1/* 2 * Host communication command constants for ChromeOS EC 3 * 4 * Copyright (C) 2012 Google, Inc 5 * 6 * This software is licensed under the terms of the GNU General Public 7 * License version 2, as published by the Free Software Foundation, and 8 * may be copied, distributed, and modified under those terms. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * The ChromeOS EC multi function device is used to mux all the requests 16 * to the EC device for its multiple features: keyboard controller, 17 * battery charging and regulator control, firmware update. 18 * 19 * NOTE: This file is copied verbatim from the ChromeOS EC Open Source 20 * project in an attempt to make future updates easy to make. 21 */ 22 23#ifndef __CROS_EC_COMMANDS_H 24#define __CROS_EC_COMMANDS_H 25 26/* 27 * Current version of this protocol 28 * 29 * TODO(crosbug.com/p/11223): This is effectively useless; protocol is 30 * determined in other ways. Remove this once the kernel code no longer 31 * depends on it. 32 */ 33#define EC_PROTO_VERSION 0x00000002 34 35/* Command version mask */ 36#define EC_VER_MASK(version) (1UL << (version)) 37 38/* I/O addresses for ACPI commands */ 39#define EC_LPC_ADDR_ACPI_DATA 0x62 40#define EC_LPC_ADDR_ACPI_CMD 0x66 41 42/* I/O addresses for host command */ 43#define EC_LPC_ADDR_HOST_DATA 0x200 44#define EC_LPC_ADDR_HOST_CMD 0x204 45 46/* I/O addresses for host command args and params */ 47/* Protocol version 2 */ 48#define EC_LPC_ADDR_HOST_ARGS 0x800 /* And 0x801, 0x802, 0x803 */ 49#define EC_LPC_ADDR_HOST_PARAM 0x804 /* For version 2 params; size is 50 * EC_PROTO2_MAX_PARAM_SIZE */ 51/* Protocol version 3 */ 52#define EC_LPC_ADDR_HOST_PACKET 0x800 /* Offset of version 3 packet */ 53#define EC_LPC_HOST_PACKET_SIZE 0x100 /* Max size of version 3 packet */ 54 55/* The actual block is 0x800-0x8ff, but some BIOSes think it's 0x880-0x8ff 56 * and they tell the kernel that so we have to think of it as two parts. */ 57#define EC_HOST_CMD_REGION0 0x800 58#define EC_HOST_CMD_REGION1 0x880 59#define EC_HOST_CMD_REGION_SIZE 0x80 60 61/* EC command register bit functions */ 62#define EC_LPC_CMDR_DATA (1 << 0) /* Data ready for host to read */ 63#define EC_LPC_CMDR_PENDING (1 << 1) /* Write pending to EC */ 64#define EC_LPC_CMDR_BUSY (1 << 2) /* EC is busy processing a command */ 65#define EC_LPC_CMDR_CMD (1 << 3) /* Last host write was a command */ 66#define EC_LPC_CMDR_ACPI_BRST (1 << 4) /* Burst mode (not used) */ 67#define EC_LPC_CMDR_SCI (1 << 5) /* SCI event is pending */ 68#define EC_LPC_CMDR_SMI (1 << 6) /* SMI event is pending */ 69 70#define EC_LPC_ADDR_MEMMAP 0x900 71#define EC_MEMMAP_SIZE 255 /* ACPI IO buffer max is 255 bytes */ 72#define EC_MEMMAP_TEXT_MAX 8 /* Size of a string in the memory map */ 73 74/* The offset address of each type of data in mapped memory. */ 75#define EC_MEMMAP_TEMP_SENSOR 0x00 /* Temp sensors 0x00 - 0x0f */ 76#define EC_MEMMAP_FAN 0x10 /* Fan speeds 0x10 - 0x17 */ 77#define EC_MEMMAP_TEMP_SENSOR_B 0x18 /* More temp sensors 0x18 - 0x1f */ 78#define EC_MEMMAP_ID 0x20 /* 0x20 == 'E', 0x21 == 'C' */ 79#define EC_MEMMAP_ID_VERSION 0x22 /* Version of data in 0x20 - 0x2f */ 80#define EC_MEMMAP_THERMAL_VERSION 0x23 /* Version of data in 0x00 - 0x1f */ 81#define EC_MEMMAP_BATTERY_VERSION 0x24 /* Version of data in 0x40 - 0x7f */ 82#define EC_MEMMAP_SWITCHES_VERSION 0x25 /* Version of data in 0x30 - 0x33 */ 83#define EC_MEMMAP_EVENTS_VERSION 0x26 /* Version of data in 0x34 - 0x3f */ 84#define EC_MEMMAP_HOST_CMD_FLAGS 0x27 /* Host cmd interface flags (8 bits) */ 85/* Unused 0x28 - 0x2f */ 86#define EC_MEMMAP_SWITCHES 0x30 /* 8 bits */ 87/* Unused 0x31 - 0x33 */ 88#define EC_MEMMAP_HOST_EVENTS 0x34 /* 32 bits */ 89/* Reserve 0x38 - 0x3f for additional host event-related stuff */ 90/* Battery values are all 32 bits */ 91#define EC_MEMMAP_BATT_VOLT 0x40 /* Battery Present Voltage */ 92#define EC_MEMMAP_BATT_RATE 0x44 /* Battery Present Rate */ 93#define EC_MEMMAP_BATT_CAP 0x48 /* Battery Remaining Capacity */ 94#define EC_MEMMAP_BATT_FLAG 0x4c /* Battery State, defined below */ 95#define EC_MEMMAP_BATT_DCAP 0x50 /* Battery Design Capacity */ 96#define EC_MEMMAP_BATT_DVLT 0x54 /* Battery Design Voltage */ 97#define EC_MEMMAP_BATT_LFCC 0x58 /* Battery Last Full Charge Capacity */ 98#define EC_MEMMAP_BATT_CCNT 0x5c /* Battery Cycle Count */ 99/* Strings are all 8 bytes (EC_MEMMAP_TEXT_MAX) */ 100#define EC_MEMMAP_BATT_MFGR 0x60 /* Battery Manufacturer String */ 101#define EC_MEMMAP_BATT_MODEL 0x68 /* Battery Model Number String */ 102#define EC_MEMMAP_BATT_SERIAL 0x70 /* Battery Serial Number String */ 103#define EC_MEMMAP_BATT_TYPE 0x78 /* Battery Type String */ 104#define EC_MEMMAP_ALS 0x80 /* ALS readings in lux (2 X 16 bits) */ 105/* Unused 0x84 - 0x8f */ 106#define EC_MEMMAP_ACC_STATUS 0x90 /* Accelerometer status (8 bits )*/ 107/* Unused 0x91 */ 108#define EC_MEMMAP_ACC_DATA 0x92 /* Accelerometer data 0x92 - 0x9f */ 109#define EC_MEMMAP_GYRO_DATA 0xa0 /* Gyroscope data 0xa0 - 0xa5 */ 110/* Unused 0xa6 - 0xfe (remember, 0xff is NOT part of the memmap region) */ 111 112 113/* Define the format of the accelerometer mapped memory status byte. */ 114#define EC_MEMMAP_ACC_STATUS_SAMPLE_ID_MASK 0x0f 115#define EC_MEMMAP_ACC_STATUS_BUSY_BIT (1 << 4) 116#define EC_MEMMAP_ACC_STATUS_PRESENCE_BIT (1 << 7) 117 118/* Number of temp sensors at EC_MEMMAP_TEMP_SENSOR */ 119#define EC_TEMP_SENSOR_ENTRIES 16 120/* 121 * Number of temp sensors at EC_MEMMAP_TEMP_SENSOR_B. 122 * 123 * Valid only if EC_MEMMAP_THERMAL_VERSION returns >= 2. 124 */ 125#define EC_TEMP_SENSOR_B_ENTRIES 8 126 127/* Special values for mapped temperature sensors */ 128#define EC_TEMP_SENSOR_NOT_PRESENT 0xff 129#define EC_TEMP_SENSOR_ERROR 0xfe 130#define EC_TEMP_SENSOR_NOT_POWERED 0xfd 131#define EC_TEMP_SENSOR_NOT_CALIBRATED 0xfc 132/* 133 * The offset of temperature value stored in mapped memory. This allows 134 * reporting a temperature range of 200K to 454K = -73C to 181C. 135 */ 136#define EC_TEMP_SENSOR_OFFSET 200 137 138/* 139 * Number of ALS readings at EC_MEMMAP_ALS 140 */ 141#define EC_ALS_ENTRIES 2 142 143/* 144 * The default value a temperature sensor will return when it is present but 145 * has not been read this boot. This is a reasonable number to avoid 146 * triggering alarms on the host. 147 */ 148#define EC_TEMP_SENSOR_DEFAULT (296 - EC_TEMP_SENSOR_OFFSET) 149 150#define EC_FAN_SPEED_ENTRIES 4 /* Number of fans at EC_MEMMAP_FAN */ 151#define EC_FAN_SPEED_NOT_PRESENT 0xffff /* Entry not present */ 152#define EC_FAN_SPEED_STALLED 0xfffe /* Fan stalled */ 153 154/* Battery bit flags at EC_MEMMAP_BATT_FLAG. */ 155#define EC_BATT_FLAG_AC_PRESENT 0x01 156#define EC_BATT_FLAG_BATT_PRESENT 0x02 157#define EC_BATT_FLAG_DISCHARGING 0x04 158#define EC_BATT_FLAG_CHARGING 0x08 159#define EC_BATT_FLAG_LEVEL_CRITICAL 0x10 160 161/* Switch flags at EC_MEMMAP_SWITCHES */ 162#define EC_SWITCH_LID_OPEN 0x01 163#define EC_SWITCH_POWER_BUTTON_PRESSED 0x02 164#define EC_SWITCH_WRITE_PROTECT_DISABLED 0x04 165/* Was recovery requested via keyboard; now unused. */ 166#define EC_SWITCH_IGNORE1 0x08 167/* Recovery requested via dedicated signal (from servo board) */ 168#define EC_SWITCH_DEDICATED_RECOVERY 0x10 169/* Was fake developer mode switch; now unused. Remove in next refactor. */ 170#define EC_SWITCH_IGNORE0 0x20 171 172/* Host command interface flags */ 173/* Host command interface supports LPC args (LPC interface only) */ 174#define EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED 0x01 175/* Host command interface supports version 3 protocol */ 176#define EC_HOST_CMD_FLAG_VERSION_3 0x02 177 178/* Wireless switch flags */ 179#define EC_WIRELESS_SWITCH_ALL ~0x00 /* All flags */ 180#define EC_WIRELESS_SWITCH_WLAN 0x01 /* WLAN radio */ 181#define EC_WIRELESS_SWITCH_BLUETOOTH 0x02 /* Bluetooth radio */ 182#define EC_WIRELESS_SWITCH_WWAN 0x04 /* WWAN power */ 183#define EC_WIRELESS_SWITCH_WLAN_POWER 0x08 /* WLAN power */ 184 185/* 186 * This header file is used in coreboot both in C and ACPI code. The ACPI code 187 * is pre-processed to handle constants but the ASL compiler is unable to 188 * handle actual C code so keep it separate. 189 */ 190#ifndef __ACPI__ 191 192/* 193 * Define __packed if someone hasn't beat us to it. Linux kernel style 194 * checking prefers __packed over __attribute__((packed)). 195 */ 196#ifndef __packed 197#define __packed __attribute__((packed)) 198#endif 199 200/* LPC command status byte masks */ 201/* EC has written a byte in the data register and host hasn't read it yet */ 202#define EC_LPC_STATUS_TO_HOST 0x01 203/* Host has written a command/data byte and the EC hasn't read it yet */ 204#define EC_LPC_STATUS_FROM_HOST 0x02 205/* EC is processing a command */ 206#define EC_LPC_STATUS_PROCESSING 0x04 207/* Last write to EC was a command, not data */ 208#define EC_LPC_STATUS_LAST_CMD 0x08 209/* EC is in burst mode. Unsupported by Chrome EC, so this bit is never set */ 210#define EC_LPC_STATUS_BURST_MODE 0x10 211/* SCI event is pending (requesting SCI query) */ 212#define EC_LPC_STATUS_SCI_PENDING 0x20 213/* SMI event is pending (requesting SMI query) */ 214#define EC_LPC_STATUS_SMI_PENDING 0x40 215/* (reserved) */ 216#define EC_LPC_STATUS_RESERVED 0x80 217 218/* 219 * EC is busy. This covers both the EC processing a command, and the host has 220 * written a new command but the EC hasn't picked it up yet. 221 */ 222#define EC_LPC_STATUS_BUSY_MASK \ 223 (EC_LPC_STATUS_FROM_HOST | EC_LPC_STATUS_PROCESSING) 224 225/* Host command response codes */ 226enum ec_status { 227 EC_RES_SUCCESS = 0, 228 EC_RES_INVALID_COMMAND = 1, 229 EC_RES_ERROR = 2, 230 EC_RES_INVALID_PARAM = 3, 231 EC_RES_ACCESS_DENIED = 4, 232 EC_RES_INVALID_RESPONSE = 5, 233 EC_RES_INVALID_VERSION = 6, 234 EC_RES_INVALID_CHECKSUM = 7, 235 EC_RES_IN_PROGRESS = 8, /* Accepted, command in progress */ 236 EC_RES_UNAVAILABLE = 9, /* No response available */ 237 EC_RES_TIMEOUT = 10, /* We got a timeout */ 238 EC_RES_OVERFLOW = 11, /* Table / data overflow */ 239 EC_RES_INVALID_HEADER = 12, /* Header contains invalid data */ 240 EC_RES_REQUEST_TRUNCATED = 13, /* Didn't get the entire request */ 241 EC_RES_RESPONSE_TOO_BIG = 14 /* Response was too big to handle */ 242}; 243 244/* 245 * Host event codes. Note these are 1-based, not 0-based, because ACPI query 246 * EC command uses code 0 to mean "no event pending". We explicitly specify 247 * each value in the enum listing so they won't change if we delete/insert an 248 * item or rearrange the list (it needs to be stable across platforms, not 249 * just within a single compiled instance). 250 */ 251enum host_event_code { 252 EC_HOST_EVENT_LID_CLOSED = 1, 253 EC_HOST_EVENT_LID_OPEN = 2, 254 EC_HOST_EVENT_POWER_BUTTON = 3, 255 EC_HOST_EVENT_AC_CONNECTED = 4, 256 EC_HOST_EVENT_AC_DISCONNECTED = 5, 257 EC_HOST_EVENT_BATTERY_LOW = 6, 258 EC_HOST_EVENT_BATTERY_CRITICAL = 7, 259 EC_HOST_EVENT_BATTERY = 8, 260 EC_HOST_EVENT_THERMAL_THRESHOLD = 9, 261 EC_HOST_EVENT_THERMAL_OVERLOAD = 10, 262 EC_HOST_EVENT_THERMAL = 11, 263 EC_HOST_EVENT_USB_CHARGER = 12, 264 EC_HOST_EVENT_KEY_PRESSED = 13, 265 /* 266 * EC has finished initializing the host interface. The host can check 267 * for this event following sending a EC_CMD_REBOOT_EC command to 268 * determine when the EC is ready to accept subsequent commands. 