. 817 */ 818#define EC_CMD_FLASH_PROTECT 0x15 819#define EC_VER_FLASH_PROTECT 1 /* Command version 1 */ 820 821/* Flags for flash protection */ 822/* RO flash code protected when the EC boots */ 823#define EC_FLASH_PROTECT_RO_AT_BOOT (1 << 0) 824/* 825 * RO flash code protected now. If this bit is set, at-boot status cannot 826 * be changed. 827 */ 828#define EC_FLASH_PROTECT_RO_NOW (1 << 1) 829/* Entire flash code protected now, until reboot. */ 830#define EC_FLASH_PROTECT_ALL_NOW (1 << 2) 831/* Flash write protect GPIO is asserted now */ 832#define EC_FLASH_PROTECT_GPIO_ASSERTED (1 << 3) 833/* Error - at least one bank of flash is stuck locked, and cannot be unlocked */ 834#define EC_FLASH_PROTECT_ERROR_STUCK (1 << 4) 835/* 836 * Error - flash protection is in inconsistent state. At least one bank of 837 * flash which should be protected is not protected. Usually fixed by 838 * re-requesting the desired flags, or by a hard reset if that fails. 839 */ 840#define EC_FLASH_PROTECT_ERROR_INCONSISTENT (1 << 5) 841/* Entile flash code protected when the EC boots */ 842#define EC_FLASH_PROTECT_ALL_AT_BOOT (1 << 6) 843 844struct ec_params_flash_protect { 845 uint32_t mask; /* Bits in flags to apply */ 846 uint32_t flags; /* New flags to apply */ 847} __packed; 848 849struct ec_response_flash_protect { 850 /* Current value of flash protect flags */ 851 uint32_t flags; 852 /* 853 * Flags which are valid on this platform. This allows the caller 854 * to distinguish between flags which aren't set vs. flags which can't 855 * be set on this platform. 856 */ 857 uint32_t valid_flags; 858 /* Flags which can be changed given the current protection state */ 859 uint32_t writable_flags; 860} __packed; 861 862/* 863 * Note: commands 0x14 - 0x19 version 0 were old commands to get/set flash 864 * write protect. These commands may be reused with version > 0. 865 */ 866 867/* Get the region offset/size */ 868#define EC_CMD_FLASH_REGION_INFO 0x16 869#define EC_VER_FLASH_REGION_INFO 1 870 871enum ec_flash_region { 872 /* Region which holds read-only EC image */ 873 EC_FLASH_REGION_RO = 0, 874 /* Region which holds rewritable EC image */ 875 EC_FLASH_REGION_RW, 876 /* 877 * Region which should be write-protected in the factory (a superset of 878 * EC_FLASH_REGION_RO) 879 */ 880 EC_FLASH_REGION_WP_RO, 881 /* Number of regions */ 882 EC_FLASH_REGION_COUNT, 883}; 884 885struct ec_params_flash_region_info { 886 uint32_t region; /* enum ec_flash_region */ 887} __packed; 888 889struct ec_response_flash_region_info { 890 uint32_t offset; 891 uint32_t size; 892} __packed; 893 894/* Read/write VbNvContext */ 895#define EC_CMD_VBNV_CONTEXT 0x17 896#define EC_VER_VBNV_CONTEXT 1 897#define EC_VBNV_BLOCK_SIZE 16 898 899enum ec_vbnvcontext_op { 900 EC_VBNV_CONTEXT_OP_READ, 901 EC_VBNV_CONTEXT_OP_WRITE, 902}; 903 904struct ec_params_vbnvcontext { 905 uint32_t op; 906 uint8_t block[EC_VBNV_BLOCK_SIZE]; 907} __packed; 908 909struct ec_response_vbnvcontext { 910 uint8_t block[EC_VBNV_BLOCK_SIZE]; 911} __packed; 912 913/*****************************************************************************/ 914/* PWM commands */ 915 916/* Get fan target RPM */ 917#define EC_CMD_PWM_GET_FAN_TARGET_RPM 0x20 918 919struct ec_response_pwm_get_fan_rpm { 920 uint32_t rpm; 921} __packed; 922 923/* Set target fan RPM */ 924#define EC_CMD_PWM_SET_FAN_TARGET_RPM 0x21 925 926struct ec_params_pwm_set_fan_target_rpm { 927 uint32_t rpm; 928} __packed; 929 930/* Get keyboard backlight */ 931#define EC_CMD_PWM_GET_KEYBOARD_BACKLIGHT 0x22 932 933struct ec_response_pwm_get_keyboard_backlight { 934 uint8_t percent; 935 uint8_t enabled; 936} __packed; 937 938/* Set keyboard backlight */ 939#define EC_CMD_PWM_SET_KEYBOARD_BACKLIGHT 0x23 940 941struct ec_params_pwm_set_keyboard_backlight { 942 uint8_t percent; 943} __packed; 944 945/* Set target fan PWM duty cycle */ 946#define EC_CMD_PWM_SET_FAN_DUTY 0x24 947 948struct ec_params_pwm_set_fan_duty { 949 uint32_t percent; 950} __packed; 951 952/*****************************************************************************/ 953/* 954 * Lightbar commands. This looks worse than it is. Since we only use one HOST 955 * command to say "talk to the lightbar", we put the "and tell it to do X" part 956 * into a subcommand. We'll make separate structs for subcommands with 957 * different input args, so that we know how much to expect. 958 */ 959#define EC_CMD_LIGHTBAR_CMD 0x28 960 961struct rgb_s { 962 uint8_t r, g, b; 963}; 964 965#define LB_BATTERY_LEVELS 4 966/* List of tweakable parameters. NOTE: It's __packed so it can be sent in a 967 * host command, but the alignment is the same regardless. Keep it that way. 968 */ 969struct lightbar_params { 970 /* Timing */ 971 int32_t google_ramp_up; 972 int32_t google_ramp_down; 973 int32_t s3s0_ramp_up; 974 int32_t s0_tick_delay[2]; /* AC=0/1 */ 975 int32_t s0a_tick_delay[2]; /* AC=0/1 */ 976 int32_t s0s3_ramp_down; 977 int32_t s3_sleep_for; 978 int32_t s3_ramp_up; 979 int32_t s3_ramp_down; 980 981 /* Oscillation */ 982 uint8_t new_s0; 983 uint8_t osc_min[2]; /* AC=0/1 */ 984 uint8_t osc_max[2]; /* AC=0/1 */ 985 uint8_t w_ofs[2]; /* AC=0/1 */ 986 987 /* Brightness limits based on the backlight and AC. */ 988 uint8_t bright_bl_off_fixed[2]; /* AC=0/1 */ 989 uint8_t bright_bl_on_min[2]; /* AC=0/1 */ 990 uint8_t bright_bl_on_max[2]; /* AC=0/1 */ 991 992 /* Battery level thresholds */ 993 uint8_t battery_threshold[LB_BATTERY_LEVELS - 1]; 994 995 /* Map [AC][battery_level] to color index */ 996 uint8_t s0_idx[2][LB_BATTERY_LEVELS]; /* AP is running */ 997 uint8_t s3_idx[2][LB_BATTERY_LEVELS]; /* AP is sleeping */ 998 999 /* Color palette */ 1000 struct rgb_s color[8]; /* 0-3 are Google colors */ 1001} __packed; 1002 1003struct ec_params_lightbar { 1004 uint8_t cmd; /* Command (see enum lightbar_command) */ 1005 union { 1006 struct { 1007 /* no args */ 1008 } dump, off, on, init, get_seq, get_params, version; 1009 1010 struct num { 1011 uint8_t num; 1012 } brightness, seq, demo; 1013 1014 struct reg { 1015 uint8_t ctrl, reg, value; 1016 } reg; 1017 1018 struct rgb { 1019 uint8_t led, red, green, blue; 1020 } rgb; 1021 1022 struct lightbar_params set_params; 1023 }; 1024} __packed; 1025 1026struct ec_response_lightbar { 1027 union { 1028 struct dump { 1029 struct { 1030 uint8_t reg; 1031 uint8_t ic0; 1032 uint8_t ic1; 1033 } vals[23]; 1034 } dump; 1035 1036 struct get_seq { 1037 uint8_t num; 1038 } get_seq; 1039 1040 struct lightbar_params get_params; 1041 1042 struct version { 1043 uint32_t num; 1044 uint32_t flags; 1045 } version; 1046 1047 struct { 1048 /* no return params */ 1049 } off, on, init, brightness, seq, reg, rgb, demo, set_params; 1050 }; 1051} __packed; 1052 1053/* Lightbar commands */ 1054enum lightbar_command { 1055 LIGHTBAR_CMD_DUMP = 0, 1056 LIGHTBAR_CMD_OFF = 1, 1057 LIGHTBAR_CMD_ON = 2, 1058 LIGHTBAR_CMD_INIT = 3, 1059 LIGHTBAR_CMD_BRIGHTNESS = 4, 1060 LIGHTBAR_CMD_SEQ = 5, 1061 LIGHTBAR_CMD_REG = 6, 1062 LIGHTBAR_CMD_RGB = 7, 1063 LIGHTBAR_CMD_GET_SEQ = 8, 1064 LIGHTBAR_CMD_DEMO = 9, 1065 LIGHTBAR_CMD_GET_PARAMS = 10, 1066 LIGHTBAR_CMD_SET_PARAMS = 11, 1067 LIGHTBAR_CMD_VERSION = 12, 1068 LIGHTBAR_NUM_CMDS 1069}; 1070 1071/*****************************************************************************/ 1072/* LED control commands */ 1073 1074#define EC_CMD_LED_CONTROL 0x29 1075 1076enum ec_led_id { 1077 /* LED to indicate battery state of charge */ 1078 EC_LED_ID_BATTERY_LED = 0, 1079 /* 1080 * LED to indicate system power state (on or in suspend). 1081 * May be on power button or on C-panel. 1082 */ 1083 EC_LED_ID_POWER_LED, 1084 /* LED on power adapter or its plug */ 1085 EC_LED_ID_ADAPTER_LED, 1086 1087 EC_LED_ID_COUNT 1088}; 1089 1090/* LED control flags */ 1091#define EC_LED_FLAGS_QUERY (1 << 0) /* Query LED capability only */ 1092#define EC_LED_FLAGS_AUTO (1 << 1) /* Switch LED back to automatic control */ 1093 1094enum ec_led_colors { 1095 EC_LED_COLOR_RED = 0, 1096 EC_LED_COLOR_GREEN, 1097 EC_LED_COLOR_BLUE, 1098 EC_LED_COLOR_YELLOW, 1099 EC_LED_COLOR_WHITE, 1100 1101 EC_LED_COLOR_COUNT 1102}; 1103 1104struct ec_params_led_control { 1105 uint8_t led_id; /* Which LED to control */ 1106 uint8_t flags; /* Control flags */ 1107 1108 uint8_t brightness[EC_LED_COLOR_COUNT]; 1109} __packed; 1110 1111struct ec_response_led_control { 1112 /* 1113 * Available brightness value range. 1114 * 1115 * Range 0 means color channel not present. 1116 * Range 1 means on/off control. 1117 * Other values means the LED is control by PWM. 1118 */ 1119 uint8_t brightness_range[EC_LED_COLOR_COUNT]; 1120} __packed; 1121 1122/*****************************************************************************/ 1123/* Verified boot commands */ 1124 1125/* 1126 * Note: command code 0x29 version 0 was VBOOT_CMD in Link EVT; it may be 1127 * reused for other purposes with version > 0. 1128 */ 1129 1130/* Verified boot hash command */ 1131#define EC_CMD_VBOOT_HASH 0x2A 1132 1133struct ec_params_vboot_hash { 1134 uint8_t cmd; /* enum ec_vboot_hash_cmd */ 1135 uint8_t hash_type; /* enum ec_vboot_hash_type */ 1136 uint8_t nonce_size; /* Nonce size; may be 0 */ 1137 uint8_t reserved0; /* Reserved; set 0 */ 1138 uint32_t offset; /* Offset in flash to hash */ 1139 uint32_t size; /* Number of bytes to hash */ 1140 uint8_t nonce_data[64]; /* Nonce data; ignored if nonce_size=0 */ 1141} __packed; 1142 1143struct ec_response_vboot_hash { 1144 uint8_t status; /* enum ec_vboot_hash_status */ 1145 uint8_t hash_type; /* enum ec_vboot_hash_type */ 1146 uint8_t digest_size; /* Size of hash digest in bytes */ 1147 uint8_t reserved0; /* Ignore; will be 0 */ 1148 uint32_t offset; /* Offset in flash which was hashed */ 1149 uint32_t size; /* Number of bytes hashed */ 1150 uint8_t hash_digest[64]; /* Hash digest data */ 1151} __packed; 1152 1153enum ec_vboot_hash_cmd { 1154 EC_VBOOT_HASH_GET = 0, /* Get current hash status */ 1155 EC_VBOOT_HASH_ABORT = 1, /* Abort calculating current hash */ 1156 EC_VBOOT_HASH_START = 2, /* Start computing a new hash */ 1157 EC_VBOOT_HASH_RECALC = 3, /* Synchronously compute a new hash */ 1158}; 1159 1160enum ec_vboot_hash_type { 1161 EC_VBOOT_HASH_TYPE_SHA256 = 0, /* SHA-256 */ 1162}; 1163 1164enum ec_vboot_hash_status { 1165 EC_VBOOT_HASH_STATUS_NONE = 0, /* No hash (not started, or aborted) */ 1166 EC_VBOOT_HASH_STATUS_DONE = 1, /* Finished computing a hash */ 1167 EC_VBOOT_HASH_STATUS_BUSY = 2, /* Busy computing a hash */ 1168}; 1169 1170/* 1171 * Special values for offset for EC_VBOOT_HASH_START and EC_VBOOT_HASH_RECALC. 1172 * If one of these is specified, the EC will automatically update offset and 1173 * size to the correct values for the specified image (RO or RW). 1174 */ 1175#define EC_VBOOT_HASH_OFFSET_RO 0xfffffffe 1176#define EC_VBOOT_HASH_OFFSET_RW 0xfffffffd 1177 1178/*****************************************************************************/ 1179/* 1180 * Motion sense commands. We'll make separate structs for sub-commands with 1181 * different input args, so that we know how much to expect. 1182 */ 1183#define EC_CMD_MOTION_SENSE_CMD 0x2B 1184 1185/* Motion sense commands */ 1186enum motionsense_command { 1187 /* 1188 * Dump command returns all motion sensor data including motion sense 1189 * module flags and individual sensor flags. 1190 */ 1191 MOTIONSENSE_CMD_DUMP = 0, 1192 1193 /* 1194 * Info command returns data describing the details of a given sensor, 1195 * including enum motionsensor_type, enum motionsensor_location, and 1196 * enum motionsensor_chip. 1197 */ 1198 MOTIONSENSE_CMD_INFO = 1, 1199 1200 /* 1201 * EC Rate command is a setter/getter command for the EC sampling rate 1202 * of all motion sensors in milliseconds. 