include/asm-powerpc/smu.h

   1 #ifndef _SMU_H
   2 #define _SMU_H
   3
   4 /*
   5  * Definitions for talking to the SMU chip in newer G5 PowerMacs
   6  */
   7 #ifdef __KERNEL__
   8 #include <linux/config.h>
   9 #include <linux/list.h>
  10 #endif
  11 #include <linux/types.h>
  12
  13 /*
  14  * Known SMU commands
  15  *
  16  * Most of what is below comes from looking at the Open Firmware driver,
  17  * though this is still incomplete and could use better documentation here
  18  * or there...
  19  */
  20
  21
  22 /*
  23  * Partition info commands
  24  *
  25  * These commands are used to retreive the sdb-partition-XX datas from
  26  * the SMU. The lenght is always 2. First byte is the subcommand code
  27  * and second byte is the partition ID.
  28  *
  29  * The reply is 6 bytes:
  30  *
  31  *  - 0..1 : partition address
  32  *  - 2    : a byte containing the partition ID
  33  *  - 3    : length (maybe other bits are rest of header ?)
  34  *
  35  * The data must then be obtained with calls to another command:
  36  * SMU_CMD_MISC_ee_GET_DATABLOCK_REC (described below).
  37  */
  38 #define SMU_CMD_PARTITION_COMMAND               0x3e
  39 #define   SMU_CMD_PARTITION_LATEST              0x01
  40 #define   SMU_CMD_PARTITION_BASE                0x02
  41 #define   SMU_CMD_PARTITION_UPDATE              0x03
  42
  43
  44 /*
  45  * Fan control
  46  *
  47  * This is a "mux" for fan control commands. The command seem to
  48  * act differently based on the number of arguments. With 1 byte
  49  * of argument, this seem to be queries for fans status, setpoint,
  50  * etc..., while with 0xe arguments, we will set the fans speeds.
  51  *
  52  * Queries (1 byte arg):
  53  * ---------------------
  54  *
  55  * arg=0x01: read RPM fans status
  56  * arg=0x02: read RPM fans setpoint
  57  * arg=0x11: read PWM fans status
  58  * arg=0x12: read PWM fans setpoint
  59  *
  60  * the "status" queries return the current speed while the "setpoint" ones
  61  * return the programmed/target speed. It _seems_ that the result is a bit
  62  * mask in the first byte of active/available fans, followed by 6 words (16
  63  * bits) containing the requested speed.
  64  *
  65  * Setpoint (14 bytes arg):
  66  * ------------------------
  67  *
  68  * first arg byte is 0 for RPM fans and 0x10 for PWM. Second arg byte is the
  69  * mask of fans affected by the command. Followed by 6 words containing the
  70  * setpoint value for selected fans in the mask (or 0 if mask value is 0)
  71  */
  72 #define SMU_CMD_FAN_COMMAND                     0x4a
  73
  74
  75 /*
  76  * Battery access
  77  *
  78  * Same command number as the PMU, could it be same syntax ?
  79  */
  80 #define SMU_CMD_BATTERY_COMMAND                 0x6f
  81 #define   SMU_CMD_GET_BATTERY_INFO              0x00
  82
  83 /*
  84  * Real time clock control
  85  *
  86  * This is a "mux", first data byte contains the "sub" command.
  87  * The "RTC" part of the SMU controls the date, time, powerup
  88  * timer, but also a PRAM
  89  *
  90  * Dates are in BCD format on 7 bytes:
  91  * [sec] [min] [hour] [weekday] [month day] [month] [year]
  92  * with month being 1 based and year minus 100
  93  */
  94 #define SMU_CMD_RTC_COMMAND                     0x8e
  95 #define   SMU_CMD_RTC_SET_PWRUP_TIMER           0x00 /* i: 7 bytes date */
  96 #define   SMU_CMD_RTC_GET_PWRUP_TIMER           0x01 /* o: 7 bytes date */
  97 #define   SMU_CMD_RTC_STOP_PWRUP_TIMER          0x02
  98 #define   SMU_CMD_RTC_SET_PRAM_BYTE_ACC         0x20 /* i: 1 byte (address?) */
  99 #define   SMU_CMD_RTC_SET_PRAM_AUTOINC          0x21 /* i: 1 byte (data?) */
 100 #define   SMU_CMD_RTC_SET_PRAM_LO_BYTES         0x22 /* i: 10 bytes */
 101 #define   SMU_CMD_RTC_SET_PRAM_HI_BYTES         0x23 /* i: 10 bytes */
 102 #define   SMU_CMD_RTC_GET_PRAM_BYTE             0x28 /* i: 1 bytes (address?) */
 103 #define   SMU_CMD_RTC_GET_PRAM_LO_BYTES         0x29 /* o: 10 bytes */
 104 #define   SMU_CMD_RTC_GET_PRAM_HI_BYTES         0x2a /* o: 10 bytes */
 105 #define   SMU_CMD_RTC_SET_DATETIME              0x80 /* i: 7 bytes date */
 106 #define   SMU_CMD_RTC_GET_DATETIME              0x81 /* o: 7 bytes date */
 107
 108  /*
 109   * i2c commands
 110   *
 111   * To issue an i2c command, first is to send a parameter block to the
 112   * the SMU. This is a command of type 0x9a with 9 bytes of header
 113   * eventually followed by data for a write:
 114   *
 115   * 0: bus number (from device-tree usually, SMU has lots of busses !)