269 */ 270 EC_HOST_EVENT_INTERFACE_READY = 14, 271 /* Keyboard recovery combo has been pressed */ 272 EC_HOST_EVENT_KEYBOARD_RECOVERY = 15, 273 274 /* Shutdown due to thermal overload */ 275 EC_HOST_EVENT_THERMAL_SHUTDOWN = 16, 276 /* Shutdown due to battery level too low */ 277 EC_HOST_EVENT_BATTERY_SHUTDOWN = 17, 278 279 /* Suggest that the AP throttle itself */ 280 EC_HOST_EVENT_THROTTLE_START = 18, 281 /* Suggest that the AP resume normal speed */ 282 EC_HOST_EVENT_THROTTLE_STOP = 19, 283 284 /* Hang detect logic detected a hang and host event timeout expired */ 285 EC_HOST_EVENT_HANG_DETECT = 20, 286 /* Hang detect logic detected a hang and warm rebooted the AP */ 287 EC_HOST_EVENT_HANG_REBOOT = 21, 288 289 /* 290 * The high bit of the event mask is not used as a host event code. If 291 * it reads back as set, then the entire event mask should be 292 * considered invalid by the host. This can happen when reading the 293 * raw event status via EC_MEMMAP_HOST_EVENTS but the LPC interface is 294 * not initialized on the EC, or improperly configured on the host. 295 */ 296 EC_HOST_EVENT_INVALID = 32 297}; 298/* Host event mask */ 299#define EC_HOST_EVENT_MASK(event_code) (1UL << ((event_code) - 1)) 300 301/* Arguments at EC_LPC_ADDR_HOST_ARGS */ 302struct ec_lpc_host_args { 303 uint8_t flags; 304 uint8_t command_version; 305 uint8_t data_size; 306 /* 307 * Checksum; sum of command + flags + command_version + data_size + 308 * all params/response data bytes. 309 */ 310 uint8_t checksum; 311} __packed; 312 313/* Flags for ec_lpc_host_args.flags */ 314/* 315 * Args are from host. Data area at EC_LPC_ADDR_HOST_PARAM contains command 316 * params. 317 * 318 * If EC gets a command and this flag is not set, this is an old-style command. 319 * Command version is 0 and params from host are at EC_LPC_ADDR_OLD_PARAM with 320 * unknown length. EC must respond with an old-style response (that is, 321 * withouth setting EC_HOST_ARGS_FLAG_TO_HOST). 322 */ 323#define EC_HOST_ARGS_FLAG_FROM_HOST 0x01 324/* 325 * Args are from EC. Data area at EC_LPC_ADDR_HOST_PARAM contains response. 326 * 327 * If EC responds to a command and this flag is not set, this is an old-style 328 * response. Command version is 0 and response data from EC is at 329 * EC_LPC_ADDR_OLD_PARAM with unknown length. 330 */ 331#define EC_HOST_ARGS_FLAG_TO_HOST 0x02 332 333/*****************************************************************************/ 334/* 335 * Byte codes returned by EC over SPI interface. 336 * 337 * These can be used by the AP to debug the EC interface, and to determine 338 * when the EC is not in a state where it will ever get around to responding 339 * to the AP. 340 * 341 * Example of sequence of bytes read from EC for a current good transfer: 342 * 1. - - AP asserts chip select (CS#) 343 * 2. EC_SPI_OLD_READY - AP sends first byte(s) of request 344 * 3. - - EC starts handling CS# interrupt 345 * 4. EC_SPI_RECEIVING - AP sends remaining byte(s) of request 346 * 5. EC_SPI_PROCESSING - EC starts processing request; AP is clocking in 347 * bytes looking for EC_SPI_FRAME_START 348 * 6. - - EC finishes processing and sets up response 349 * 7. EC_SPI_FRAME_START - AP reads frame byte 350 * 8. (response packet) - AP reads response packet 351 * 9. EC_SPI_PAST_END - Any additional bytes read by AP 352 * 10 - - AP deasserts chip select 353 * 11 - - EC processes CS# interrupt and sets up DMA for 354 * next request 355 * 356 * If the AP is waiting for EC_SPI_FRAME_START and sees any value other than 357 * the following byte values: 358 * EC_SPI_OLD_READY 359 * EC_SPI_RX_READY 360 * EC_SPI_RECEIVING 361 * EC_SPI_PROCESSING 362 * 363 * Then the EC found an error in the request, or was not ready for the request 364 * and lost data. The AP should give up waiting for EC_SPI_FRAME_START, 365 * because the EC is unable to tell when the AP is done sending its request. 366 */ 367 368/* 369 * Framing byte which precedes a response packet from the EC. After sending a 370 * request, the AP will clock in bytes until it sees the framing byte, then 371 * clock in the response packet. 372 */ 373#define EC_SPI_FRAME_START 0xec 374 375/* 376 * Padding bytes which are clocked out after the end of a response packet. 377 */ 378#define EC_SPI_PAST_END 0xed 379 380/* 381 * EC is ready to receive, and has ignored the byte sent by the AP. EC expects 382 * that the AP will send a valid packet header (starting with 383 * EC_COMMAND_PROTOCOL_3) in the next 32 bytes. 384 */ 385#define EC_SPI_RX_READY 0xf8 386 387/* 388 * EC has started receiving the request from the AP, but hasn't started 389 * processing it yet. 390 */ 391#define EC_SPI_RECEIVING 0xf9 392 393/* EC has received the entire request from the AP and is processing it. */ 394#define EC_SPI_PROCESSING 0xfa 395 396/* 397 * EC received bad data from the AP, such as a packet header with an invalid 398 * length. EC will ignore all data until chip select deasserts. 399 */ 400#define EC_SPI_RX_BAD_DATA 0xfb 401 402/* 403 * EC received data from the AP before it was ready. That is, the AP asserted 404 * chip select and started clocking data before the EC was ready to receive it. 405 * EC will ignore all data until chip select deasserts. 406 */ 407#define EC_SPI_NOT_READY 0xfc 408 409/* 410 * EC was ready to receive a request from the AP. EC has treated the byte sent 411 * by the AP as part of a request packet, or (for old-style ECs) is processing 412 * a fully received packet but is not ready to respond yet. 413 */ 414#define EC_SPI_OLD_READY 0xfd 415 416/*****************************************************************************/ 417 418/* 419 * Protocol version 2 for I2C and SPI send a request this way: 420 * 421 * 0 EC_CMD_VERSION0 + (command version) 422 * 1 Command number 423 * 2 Length of params = N 424 * 3..N+2 Params, if any 425 * N+3 8-bit checksum of bytes 0..N+2 426 * 427 * The corresponding response is: 428 * 429 * 0 Result code (EC_RES_*) 430 * 1 Length of params = M 431 * 2..M+1 Params, if any 432 * M+2 8-bit checksum of bytes 0..M+1 433 */ 434#define EC_PROTO2_REQUEST_HEADER_BYTES 3 435#define EC_PROTO2_REQUEST_TRAILER_BYTES 1 436#define EC_PROTO2_REQUEST_OVERHEAD (EC_PROTO2_REQUEST_HEADER_BYTES + \ 437 EC_PROTO2_REQUEST_TRAILER_BYTES) 438 439#define EC_PROTO2_RESPONSE_HEADER_BYTES 2 440#define EC_PROTO2_RESPONSE_TRAILER_BYTES 1 441#define EC_PROTO2_RESPONSE_OVERHEAD (EC_PROTO2_RESPONSE_HEADER_BYTES + \ 442 EC_PROTO2_RESPONSE_TRAILER_BYTES) 443 444/* Parameter length was limited by the LPC interface */ 445#define EC_PROTO2_MAX_PARAM_SIZE 0xfc 446 447/* Maximum request and response packet sizes for protocol version 2 */ 448#define EC_PROTO2_MAX_REQUEST_SIZE (EC_PROTO2_REQUEST_OVERHEAD + \ 449 EC_PROTO2_MAX_PARAM_SIZE) 450#define EC_PROTO2_MAX_RESPONSE_SIZE (EC_PROTO2_RESPONSE_OVERHEAD + \ 451 EC_PROTO2_MAX_PARAM_SIZE) 452 453/*****************************************************************************/ 454 455/* 456 * Value written to legacy command port / prefix byte to indicate protocol 457 * 3+ structs are being used. Usage is bus-dependent. 458 */ 459#define EC_COMMAND_PROTOCOL_3 0xda 460 461#define EC_HOST_REQUEST_VERSION 3 462 463/* Version 3 request from host */ 464struct ec_host_request { 465 /* Struct version (=3) 466 * 467 * EC will return EC_RES_INVALID_HEADER if it receives a header with a 468 * version it doesn't know how to parse. 469 */ 470 uint8_t struct_version; 471 472 /* 473 * Checksum of request and data; sum of all bytes including checksum 474 * should total to 0. 475 */ 476 uint8_t checksum; 477 478 /* Command code */ 479 uint16_t command; 480 481 /* Command version */ 482 uint8_t command_version; 483 484 /* Unused byte in current protocol version; set to 0 */ 485 uint8_t reserved; 486 487 /* Length of data which follows this header */ 488 uint16_t data_len; 489} __packed; 490 491#define EC_HOST_RESPONSE_VERSION 3 492 493/* Version 3 response from EC */ 494struct ec_host_response { 495 /* Struct version (=3) */ 496 uint8_t struct_version; 497 498 /* 499 * Checksum of response and data; sum of all bytes including checksum 500 * should total to 0. 501 */ 502 uint8_t checksum; 503 504 /* Result code (EC_RES_*) */ 505 uint16_t result; 506 507 /* Length of data which follows this header */ 508 uint16_t data_len; 509 510 /* Unused bytes in current protocol version; set to 0 */ 511 uint16_t reserved; 512} __packed; 513 514/*****************************************************************************/ 515/* 516 * Notes on commands: 517 * 518 * Each command is an 16-bit command value. Commands which take params or 519 * return response data specify structs for that data. If no struct is 520 * specified, the command does not input or output data, respectively. 521 * Parameter/response length is implicit in the structs. Some underlying 522 * communication protocols (I2C, SPI) may add length or checksum headers, but 523 * those are implementation-dependent and not defined here. 524 */ 525 526/*****************************************************************************/ 527/* General / test commands */ 528 529/* 530 * Get protocol version, used to deal with non-backward compatible protocol 531 * changes. 532 */ 533#define EC_CMD_PROTO_VERSION 0x00 534 535struct ec_response_proto_version { 536 uint32_t version; 537} __packed; 538 539/* 540 * Hello. This is a simple command to test the EC is responsive to 541 * commands. 542 */ 543#define EC_CMD_HELLO 0x01 544 545struct ec_params_hello { 546 uint32_t in_data; /* Pass anything here */ 547} __packed; 548 549struct ec_response_hello { 550 uint32_t out_data; /* Output will be in_data + 0x01020304 */ 551} __packed; 552 553/* Get version number */ 554#define EC_CMD_GET_VERSION 0x02 555 556enum ec_current_image { 557 EC_IMAGE_UNKNOWN = 0, 558 EC_IMAGE_RO, 559 EC_IMAGE_RW 560}; 561 562struct ec_response_get_version { 563 /* Null-terminated version strings for RO, RW */ 564 char version_string_ro[32]; 565 char version_string_rw[32]; 566 char reserved[32]; /* Was previously RW-B string */ 567 uint32_t current_image; /* One of ec_current_image */ 568} __packed; 569 570/* Read test */ 571#define EC_CMD_READ_TEST 0x03 572 573struct ec_params_read_test { 574 uint32_t offset; /* Starting value for read buffer */ 575 uint32_t size; /* Size to read in bytes */ 576} __packed; 577 578struct ec_response_read_test { 579 uint32_t data[32]; 580} __packed; 581 582/* 583 * Get build information 584 * 585 * Response is null-terminated string. 