1203 */ 1204 MOTIONSENSE_CMD_EC_RATE = 2, 1205 1206 /* 1207 * Sensor ODR command is a setter/getter command for the output data 1208 * rate of a specific motion sensor in millihertz. 1209 */ 1210 MOTIONSENSE_CMD_SENSOR_ODR = 3, 1211 1212 /* 1213 * Sensor range command is a setter/getter command for the range of 1214 * a specified motion sensor in +/-G's or +/- deg/s. 1215 */ 1216 MOTIONSENSE_CMD_SENSOR_RANGE = 4, 1217 1218 /* 1219 * Setter/getter command for the keyboard wake angle. When the lid 1220 * angle is greater than this value, keyboard wake is disabled in S3, 1221 * and when the lid angle goes less than this value, keyboard wake is 1222 * enabled. Note, the lid angle measurement is an approximate, 1223 * un-calibrated value, hence the wake angle isn't exact. 1224 */ 1225 MOTIONSENSE_CMD_KB_WAKE_ANGLE = 5, 1226 1227 /* Number of motionsense sub-commands. */ 1228 MOTIONSENSE_NUM_CMDS 1229}; 1230 1231enum motionsensor_id { 1232 EC_MOTION_SENSOR_ACCEL_BASE = 0, 1233 EC_MOTION_SENSOR_ACCEL_LID = 1, 1234 EC_MOTION_SENSOR_GYRO = 2, 1235 1236 /* 1237 * Note, if more sensors are added and this count changes, the padding 1238 * in ec_response_motion_sense dump command must be modified. 1239 */ 1240 EC_MOTION_SENSOR_COUNT = 3 1241}; 1242 1243/* List of motion sensor types. */ 1244enum motionsensor_type { 1245 MOTIONSENSE_TYPE_ACCEL = 0, 1246 MOTIONSENSE_TYPE_GYRO = 1, 1247}; 1248 1249/* List of motion sensor locations. */ 1250enum motionsensor_location { 1251 MOTIONSENSE_LOC_BASE = 0, 1252 MOTIONSENSE_LOC_LID = 1, 1253}; 1254 1255/* List of motion sensor chips. */ 1256enum motionsensor_chip { 1257 MOTIONSENSE_CHIP_KXCJ9 = 0, 1258}; 1259 1260/* Module flag masks used for the dump sub-command. */ 1261#define MOTIONSENSE_MODULE_FLAG_ACTIVE (1<<0) 1262 1263/* Sensor flag masks used for the dump sub-command. */ 1264#define MOTIONSENSE_SENSOR_FLAG_PRESENT (1<<0) 1265 1266/* 1267 * Send this value for the data element to only perform a read. If you 1268 * send any other value, the EC will interpret it as data to set and will 1269 * return the actual value set. 1270 */ 1271#define EC_MOTION_SENSE_NO_VALUE -1 1272 1273struct ec_params_motion_sense { 1274 uint8_t cmd; 1275 union { 1276 /* Used for MOTIONSENSE_CMD_DUMP. */ 1277 struct { 1278 /* no args */ 1279 } dump; 1280 1281 /* 1282 * Used for MOTIONSENSE_CMD_EC_RATE and 1283 * MOTIONSENSE_CMD_KB_WAKE_ANGLE. 1284 */ 1285 struct { 1286 /* Data to set or EC_MOTION_SENSE_NO_VALUE to read. */ 1287 int16_t data; 1288 } ec_rate, kb_wake_angle; 1289 1290 /* Used for MOTIONSENSE_CMD_INFO. */ 1291 struct { 1292 /* Should be element of enum motionsensor_id. */ 1293 uint8_t sensor_num; 1294 } info; 1295 1296 /* 1297 * Used for MOTIONSENSE_CMD_SENSOR_ODR and 1298 * MOTIONSENSE_CMD_SENSOR_RANGE. 1299 */ 1300 struct { 1301 /* Should be element of enum motionsensor_id. */ 1302 uint8_t sensor_num; 1303 1304 /* Rounding flag, true for round-up, false for down. */ 1305 uint8_t roundup; 1306 1307 uint16_t reserved; 1308 1309 /* Data to set or EC_MOTION_SENSE_NO_VALUE to read. */ 1310 int32_t data; 1311 } sensor_odr, sensor_range; 1312 }; 1313} __packed; 1314 1315struct ec_response_motion_sense { 1316 union { 1317 /* Used for MOTIONSENSE_CMD_DUMP. */ 1318 struct { 1319 /* Flags representing the motion sensor module. */ 1320 uint8_t module_flags; 1321 1322 /* Flags for each sensor in enum motionsensor_id. */ 1323 uint8_t sensor_flags[EC_MOTION_SENSOR_COUNT]; 1324 1325 /* Array of all sensor data. Each sensor is 3-axis. */ 1326 int16_t data[3*EC_MOTION_SENSOR_COUNT]; 1327 } dump; 1328 1329 /* Used for MOTIONSENSE_CMD_INFO. */ 1330 struct { 1331 /* Should be element of enum motionsensor_type. */ 1332 uint8_t type; 1333 1334 /* Should be element of enum motionsensor_location. */ 1335 uint8_t location; 1336 1337 /* Should be element of enum motionsensor_chip. */ 1338 uint8_t chip; 1339 } info; 1340 1341 /* 1342 * Used for MOTIONSENSE_CMD_EC_RATE, MOTIONSENSE_CMD_SENSOR_ODR, 1343 * MOTIONSENSE_CMD_SENSOR_RANGE, and 1344 * MOTIONSENSE_CMD_KB_WAKE_ANGLE. 1345 */ 1346 struct { 1347 /* Current value of the parameter queried. */ 1348 int32_t ret; 1349 } ec_rate, sensor_odr, sensor_range, kb_wake_angle; 1350 }; 1351} __packed; 1352 1353/*****************************************************************************/ 1354/* USB charging control commands */ 1355 1356/* Set USB port charging mode */ 1357#define EC_CMD_USB_CHARGE_SET_MODE 0x30 1358 1359struct ec_params_usb_charge_set_mode { 1360 uint8_t usb_port_id; 1361 uint8_t mode; 1362} __packed; 1363 1364/*****************************************************************************/ 1365/* Persistent storage for host */ 1366 1367/* Maximum bytes that can be read/written in a single command */ 1368#define EC_PSTORE_SIZE_MAX 64 1369 1370/* Get persistent storage info */ 1371#define EC_CMD_PSTORE_INFO 0x40 1372 1373struct ec_response_pstore_info { 1374 /* Persistent storage size, in bytes */ 1375 uint32_t pstore_size; 1376 /* Access size; read/write offset and size must be a multiple of this */ 1377 uint32_t access_size; 1378} __packed; 1379 1380/* 1381 * Read persistent storage 1382 * 1383 * Response is params.size bytes of data. 1384 */ 1385#define EC_CMD_PSTORE_READ 0x41 1386 1387struct ec_params_pstore_read { 1388 uint32_t offset; /* Byte offset to read */ 1389 uint32_t size; /* Size to read in bytes */ 1390} __packed; 1391 1392/* Write persistent storage */ 1393#define EC_CMD_PSTORE_WRITE 0x42 1394 1395struct ec_params_pstore_write { 1396 uint32_t offset; /* Byte offset to write */ 1397 uint32_t size; /* Size to write in bytes */ 1398 uint8_t data[EC_PSTORE_SIZE_MAX]; 1399} __packed; 1400 1401/*****************************************************************************/ 1402/* Real-time clock */ 1403 1404/* RTC params and response structures */ 1405struct ec_params_rtc { 1406 uint32_t time; 1407} __packed; 1408 1409struct ec_response_rtc { 1410 uint32_t time; 1411} __packed; 1412 1413/* These use ec_response_rtc */ 1414#define EC_CMD_RTC_GET_VALUE 0x44 1415#define EC_CMD_RTC_GET_ALARM 0x45 1416 1417/* These all use ec_params_rtc */ 1418#define EC_CMD_RTC_SET_VALUE 0x46 1419#define EC_CMD_RTC_SET_ALARM 0x47 1420 1421/*****************************************************************************/ 1422/* Port80 log access */ 1423 1424/* Get last port80 code from previous boot */ 1425#define EC_CMD_PORT80_LAST_BOOT 0x48 1426 1427struct ec_response_port80_last_boot { 1428 uint16_t code; 1429} __packed; 1430 1431/*****************************************************************************/ 1432/* Thermal engine commands. Note that there are two implementations. We'll 1433 * reuse the command number, but the data and behavior is incompatible. 