 116   * 1: transfer type/format (see below)
 117   * 2: device address. For combined and combined4 type transfers, this
 118   *    is the "write" version of the address (bit 0x01 cleared)
 119   * 3: subaddress length (0..3)
 120   * 4: subaddress byte 0 (or only byte for subaddress length 1)
 121   * 5: subaddress byte 1
 122   * 6: subaddress byte 2
 123   * 7: combined address (device address for combined mode data phase)
 124   * 8: data length
 125   *
 126   * The transfer types are the same good old Apple ones it seems,
 127   * that is:
 128   *   - 0x00: Simple transfer
 129   *   - 0x01: Subaddress transfer (addr write + data tx, no restart)
 130   *   - 0x02: Combined transfer (addr write + restart + data tx)
 131   *
 132   * This is then followed by actual data for a write.
 133   *
 134   * At this point, the OF driver seems to have a limitation on transfer
 135   * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know
 136   * wether this is just an OF limit due to some temporary buffer size
 137   * or if this is an SMU imposed limit. This driver has the same limitation
 138   * for now as I use a 0x10 bytes temporary buffer as well
 139   *
 140   * Once that is completed, a response is expected from the SMU. This is
 141   * obtained via a command of type 0x9a with a length of 1 byte containing
 142   * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's
 143   * though I can't tell yet if this is actually necessary. Once this command
 144   * is complete, at this point, all I can tell is what OF does. OF tests
 145   * byte 0 of the reply:
 146   *   - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ?
 147   *   - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0)
 148   *   - on write, < 0 -> failure (immediate exit)
 149   *   - else, OF just exists (without error, weird)
 150   *
 151   * So on read, there is this wait-for-busy thing when getting a 0xfc or
 152   * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and
 153   * doing the above again until either the retries expire or the result
 154   * is no longer 0xfe or 0xfc
 155   *
 156   * The Darwin I2C driver is less subtle though. On any non-success status
 157   * from the response command, it waits 5ms and tries again up to 20 times,
 158   * it doesn't differenciate between fatal errors or "busy" status.
 159   *
 160   * This driver provides an asynchronous paramblock based i2c command
 161   * interface to be used either directly by low level code or by a higher
 162   * level driver interfacing to the linux i2c layer. The current
 163   * implementation of this relies on working timers & timer interrupts
 164   * though, so be careful of calling context for now. This may be "fixed"
 165   * in the future by adding a polling facility.
 166   */
 167 #define SMU_CMD_I2C_COMMAND                     0x9a
 168           /* transfer types */
 169 #define   SMU_I2C_TRANSFER_SIMPLE       0x00
 170 #define   SMU_I2C_TRANSFER_STDSUB       0x01
 171 #define   SMU_I2C_TRANSFER_COMBINED     0x02
 172
 173 /*
 174  * Power supply control
 175  *
 176  * The "sub" command is an ASCII string in the data, the
 177  * data lenght is that of the string.
 178  *
 179  * The VSLEW command can be used to get or set the voltage slewing.
 180  *  - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of
 181  *    reply at data offset 6, 7 and 8.