586 */ 587#define EC_CMD_GET_BUILD_INFO 0x04 588 589/* Get chip info */ 590#define EC_CMD_GET_CHIP_INFO 0x05 591 592struct ec_response_get_chip_info { 593 /* Null-terminated strings */ 594 char vendor[32]; 595 char name[32]; 596 char revision[32]; /* Mask version */ 597} __packed; 598 599/* Get board HW version */ 600#define EC_CMD_GET_BOARD_VERSION 0x06 601 602struct ec_response_board_version { 603 uint16_t board_version; /* A monotonously incrementing number. */ 604} __packed; 605 606/* 607 * Read memory-mapped data. 608 * 609 * This is an alternate interface to memory-mapped data for bus protocols 610 * which don't support direct-mapped memory - I2C, SPI, etc. 611 * 612 * Response is params.size bytes of data. 613 */ 614#define EC_CMD_READ_MEMMAP 0x07 615 616struct ec_params_read_memmap { 617 uint8_t offset; /* Offset in memmap (EC_MEMMAP_*) */ 618 uint8_t size; /* Size to read in bytes */ 619} __packed; 620 621/* Read versions supported for a command */ 622#define EC_CMD_GET_CMD_VERSIONS 0x08 623 624struct ec_params_get_cmd_versions { 625 uint8_t cmd; /* Command to check */ 626} __packed; 627 628struct ec_response_get_cmd_versions { 629 /* 630 * Mask of supported versions; use EC_VER_MASK() to compare with a 631 * desired version. 632 */ 633 uint32_t version_mask; 634} __packed; 635 636/* 637 * Check EC communcations status (busy). This is needed on i2c/spi but not 638 * on lpc since it has its own out-of-band busy indicator. 639 * 640 * lpc must read the status from the command register. Attempting this on 641 * lpc will overwrite the args/parameter space and corrupt its data. 642 */ 643#define EC_CMD_GET_COMMS_STATUS 0x09 644 645/* Avoid using ec_status which is for return values */ 646enum ec_comms_status { 647 EC_COMMS_STATUS_PROCESSING = 1 << 0, /* Processing cmd */ 648}; 649 650struct ec_response_get_comms_status { 651 uint32_t flags; /* Mask of enum ec_comms_status */ 652} __packed; 653 654/* Fake a variety of responses, purely for testing purposes. */ 655#define EC_CMD_TEST_PROTOCOL 0x0a 656 657/* Tell the EC what to send back to us. */ 658struct ec_params_test_protocol { 659 uint32_t ec_result; 660 uint32_t ret_len; 661 uint8_t buf[32]; 662} __packed; 663 664/* Here it comes... */ 665struct ec_response_test_protocol { 666 uint8_t buf[32]; 667} __packed; 668 669/* Get prococol information */ 670#define EC_CMD_GET_PROTOCOL_INFO 0x0b 671 672/* Flags for ec_response_get_protocol_info.flags */ 673/* EC_RES_IN_PROGRESS may be returned if a command is slow */ 674#define EC_PROTOCOL_INFO_IN_PROGRESS_SUPPORTED (1 << 0) 675 676struct ec_response_get_protocol_info { 677 /* Fields which exist if at least protocol version 3 supported */ 678 679 /* Bitmask of protocol versions supported (1 << n means version n)*/ 680 uint32_t protocol_versions; 681 682 /* Maximum request packet size, in bytes */ 683 uint16_t max_request_packet_size; 684 685 /* Maximum response packet size, in bytes */ 686 uint16_t max_response_packet_size; 687 688 /* Flags; see EC_PROTOCOL_INFO_* */ 689 uint32_t flags; 690} __packed; 691 692 693/*****************************************************************************/ 694/* Get/Set miscellaneous values */ 695 696/* The upper byte of .flags tells what to do (nothing means "get") */ 697#define EC_GSV_SET 0x80000000 698 699/* The lower three bytes of .flags identifies the parameter, if that has 700 meaning for an individual command. */ 701#define EC_GSV_PARAM_MASK 0x00ffffff 702 703struct ec_params_get_set_value { 704 uint32_t flags; 705 uint32_t value; 706} __packed; 707 708struct ec_response_get_set_value { 709 uint32_t flags; 710 uint32_t value; 711} __packed; 712 713/* More than one command can use these structs to get/set paramters. */ 714#define EC_CMD_GSV_PAUSE_IN_S5 0x0c 715 716/*****************************************************************************/ 717/* List the features supported by the firmware */ 718#define EC_CMD_GET_FEATURES 0x0d 719 720/* Supported features */ 721enum ec_feature_code { 722 /* 723 * This image contains a limited set of features. Another image 724 * in RW partition may support more features. 725 */ 726 EC_FEATURE_LIMITED = 0, 727 /* 728 * Commands for probing/reading/writing/erasing the flash in the 729 * EC are present. 730 */ 731 EC_FEATURE_FLASH = 1, 732 /* 733 * Can control the fan speed directly. 734 */ 735 EC_FEATURE_PWM_FAN = 2, 736 /* 737 * Can control the intensity of the keyboard backlight. 738 */ 739 EC_FEATURE_PWM_KEYB = 3, 740 /* 741 * Support Google lightbar, introduced on Pixel. 742 */ 743 EC_FEATURE_LIGHTBAR = 4, 744 /* Control of LEDs */ 745 EC_FEATURE_LED = 5, 746 /* Exposes an interface to control gyro and sensors. 747 * The host goes through the EC to access these sensors. 748 * In addition, the EC may provide composite sensors, like lid angle. 749 */ 750 EC_FEATURE_MOTION_SENSE = 6, 751 /* The keyboard is controlled by the EC */ 752 EC_FEATURE_KEYB = 7, 753 /* The AP can use part of the EC flash as persistent storage. */ 754 EC_FEATURE_PSTORE = 8, 755 /* The EC monitors BIOS port 80h, and can return POST codes. */ 756 EC_FEATURE_PORT80 = 9, 757 /* 758 * Thermal management: include TMP specific commands. 759 * Higher level than direct fan control. 760 */ 761 EC_FEATURE_THERMAL = 10, 762 /* Can switch the screen backlight on/off */ 763 EC_FEATURE_BKLIGHT_SWITCH = 11, 764 /* Can switch the wifi module on/off */ 765 EC_FEATURE_WIFI_SWITCH = 12, 766 /* Monitor host events, through for example SMI or SCI */ 767 EC_FEATURE_HOST_EVENTS = 13, 768 /* The EC exposes GPIO commands to control/monitor connected devices. */ 769 EC_FEATURE_GPIO = 14, 770 /* The EC can send i2c messages to downstream devices. */ 771 EC_FEATURE_I2C = 15, 772 /* Command to control charger are included */ 773 EC_FEATURE_CHARGER = 16, 774 /* Simple battery support. */ 775 EC_FEATURE_BATTERY = 17, 776 /* 777 * Support Smart battery protocol 778 * (Common Smart Battery System Interface Specification) 779 */ 780 EC_FEATURE_SMART_BATTERY = 18, 781 /* EC can dectect when the host hangs. */ 782 EC_FEATURE_HANG_DETECT = 19, 783 /* Report power information, for pit only */ 784 EC_FEATURE_PMU = 20, 785 /* Another Cros EC device is present downstream of this one */ 786 EC_FEATURE_SUB_MCU = 21, 787 /* Support USB Power delivery (PD) commands */ 788 EC_FEATURE_USB_PD = 22, 789 /* Control USB multiplexer, for audio through USB port for instance. */ 790 EC_FEATURE_USB_MUX = 23, 791 /* Motion Sensor code has an internal software FIFO */ 792 EC_FEATURE_MOTION_SENSE_FIFO = 24, 793}; 794 795#define EC_FEATURE_MASK_0(event_code) (1UL << (event_code % 32)) 796#define EC_FEATURE_MASK_1(event_code) (1UL << (event_code - 32)) 797struct ec_response_get_features { 798 uint32_t flags[2]; 799} __packed; 800 801/*****************************************************************************/ 802/* Flash commands */ 803 804/* Get flash info */ 805#define EC_CMD_FLASH_INFO 0x10 806 807/* Version 0 returns these fields */ 808struct ec_response_flash_info { 809 /* Usable flash size, in bytes */ 810 uint32_t flash_size; 811 /* 812 * Write block size. Write offset and size must be a multiple 813 * of this. 814 */ 815 uint32_t write_block_size; 816 /* 817 * Erase block size. Erase offset and size must be a multiple 818 * of this. 819 */ 820 uint32_t erase_block_size; 821 /* 822 * Protection block size. Protection offset and size must be a 823 * multiple of this. 824 */ 825 uint32_t protect_block_size; 826} __packed; 827 828/* Flags for version 1+ flash info command */ 829/* EC flash erases bits to 0 instead of 1 */ 830#define EC_FLASH_INFO_ERASE_TO_0 (1 << 0) 831 832/* 833 * Version 1 returns the same initial fields as version 0, with additional 834 * fields following. 835 * 836 * gcc anonymous structs don't seem to get along with the __packed directive; 837 * if they did we'd define the version 0 struct as a sub-struct of this one. 838 */ 839struct ec_response_flash_info_1 { 840 /* Version 0 fields; see above for description */ 841 uint32_t flash_size; 842 uint32_t write_block_size; 843 uint32_t erase_block_size; 844 uint32_t protect_block_size; 845 846 /* Version 1 adds these fields: */ 847 /* 848 * Ideal write size in bytes. Writes will be fastest if size is 849 * exactly this and offset is a multiple of this. For example, an EC 850 * may have a write buffer which can do half-page operations if data is 851 * aligned, and a slower word-at-a-time write mode. 852 */ 853 uint32_t write_ideal_size; 854 855 /* Flags; see EC_FLASH_INFO_* */ 856 uint32_t flags; 857} __packed; 858 859/* 860 * Read flash 861 * 862 * Response is params.size bytes of data. 863 */ 864#define EC_CMD_FLASH_READ 0x11 865 866struct ec_params_flash_read { 867 uint32_t offset; /* Byte offset to read */ 868 uint32_t size; /* Size to read in bytes */ 869} __packed; 870 871/* Write flash */ 872#define EC_CMD_FLASH_WRITE 0x12 873#define EC_VER_FLASH_WRITE 1 874 875/* Version 0 of the flash command supported only 64 bytes of data */ 876#define EC_FLASH_WRITE_VER0_SIZE 64 877 878struct ec_params_flash_write { 879 uint32_t offset; /* Byte offset to write */ 880 uint32_t size; /* Size to write in bytes */ 881 /* Followed by data to write */ 882} __packed; 883 884/* Erase flash */ 885#define EC_CMD_FLASH_ERASE 0x13 886 887struct ec_params_flash_erase { 888 uint32_t offset; /* Byte offset to erase */ 889 uint32_t size; /* Size to erase in bytes */ 890} __packed; 891 892/* 893 * Get/set flash protection. 894 * 895 * If mask!=0, sets/clear the requested bits of flags. Depending on the 896 * firmware write protect GPIO, not all flags will take effect immediately; 897 * some flags require a subsequent hard reset to take effect. Check the 898 * returned flags bits to see what actually happened. 899 * 900 * If mask=0, simply returns the current flags state. 901 */ 902#define EC_CMD_FLASH_PROTECT 0x15 903#define EC_VER_FLASH_PROTECT 1 /* Command version 1 */ 904 905/* Flags for flash protection */ 906/* RO flash code protected when the EC boots */ 907#define EC_FLASH_PROTECT_RO_AT_BOOT (1 << 0) 908/* 909 * RO flash code protected now. If this bit is set, at-boot status cannot 910 * be changed. 911 */ 912#define EC_FLASH_PROTECT_RO_NOW (1 << 1) 913/* Entire flash code protected now, until reboot. */ 914#define EC_FLASH_PROTECT_ALL_NOW (1 << 2) 915/* Flash write protect GPIO is asserted now */ 916#define EC_FLASH_PROTECT_GPIO_ASSERTED (1 << 3) 917/* Error - at least one bank of flash is stuck locked, and cannot be unlocked */ 918#define EC_FLASH_PROTECT_ERROR_STUCK (1 << 4) 919/* 920 * Error - flash protection is in inconsistent state. At least one bank of 921 * flash which should be protected is not protected. Usually fixed by 922 * re-requesting the desired flags, or by a hard reset if that fails. 923 */ 924#define EC_FLASH_PROTECT_ERROR_INCONSISTENT (1 << 5) 925/* Entile flash code protected when the EC boots */ 926#define EC_FLASH_PROTECT_ALL_AT_BOOT (1 << 6) 927 928struct ec_params_flash_protect { 929 uint32_t mask; /* Bits in flags to apply */ 930 uint32_t flags; /* New flags to apply */ 931} __packed; 932 933struct ec_response_flash_protect { 934 /* Current value of flash protect flags */ 935 uint32_t flags; 936 /* 937 * Flags which are valid on this platform. This allows the caller 938 * to distinguish between flags which aren't set vs. flags which can't 939 * be set on this platform. 940 */ 941 uint32_t valid_flags; 942 /* Flags which can be changed given the current protection state */ 943 uint32_t writable_flags; 944} __packed; 945 946/* 947 * Note: commands 0x14 - 0x19 version 0 were old commands to get/set flash 948 * write protect. These commands may be reused with version > 0. 949 */ 950 951/* Get the region offset/size */ 952#define EC_CMD_FLASH_REGION_INFO 0x16 953#define EC_VER_FLASH_REGION_INFO 1 954 955enum ec_flash_region { 956 /* Region which holds read-only EC image */ 957 EC_FLASH_REGION_RO = 0, 958 /* Region which holds rewritable EC image */ 959 EC_FLASH_REGION_RW, 960 /* 961 * Region which should be write-protected in the factory (a superset of 962 * EC_FLASH_REGION_RO) 963 */ 964 EC_FLASH_REGION_WP_RO, 965 /* Number of regions */ 966 EC_FLASH_REGION_COUNT, 967}; 968 969struct ec_params_flash_region_info { 970 uint32_t region; /* enum ec_flash_region */ 971} __packed; 972 973struct ec_response_flash_region_info { 974 uint32_t offset; 975 uint32_t size; 976} __packed; 977 978/* Read/write VbNvContext */ 979#define EC_CMD_VBNV_CONTEXT 0x17 980#define EC_VER_VBNV_CONTEXT 1 981#define EC_VBNV_BLOCK_SIZE 16 982 983enum ec_vbnvcontext_op { 984 EC_VBNV_CONTEXT_OP_READ, 985 EC_VBNV_CONTEXT_OP_WRITE, 986}; 987 988struct ec_params_vbnvcontext { 989 uint32_t op; 990 uint8_t block[EC_VBNV_BLOCK_SIZE]; 991} __packed; 992 993struct ec_response_vbnvcontext { 994 uint8_t block[EC_VBNV_BLOCK_SIZE]; 995} __packed; 996 997/*****************************************************************************/ 998/* PWM commands */ 999 1000/* Get fan target RPM */