1434 * Version 0 is what originally shipped on Link. 1435 * Version 1 separates the CPU thermal limits from the fan control. 1436 */ 1437 1438#define EC_CMD_THERMAL_SET_THRESHOLD 0x50 1439#define EC_CMD_THERMAL_GET_THRESHOLD 0x51 1440 1441/* The version 0 structs are opaque. You have to know what they are for 1442 * the get/set commands to make any sense. 1443 */ 1444 1445/* Version 0 - set */ 1446struct ec_params_thermal_set_threshold { 1447 uint8_t sensor_type; 1448 uint8_t threshold_id; 1449 uint16_t value; 1450} __packed; 1451 1452/* Version 0 - get */ 1453struct ec_params_thermal_get_threshold { 1454 uint8_t sensor_type; 1455 uint8_t threshold_id; 1456} __packed; 1457 1458struct ec_response_thermal_get_threshold { 1459 uint16_t value; 1460} __packed; 1461 1462 1463/* The version 1 structs are visible. */ 1464enum ec_temp_thresholds { 1465 EC_TEMP_THRESH_WARN = 0, 1466 EC_TEMP_THRESH_HIGH, 1467 EC_TEMP_THRESH_HALT, 1468 1469 EC_TEMP_THRESH_COUNT 1470}; 1471 1472/* Thermal configuration for one temperature sensor. Temps are in degrees K. 1473 * Zero values will be silently ignored by the thermal task. 1474 */ 1475struct ec_thermal_config { 1476 uint32_t temp_host[EC_TEMP_THRESH_COUNT]; /* levels of hotness */ 1477 uint32_t temp_fan_off; /* no active cooling needed */ 1478 uint32_t temp_fan_max; /* max active cooling needed */ 1479} __packed; 1480 1481/* Version 1 - get config for one sensor. */ 1482struct ec_params_thermal_get_threshold_v1 { 1483 uint32_t sensor_num; 1484} __packed; 1485/* This returns a struct ec_thermal_config */ 1486 1487/* Version 1 - set config for one sensor. 1488 * Use read-modify-write for best results! */ 1489struct ec_params_thermal_set_threshold_v1 { 1490 uint32_t sensor_num; 1491 struct ec_thermal_config cfg; 1492} __packed; 1493/* This returns no data */ 1494 1495/****************************************************************************/ 1496 1497/* Toggle automatic fan control */ 1498#define EC_CMD_THERMAL_AUTO_FAN_CTRL 0x52 1499 1500/* Get TMP006 calibration data */ 1501#define EC_CMD_TMP006_GET_CALIBRATION 0x53 1502 1503struct ec_params_tmp006_get_calibration { 1504 uint8_t index; 1505} __packed; 1506 1507struct ec_response_tmp006_get_calibration { 1508 float s0; 1509 float b0; 1510 float b1; 1511 float b2; 1512} __packed; 1513 1514/* Set TMP006 calibration data */ 1515#define EC_CMD_TMP006_SET_CALIBRATION 0x54 1516 1517struct ec_params_tmp006_set_calibration { 1518 uint8_t index; 1519 uint8_t reserved[3]; /* Reserved; set 0 */ 1520 float s0; 1521 float b0; 1522 float b1; 1523 float b2; 1524} __packed; 1525 1526/* Read raw TMP006 data */ 1527#define EC_CMD_TMP006_GET_RAW 0x55 1528 1529struct ec_params_tmp006_get_raw { 1530 uint8_t index; 1531} __packed; 1532 1533struct ec_response_tmp006_get_raw { 1534 int32_t t; /* In 1/100 K */ 1535 int32_t v; /* In nV */ 1536}; 1537 1538/*****************************************************************************/ 1539/* MKBP - Matrix KeyBoard Protocol */ 1540 1541/* 1542 * Read key state 1543 * 1544 * Returns raw data for keyboard cols; see ec_response_mkbp_info.cols for 1545 * expected response size. 1546 */ 1547#define EC_CMD_MKBP_STATE 0x60 1548 1549/* Provide information about the matrix : number of rows and columns */ 1550#define EC_CMD_MKBP_INFO 0x61 1551 1552struct ec_response_mkbp_info { 1553 uint32_t rows; 1554 uint32_t cols; 1555 uint8_t switches; 1556} __packed; 1557 1558/* Simulate key press */ 1559#define EC_CMD_MKBP_SIMULATE_KEY 0x62 1560 1561struct ec_params_mkbp_simulate_key { 1562 uint8_t col; 1563 uint8_t row; 1564 uint8_t pressed; 1565} __packed; 1566 1567/* Configure keyboard scanning */ 1568#define EC_CMD_MKBP_SET_CONFIG 0x64 1569#define EC_CMD_MKBP_GET_CONFIG 0x65 1570 1571/* flags */ 1572enum mkbp_config_flags { 1573 EC_MKBP_FLAGS_ENABLE = 1, /* Enable keyboard scanning */ 1574}; 1575 1576enum mkbp_config_valid { 1577 EC_MKBP_VALID_SCAN_PERIOD = 1 << 0, 1578 EC_MKBP_VALID_POLL_TIMEOUT = 1 << 1, 1579 EC_MKBP_VALID_MIN_POST_SCAN_DELAY = 1 << 3, 1580 EC_MKBP_VALID_OUTPUT_SETTLE = 1 << 4, 1581 EC_MKBP_VALID_DEBOUNCE_DOWN = 1 << 5, 1582 EC_MKBP_VALID_DEBOUNCE_UP = 1 << 6, 1583 EC_MKBP_VALID_FIFO_MAX_DEPTH = 1 << 7, 1584}; 1585 1586/* Configuration for our key scanning algorithm */ 1587struct ec_mkbp_config { 1588 uint32_t valid_mask; /* valid fields */ 1589 uint8_t flags; /* some flags (enum mkbp_config_flags) */ 1590 uint8_t valid_flags; /* which flags are valid */ 1591 uint16_t scan_period_us; /* period between start of scans */ 1592 /* revert to interrupt mode after no activity for this long */ 1593 uint32_t poll_timeout_us; 1594 /* 1595 * minimum post-scan relax time. Once we finish a scan we check 1596 * the time until we are due to start the next one. If this time is 1597 * shorter this field, we use this instead. 