 182  *  - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is
 183  *    used to set the voltage slewing point. The SMU replies with "DONE"
 184  * I yet have to figure out their exact meaning of those 3 bytes in
 185  * both cases. They seem to be:
 186  *  x = processor mask
 187  *  y = op. point index
 188  *  z = processor freq. step index
 189  * I haven't yet decyphered result codes
 190  *
 191  */
 192 #define SMU_CMD_POWER_COMMAND                   0xaa
 193 #define   SMU_CMD_POWER_RESTART                 "RESTART"
 194 #define   SMU_CMD_POWER_SHUTDOWN                "SHUTDOWN"
 195 #define   SMU_CMD_POWER_VOLTAGE_SLEW            "VSLEW"
 196
 197 /*
 198  * Read ADC sensors
 199  *
 200  * This command takes one byte of parameter: the sensor ID (or "reg"
 201  * value in the device-tree) and returns a 16 bits value
 202  */
 203 #define SMU_CMD_READ_ADC                        0xd8
 204
 205 /* Misc commands
 206  *
 207  * This command seem to be a grab bag of various things
 208  */
 209 #define SMU_CMD_MISC_df_COMMAND                 0xdf
 210 #define   SMU_CMD_MISC_df_SET_DISPLAY_LIT       0x02 /* i: 1 byte */
 211 #define   SMU_CMD_MISC_df_NMI_OPTION            0x04
 212
 213 /*
 214  * Version info commands
 215  *
 216  * I haven't quite tried to figure out how these work
 217  */
 218 #define SMU_CMD_VERSION_COMMAND                 0xea
 219
 220
 221 /*
 222  * Misc commands
 223  *
 224  * This command seem to be a grab bag of various things
 225  *
 226  * SMU_CMD_MISC_ee_GET_DATABLOCK_REC is used, among others, to
 227  * transfer blocks of data from the SMU. So far, I've decrypted it's
 228  * usage to retreive partition data. In order to do that, you have to
 229  * break your transfer in "chunks" since that command cannot transfer
 230  * more than a chunk at a time. The chunk size used by OF is 0xe bytes,
 231  * but it seems that the darwin driver will let you do 0x1e bytes if
 232  * your "PMU" version is >= 0x30. You can get the "PMU" version apparently
 233  * either in the last 16 bits of property "smu-version-pmu" or as the 16
 234  * bytes at offset 1 of "smu-version-info"
 235  *
 236  * For each chunk, the command takes 7 bytes of arguments:
 237  *  byte 0: subcommand code (0x02)
 238  *  byte 1: 0x04 (always, I don't know what it means, maybe the address
 239  *                space to use or some other nicety. It's hard coded in OF)
 240  *  byte 2..5: SMU address of the chunk (big endian 32 bits)
 241  *  byte 6: size to transfer (up to max chunk size)
 242  *
 243  * The data is returned directly
 244  */
 245 #define SMU_CMD_MISC_ee_COMMAND                 0xee
 246 #define   SMU_CMD_MISC_ee_GET_DATABLOCK_REC     0x02
 247 #define   SMU_CMD_MISC_ee_LEDS_CTRL             0x04 /* i: 00 (00,01) [00] */
 248 #define   SMU_CMD_MISC_ee_GET_DATA              0x05 /* i: 00 , o: ?? */
 249
 250
 251
 252 /*
 253  * - Kernel side interface -
 254  */
 255
 256 #ifdef __KERNEL__
 257
 258 /*
 259  * Asynchronous SMU commands
 260  *
 261  * Fill up this structure and submit it via smu_queue_command(),
 262  * and get notified by the optional done() callback, or because
 263  * status becomes != 1
 264  */
 265
 266 struct smu_cmd;
 267
 268 struct smu_cmd
 269 {
 270         /* public */
 271         u8                      cmd;            /* command */
 272         int                     data_len;       /* data len */
 273         int                     reply_len;      /* reply len */
 274         void                    *data_buf;      /* data buffer */
 275         void                    *reply_buf;     /* reply buffer */
 276         int                     status;         /* command status */
 277         void                    (*done)(struct smu_cmd *cmd, void *misc);
 278         void                    *misc;
 279
 280         /* private */
 281         struct list_head        link;
 282 };
 283
 284 /*
 285  * Queues an SMU command, all fields have to be initialized
 286  */
 287 extern int smu_queue_cmd(struct smu_cmd *cmd);
 288
 289 /*
 290  * Simple command wrapper. This structure embeds a small buffer
 291  * to ease sending simple SMU commands from the stack
 292  */
 293 struct smu_simple_cmd
 294 {
 295         struct smu_cmd  cmd;
 296         u8              buffer[16];
 297 };
 298
 299 /*
 300  * Queues a simple command. All fields will be initialized by that
 301  * function
 302  */
 303 extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
 304                             unsigned int data_len,
 305                             void (*done)(struct smu_cmd *cmd, void *misc),
 306                             void *misc,
 307                             ...);
 308
 309 /*
 310  * Completion helper. Pass it to smu_queue_simple or as 'done'
 311  * member to smu_queue_cmd, it will call complete() on the struct
 312  * completion passed in the "misc" argument
 313  */
 314 extern void smu_done_complete(struct smu_cmd *cmd, void *misc);
 315
 316 /*
 317  * Synchronous helpers. Will spin-wait for completion of a command
 318  */
 319 extern void smu_spinwait_cmd(struct smu_cmd *cmd);
 320
 321 static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd)
 322 {
 323         smu_spinwait_cmd(&scmd->cmd);
 324 }
 325
 326 /*
 327  * Poll routine to call if blocked with irqs off
 328  */
 329 extern void smu_poll(void);
 330
 331
 332 /*
 333  * Init routine, presence check....