1001#define EC_CMD_PWM_GET_FAN_TARGET_RPM 0x20 1002 1003struct ec_response_pwm_get_fan_rpm { 1004 uint32_t rpm; 1005} __packed; 1006 1007/* Set target fan RPM */ 1008#define EC_CMD_PWM_SET_FAN_TARGET_RPM 0x21 1009 1010struct ec_params_pwm_set_fan_target_rpm { 1011 uint32_t rpm; 1012} __packed; 1013 1014/* Get keyboard backlight */ 1015#define EC_CMD_PWM_GET_KEYBOARD_BACKLIGHT 0x22 1016 1017struct ec_response_pwm_get_keyboard_backlight { 1018 uint8_t percent; 1019 uint8_t enabled; 1020} __packed; 1021 1022/* Set keyboard backlight */ 1023#define EC_CMD_PWM_SET_KEYBOARD_BACKLIGHT 0x23 1024 1025struct ec_params_pwm_set_keyboard_backlight { 1026 uint8_t percent; 1027} __packed; 1028 1029/* Set target fan PWM duty cycle */ 1030#define EC_CMD_PWM_SET_FAN_DUTY 0x24 1031 1032struct ec_params_pwm_set_fan_duty { 1033 uint32_t percent; 1034} __packed; 1035 1036#define EC_CMD_PWM_SET_DUTY 0x25 1037/* 16 bit duty cycle, 0xffff = 100% */ 1038#define EC_PWM_MAX_DUTY 0xffff 1039 1040enum ec_pwm_type { 1041 /* All types, indexed by board-specific enum pwm_channel */ 1042 EC_PWM_TYPE_GENERIC = 0, 1043 /* Keyboard backlight */ 1044 EC_PWM_TYPE_KB_LIGHT, 1045 /* Display backlight */ 1046 EC_PWM_TYPE_DISPLAY_LIGHT, 1047 EC_PWM_TYPE_COUNT, 1048}; 1049 1050struct ec_params_pwm_set_duty { 1051 uint16_t duty; /* Duty cycle, EC_PWM_MAX_DUTY = 100% */ 1052 uint8_t pwm_type; /* ec_pwm_type */ 1053 uint8_t index; /* Type-specific index, or 0 if unique */ 1054} __packed; 1055 1056#define EC_CMD_PWM_GET_DUTY 0x26 1057 1058struct ec_params_pwm_get_duty { 1059 uint8_t pwm_type; /* ec_pwm_type */ 1060 uint8_t index; /* Type-specific index, or 0 if unique */ 1061} __packed; 1062 1063struct ec_response_pwm_get_duty { 1064 uint16_t duty; /* Duty cycle, EC_PWM_MAX_DUTY = 100% */ 1065} __packed; 1066 1067/*****************************************************************************/ 1068/* 1069 * Lightbar commands. This looks worse than it is. Since we only use one HOST 1070 * command to say "talk to the lightbar", we put the "and tell it to do X" part 1071 * into a subcommand. We'll make separate structs for subcommands with 1072 * different input args, so that we know how much to expect. 1073 */ 1074#define EC_CMD_LIGHTBAR_CMD 0x28 1075 1076struct rgb_s { 1077 uint8_t r, g, b; 1078}; 1079 1080#define LB_BATTERY_LEVELS 4 1081/* List of tweakable parameters. NOTE: It's __packed so it can be sent in a 1082 * host command, but the alignment is the same regardless. Keep it that way. 1083 */ 1084struct lightbar_params_v0 { 1085 /* Timing */ 1086 int32_t google_ramp_up; 1087 int32_t google_ramp_down; 1088 int32_t s3s0_ramp_up; 1089 int32_t s0_tick_delay[2]; /* AC=0/1 */ 1090 int32_t s0a_tick_delay[2]; /* AC=0/1 */ 1091 int32_t s0s3_ramp_down; 1092 int32_t s3_sleep_for; 1093 int32_t s3_ramp_up; 1094 int32_t s3_ramp_down; 1095 1096 /* Oscillation */ 1097 uint8_t new_s0; 1098 uint8_t osc_min[2]; /* AC=0/1 */ 1099 uint8_t osc_max[2]; /* AC=0/1 */ 1100 uint8_t w_ofs[2]; /* AC=0/1 */ 1101 1102 /* Brightness limits based on the backlight and AC. */ 1103 uint8_t bright_bl_off_fixed[2]; /* AC=0/1 */ 1104 uint8_t bright_bl_on_min[2]; /* AC=0/1 */ 1105 uint8_t bright_bl_on_max[2]; /* AC=0/1 */ 1106 1107 /* Battery level thresholds */ 1108 uint8_t battery_threshold[LB_BATTERY_LEVELS - 1]; 1109 1110 /* Map [AC][battery_level] to color index */ 1111 uint8_t s0_idx[2][LB_BATTERY_LEVELS]; /* AP is running */ 1112 uint8_t s3_idx[2][LB_BATTERY_LEVELS]; /* AP is sleeping */ 1113 1114 /* Color palette */ 1115 struct rgb_s color[8]; /* 0-3 are Google colors */ 1116} __packed; 1117 1118struct lightbar_params_v1 { 1119 /* Timing */ 1120 int32_t google_ramp_up; 1121 int32_t google_ramp_down; 1122 int32_t s3s0_ramp_up; 1123 int32_t s0_tick_delay[2]; /* AC=0/1 */ 1124 int32_t s0a_tick_delay[2]; /* AC=0/1 */ 1125 int32_t s0s3_ramp_down; 1126 int32_t s3_sleep_for; 1127 int32_t s3_ramp_up; 1128 int32_t s3_ramp_down; 1129 int32_t tap_tick_delay; 1130 int32_t tap_display_time; 1131 1132 /* Tap-for-battery params */ 1133 uint8_t tap_pct_red; 1134 uint8_t tap_pct_green; 1135 uint8_t tap_seg_min_on; 1136 uint8_t tap_seg_max_on; 1137 uint8_t tap_seg_osc; 1138 uint8_t tap_idx[3]; 1139 1140 /* Oscillation */ 1141 uint8_t osc_min[2]; /* AC=0/1 */ 1142 uint8_t osc_max[2]; /* AC=0/1 */ 1143 uint8_t w_ofs[2]; /* AC=0/1 */ 1144 1145 /* Brightness limits based on the backlight and AC. */ 1146 uint8_t bright_bl_off_fixed[2]; /* AC=0/1 */ 1147 uint8_t bright_bl_on_min[2]; /* AC=0/1 */ 1148 uint8_t bright_bl_on_max[2]; /* AC=0/1 */ 1149 1150 /* Battery level thresholds */ 1151 uint8_t battery_threshold[LB_BATTERY_LEVELS - 1]; 1152 1153 /* Map [AC][battery_level] to color index */ 1154 uint8_t s0_idx[2][LB_BATTERY_LEVELS]; /* AP is running */ 1155 uint8_t s3_idx[2][LB_BATTERY_LEVELS]; /* AP is sleeping */ 1156 1157 /* Color palette */ 1158 struct rgb_s color[8]; /* 0-3 are Google colors */ 1159} __packed; 1160 1161struct ec_params_lightbar { 1162 uint8_t cmd; /* Command (see enum lightbar_command) */ 1163 union { 1164 struct { 1165 /* no args */ 1166 } dump, off, on, init, get_seq, get_params_v0, get_params_v1, 1167 version, get_brightness, get_demo; 1168 1169 struct { 1170 uint8_t num; 1171 } set_brightness, seq, demo; 1172 1173 struct { 1174 uint8_t ctrl, reg, value; 1175 } reg; 1176 1177 struct { 1178 uint8_t led, red, green, blue; 1179 } set_rgb; 1180 1181 struct { 1182 uint8_t led; 1183 } get_rgb; 1184 1185 struct lightbar_params_v0 set_params_v0; 1186 struct lightbar_params_v1 set_params_v1; 1187 }; 1188} __packed; 1189 1190struct ec_response_lightbar { 1191 union { 1192 struct { 1193 struct { 1194 uint8_t reg; 1195 uint8_t ic0; 1196 uint8_t ic1; 1197 } vals[23]; 1198 } dump; 1199 1200 struct { 1201 uint8_t num; 1202 } get_seq, get_brightness, get_demo; 1203 1204 struct lightbar_params_v0 get_params_v0; 1205 struct lightbar_params_v1 get_params_v1; 1206 1207 struct { 1208 uint32_t num; 1209 uint32_t flags; 1210 } version; 1211 1212 struct { 1213 uint8_t red, green, blue; 1214 } get_rgb; 1215 1216 struct { 1217 /* no return params */ 1218 } off, on, init, set_brightness, seq, reg, set_rgb, 1219 demo, set_params_v0, set_params_v1; 1220 }; 1221} __packed; 1222 1223/* Lightbar commands */ 1224enum lightbar_command { 1225 LIGHTBAR_CMD_DUMP = 0, 1226 LIGHTBAR_CMD_OFF = 1, 1227 LIGHTBAR_CMD_ON = 2, 1228 LIGHTBAR_CMD_INIT = 3, 1229 LIGHTBAR_CMD_SET_BRIGHTNESS = 4, 1230 LIGHTBAR_CMD_SEQ = 5, 1231 LIGHTBAR_CMD_REG = 6, 1232 LIGHTBAR_CMD_SET_RGB = 7, 1233 LIGHTBAR_CMD_GET_SEQ = 8, 1234 LIGHTBAR_CMD_DEMO = 9, 1235 LIGHTBAR_CMD_GET_PARAMS_V0 = 10, 1236 LIGHTBAR_CMD_SET_PARAMS_V0 = 11, 1237 LIGHTBAR_CMD_VERSION = 12, 1238 LIGHTBAR_CMD_GET_BRIGHTNESS = 13, 1239 LIGHTBAR_CMD_GET_RGB = 14, 1240 LIGHTBAR_CMD_GET_DEMO = 15, 1241 LIGHTBAR_CMD_GET_PARAMS_V1 = 16, 1242 LIGHTBAR_CMD_SET_PARAMS_V1 = 17, 1243 LIGHTBAR_NUM_CMDS 1244}; 1245 1246/*****************************************************************************/ 1247/* LED control commands */ 1248 1249#define EC_CMD_LED_CONTROL 0x29 1250 1251enum ec_led_id { 1252 /* LED to indicate battery state of charge */ 1253 EC_LED_ID_BATTERY_LED = 0, 1254 /* 1255 * LED to indicate system power state (on or in suspend). 1256 * May be on power button or on C-panel. 1257 */ 1258 EC_LED_ID_POWER_LED, 1259 /* LED on power adapter or its plug */ 1260 EC_LED_ID_ADAPTER_LED, 1261 1262 EC_LED_ID_COUNT 1263}; 1264 1265/* LED control flags */ 1266#define EC_LED_FLAGS_QUERY (1 << 0) /* Query LED capability only */ 1267#define EC_LED_FLAGS_AUTO (1 << 1) /* Switch LED back to automatic control */ 1268 1269enum ec_led_colors { 1270 EC_LED_COLOR_RED = 0, 1271 EC_LED_COLOR_GREEN, 1272 EC_LED_COLOR_BLUE, 1273 EC_LED_COLOR_YELLOW, 1274 EC_LED_COLOR_WHITE, 1275 1276 EC_LED_COLOR_COUNT 1277}; 1278 1279struct ec_params_led_control { 1280 uint8_t led_id; /* Which LED to control */ 1281 uint8_t flags; /* Control flags */ 1282 1283 uint8_t brightness[EC_LED_COLOR_COUNT]; 1284} __packed; 1285 1286struct ec_response_led_control { 1287 /* 1288 * Available brightness value range. 1289 * 1290 * Range 0 means color channel not present. 1291 * Range 1 means on/off control. 1292 * Other values means the LED is control by PWM. 1293 */ 1294 uint8_t brightness_range[EC_LED_COLOR_COUNT]; 1295} __packed; 1296 1297/*****************************************************************************/ 1298/* Verified boot commands */ 1299 1300/* 1301 * Note: command code 0x29 version 0 was VBOOT_CMD in Link EVT; it may be 1302 * reused for other purposes with version > 0. 1303 */ 1304 1305/* Verified boot hash command */ 1306#define EC_CMD_VBOOT_HASH 0x2A 1307 1308struct ec_params_vboot_hash { 1309 uint8_t cmd; /* enum ec_vboot_hash_cmd */ 1310 uint8_t hash_type; /* enum ec_vboot_hash_type */ 1311 uint8_t nonce_size; /* Nonce size; may be 0 */ 1312 uint8_t reserved0; /* Reserved; set 0 */ 1313 uint32_t offset; /* Offset in flash to hash */ 1314 uint32_t size; /* Number of bytes to hash */ 1315 uint8_t nonce_data[64]; /* Nonce data; ignored if nonce_size=0 */ 1316} __packed; 1317 1318struct ec_response_vboot_hash { 1319 uint8_t status; /* enum ec_vboot_hash_status */ 1320 uint8_t hash_type; /* enum ec_vboot_hash_type */ 1321 uint8_t digest_size; /* Size of hash digest in bytes */ 1322 uint8_t reserved0; /* Ignore; will be 0 */ 1323 uint32_t offset; /* Offset in flash which was hashed */ 1324 uint32_t size; /* Number of bytes hashed */ 1325 uint8_t hash_digest[64]; /* Hash digest data */ 1326} __packed; 1327 1328enum ec_vboot_hash_cmd { 1329 EC_VBOOT_HASH_GET = 0, /* Get current hash status */ 1330 EC_VBOOT_HASH_ABORT = 1, /* Abort calculating current hash */ 1331 EC_VBOOT_HASH_START = 2, /* Start computing a new hash */ 1332 EC_VBOOT_HASH_RECALC = 3, /* Synchronously compute a new hash */ 1333}; 1334 1335enum ec_vboot_hash_type { 1336 EC_VBOOT_HASH_TYPE_SHA256 = 0, /* SHA-256 */ 1337}; 1338 1339enum ec_vboot_hash_status { 1340 EC_VBOOT_HASH_STATUS_NONE = 0, /* No hash (not started, or aborted) */ 1341 EC_VBOOT_HASH_STATUS_DONE = 1, /* Finished computing a hash */ 1342 EC_VBOOT_HASH_STATUS_BUSY = 2, /* Busy computing a hash */ 1343}; 1344 1345/* 1346 * Special values for offset for EC_VBOOT_HASH_START and EC_VBOOT_HASH_RECALC. 