1598 */ 1599 uint16_t min_post_scan_delay_us; 1600 /* delay between setting up output and waiting for it to settle */ 1601 uint16_t output_settle_us; 1602 uint16_t debounce_down_us; /* time for debounce on key down */ 1603 uint16_t debounce_up_us; /* time for debounce on key up */ 1604 /* maximum depth to allow for fifo (0 = no keyscan output) */ 1605 uint8_t fifo_max_depth; 1606} __packed; 1607 1608struct ec_params_mkbp_set_config { 1609 struct ec_mkbp_config config; 1610} __packed; 1611 1612struct ec_response_mkbp_get_config { 1613 struct ec_mkbp_config config; 1614} __packed; 1615 1616/* Run the key scan emulation */ 1617#define EC_CMD_KEYSCAN_SEQ_CTRL 0x66 1618 1619enum ec_keyscan_seq_cmd { 1620 EC_KEYSCAN_SEQ_STATUS = 0, /* Get status information */ 1621 EC_KEYSCAN_SEQ_CLEAR = 1, /* Clear sequence */ 1622 EC_KEYSCAN_SEQ_ADD = 2, /* Add item to sequence */ 1623 EC_KEYSCAN_SEQ_START = 3, /* Start running sequence */ 1624 EC_KEYSCAN_SEQ_COLLECT = 4, /* Collect sequence summary data */ 1625}; 1626 1627enum ec_collect_flags { 1628 /* 1629 * Indicates this scan was processed by the EC. Due to timing, some 1630 * scans may be skipped. 1631 */ 1632 EC_KEYSCAN_SEQ_FLAG_DONE = 1 << 0, 1633}; 1634 1635struct ec_collect_item { 1636 uint8_t flags; /* some flags (enum ec_collect_flags) */ 1637}; 1638 1639struct ec_params_keyscan_seq_ctrl { 1640 uint8_t cmd; /* Command to send (enum ec_keyscan_seq_cmd) */ 1641 union { 1642 struct { 1643 uint8_t active; /* still active */ 1644 uint8_t num_items; /* number of items */ 1645 /* Current item being presented */ 1646 uint8_t cur_item; 1647 } status; 1648 struct { 1649 /* 1650 * Absolute time for this scan, measured from the 1651 * start of the sequence. 1652 */ 1653 uint32_t time_us; 1654 uint8_t scan[0]; /* keyscan data */ 1655 } add; 1656 struct { 1657 uint8_t start_item; /* First item to return */ 1658 uint8_t num_items; /* Number of items to return */ 1659 } collect; 1660 }; 1661} __packed; 1662 1663struct ec_result_keyscan_seq_ctrl { 1664 union { 1665 struct { 1666 uint8_t num_items; /* Number of items */ 1667 /* Data for each item */ 1668 struct ec_collect_item item[0]; 1669 } collect; 1670 }; 1671} __packed; 1672 1673/*****************************************************************************/ 1674/* Temperature sensor commands */ 1675 1676/* Read temperature sensor info */ 1677#define EC_CMD_TEMP_SENSOR_GET_INFO 0x70 1678 1679struct ec_params_temp_sensor_get_info { 1680 uint8_t id; 1681} __packed; 1682 1683struct ec_response_temp_sensor_get_info { 1684 char sensor_name[32]; 1685 uint8_t sensor_type; 1686} __packed; 1687 1688/*****************************************************************************/ 1689 1690/* 1691 * Note: host commands 0x80 - 0x87 are reserved to avoid conflict with ACPI 1692 * commands accidentally sent to the wrong interface. See the ACPI section 1693 * below. 1694 */ 1695 1696/*****************************************************************************/ 1697/* Host event commands */ 1698 1699/* 1700 * Host event mask params and response structures, shared by all of the host 1701 * event commands below. 1702 */ 1703struct ec_params_host_event_mask { 1704 uint32_t mask; 1705} __packed; 1706 1707struct ec_response_host_event_mask { 1708 uint32_t mask; 1709} __packed; 1710 1711/* These all use ec_response_host_event_mask */ 1712#define EC_CMD_HOST_EVENT_GET_B 0x87 1713#define EC_CMD_HOST_EVENT_GET_SMI_MASK 0x88 1714#define EC_CMD_HOST_EVENT_GET_SCI_MASK 0x89 1715#define EC_CMD_HOST_EVENT_GET_WAKE_MASK 0x8d 1716 1717/* These all use ec_params_host_event_mask */ 1718#define EC_CMD_HOST_EVENT_SET_SMI_MASK 0x8a 1719#define EC_CMD_HOST_EVENT_SET_SCI_MASK 0x8b 1720#define EC_CMD_HOST_EVENT_CLEAR 0x8c 1721#define EC_CMD_HOST_EVENT_SET_WAKE_MASK 0x8e 1722#define EC_CMD_HOST_EVENT_CLEAR_B 0x8f 1723 1724/*****************************************************************************/ 1725/* Switch commands */ 1726 1727/* Enable/disable LCD backlight */ 1728#define EC_CMD_SWITCH_ENABLE_BKLIGHT 0x90 1729 1730struct ec_params_switch_enable_backlight { 1731 uint8_t enabled; 1732} __packed; 1733 1734/* Enable/disable WLAN/Bluetooth */ 1735#define EC_CMD_SWITCH_ENABLE_WIRELESS 0x91 1736#define EC_VER_SWITCH_ENABLE_WIRELESS 1 1737 1738/* Version 0 params; no response */ 1739struct ec_params_switch_enable_wireless_v0 { 1740 uint8_t enabled; 1741} __packed; 1742 1743/* Version 1 params */ 1744struct ec_params_switch_enable_wireless_v1 { 1745 /* Flags to enable now */ 1746 uint8_t now_flags; 1747 1748 /* Which flags to copy from now_flags */ 1749 uint8_t now_mask; 1750 1751 /* 1752 * Flags to leave enabled in S3, if they're on at the S0->S3 1753 * transition. (Other flags will be disabled by the S0->S3 1754 * transition.) 1755 */ 1756 uint8_t suspend_flags; 1757 1758 /* Which flags to copy from suspend_flags */ 1759 uint8_t suspend_mask; 1760} __packed; 1761 1762/* Version 1 response */ 1763struct ec_response_switch_enable_wireless_v1 { 1764 /* Flags to enable now */ 1765 uint8_t now_flags; 1766 1767 /* Flags to leave enabled in S3 */ 1768 uint8_t suspend_flags; 1769} __packed; 1770 1771/*****************************************************************************/ 1772/* GPIO commands. Only available on EC if write protect has been disabled. */ 1773 1774/* Set GPIO output value */ 1775#define EC_CMD_GPIO_SET 0x92 1776 1777struct ec_params_gpio_set { 1778 char name[32]; 1779 uint8_t val; 1780} __packed; 1781 1782/* Get GPIO value */ 1783#define EC_CMD_GPIO_GET 0x93 1784 1785struct ec_params_gpio_get { 1786 char name[32]; 1787} __packed; 1788struct ec_response_gpio_get { 1789 uint8_t val; 1790} __packed; 1791 1792/*****************************************************************************/ 1793/* I2C commands. Only available when flash write protect is unlocked. */ 1794 1795/* 1796 * TODO(crosbug.com/p/23570): These commands are deprecated, and will be 1797 * removed soon. Use EC_CMD_I2C_XFER instead. 