 334  */
 335 extern int smu_init(void);
 336 extern int smu_present(void);
 337 struct of_device;
 338 extern struct of_device *smu_get_ofdev(void);
 339
 340
 341 /*
 342  * Common command wrappers
 343  */
 344 extern void smu_shutdown(void);
 345 extern void smu_restart(void);
 346 struct rtc_time;
 347 extern int smu_get_rtc_time(struct rtc_time *time, int spinwait);
 348 extern int smu_set_rtc_time(struct rtc_time *time, int spinwait);
 349
 350 /*
 351  * SMU command buffer absolute address, exported by pmac_setup,
 352  * this is allocated very early during boot.
 353  */
 354 extern unsigned long smu_cmdbuf_abs;
 355
 356
 357 /*
 358  * Kenrel asynchronous i2c interface
 359  */
 360
 361 /* SMU i2c header, exactly matches i2c header on wire */
 362 struct smu_i2c_param
 363 {
 364         u8      bus;            /* SMU bus ID (from device tree) */
 365         u8      type;           /* i2c transfer type */
 366         u8      devaddr;        /* device address (includes direction) */
 367         u8      sublen;         /* subaddress length */
 368         u8      subaddr[3];     /* subaddress */
 369         u8      caddr;          /* combined address, filled by SMU driver */
 370         u8      datalen;        /* length of transfer */
 371         u8      data[7];        /* data */
 372 };
 373
 374 #define SMU_I2C_READ_MAX        0x0d
 375 #define SMU_I2C_WRITE_MAX       0x05
 376
 377 struct smu_i2c_cmd
 378 {
 379         /* public */
 380         struct smu_i2c_param    info;
 381         void                    (*done)(struct smu_i2c_cmd *cmd, void *misc);
 382         void                    *misc;
 383         int                     status; /* 1 = pending, 0 = ok, <0 = fail */
 384
 385         /* private */
 386         struct smu_cmd          scmd;
 387         int                     read;
 388         int                     stage;
 389         int                     retries;
 390         u8                      pdata[0x10];
 391         struct list_head        link;
 392 };
 393
 394 /*
 395  * Call this to queue an i2c command to the SMU. You must fill info,
 396  * including info.data for a write, done and misc.
 397  * For now, no polling interface is provided so you have to use completion
 398  * callback.
 399  */
 400 extern int smu_queue_i2c(struct smu_i2c_cmd *cmd);
 401
 402
 403 #endif /* __KERNEL__ */
 404
 405
 406 /*
 407  * - SMU "sdb" partitions informations -
 408  */
 409
 410
 411 /*
 412  * Partition header format
 413  */
 414 struct smu_sdbp_header {
 415         __u8    id;
 416         __u8    len;
 417         __u8    version;
 418         __u8    flags;
 419 };
 420
 421
 422  /*
 423  * demangle 16 and 32 bits integer in some SMU partitions
 424  * (currently, afaik, this concerns only the FVT partition
 425  * (0x12)
 426  */
 427 #define SMU_U16_MIX(x)  le16_to_cpu(x);
 428 #define SMU_U32_MIX(x)  ((((x) & 0xff00ff00u) >> 8)|(((x) & 0x00ff00ffu) << 8))
 429
 430
 431 /* This is the definition of the SMU sdb-partition-0x12 table (called
 432  * CPU F/V/T operating points in Darwin). The definition for all those
 433  * SMU tables should be moved to some separate file
 434  */
 435 #define SMU_SDB_FVT_ID                  0x12
 436
 437 struct smu_sdbp_fvt {
 438         __u32   sysclk;                 /* Base SysClk frequency in Hz for
 439                                          * this operating point. Value need to
 440                                          * be unmixed with SMU_U32_MIX()
 441                                          */
 442         __u8    pad;
 443         __u8    maxtemp;                /* Max temp. supported by this
 444                                          * operating point
 445                                          */
 446
 447         __u16   volts[3];               /* CPU core voltage for the 3
 448                                          * PowerTune modes, a mode with
 449                                          * 0V = not supported. Value need
 450                                          * to be unmixed with SMU_U16_MIX()
 451                                          */
 452 };
 453
 454 /* This partition contains voltage & current sensor calibration
 455  * informations