1347 * If one of these is specified, the EC will automatically update offset and 1348 * size to the correct values for the specified image (RO or RW). 1349 */ 1350#define EC_VBOOT_HASH_OFFSET_RO 0xfffffffe 1351#define EC_VBOOT_HASH_OFFSET_RW 0xfffffffd 1352 1353/*****************************************************************************/ 1354/* 1355 * Motion sense commands. We'll make separate structs for sub-commands with 1356 * different input args, so that we know how much to expect. 1357 */ 1358#define EC_CMD_MOTION_SENSE_CMD 0x2B 1359 1360/* Motion sense commands */ 1361enum motionsense_command { 1362 /* 1363 * Dump command returns all motion sensor data including motion sense 1364 * module flags and individual sensor flags. 1365 */ 1366 MOTIONSENSE_CMD_DUMP = 0, 1367 1368 /* 1369 * Info command returns data describing the details of a given sensor, 1370 * including enum motionsensor_type, enum motionsensor_location, and 1371 * enum motionsensor_chip. 1372 */ 1373 MOTIONSENSE_CMD_INFO = 1, 1374 1375 /* 1376 * EC Rate command is a setter/getter command for the EC sampling rate 1377 * of all motion sensors in milliseconds. 1378 */ 1379 MOTIONSENSE_CMD_EC_RATE = 2, 1380 1381 /* 1382 * Sensor ODR command is a setter/getter command for the output data 1383 * rate of a specific motion sensor in millihertz. 1384 */ 1385 MOTIONSENSE_CMD_SENSOR_ODR = 3, 1386 1387 /* 1388 * Sensor range command is a setter/getter command for the range of 1389 * a specified motion sensor in +/-G's or +/- deg/s. 1390 */ 1391 MOTIONSENSE_CMD_SENSOR_RANGE = 4, 1392 1393 /* 1394 * Setter/getter command for the keyboard wake angle. When the lid 1395 * angle is greater than this value, keyboard wake is disabled in S3, 1396 * and when the lid angle goes less than this value, keyboard wake is 1397 * enabled. Note, the lid angle measurement is an approximate, 1398 * un-calibrated value, hence the wake angle isn't exact. 1399 */ 1400 MOTIONSENSE_CMD_KB_WAKE_ANGLE = 5, 1401 1402 /* 1403 * Returns a single sensor data. 1404 */ 1405 MOTIONSENSE_CMD_DATA = 6, 1406 1407 /* 1408 * Perform low level calibration.. On sensors that support it, ask to 1409 * do offset calibration. 1410 */ 1411 MOTIONSENSE_CMD_PERFORM_CALIB = 10, 1412 1413 /* 1414 * Sensor Offset command is a setter/getter command for the offset used 1415 * for calibration. The offsets can be calculated by the host, or via 1416 * PERFORM_CALIB command. 1417 */ 1418 MOTIONSENSE_CMD_SENSOR_OFFSET = 11, 1419 1420 /* Number of motionsense sub-commands. */ 1421 MOTIONSENSE_NUM_CMDS 1422}; 1423 1424enum motionsensor_id { 1425 EC_MOTION_SENSOR_ACCEL_BASE = 0, 1426 EC_MOTION_SENSOR_ACCEL_LID = 1, 1427 EC_MOTION_SENSOR_GYRO = 2, 1428 1429 /* 1430 * Note, if more sensors are added and this count changes, the padding 1431 * in ec_response_motion_sense dump command must be modified. 1432 */ 1433 EC_MOTION_SENSOR_COUNT = 3 1434}; 1435 1436/* List of motion sensor types. */ 1437enum motionsensor_type { 1438 MOTIONSENSE_TYPE_ACCEL = 0, 1439 MOTIONSENSE_TYPE_GYRO = 1, 1440 MOTIONSENSE_TYPE_MAG = 2, 1441 MOTIONSENSE_TYPE_PROX = 3, 1442 MOTIONSENSE_TYPE_LIGHT = 4, 1443 MOTIONSENSE_TYPE_ACTIVITY = 5, 1444 MOTIONSENSE_TYPE_MAX 1445}; 1446 1447/* List of motion sensor locations. */ 1448enum motionsensor_location { 1449 MOTIONSENSE_LOC_BASE = 0, 1450 MOTIONSENSE_LOC_LID = 1, 1451 MOTIONSENSE_LOC_MAX, 1452}; 1453 1454/* List of motion sensor chips. */ 1455enum motionsensor_chip { 1456 MOTIONSENSE_CHIP_KXCJ9 = 0, 1457}; 1458 1459/* Module flag masks used for the dump sub-command. */ 1460#define MOTIONSENSE_MODULE_FLAG_ACTIVE (1<<0) 1461 1462/* Sensor flag masks used for the dump sub-command. */ 1463#define MOTIONSENSE_SENSOR_FLAG_PRESENT (1<<0) 1464 1465/* 1466 * Send this value for the data element to only perform a read. If you 1467 * send any other value, the EC will interpret it as data to set and will 1468 * return the actual value set. 1469 */ 1470#define EC_MOTION_SENSE_NO_VALUE -1 1471 1472#define EC_MOTION_SENSE_INVALID_CALIB_TEMP 0x8000 1473 1474/* Set Calibration information */ 1475#define MOTION_SENSE_SET_OFFSET 1 1476 1477struct ec_response_motion_sensor_data { 1478 /* Flags for each sensor. */ 1479 uint8_t flags; 1480 /* Sensor number the data comes from */ 1481 uint8_t sensor_num; 1482 /* Each sensor is up to 3-axis. */ 1483 union { 1484 int16_t data[3]; 1485 struct { 1486 uint16_t rsvd; 1487 uint32_t timestamp; 1488 } __packed; 1489 struct { 1490 uint8_t activity; /* motionsensor_activity */ 1491 uint8_t state; 1492 int16_t add_info[2]; 1493 }; 1494 }; 1495} __packed; 1496 1497struct ec_params_motion_sense { 1498 uint8_t cmd; 1499 union { 1500 /* Used for MOTIONSENSE_CMD_DUMP. */ 1501 struct { 1502 /* no args */ 1503 } dump; 1504 1505 /* 1506 * Used for MOTIONSENSE_CMD_EC_RATE and 1507 * MOTIONSENSE_CMD_KB_WAKE_ANGLE. 1508 */ 1509 struct { 1510 /* Data to set or EC_MOTION_SENSE_NO_VALUE to read. */ 1511 int16_t data; 1512 } ec_rate, kb_wake_angle; 1513 1514 /* Used for MOTIONSENSE_CMD_SENSOR_OFFSET */ 1515 struct { 1516 uint8_t sensor_num; 1517 1518 /* 1519 * bit 0: If set (MOTION_SENSE_SET_OFFSET), set 1520 * the calibration information in the EC. 1521 * If unset, just retrieve calibration information. 1522 */ 1523 uint16_t flags; 1524 1525 /* 1526 * Temperature at calibration, in units of 0.01 C 1527 * 0x8000: invalid / unknown. 1528 * 0x0: 0C 1529 * 0x7fff: +327.67C 1530 */ 1531 int16_t temp; 1532 1533 /* 1534 * Offset for calibration. 1535 * Unit: 1536 * Accelerometer: 1/1024 g 1537 * Gyro: 1/1024 deg/s 1538 * Compass: 1/16 uT 1539 */ 1540 int16_t offset[3]; 1541 } __packed sensor_offset; 1542 1543 /* Used for MOTIONSENSE_CMD_INFO. */ 1544 struct { 1545 uint8_t sensor_num; 1546 } info; 1547 1548 /* 1549 * Used for MOTIONSENSE_CMD_SENSOR_ODR and 1550 * MOTIONSENSE_CMD_SENSOR_RANGE. 1551 */ 1552 struct { 1553 /* Should be element of enum motionsensor_id. */ 1554 uint8_t sensor_num; 1555 1556 /* Rounding flag, true for round-up, false for down. */ 1557 uint8_t roundup; 1558 1559 uint16_t reserved; 1560 1561 /* Data to set or EC_MOTION_SENSE_NO_VALUE to read. */ 1562 int32_t data; 1563 } sensor_odr, sensor_range; 1564 }; 1565} __packed; 1566 1567struct ec_response_motion_sense { 1568 union { 1569 /* Used for MOTIONSENSE_CMD_DUMP. */ 1570 struct { 1571 /* Flags representing the motion sensor module. */ 1572 uint8_t module_flags; 1573 1574 /* Number of sensors managed directly by the EC. */ 1575 uint8_t sensor_count; 1576 1577 /* 1578 * Sensor data is truncated if response_max is too small 1579 * for holding all the data. 1580 */ 1581 struct ec_response_motion_sensor_data sensor[0]; 1582 } dump; 1583 1584 /* Used for MOTIONSENSE_CMD_INFO. */ 1585 struct { 1586 /* Should be element of enum motionsensor_type. */ 1587 uint8_t type; 1588 1589 /* Should be element of enum motionsensor_location. */ 1590 uint8_t location; 1591 1592 /* Should be element of enum motionsensor_chip. */ 1593 uint8_t chip; 1594 } info; 1595 1596 /* Used for MOTIONSENSE_CMD_DATA */ 1597 struct ec_response_motion_sensor_data data; 1598 1599 /* 1600 * Used for MOTIONSENSE_CMD_EC_RATE, MOTIONSENSE_CMD_SENSOR_ODR, 1601 * MOTIONSENSE_CMD_SENSOR_RANGE, and 1602 * MOTIONSENSE_CMD_KB_WAKE_ANGLE. 1603 */ 1604 struct { 1605 /* Current value of the parameter queried. */ 1606 int32_t ret; 1607 } ec_rate, sensor_odr, sensor_range, kb_wake_angle; 1608 1609 /* Used for MOTIONSENSE_CMD_SENSOR_OFFSET */ 1610 struct { 1611 int16_t temp; 1612 int16_t offset[3]; 1613 } sensor_offset, perform_calib; 1614 }; 1615} __packed; 1616 1617/*****************************************************************************/ 1618/* USB charging control commands */ 1619 1620/* Set USB port charging mode */ 1621#define EC_CMD_USB_CHARGE_SET_MODE 0x30 1622 1623struct ec_params_usb_charge_set_mode { 1624 uint8_t usb_port_id; 1625 uint8_t mode; 1626} __packed; 1627 1628/*****************************************************************************/ 1629/* Persistent storage for host */ 1630 1631/* Maximum bytes that can be read/written in a single command */ 1632#define EC_PSTORE_SIZE_MAX 64 1633 1634/* Get persistent storage info */ 1635#define EC_CMD_PSTORE_INFO 0x40 1636 1637struct ec_response_pstore_info { 1638 /* Persistent storage size, in bytes */ 1639 uint32_t pstore_size; 1640 /* Access size; read/write offset and size must be a multiple of this */ 1641 uint32_t access_size; 1642} __packed; 1643 1644/* 1645 * Read persistent storage 1646 * 1647 * Response is params.size bytes of data. 1648 */ 1649#define EC_CMD_PSTORE_READ 0x41 1650 1651struct ec_params_pstore_read { 1652 uint32_t offset; /* Byte offset to read */ 1653 uint32_t size; /* Size to read in bytes */ 1654} __packed; 1655 1656/* Write persistent storage */ 1657#define EC_CMD_PSTORE_WRITE 0x42 1658 1659struct ec_params_pstore_write { 1660 uint32_t offset; /* Byte offset to write */ 1661 uint32_t size; /* Size to write in bytes */ 1662 uint8_t data[EC_PSTORE_SIZE_MAX]; 1663} __packed; 1664 1665/*****************************************************************************/ 1666/* Real-time clock */ 1667 1668/* RTC params and response structures */ 1669struct ec_params_rtc { 1670 uint32_t time; 1671} __packed; 1672 1673struct ec_response_rtc { 1674 uint32_t time; 1675} __packed; 1676 1677/* These use ec_response_rtc */ 1678#define EC_CMD_RTC_GET_VALUE 0x44 1679#define EC_CMD_RTC_GET_ALARM 0x45 1680 1681/* These all use ec_params_rtc */ 1682#define EC_CMD_RTC_SET_VALUE 0x46 1683#define EC_CMD_RTC_SET_ALARM 0x47 1684 1685/*****************************************************************************/ 1686/* Port80 log access */ 1687 1688/* Maximum entries that can be read/written in a single command */ 1689#define EC_PORT80_SIZE_MAX 32 1690 1691/* Get last port80 code from previous boot */ 1692#define EC_CMD_PORT80_LAST_BOOT 0x48 1693#define EC_CMD_PORT80_READ 0x48 1694 1695enum ec_port80_subcmd { 1696 EC_PORT80_GET_INFO = 0, 1697 EC_PORT80_READ_BUFFER, 1698}; 1699 1700struct ec_params_port80_read { 1701 uint16_t subcmd; 1702 union { 1703 struct { 1704 uint32_t offset; 1705 uint32_t num_entries; 1706 } read_buffer; 1707 }; 1708} __packed; 1709 1710struct ec_response_port80_read { 1711 union { 1712 struct { 1713 uint32_t writes; 1714 uint32_t history_size; 1715 uint32_t last_boot; 1716 } get_info; 1717 struct { 1718 uint16_t codes[EC_PORT80_SIZE_MAX]; 1719 } data; 1720 }; 1721} __packed; 1722 1723struct ec_response_port80_last_boot { 1724 uint16_t code; 1725} __packed; 1726 1727/*****************************************************************************/ 1728/* Thermal engine commands. Note that there are two implementations. We'll 1729 * reuse the command number, but the data and behavior is incompatible. 1730 * Version 0 is what originally shipped on Link. 1731 * Version 1 separates the CPU thermal limits from the fan control. 