1798 */ 1799 1800/* Read I2C bus */ 1801#define EC_CMD_I2C_READ 0x94 1802 1803struct ec_params_i2c_read { 1804 uint16_t addr; /* 8-bit address (7-bit shifted << 1) */ 1805 uint8_t read_size; /* Either 8 or 16. */ 1806 uint8_t port; 1807 uint8_t offset; 1808} __packed; 1809struct ec_response_i2c_read { 1810 uint16_t data; 1811} __packed; 1812 1813/* Write I2C bus */ 1814#define EC_CMD_I2C_WRITE 0x95 1815 1816struct ec_params_i2c_write { 1817 uint16_t data; 1818 uint16_t addr; /* 8-bit address (7-bit shifted << 1) */ 1819 uint8_t write_size; /* Either 8 or 16. */ 1820 uint8_t port; 1821 uint8_t offset; 1822} __packed; 1823 1824/*****************************************************************************/ 1825/* Charge state commands. Only available when flash write protect unlocked. */ 1826 1827/* Force charge state machine to stop charging the battery or force it to 1828 * discharge the battery. 1829 */ 1830#define EC_CMD_CHARGE_CONTROL 0x96 1831#define EC_VER_CHARGE_CONTROL 1 1832 1833enum ec_charge_control_mode { 1834 CHARGE_CONTROL_NORMAL = 0, 1835 CHARGE_CONTROL_IDLE, 1836 CHARGE_CONTROL_DISCHARGE, 1837}; 1838 1839struct ec_params_charge_control { 1840 uint32_t mode; /* enum charge_control_mode */ 1841} __packed; 1842 1843/*****************************************************************************/ 1844/* Console commands. Only available when flash write protect is unlocked. */ 1845 1846/* Snapshot console output buffer for use by EC_CMD_CONSOLE_READ. */ 1847#define EC_CMD_CONSOLE_SNAPSHOT 0x97 1848 1849/* 1850 * Read next chunk of data from saved snapshot. 1851 * 1852 * Response is null-terminated string. Empty string, if there is no more 1853 * remaining output. 1854 */ 1855#define EC_CMD_CONSOLE_READ 0x98 1856 1857/*****************************************************************************/ 1858 1859/* 1860 * Cut off battery power output if the battery supports. 1861 * 1862 * For unsupported battery, just don't implement this command and lets EC 1863 * return EC_RES_INVALID_COMMAND. 1864 */ 1865#define EC_CMD_BATTERY_CUT_OFF 0x99 1866 1867/*****************************************************************************/ 1868/* USB port mux control. */ 1869 1870/* 1871 * Switch USB mux or return to automatic switching. 1872 */ 1873#define EC_CMD_USB_MUX 0x9a 1874 1875struct ec_params_usb_mux { 1876 uint8_t mux; 1877} __packed; 1878 1879/*****************************************************************************/ 1880/* LDOs / FETs control. */ 1881 1882enum ec_ldo_state { 1883 EC_LDO_STATE_OFF = 0, /* the LDO / FET is shut down */ 1884 EC_LDO_STATE_ON = 1, /* the LDO / FET is ON / providing power */ 1885}; 1886 1887/* 1888 * Switch on/off a LDO. 1889 */ 1890#define EC_CMD_LDO_SET 0x9b 1891 1892struct ec_params_ldo_set { 1893 uint8_t index; 1894 uint8_t state; 1895} __packed; 1896 1897/* 1898 * Get LDO state. 1899 */ 1900#define EC_CMD_LDO_GET 0x9c 1901 1902struct ec_params_ldo_get { 1903 uint8_t index; 1904} __packed; 1905 1906struct ec_response_ldo_get { 1907 uint8_t state; 1908} __packed; 1909 1910/*****************************************************************************/ 1911/* Power info. */ 1912 1913/* 1914 * Get power info. 1915 */ 1916#define EC_CMD_POWER_INFO 0x9d 1917 1918struct ec_response_power_info { 1919 uint32_t usb_dev_type; 1920 uint16_t voltage_ac; 1921 uint16_t voltage_system; 1922 uint16_t current_system; 1923 uint16_t usb_current_limit; 1924} __packed; 1925 1926/*****************************************************************************/ 1927/* I2C passthru command */ 1928 1929#define EC_CMD_I2C_PASSTHRU 0x9e 1930 1931/* Read data; if not present, message is a write */ 1932#define EC_I2C_FLAG_READ (1 << 15) 1933 1934/* Mask for address */ 1935#define EC_I2C_ADDR_MASK 0x3ff 1936 1937#define EC_I2C_STATUS_NAK (1 << 0) /* Transfer was not acknowledged */ 1938#define EC_I2C_STATUS_TIMEOUT (1 << 1) /* Timeout during transfer */ 1939 1940/* Any error */ 1941#define EC_I2C_STATUS_ERROR (EC_I2C_STATUS_NAK | EC_I2C_STATUS_TIMEOUT) 1942 1943struct ec_params_i2c_passthru_msg { 1944 uint16_t addr_flags; /* I2C slave address (7 or 10 bits) and flags */ 1945 uint16_t len; /* Number of bytes to read or write */ 1946} __packed; 1947 1948struct ec_params_i2c_passthru { 1949 uint8_t port; /* I2C port number */ 1950 uint8_t num_msgs; /* Number of messages */ 1951 struct ec_params_i2c_passthru_msg msg[]; 1952 /* Data to write for all messages is concatenated here */ 1953} __packed; 1954 1955struct ec_response_i2c_passthru { 1956 uint8_t i2c_status; /* Status flags (EC_I2C_STATUS_...) */ 1957 uint8_t num_msgs; /* Number of messages processed */ 1958 uint8_t data[]; /* Data read by messages concatenated here */ 1959} __packed; 1960 1961/*****************************************************************************/ 1962/* Power button hang detect */ 1963 1964#define EC_CMD_HANG_DETECT 0x9f 1965 1966/* Reasons to start hang detection timer */ 1967/* Power button pressed */ 1968#define EC_HANG_START_ON_POWER_PRESS (1 << 0) 1969 1970/* Lid closed */ 1971#define EC_HANG_START_ON_LID_CLOSE (1 << 1) 1972 1973 /* Lid opened */ 1974#define EC_HANG_START_ON_LID_OPEN (1 << 2) 1975 1976/* Start of AP S3->S0 transition (booting or resuming from suspend) */ 1977#define EC_HANG_START_ON_RESUME (1 << 3) 1978 1979/* Reasons to cancel hang detection */ 1980 1981/* Power button released */ 1982#define EC_HANG_STOP_ON_POWER_RELEASE (1 << 8) 1983 1984/* Any host command from AP received */ 1985#define EC_HANG_STOP_ON_HOST_COMMAND (1 << 9) 1986 1987/* Stop on end of AP S0->S3 transition (suspending or shutting down) */ 1988#define EC_HANG_STOP_ON_SUSPEND (1 << 10) 1989 1990/* 1991 * If this flag is set, all the other fields are ignored, and the hang detect 1992 * timer is started. This provides the AP a way to start the hang timer 1993 * without reconfiguring any of the other hang detect settings. Note that 1994 * you must previously have configured the timeouts. 