 456  */
 457 #define SMU_SDB_CPUVCP_ID               0x21
 458
 459 struct smu_sdbp_cpuvcp {
 460         __u16   volt_scale;             /* u4.12 fixed point */
 461         __s16   volt_offset;            /* s4.12 fixed point */
 462         __u16   curr_scale;             /* u4.12 fixed point */
 463         __s16   curr_offset;            /* s4.12 fixed point */
 464         __s32   power_quads[3];         /* s4.28 fixed point */
 465 };
 466
 467 /* This partition contains CPU thermal diode calibration
 468  */
 469 #define SMU_SDB_CPUDIODE_ID             0x18
 470
 471 struct smu_sdbp_cpudiode {
 472         __u16   m_value;                /* u1.15 fixed point */
 473         __s16   b_value;                /* s10.6 fixed point */
 474
 475 };
 476
 477 /* This partition contains Slots power calibration
 478  */
 479 #define SMU_SDB_SLOTSPOW_ID             0x78
 480
 481 struct smu_sdbp_slotspow {
 482         __u16   pow_scale;              /* u4.12 fixed point */
 483         __s16   pow_offset;             /* s4.12 fixed point */
 484 };
 485
 486 /* This partition contains machine specific version information about
 487  * the sensor/control layout
 488  */
 489 #define SMU_SDB_SENSORTREE_ID           0x25
 490
 491 struct smu_sdbp_sensortree {
 492         __u8    model_id;
 493         __u8    unknown[3];
 494 };
 495
 496 /* This partition contains CPU thermal control PID informations. So far
 497  * only single CPU machines have been seen with an SMU, so we assume this
 498  * carries only informations for those
 499  */
 500 #define SMU_SDB_CPUPIDDATA_ID           0x17
 501
 502 struct smu_sdbp_cpupiddata {
 503         __u8    unknown1;
 504         __u8    target_temp_delta;
 505         __u8    unknown2;
 506         __u8    history_len;
 507         __s16   power_adj;
 508         __u16   max_power;
 509         __s32   gp,gr,gd;
 510 };
 511
 512
 513 /* Other partitions without known structures */
 514 #define SMU_SDB_DEBUG_SWITCHES_ID       0x05
 515
 516 #ifdef __KERNEL__
 517 /*
 518  * This returns the pointer to an SMU "sdb" partition data or NULL
 519  * if not found. The data format is described below
 520  */
 521 extern struct smu_sdbp_header *smu_get_sdb_partition(int id,
 522                                                      unsigned int *size);
 523
 524 #endif /* __KERNEL__ */
 525
 526
 527 /*
 528  * - Userland interface -
 529  */
 530
 531 /*
 532  * A given instance of the device can be configured for 2 different
 533  * things at the moment:
 534  *
 535  *  - sending SMU commands (default at open() time)
 536  *  - receiving SMU events (not yet implemented)
 537  *
 538  * Commands are written with write() of a command block. They can be
 539  * "driver" commands (for example to switch to event reception mode)
 540  * or real SMU commands. They are made of a header followed by command
 541  * data if any.
 542  *
 543  * For SMU commands (not for driver commands), you can then read() back
 544  * a reply. The reader will be blocked or not depending on how the device
 545  * file is opened. poll() isn't implemented yet. The reply will consist
 546  * of a header as well, followed by the reply data if any. You should
 547  * always provide a buffer large enough for the maximum reply data, I
 548  * recommand one page.
 549  *
 550  * It is illegal to send SMU commands through a file descriptor configured
 551  * for events reception
 552  *
 553  */
 554 struct smu_user_cmd_hdr
 555 {
 556         __u32           cmdtype;
 557 #define SMU_CMDTYPE_SMU                 0       /* SMU command */
 558 #define SMU_CMDTYPE_WANTS_EVENTS        1       /* switch fd to events mode */
 559 #define SMU_CMDTYPE_GET_PARTITION       2       /* retreive an sdb partition */
 560
 561         __u8            cmd;                    /* SMU command byte */
 562         __u8            pad[3];                 /* padding */
 563         __u32           data_len;               /* Lenght of data following */
 564 };
 565
 566 struct smu_user_reply_hdr
 567 {
 568         __u32           status;                 /* Command status */
 569         __u32           reply_len;              /* Lenght of data follwing */
 570 };
 571
 572 #endif /*  _SMU_H */