1732 */ 1733 1734#define EC_CMD_THERMAL_SET_THRESHOLD 0x50 1735#define EC_CMD_THERMAL_GET_THRESHOLD 0x51 1736 1737/* The version 0 structs are opaque. You have to know what they are for 1738 * the get/set commands to make any sense. 1739 */ 1740 1741/* Version 0 - set */ 1742struct ec_params_thermal_set_threshold { 1743 uint8_t sensor_type; 1744 uint8_t threshold_id; 1745 uint16_t value; 1746} __packed; 1747 1748/* Version 0 - get */ 1749struct ec_params_thermal_get_threshold { 1750 uint8_t sensor_type; 1751 uint8_t threshold_id; 1752} __packed; 1753 1754struct ec_response_thermal_get_threshold { 1755 uint16_t value; 1756} __packed; 1757 1758 1759/* The version 1 structs are visible. */ 1760enum ec_temp_thresholds { 1761 EC_TEMP_THRESH_WARN = 0, 1762 EC_TEMP_THRESH_HIGH, 1763 EC_TEMP_THRESH_HALT, 1764 1765 EC_TEMP_THRESH_COUNT 1766}; 1767 1768/* Thermal configuration for one temperature sensor. Temps are in degrees K. 1769 * Zero values will be silently ignored by the thermal task. 1770 */ 1771struct ec_thermal_config { 1772 uint32_t temp_host[EC_TEMP_THRESH_COUNT]; /* levels of hotness */ 1773 uint32_t temp_fan_off; /* no active cooling needed */ 1774 uint32_t temp_fan_max; /* max active cooling needed */ 1775} __packed; 1776 1777/* Version 1 - get config for one sensor. */ 1778struct ec_params_thermal_get_threshold_v1 { 1779 uint32_t sensor_num; 1780} __packed; 1781/* This returns a struct ec_thermal_config */ 1782 1783/* Version 1 - set config for one sensor. 1784 * Use read-modify-write for best results! */ 1785struct ec_params_thermal_set_threshold_v1 { 1786 uint32_t sensor_num; 1787 struct ec_thermal_config cfg; 1788} __packed; 1789/* This returns no data */ 1790 1791/****************************************************************************/ 1792 1793/* Toggle automatic fan control */ 1794#define EC_CMD_THERMAL_AUTO_FAN_CTRL 0x52 1795 1796/* Get TMP006 calibration data */ 1797#define EC_CMD_TMP006_GET_CALIBRATION 0x53 1798 1799struct ec_params_tmp006_get_calibration { 1800 uint8_t index; 1801} __packed; 1802 1803struct ec_response_tmp006_get_calibration { 1804 float s0; 1805 float b0; 1806 float b1; 1807 float b2; 1808} __packed; 1809 1810/* Set TMP006 calibration data */ 1811#define EC_CMD_TMP006_SET_CALIBRATION 0x54 1812 1813struct ec_params_tmp006_set_calibration { 1814 uint8_t index; 1815 uint8_t reserved[3]; /* Reserved; set 0 */ 1816 float s0; 1817 float b0; 1818 float b1; 1819 float b2; 1820} __packed; 1821 1822/* Read raw TMP006 data */ 1823#define EC_CMD_TMP006_GET_RAW 0x55 1824 1825struct ec_params_tmp006_get_raw { 1826 uint8_t index; 1827} __packed; 1828 1829struct ec_response_tmp006_get_raw { 1830 int32_t t; /* In 1/100 K */ 1831 int32_t v; /* In nV */ 1832}; 1833 1834/*****************************************************************************/ 1835/* MKBP - Matrix KeyBoard Protocol */ 1836 1837/* 1838 * Read key state 1839 * 1840 * Returns raw data for keyboard cols; see ec_response_mkbp_info.cols for 1841 * expected response size. 1842 */ 1843#define EC_CMD_MKBP_STATE 0x60 1844 1845/* Provide information about the matrix : number of rows and columns */ 1846#define EC_CMD_MKBP_INFO 0x61 1847 1848struct ec_response_mkbp_info { 1849 uint32_t rows; 1850 uint32_t cols; 1851 uint8_t switches; 1852} __packed; 1853 1854/* Simulate key press */ 1855#define EC_CMD_MKBP_SIMULATE_KEY 0x62 1856 1857struct ec_params_mkbp_simulate_key { 1858 uint8_t col; 1859 uint8_t row; 1860 uint8_t pressed; 1861} __packed; 1862 1863/* Configure keyboard scanning */ 1864#define EC_CMD_MKBP_SET_CONFIG 0x64 1865#define EC_CMD_MKBP_GET_CONFIG 0x65 1866 1867/* flags */ 1868enum mkbp_config_flags { 1869 EC_MKBP_FLAGS_ENABLE = 1, /* Enable keyboard scanning */ 1870}; 1871 1872enum mkbp_config_valid { 1873 EC_MKBP_VALID_SCAN_PERIOD = 1 << 0, 1874 EC_MKBP_VALID_POLL_TIMEOUT = 1 << 1, 1875 EC_MKBP_VALID_MIN_POST_SCAN_DELAY = 1 << 3, 1876 EC_MKBP_VALID_OUTPUT_SETTLE = 1 << 4, 1877 EC_MKBP_VALID_DEBOUNCE_DOWN = 1 << 5, 1878 EC_MKBP_VALID_DEBOUNCE_UP = 1 << 6, 1879 EC_MKBP_VALID_FIFO_MAX_DEPTH = 1 << 7, 1880}; 1881 1882/* Configuration for our key scanning algorithm */ 1883struct ec_mkbp_config { 1884 uint32_t valid_mask; /* valid fields */ 1885 uint8_t flags; /* some flags (enum mkbp_config_flags) */ 1886 uint8_t valid_flags; /* which flags are valid */ 1887 uint16_t scan_period_us; /* period between start of scans */ 1888 /* revert to interrupt mode after no activity for this long */ 1889 uint32_t poll_timeout_us; 1890 /* 1891 * minimum post-scan relax time. Once we finish a scan we check 1892 * the time until we are due to start the next one. If this time is 1893 * shorter this field, we use this instead. 1894 */ 1895 uint16_t min_post_scan_delay_us; 1896 /* delay between setting up output and waiting for it to settle */ 1897 uint16_t output_settle_us; 1898 uint16_t debounce_down_us; /* time for debounce on key down */ 1899 uint16_t debounce_up_us; /* time for debounce on key up */ 1900 /* maximum depth to allow for fifo (0 = no keyscan output) */ 1901 uint8_t fifo_max_depth; 1902} __packed; 1903 1904struct ec_params_mkbp_set_config { 1905 struct ec_mkbp_config config; 1906} __packed; 1907 1908struct ec_response_mkbp_get_config { 1909 struct ec_mkbp_config config; 1910} __packed; 1911 1912/* Run the key scan emulation */ 1913#define EC_CMD_KEYSCAN_SEQ_CTRL 0x66 1914 1915enum ec_keyscan_seq_cmd { 1916 EC_KEYSCAN_SEQ_STATUS = 0, /* Get status information */ 1917 EC_KEYSCAN_SEQ_CLEAR = 1, /* Clear sequence */ 1918 EC_KEYSCAN_SEQ_ADD = 2, /* Add item to sequence */ 1919 EC_KEYSCAN_SEQ_START = 3, /* Start running sequence */ 1920 EC_KEYSCAN_SEQ_COLLECT = 4, /* Collect sequence summary data */ 1921}; 1922 1923enum ec_collect_flags { 1924 /* 1925 * Indicates this scan was processed by the EC. Due to timing, some 1926 * scans may be skipped. 1927 */ 1928 EC_KEYSCAN_SEQ_FLAG_DONE = 1 << 0, 1929}; 1930 1931struct ec_collect_item { 1932 uint8_t flags; /* some flags (enum ec_collect_flags) */ 1933}; 1934 1935struct ec_params_keyscan_seq_ctrl { 1936 uint8_t cmd; /* Command to send (enum ec_keyscan_seq_cmd) */ 1937 union { 1938 struct { 1939 uint8_t active; /* still active */ 1940 uint8_t num_items; /* number of items */ 1941 /* Current item being presented */ 1942 uint8_t cur_item; 1943 } status; 1944 struct { 1945 /* 1946 * Absolute time for this scan, measured from the 1947 * start of the sequence. 1948 */ 1949 uint32_t time_us; 1950 uint8_t scan[0]; /* keyscan data */ 1951 } add; 1952 struct { 1953 uint8_t start_item; /* First item to return */ 1954 uint8_t num_items; /* Number of items to return */ 1955 } collect; 1956 }; 1957} __packed; 1958 1959struct ec_result_keyscan_seq_ctrl { 1960 union { 1961 struct { 1962 uint8_t num_items; /* Number of items */ 1963 /* Data for each item */ 1964 struct ec_collect_item item[0]; 1965 } collect; 1966 }; 1967} __packed; 1968 1969/* 1970 * Command for retrieving the next pending MKBP event from the EC device 1971 * 1972 * The device replies with UNAVAILABLE if there aren't any pending events. 1973 */ 1974#define EC_CMD_GET_NEXT_EVENT 0x67 1975 1976enum ec_mkbp_event { 1977 /* Keyboard matrix changed. The event data is the new matrix state. */ 1978 EC_MKBP_EVENT_KEY_MATRIX = 0, 1979 1980 /* New host event. The event data is 4 bytes of host event flags. */ 1981 EC_MKBP_EVENT_HOST_EVENT = 1, 1982 1983 /* New Sensor FIFO data. The event data is fifo_info structure. */ 1984 EC_MKBP_EVENT_SENSOR_FIFO = 2, 1985 1986 /* Number of MKBP events */ 1987 EC_MKBP_EVENT_COUNT, 1988}; 1989 1990union ec_response_get_next_data { 1991 uint8_t key_matrix[13]; 1992 1993 /* Unaligned */ 1994 uint32_t host_event; 1995} __packed; 1996 1997struct ec_response_get_next_event { 1998 uint8_t event_type; 1999 /* Followed by event data if any */ 2000 union ec_response_get_next_data data;
2001} __packed; 2002 2003/*****************************************************************************/ 2004/* Temperature sensor commands */ 2005 2006/* Read temperature sensor info */ 2007#define EC_CMD_TEMP_SENSOR_GET_INFO 0x70 2008 2009struct ec_params_temp_sensor_get_info { 2010 uint8_t id; 2011} __packed; 2012 2013struct ec_response_temp_sensor_get_info { 2014 char sensor_name[32]; 2015 uint8_t sensor_type; 2016} __packed; 2017 2018/*****************************************************************************/ 2019 2020/* 2021 * Note: host commands 0x80 - 0x87 are reserved to avoid conflict with ACPI 2022 * commands accidentally sent to the wrong interface. See the ACPI section 2023 * below. 2024 */ 2025 2026/*****************************************************************************/ 2027/* Host event commands */ 2028 2029/* 2030 * Host event mask params and response structures, shared by all of the host 2031 * event commands below. 2032 */ 2033struct ec_params_host_event_mask { 2034 uint32_t mask; 2035} __packed; 2036 2037struct ec_response_host_event_mask { 2038 uint32_t mask; 2039} __packed; 2040 2041/* These all use ec_response_host_event_mask */ 2042#define EC_CMD_HOST_EVENT_GET_B 0x87 2043#define EC_CMD_HOST_EVENT_GET_SMI_MASK 0x88 2044#define EC_CMD_HOST_EVENT_GET_SCI_MASK 0x89 2045#define EC_CMD_HOST_EVENT_GET_WAKE_MASK 0x8d 2046 2047/* These all use ec_params_host_event_mask */ 2048#define EC_CMD_HOST_EVENT_SET_SMI_MASK 0x8a 2049#define EC_CMD_HOST_EVENT_SET_SCI_MASK 0x8b 2050#define EC_CMD_HOST_EVENT_CLEAR 0x8c 2051#define EC_CMD_HOST_EVENT_SET_WAKE_MASK 0x8e 2052#define EC_CMD_HOST_EVENT_CLEAR_B 0x8f 2053 2054/*****************************************************************************/ 2055/* Switch commands */ 2056 2057/* Enable/disable LCD backlight */ 2058#define EC_CMD_SWITCH_ENABLE_BKLIGHT 0x90 2059 2060struct ec_params_switch_enable_backlight { 2061 uint8_t enabled; 2062} __packed; 2063 2064/* Enable/disable WLAN/Bluetooth */ 2065#define EC_CMD_SWITCH_ENABLE_WIRELESS 0x91 2066#define EC_VER_SWITCH_ENABLE_WIRELESS 1 2067 2068/* Version 0 params; no response */ 2069struct ec_params_switch_enable_wireless_v0 { 2070 uint8_t enabled; 2071} __packed; 2072 2073/* Version 1 params */ 2074struct ec_params_switch_enable_wireless_v1 { 2075 /* Flags to enable now */ 2076 uint8_t now_flags; 2077 2078 /* Which flags to copy from now_flags */ 2079 uint8_t now_mask; 2080 2081 /* 2082 * Flags to leave enabled in S3, if they're on at the S0->S3 2083 * transition. (Other flags will be disabled by the S0->S3 2084 * transition.) 