1995 */ 1996#define EC_HANG_START_NOW (1 << 30) 1997 1998/* 1999 * If this flag is set, all the other fields are ignored (including 2000 * EC_HANG_START_NOW). This provides the AP a way to stop the hang timer 2001 * without reconfiguring any of the other hang detect settings. 2002 */ 2003#define EC_HANG_STOP_NOW (1 << 31) 2004 2005struct ec_params_hang_detect { 2006 /* Flags; see EC_HANG_* */ 2007 uint32_t flags; 2008 2009 /* Timeout in msec before generating host event, if enabled */ 2010 uint16_t host_event_timeout_msec; 2011 2012 /* Timeout in msec before generating warm reboot, if enabled */ 2013 uint16_t warm_reboot_timeout_msec; 2014} __packed; 2015 2016/*****************************************************************************/ 2017/* Commands for battery charging */ 2018 2019/* 2020 * This is the single catch-all host command to exchange data regarding the 2021 * charge state machine (v2 and up). 2022 */ 2023#define EC_CMD_CHARGE_STATE 0xa0 2024 2025/* Subcommands for this host command */ 2026enum charge_state_command { 2027 CHARGE_STATE_CMD_GET_STATE, 2028 CHARGE_STATE_CMD_GET_PARAM, 2029 CHARGE_STATE_CMD_SET_PARAM, 2030 CHARGE_STATE_NUM_CMDS 2031}; 2032 2033/* 2034 * Known param numbers are defined here. Ranges are reserved for board-specific 2035 * params, which are handled by the particular implementations. 2036 */ 2037enum charge_state_params { 2038 CS_PARAM_CHG_VOLTAGE, /* charger voltage limit */ 2039 CS_PARAM_CHG_CURRENT, /* charger current limit */ 2040 CS_PARAM_CHG_INPUT_CURRENT, /* charger input current limit */ 2041 CS_PARAM_CHG_STATUS, /* charger-specific status */ 2042 CS_PARAM_CHG_OPTION, /* charger-specific options */ 2043 /* How many so far? */ 2044 CS_NUM_BASE_PARAMS, 2045 2046 /* Range for CONFIG_CHARGER_PROFILE_OVERRIDE params */ 2047 CS_PARAM_CUSTOM_PROFILE_MIN = 0x10000, 2048 CS_PARAM_CUSTOM_PROFILE_MAX = 0x1ffff, 2049 2050 /* Other custom param ranges go here... */ 2051}; 2052 2053struct ec_params_charge_state { 2054 uint8_t cmd; /* enum charge_state_command */ 2055 union { 2056 struct { 2057 /* no args */ 2058 } get_state; 2059 2060 struct { 2061 uint32_t param; /* enum charge_state_param */ 2062 } get_param; 2063 2064 struct { 2065 uint32_t param; /* param to set */ 2066 uint32_t value; /* value to set */ 2067 } set_param; 2068 }; 2069} __packed; 2070 2071struct ec_response_charge_state { 2072 union { 2073 struct { 2074 int ac; 2075 int chg_voltage; 2076 int chg_current; 2077 int chg_input_current; 2078 int batt_state_of_charge; 2079 } get_state; 2080 2081 struct { 2082 uint32_t value; 2083 } get_param; 2084 struct { 2085 /* no return values */ 2086 } set_param; 2087 }; 2088} __packed; 2089 2090 2091/* 2092 * Set maximum battery charging current. 2093 */ 2094#define EC_CMD_CHARGE_CURRENT_LIMIT 0xa1 2095 2096struct ec_params_current_limit { 2097 uint32_t limit; /* in mA */ 2098} __packed; 2099 2100/* 2101 * Set maximum external power current. 2102 */ 2103#define EC_CMD_EXT_POWER_CURRENT_LIMIT 0xa2 2104 2105struct ec_params_ext_power_current_limit { 2106 uint32_t limit; /* in mA */ 2107} __packed; 2108 2109/*****************************************************************************/ 2110/* Smart battery pass-through */ 2111 2112/* Get / Set 16-bit smart battery registers */ 2113#define EC_CMD_SB_READ_WORD 0xb0 2114#define EC_CMD_SB_WRITE_WORD 0xb1 2115 2116/* Get / Set string smart battery parameters 2117 * formatted as SMBUS "block". 2118 */ 2119#define EC_CMD_SB_READ_BLOCK 0xb2 2120#define EC_CMD_SB_WRITE_BLOCK 0xb3 2121 2122struct ec_params_sb_rd { 2123 uint8_t reg; 2124} __packed; 2125 2126struct ec_response_sb_rd_word { 2127 uint16_t value; 2128} __packed; 2129 2130struct ec_params_sb_wr_word { 2131 uint8_t reg; 2132 uint16_t value; 2133} __packed; 2134 2135struct ec_response_sb_rd_block { 2136 uint8_t data[32]; 2137} __packed; 2138 2139struct ec_params_sb_wr_block { 2140 uint8_t reg; 2141 uint16_t data[32]; 2142} __packed; 2143 2144/*****************************************************************************/ 2145/* System commands */ 2146 2147/* 2148 * TODO(crosbug.com/p/23747): This is a confusing name, since it doesn't 2149 * necessarily reboot the EC. Rename to "image" or something similar? 2150 */ 2151#define EC_CMD_REBOOT_EC 0xd2 2152 2153/* Command */ 2154enum ec_reboot_cmd { 2155 EC_REBOOT_CANCEL = 0, /* Cancel a pending reboot */ 2156 EC_REBOOT_JUMP_RO = 1, /* Jump to RO without rebooting */ 2157 EC_REBOOT_JUMP_RW = 2, /* Jump to RW without rebooting */ 2158 /* (command 3 was jump to RW-B) */ 2159 EC_REBOOT_COLD = 4, /* Cold-reboot */ 2160 EC_REBOOT_DISABLE_JUMP = 5, /* Disable jump until next reboot */ 2161 EC_REBOOT_HIBERNATE = 6 /* Hibernate EC */ 2162}; 2163 2164/* Flags for ec_params_reboot_ec.reboot_flags */ 2165#define EC_REBOOT_FLAG_RESERVED0 (1 << 0) /* Was recovery request */ 2166#define EC_REBOOT_FLAG_ON_AP_SHUTDOWN (1 << 1) /* Reboot after AP shutdown */ 2167 2168struct ec_params_reboot_ec { 2169 uint8_t cmd; /* enum ec_reboot_cmd */ 2170 uint8_t flags; /* See EC_REBOOT_FLAG_* */ 2171} __packed; 2172 2173/* 2174 * Get information on last EC panic. 2175 * 2176 * Returns variable-length platform-dependent panic information. See panic.h 2177 * for details. 2178 */ 2179#define EC_CMD_GET_PANIC_INFO 0xd3 2180 2181/*****************************************************************************/ 2182/* 2183 * ACPI commands 2184 * 2185 * These are valid ONLY on the ACPI command/data port. 2186 */ 2187 2188/* 2189 * ACPI Read Embedded Controller 2190 * 2191 * This reads from ACPI memory space on the EC (EC_ACPI_MEM_*). 2192 * 2193 * Use the following sequence: 2194 * 2195 * - Write EC_CMD_ACPI_READ to EC_LPC_ADDR_ACPI_CMD 2196 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2197 * - Write address to EC_LPC_ADDR_ACPI_DATA 2198 * - Wait for EC_LPC_CMDR_DATA bit to set 2199 * - Read value from EC_LPC_ADDR_ACPI_DATA 2200 */ 2201#define EC_CMD_ACPI_READ 0x80 2202 2203/* 2204 * ACPI Write Embedded Controller 2205 * 2206 * This reads from ACPI memory space on the EC (EC_ACPI_MEM_*). 