2085 */ 2086 uint8_t suspend_flags; 2087 2088 /* Which flags to copy from suspend_flags */ 2089 uint8_t suspend_mask; 2090} __packed; 2091 2092/* Version 1 response */ 2093struct ec_response_switch_enable_wireless_v1 { 2094 /* Flags to enable now */ 2095 uint8_t now_flags; 2096 2097 /* Flags to leave enabled in S3 */ 2098 uint8_t suspend_flags; 2099} __packed; 2100 2101/*****************************************************************************/ 2102/* GPIO commands. Only available on EC if write protect has been disabled. */ 2103 2104/* Set GPIO output value */ 2105#define EC_CMD_GPIO_SET 0x92 2106 2107struct ec_params_gpio_set { 2108 char name[32]; 2109 uint8_t val; 2110} __packed; 2111 2112/* Get GPIO value */ 2113#define EC_CMD_GPIO_GET 0x93 2114 2115/* Version 0 of input params and response */ 2116struct ec_params_gpio_get { 2117 char name[32]; 2118} __packed; 2119struct ec_response_gpio_get { 2120 uint8_t val; 2121} __packed; 2122 2123/* Version 1 of input params and response */ 2124struct ec_params_gpio_get_v1 { 2125 uint8_t subcmd; 2126 union { 2127 struct { 2128 char name[32]; 2129 } get_value_by_name; 2130 struct { 2131 uint8_t index; 2132 } get_info; 2133 }; 2134} __packed; 2135 2136struct ec_response_gpio_get_v1 { 2137 union { 2138 struct { 2139 uint8_t val; 2140 } get_value_by_name, get_count; 2141 struct { 2142 uint8_t val; 2143 char name[32]; 2144 uint32_t flags; 2145 } get_info; 2146 }; 2147} __packed; 2148 2149enum gpio_get_subcmd { 2150 EC_GPIO_GET_BY_NAME = 0, 2151 EC_GPIO_GET_COUNT = 1, 2152 EC_GPIO_GET_INFO = 2, 2153}; 2154 2155/*****************************************************************************/ 2156/* I2C commands. Only available when flash write protect is unlocked. */ 2157 2158/* 2159 * TODO(crosbug.com/p/23570): These commands are deprecated, and will be 2160 * removed soon. Use EC_CMD_I2C_XFER instead. 2161 */ 2162 2163/* Read I2C bus */ 2164#define EC_CMD_I2C_READ 0x94 2165 2166struct ec_params_i2c_read { 2167 uint16_t addr; /* 8-bit address (7-bit shifted << 1) */ 2168 uint8_t read_size; /* Either 8 or 16. */ 2169 uint8_t port; 2170 uint8_t offset; 2171} __packed; 2172struct ec_response_i2c_read { 2173 uint16_t data; 2174} __packed; 2175 2176/* Write I2C bus */ 2177#define EC_CMD_I2C_WRITE 0x95 2178 2179struct ec_params_i2c_write { 2180 uint16_t data; 2181 uint16_t addr; /* 8-bit address (7-bit shifted << 1) */ 2182 uint8_t write_size; /* Either 8 or 16. */ 2183 uint8_t port; 2184 uint8_t offset; 2185} __packed; 2186 2187/*****************************************************************************/ 2188/* Charge state commands. Only available when flash write protect unlocked. */ 2189 2190/* Force charge state machine to stop charging the battery or force it to 2191 * discharge the battery. 2192 */ 2193#define EC_CMD_CHARGE_CONTROL 0x96 2194#define EC_VER_CHARGE_CONTROL 1 2195 2196enum ec_charge_control_mode { 2197 CHARGE_CONTROL_NORMAL = 0, 2198 CHARGE_CONTROL_IDLE, 2199 CHARGE_CONTROL_DISCHARGE, 2200}; 2201 2202struct ec_params_charge_control { 2203 uint32_t mode; /* enum charge_control_mode */ 2204} __packed; 2205 2206/*****************************************************************************/ 2207/* Console commands. Only available when flash write protect is unlocked. */ 2208 2209/* Snapshot console output buffer for use by EC_CMD_CONSOLE_READ. */ 2210#define EC_CMD_CONSOLE_SNAPSHOT 0x97 2211 2212/* 2213 * Read next chunk of data from saved snapshot. 2214 * 2215 * Response is null-terminated string. Empty string, if there is no more 2216 * remaining output. 2217 */ 2218#define EC_CMD_CONSOLE_READ 0x98 2219 2220/*****************************************************************************/ 2221 2222/* 2223 * Cut off battery power immediately or after the host has shut down. 2224 * 2225 * return EC_RES_INVALID_COMMAND if unsupported by a board/battery. 2226 * EC_RES_SUCCESS if the command was successful. 2227 * EC_RES_ERROR if the cut off command failed. 2228 */ 2229 2230#define EC_CMD_BATTERY_CUT_OFF 0x99 2231 2232#define EC_BATTERY_CUTOFF_FLAG_AT_SHUTDOWN (1 << 0) 2233 2234struct ec_params_battery_cutoff { 2235 uint8_t flags; 2236} __packed; 2237 2238/*****************************************************************************/ 2239/* USB port mux control. */ 2240 2241/* 2242 * Switch USB mux or return to automatic switching. 2243 */ 2244#define EC_CMD_USB_MUX 0x9a 2245 2246struct ec_params_usb_mux { 2247 uint8_t mux; 2248} __packed; 2249 2250/*****************************************************************************/ 2251/* LDOs / FETs control. */ 2252 2253enum ec_ldo_state { 2254 EC_LDO_STATE_OFF = 0, /* the LDO / FET is shut down */ 2255 EC_LDO_STATE_ON = 1, /* the LDO / FET is ON / providing power */ 2256}; 2257 2258/* 2259 * Switch on/off a LDO. 2260 */ 2261#define EC_CMD_LDO_SET 0x9b 2262 2263struct ec_params_ldo_set { 2264 uint8_t index; 2265 uint8_t state; 2266} __packed; 2267 2268/* 2269 * Get LDO state. 2270 */ 2271#define EC_CMD_LDO_GET 0x9c 2272 2273struct ec_params_ldo_get { 2274 uint8_t index; 2275} __packed; 2276 2277struct ec_response_ldo_get { 2278 uint8_t state; 2279} __packed; 2280 2281/*****************************************************************************/ 2282/* Power info. */ 2283 2284/* 2285 * Get power info. 2286 */ 2287#define EC_CMD_POWER_INFO 0x9d 2288 2289struct ec_response_power_info { 2290 uint32_t usb_dev_type; 2291 uint16_t voltage_ac; 2292 uint16_t voltage_system; 2293 uint16_t current_system; 2294 uint16_t usb_current_limit; 2295} __packed; 2296 2297/*****************************************************************************/ 2298/* I2C passthru command */ 2299 2300#define EC_CMD_I2C_PASSTHRU 0x9e 2301 2302/* Read data; if not present, message is a write */ 2303#define EC_I2C_FLAG_READ (1 << 15) 2304 2305/* Mask for address */ 2306#define EC_I2C_ADDR_MASK 0x3ff 2307 2308#define EC_I2C_STATUS_NAK (1 << 0) /* Transfer was not acknowledged */ 2309#define EC_I2C_STATUS_TIMEOUT (1 << 1) /* Timeout during transfer */ 2310 2311/* Any error */ 2312#define EC_I2C_STATUS_ERROR (EC_I2C_STATUS_NAK | EC_I2C_STATUS_TIMEOUT) 2313 2314struct ec_params_i2c_passthru_msg { 2315 uint16_t addr_flags; /* I2C slave address (7 or 10 bits) and flags */ 2316 uint16_t len; /* Number of bytes to read or write */ 2317} __packed; 2318 2319struct ec_params_i2c_passthru { 2320 uint8_t port; /* I2C port number */ 2321 uint8_t num_msgs; /* Number of messages */ 2322 struct ec_params_i2c_passthru_msg msg[]; 2323 /* Data to write for all messages is concatenated here */ 2324} __packed; 2325 2326struct ec_response_i2c_passthru { 2327 uint8_t i2c_status; /* Status flags (EC_I2C_STATUS_...) */ 2328 uint8_t num_msgs; /* Number of messages processed */ 2329 uint8_t data[]; /* Data read by messages concatenated here */ 2330} __packed; 2331 2332/*****************************************************************************/ 2333/* Power button hang detect */ 2334 2335#define EC_CMD_HANG_DETECT 0x9f 2336 2337/* Reasons to start hang detection timer */ 2338/* Power button pressed */ 2339#define EC_HANG_START_ON_POWER_PRESS (1 << 0) 2340 2341/* Lid closed */ 2342#define EC_HANG_START_ON_LID_CLOSE (1 << 1) 2343 2344 /* Lid opened */ 2345#define EC_HANG_START_ON_LID_OPEN (1 << 2) 2346 2347/* Start of AP S3->S0 transition (booting or resuming from suspend) */ 2348#define EC_HANG_START_ON_RESUME (1 << 3) 2349 2350/* Reasons to cancel hang detection */ 2351 2352/* Power button released */ 2353#define EC_HANG_STOP_ON_POWER_RELEASE (1 << 8) 2354 2355/* Any host command from AP received */ 2356#define EC_HANG_STOP_ON_HOST_COMMAND (1 << 9) 2357 2358/* Stop on end of AP S0->S3 transition (suspending or shutting down) */ 2359#define EC_HANG_STOP_ON_SUSPEND (1 << 10) 2360 2361/* 2362 * If this flag is set, all the other fields are ignored, and the hang detect 2363 * timer is started. This provides the AP a way to start the hang timer 2364 * without reconfiguring any of the other hang detect settings. Note that 2365 * you must previously have configured the timeouts. 2366 */ 2367#define EC_HANG_START_NOW (1 << 30) 2368 2369/* 2370 * If this flag is set, all the other fields are ignored (including 2371 * EC_HANG_START_NOW). This provides the AP a way to stop the hang timer 2372 * without reconfiguring any of the other hang detect settings. 2373 */ 2374#define EC_HANG_STOP_NOW (1 << 31) 2375 2376struct ec_params_hang_detect { 2377 /* Flags; see EC_HANG_* */ 2378 uint32_t flags; 2379 2380 /* Timeout in msec before generating host event, if enabled */ 2381 uint16_t host_event_timeout_msec; 2382 2383 /* Timeout in msec before generating warm reboot, if enabled */ 2384 uint16_t warm_reboot_timeout_msec; 2385} __packed; 2386 2387/*****************************************************************************/ 2388/* Commands for battery charging */ 2389 2390/* 2391 * This is the single catch-all host command to exchange data regarding the 2392 * charge state machine (v2 and up). 2393 */ 2394#define EC_CMD_CHARGE_STATE 0xa0 2395 2396/* Subcommands for this host command */ 2397enum charge_state_command { 2398 CHARGE_STATE_CMD_GET_STATE, 2399 CHARGE_STATE_CMD_GET_PARAM, 2400 CHARGE_STATE_CMD_SET_PARAM, 2401 CHARGE_STATE_NUM_CMDS 2402}; 2403 2404/* 2405 * Known param numbers are defined here. Ranges are reserved for board-specific 2406 * params, which are handled by the particular implementations. 2407 */ 2408enum charge_state_params { 2409 CS_PARAM_CHG_VOLTAGE, /* charger voltage limit */ 2410 CS_PARAM_CHG_CURRENT, /* charger current limit */ 2411 CS_PARAM_CHG_INPUT_CURRENT, /* charger input current limit */ 2412 CS_PARAM_CHG_STATUS, /* charger-specific status */ 2413 CS_PARAM_CHG_OPTION, /* charger-specific options */ 2414 /* How many so far? */ 2415 CS_NUM_BASE_PARAMS, 2416 2417 /* Range for CONFIG_CHARGER_PROFILE_OVERRIDE params */ 2418 CS_PARAM_CUSTOM_PROFILE_MIN = 0x10000, 2419 CS_PARAM_CUSTOM_PROFILE_MAX = 0x1ffff, 2420 2421 /* Other custom param ranges go here... */ 2422}; 2423 2424struct ec_params_charge_state { 2425 uint8_t cmd; /* enum charge_state_command */ 2426 union { 2427 struct { 2428 /* no args */ 2429 } get_state; 2430 2431 struct { 2432 uint32_t param; /* enum charge_state_param */ 2433 } get_param; 2434 2435 struct { 2436 uint32_t param; /* param to set */ 2437 uint32_t value; /* value to set */ 2438 } set_param; 2439 }; 2440} __packed; 2441 2442struct ec_response_charge_state { 2443 union { 2444 struct { 2445 int ac; 2446 int chg_voltage; 2447 int chg_current; 2448 int chg_input_current; 2449 int batt_state_of_charge; 2450 } get_state; 2451 2452 struct { 2453 uint32_t value; 2454 } get_param; 2455 struct { 2456 /* no return values */ 2457 } set_param; 2458 }; 2459} __packed; 2460 2461 2462/* 2463 * Set maximum battery charging current. 2464 */ 2465#define EC_CMD_CHARGE_CURRENT_LIMIT 0xa1 2466 2467struct ec_params_current_limit { 2468 uint32_t limit; /* in mA */ 2469} __packed; 2470 2471/* 2472 * Set maximum external power current. 2473 */ 2474#define EC_CMD_EXT_POWER_CURRENT_LIMIT 0xa2 2475 2476struct ec_params_ext_power_current_limit { 2477 uint32_t limit; /* in mA */ 2478} __packed; 2479 2480/*****************************************************************************/ 2481/* Smart battery pass-through */ 2482 2483/* Get / Set 16-bit smart battery registers */ 2484#define EC_CMD_SB_READ_WORD 0xb0 2485#define EC_CMD_SB_WRITE_WORD 0xb1 2486 2487/* Get / Set string smart battery parameters 2488 * formatted as SMBUS "block". 2489 */ 2490#define EC_CMD_SB_READ_BLOCK 0xb2 2491#define EC_CMD_SB_WRITE_BLOCK 0xb3 2492 2493struct ec_params_sb_rd { 2494 uint8_t reg; 2495} __packed; 2496 2497struct ec_response_sb_rd_word { 2498 uint16_t value; 2499} __packed; 2500 2501struct ec_params_sb_wr_word { 2502 uint8_t reg; 2503 uint16_t value; 2504} __packed; 2505 2506struct ec_response_sb_rd_block { 2507 uint8_t data[32]; 2508} __packed; 2509 2510struct ec_params_sb_wr_block { 2511 uint8_t reg; 2512 uint16_t data[32]; 2513} __packed; 2514 2515/*****************************************************************************/ 2516/* Battery vendor parameters 2517 * 2518 * Get or set vendor-specific parameters in the battery. Implementations may 2519 * differ between boards or batteries. On a set operation, the response 2520 * contains the actual value set, which may be rounded or clipped from the 2521 * requested value. 