2207 * 2208 * Use the following sequence: 2209 * 2210 * - Write EC_CMD_ACPI_WRITE to EC_LPC_ADDR_ACPI_CMD 2211 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2212 * - Write address to EC_LPC_ADDR_ACPI_DATA 2213 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2214 * - Write value to EC_LPC_ADDR_ACPI_DATA 2215 */ 2216#define EC_CMD_ACPI_WRITE 0x81 2217 2218/* 2219 * ACPI Query Embedded Controller 2220 * 2221 * This clears the lowest-order bit in the currently pending host events, and 2222 * sets the result code to the 1-based index of the bit (event 0x00000001 = 1, 2223 * event 0x80000000 = 32), or 0 if no event was pending. 2224 */ 2225#define EC_CMD_ACPI_QUERY_EVENT 0x84 2226 2227/* Valid addresses in ACPI memory space, for read/write commands */ 2228 2229/* Memory space version; set to EC_ACPI_MEM_VERSION_CURRENT */ 2230#define EC_ACPI_MEM_VERSION 0x00 2231/* 2232 * Test location; writing value here updates test compliment byte to (0xff - 2233 * value). 2234 */ 2235#define EC_ACPI_MEM_TEST 0x01 2236/* Test compliment; writes here are ignored. */ 2237#define EC_ACPI_MEM_TEST_COMPLIMENT 0x02 2238 2239/* Keyboard backlight brightness percent (0 - 100) */ 2240#define EC_ACPI_MEM_KEYBOARD_BACKLIGHT 0x03 2241/* DPTF Target Fan Duty (0-100, 0xff for auto/none) */ 2242#define EC_ACPI_MEM_FAN_DUTY 0x04 2243 2244/* 2245 * DPTF temp thresholds. Any of the EC's temp sensors can have up to two 2246 * independent thresholds attached to them. The current value of the ID 2247 * register determines which sensor is affected by the THRESHOLD and COMMIT 2248 * registers. The THRESHOLD register uses the same EC_TEMP_SENSOR_OFFSET scheme 2249 * as the memory-mapped sensors. The COMMIT register applies those settings. 2250 * 2251 * The spec does not mandate any way to read back the threshold settings 2252 * themselves, but when a threshold is crossed the AP needs a way to determine 2253 * which sensor(s) are responsible. Each reading of the ID register clears and 2254 * returns one sensor ID that has crossed one of its threshold (in either 2255 * direction) since the last read. A value of 0xFF means "no new thresholds 2256 * have tripped". Setting or enabling the thresholds for a sensor will clear 2257 * the unread event count for that sensor. 2258 */ 2259#define EC_ACPI_MEM_TEMP_ID 0x05 2260#define EC_ACPI_MEM_TEMP_THRESHOLD 0x06 2261#define EC_ACPI_MEM_TEMP_COMMIT 0x07 2262/* 2263 * Here are the bits for the COMMIT register: 2264 * bit 0 selects the threshold index for the chosen sensor (0/1) 2265 * bit 1 enables/disables the selected threshold (0 = off, 1 = on) 2266 * Each write to the commit register affects one threshold. 2267 */ 2268#define EC_ACPI_MEM_TEMP_COMMIT_SELECT_MASK (1 << 0) 2269#define EC_ACPI_MEM_TEMP_COMMIT_ENABLE_MASK (1 << 1) 2270/* 2271 * Example: 2272 * 2273 * Set the thresholds for sensor 2 to 50 C and 60 C: 2274 * write 2 to [0x05] -- select temp sensor 2 2275 * write 0x7b to [0x06] -- C_TO_K(50) - EC_TEMP_SENSOR_OFFSET 2276 * write 0x2 to [0x07] -- enable threshold 0 with this value 2277 * write 0x85 to [0x06] -- C_TO_K(60) - EC_TEMP_SENSOR_OFFSET 2278 * write 0x3 to [0x07] -- enable threshold 1 with this value 2279 * 2280 * Disable the 60 C threshold, leaving the 50 C threshold unchanged: 2281 * write 2 to [0x05] -- select temp sensor 2 2282 * write 0x1 to [0x07] -- disable threshold 1 2283 */ 2284 2285/* DPTF battery charging current limit */ 2286#define EC_ACPI_MEM_CHARGING_LIMIT 0x08 2287 2288/* Charging limit is specified in 64 mA steps */ 2289#define EC_ACPI_MEM_CHARGING_LIMIT_STEP_MA 64 2290/* Value to disable DPTF battery charging limit */ 2291#define EC_ACPI_MEM_CHARGING_LIMIT_DISABLED 0xff 2292 2293/* Current version of ACPI memory address space */ 2294#define EC_ACPI_MEM_VERSION_CURRENT 1 2295 2296 2297/*****************************************************************************/ 2298/* 2299 * Special commands 2300 * 2301 * These do not follow the normal rules for commands. See each command for 2302 * details. 2303 */ 2304 2305/* 2306 * Reboot NOW 2307 * 2308 * This command will work even when the EC LPC interface is busy, because the 2309 * reboot command is processed at interrupt level. Note that when the EC 2310 * reboots, the host will reboot too, so there is no response to this command. 2311 * 2312 * Use EC_CMD_REBOOT_EC to reboot the EC more politely. 2313 */ 2314#define EC_CMD_REBOOT 0xd1 /* Think "die" */ 2315 2316/* 2317 * Resend last response (not supported on LPC). 2318 * 2319 * Returns EC_RES_UNAVAILABLE if there is no response available - for example, 2320 * there was no previous command, or the previous command's response was too 2321 * big to save. 2322 */ 2323#define EC_CMD_RESEND_RESPONSE 0xdb 2324 2325/* 2326 * This header byte on a command indicate version 0. Any header byte less 2327 * than this means that we are talking to an old EC which doesn't support 2328 * versioning. In that case, we assume version 0. 2329 * 2330 * Header bytes greater than this indicate a later version. For example, 2331 * EC_CMD_VERSION0 + 1 means we are using version 1. 2332 * 2333 * The old EC interface must not use commands 0xdc or higher. 2334 */ 2335#define EC_CMD_VERSION0 0xdc 2336 2337#endif /* !__ACPI__ */ 2338 2339/*****************************************************************************/ 2340/* 2341 * Deprecated constants. These constants have been renamed for clarity. The 2342 * meaning and size has not changed. Programs that use the old names should 2343 * switch to the new names soon, as the old names may not be carried forward 2344 * forever. 2345 */ 2346#define EC_HOST_PARAM_SIZE EC_PROTO2_MAX_PARAM_SIZE 2347#define EC_LPC_ADDR_OLD_PARAM EC_HOST_CMD_REGION1 2348#define EC_OLD_PARAM_SIZE EC_HOST_CMD_REGION_SIZE 2349 2350#endif /* __CROS_EC_COMMANDS_H */ 2351