2522 */ 2523 2524#define EC_CMD_BATTERY_VENDOR_PARAM 0xb4 2525 2526enum ec_battery_vendor_param_mode { 2527 BATTERY_VENDOR_PARAM_MODE_GET = 0, 2528 BATTERY_VENDOR_PARAM_MODE_SET, 2529}; 2530 2531struct ec_params_battery_vendor_param { 2532 uint32_t param; 2533 uint32_t value; 2534 uint8_t mode; 2535} __packed; 2536 2537struct ec_response_battery_vendor_param { 2538 uint32_t value; 2539} __packed; 2540 2541/*****************************************************************************/ 2542/* System commands */ 2543 2544/* 2545 * TODO(crosbug.com/p/23747): This is a confusing name, since it doesn't 2546 * necessarily reboot the EC. Rename to "image" or something similar? 2547 */ 2548#define EC_CMD_REBOOT_EC 0xd2 2549 2550/* Command */ 2551enum ec_reboot_cmd { 2552 EC_REBOOT_CANCEL = 0, /* Cancel a pending reboot */ 2553 EC_REBOOT_JUMP_RO = 1, /* Jump to RO without rebooting */ 2554 EC_REBOOT_JUMP_RW = 2, /* Jump to RW without rebooting */ 2555 /* (command 3 was jump to RW-B) */ 2556 EC_REBOOT_COLD = 4, /* Cold-reboot */ 2557 EC_REBOOT_DISABLE_JUMP = 5, /* Disable jump until next reboot */ 2558 EC_REBOOT_HIBERNATE = 6 /* Hibernate EC */ 2559}; 2560 2561/* Flags for ec_params_reboot_ec.reboot_flags */ 2562#define EC_REBOOT_FLAG_RESERVED0 (1 << 0) /* Was recovery request */ 2563#define EC_REBOOT_FLAG_ON_AP_SHUTDOWN (1 << 1) /* Reboot after AP shutdown */ 2564 2565struct ec_params_reboot_ec { 2566 uint8_t cmd; /* enum ec_reboot_cmd */ 2567 uint8_t flags; /* See EC_REBOOT_FLAG_* */ 2568} __packed; 2569 2570/* 2571 * Get information on last EC panic. 2572 * 2573 * Returns variable-length platform-dependent panic information. See panic.h 2574 * for details. 2575 */ 2576#define EC_CMD_GET_PANIC_INFO 0xd3 2577 2578/*****************************************************************************/ 2579/* 2580 * ACPI commands 2581 * 2582 * These are valid ONLY on the ACPI command/data port. 2583 */ 2584 2585/* 2586 * ACPI Read Embedded Controller 2587 * 2588 * This reads from ACPI memory space on the EC (EC_ACPI_MEM_*). 2589 * 2590 * Use the following sequence: 2591 * 2592 * - Write EC_CMD_ACPI_READ to EC_LPC_ADDR_ACPI_CMD 2593 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2594 * - Write address to EC_LPC_ADDR_ACPI_DATA 2595 * - Wait for EC_LPC_CMDR_DATA bit to set 2596 * - Read value from EC_LPC_ADDR_ACPI_DATA 2597 */ 2598#define EC_CMD_ACPI_READ 0x80 2599 2600/* 2601 * ACPI Write Embedded Controller 2602 * 2603 * This reads from ACPI memory space on the EC (EC_ACPI_MEM_*). 2604 * 2605 * Use the following sequence: 2606 * 2607 * - Write EC_CMD_ACPI_WRITE to EC_LPC_ADDR_ACPI_CMD 2608 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2609 * - Write address to EC_LPC_ADDR_ACPI_DATA 2610 * - Wait for EC_LPC_CMDR_PENDING bit to clear 2611 * - Write value to EC_LPC_ADDR_ACPI_DATA 2612 */ 2613#define EC_CMD_ACPI_WRITE 0x81 2614 2615/* 2616 * ACPI Query Embedded Controller 2617 * 2618 * This clears the lowest-order bit in the currently pending host events, and 2619 * sets the result code to the 1-based index of the bit (event 0x00000001 = 1, 2620 * event 0x80000000 = 32), or 0 if no event was pending. 2621 */ 2622#define EC_CMD_ACPI_QUERY_EVENT 0x84 2623 2624/* Valid addresses in ACPI memory space, for read/write commands */ 2625 2626/* Memory space version; set to EC_ACPI_MEM_VERSION_CURRENT */ 2627#define EC_ACPI_MEM_VERSION 0x00 2628/* 2629 * Test location; writing value here updates test compliment byte to (0xff - 2630 * value). 2631 */ 2632#define EC_ACPI_MEM_TEST 0x01 2633/* Test compliment; writes here are ignored. */ 2634#define EC_ACPI_MEM_TEST_COMPLIMENT 0x02 2635 2636/* Keyboard backlight brightness percent (0 - 100) */ 2637#define EC_ACPI_MEM_KEYBOARD_BACKLIGHT 0x03 2638/* DPTF Target Fan Duty (0-100, 0xff for auto/none) */ 2639#define EC_ACPI_MEM_FAN_DUTY 0x04 2640 2641/* 2642 * DPTF temp thresholds. Any of the EC's temp sensors can have up to two 2643 * independent thresholds attached to them. The current value of the ID 2644 * register determines which sensor is affected by the THRESHOLD and COMMIT 2645 * registers. The THRESHOLD register uses the same EC_TEMP_SENSOR_OFFSET scheme 2646 * as the memory-mapped sensors. The COMMIT register applies those settings. 2647 * 2648 * The spec does not mandate any way to read back the threshold settings 2649 * themselves, but when a threshold is crossed the AP needs a way to determine 2650 * which sensor(s) are responsible. Each reading of the ID register clears and 2651 * returns one sensor ID that has crossed one of its threshold (in either 2652 * direction) since the last read. A value of 0xFF means "no new thresholds 2653 * have tripped". Setting or enabling the thresholds for a sensor will clear 2654 * the unread event count for that sensor. 2655 */ 2656#define EC_ACPI_MEM_TEMP_ID 0x05 2657#define EC_ACPI_MEM_TEMP_THRESHOLD 0x06 2658#define EC_ACPI_MEM_TEMP_COMMIT 0x07 2659/* 2660 * Here are the bits for the COMMIT register: 2661 * bit 0 selects the threshold index for the chosen sensor (0/1) 2662 * bit 1 enables/disables the selected threshold (0 = off, 1 = on) 2663 * Each write to the commit register affects one threshold. 2664 */ 2665#define EC_ACPI_MEM_TEMP_COMMIT_SELECT_MASK (1 << 0) 2666#define EC_ACPI_MEM_TEMP_COMMIT_ENABLE_MASK (1 << 1) 2667/* 2668 * Example: 2669 * 2670 * Set the thresholds for sensor 2 to 50 C and 60 C: 2671 * write 2 to [0x05] -- select temp sensor 2 2672 * write 0x7b to [0x06] -- C_TO_K(50) - EC_TEMP_SENSOR_OFFSET 2673 * write 0x2 to [0x07] -- enable threshold 0 with this value 2674 * write 0x85 to [0x06] -- C_TO_K(60) - EC_TEMP_SENSOR_OFFSET 2675 * write 0x3 to [0x07] -- enable threshold 1 with this value 2676 * 2677 * Disable the 60 C threshold, leaving the 50 C threshold unchanged: 2678 * write 2 to [0x05] -- select temp sensor 2 2679 * write 0x1 to [0x07] -- disable threshold 1 2680 */ 2681 2682/* DPTF battery charging current limit */ 2683#define EC_ACPI_MEM_CHARGING_LIMIT 0x08 2684 2685/* Charging limit is specified in 64 mA steps */ 2686#define EC_ACPI_MEM_CHARGING_LIMIT_STEP_MA 64 2687/* Value to disable DPTF battery charging limit */ 2688#define EC_ACPI_MEM_CHARGING_LIMIT_DISABLED 0xff 2689 2690/* Current version of ACPI memory address space */ 2691#define EC_ACPI_MEM_VERSION_CURRENT 1 2692 2693 2694/*****************************************************************************/ 2695/* 2696 * Special commands 2697 * 2698 * These do not follow the normal rules for commands. See each command for 2699 * details. 2700 */ 2701 2702/* 2703 * Reboot NOW 2704 * 2705 * This command will work even when the EC LPC interface is busy, because the 2706 * reboot command is processed at interrupt level. Note that when the EC 2707 * reboots, the host will reboot too, so there is no response to this command. 2708 * 2709 * Use EC_CMD_REBOOT_EC to reboot the EC more politely. 2710 */ 2711#define EC_CMD_REBOOT 0xd1 /* Think "die" */ 2712 2713/* 2714 * Resend last response (not supported on LPC). 2715 * 2716 * Returns EC_RES_UNAVAILABLE if there is no response available - for example, 2717 * there was no previous command, or the previous command's response was too 2718 * big to save. 2719 */ 2720#define EC_CMD_RESEND_RESPONSE 0xdb 2721 2722/* 2723 * This header byte on a command indicate version 0. Any header byte less 2724 * than this means that we are talking to an old EC which doesn't support 2725 * versioning. In that case, we assume version 0. 2726 * 2727 * Header bytes greater than this indicate a later version. For example, 2728 * EC_CMD_VERSION0 + 1 means we are using version 1. 2729 * 2730 * The old EC interface must not use commands 0xdc or higher. 2731 */ 2732#define EC_CMD_VERSION0 0xdc 2733 2734#endif /* !__ACPI__ */ 2735 2736/*****************************************************************************/ 2737/* 2738 * PD commands 2739 * 2740 * These commands are for PD MCU communication. 2741 */ 2742 2743/* EC to PD MCU exchange status command */ 2744#define EC_CMD_PD_EXCHANGE_STATUS 0x100 2745 2746/* Status of EC being sent to PD */ 2747struct ec_params_pd_status { 2748 int8_t batt_soc; /* battery state of charge */ 2749} __packed; 2750 2751/* Status of PD being sent back to EC */ 2752struct ec_response_pd_status { 2753 int8_t status; /* PD MCU status */ 2754 uint32_t curr_lim_ma; /* input current limit */ 2755} __packed; 2756 2757/* Set USB type-C port role and muxes */ 2758#define EC_CMD_USB_PD_CONTROL 0x101 2759 2760enum usb_pd_control_role { 2761 USB_PD_CTRL_ROLE_NO_CHANGE = 0, 2762 USB_PD_CTRL_ROLE_TOGGLE_ON = 1, /* == AUTO */ 2763 USB_PD_CTRL_ROLE_TOGGLE_OFF = 2, 2764 USB_PD_CTRL_ROLE_FORCE_SINK = 3, 2765 USB_PD_CTRL_ROLE_FORCE_SOURCE = 4, 2766}; 2767 2768enum usb_pd_control_mux { 2769 USB_PD_CTRL_MUX_NO_CHANGE = 0, 2770 USB_PD_CTRL_MUX_NONE = 1, 2771 USB_PD_CTRL_MUX_USB = 2, 2772 USB_PD_CTRL_MUX_DP = 3, 2773 USB_PD_CTRL_MUX_DOCK = 4, 2774 USB_PD_CTRL_MUX_AUTO = 5, 2775}; 2776 2777struct ec_params_usb_pd_control { 2778 uint8_t port; 2779 uint8_t role; 2780 uint8_t mux; 2781} __packed; 2782 2783/*****************************************************************************/ 2784/* 2785 * Passthru commands 2786 * 2787 * Some platforms have sub-processors chained to each other. For example. 2788 * 2789 * AP <--> EC <--> PD MCU 2790 * 2791 * The top 2 bits of the command number are used to indicate which device the 2792 * command is intended for. Device 0 is always the device receiving the 2793 * command; other device mapping is board-specific. 2794 * 2795 * When a device receives a command to be passed to a sub-processor, it passes 2796 * it on with the device number set back to 0. This allows the sub-processor 2797 * to remain blissfully unaware of whether the command originated on the next 2798 * device up the chain, or was passed through from the AP. 2799 * 2800 * In the above example, if the AP wants to send command 0x0002 to the PD MCU, 2801 * AP sends command 0x4002 to the EC 2802 * EC sends command 0x0002 to the PD MCU 2803 * EC forwards PD MCU response back to the AP 2804 */ 2805 2806/* Offset and max command number for sub-device n */ 2807#define EC_CMD_PASSTHRU_OFFSET(n) (0x4000 * (n)) 2808#define EC_CMD_PASSTHRU_MAX(n) (EC_CMD_PASSTHRU_OFFSET(n) + 0x3fff) 2809 2810/*****************************************************************************/ 2811/* 2812 * Deprecated constants. These constants have been renamed for clarity. The 2813 * meaning and size has not changed. Programs that use the old names should 2814 * switch to the new names soon, as the old names may not be carried forward 2815 * forever. 2816 */ 2817#define EC_HOST_PARAM_SIZE EC_PROTO2_MAX_PARAM_SIZE 2818#define EC_LPC_ADDR_OLD_PARAM EC_HOST_CMD_REGION1 2819#define EC_OLD_PARAM_SIZE EC_HOST_CMD_REGION_SIZE 2820 2821#endif /* __CROS_EC_COMMANDS_H */ 2822