include/asm-powerpc/smu.h

   1 #ifndef _SMU_H
   2 #define _SMU_H
   3
   4 /*
   5  * Definitions for talking to the SMU chip in newer G5 PowerMacs
   6  */
   7 #ifdef __KERNEL__
   8 #include <linux/list.h>
   9 #endif
  10 #include <linux/types.h>
  11
  12 /*
  13  * Known SMU commands
  14  *
  15  * Most of what is below comes from looking at the Open Firmware driver,
  16  * though this is still incomplete and could use better documentation here
  17  * or there...
  18  */
  19
  20
  21 /*
  22  * Partition info commands
  23  *
  24  * These commands are used to retrieve the sdb-partition-XX datas from
  25  * the SMU. The lenght is always 2. First byte is the subcommand code
  26  * and second byte is the partition ID.
  27  *
  28  * The reply is 6 bytes:
  29  *
  30  *  - 0..1 : partition address
  31  *  - 2    : a byte containing the partition ID
  32  *  - 3    : length (maybe other bits are rest of header ?)
  33  *
  34  * The data must then be obtained with calls to another command:
  35  * SMU_CMD_MISC_ee_GET_DATABLOCK_REC (described below).
  36  */
  37 #define SMU_CMD_PARTITION_COMMAND               0x3e
  38 #define   SMU_CMD_PARTITION_LATEST              0x01
  39 #define   SMU_CMD_PARTITION_BASE                0x02
  40 #define   SMU_CMD_PARTITION_UPDATE              0x03
  41
  42
  43 /*
  44  * Fan control
  45  *
  46  * This is a "mux" for fan control commands. The command seem to
  47  * act differently based on the number of arguments. With 1 byte
  48  * of argument, this seem to be queries for fans status, setpoint,
  49  * etc..., while with 0xe arguments, we will set the fans speeds.
  50  *
  51  * Queries (1 byte arg):
  52  * ---------------------
  53  *
  54  * arg=0x01: read RPM fans status
  55  * arg=0x02: read RPM fans setpoint
  56  * arg=0x11: read PWM fans status
  57  * arg=0x12: read PWM fans setpoint
  58  *
  59  * the "status" queries return the current speed while the "setpoint" ones
  60  * return the programmed/target speed. It _seems_ that the result is a bit
  61  * mask in the first byte of active/available fans, followed by 6 words (16
  62  * bits) containing the requested speed.
  63  *
  64  * Setpoint (14 bytes arg):
  65  * ------------------------
  66  *
  67  * first arg byte is 0 for RPM fans and 0x10 for PWM. Second arg byte is the
  68  * mask of fans affected by the command. Followed by 6 words containing the
  69  * setpoint value for selected fans in the mask (or 0 if mask value is 0)
  70  */
  71 #define SMU_CMD_FAN_COMMAND                     0x4a
  72
  73
  74 /*
  75  * Battery access
  76  *
  77  * Same command number as the PMU, could it be same syntax ?
  78  */
  79 #define SMU_CMD_BATTERY_COMMAND                 0x6f
  80 #define   SMU_CMD_GET_BATTERY_INFO              0x00
  81
  82 /*
  83  * Real time clock control
  84  *
  85  * This is a "mux", first data byte contains the "sub" command.
  86  * The "RTC" part of the SMU controls the date, time, powerup
  87  * timer, but also a PRAM
  88  *
  89  * Dates are in BCD format on 7 bytes:
  90  * [sec] [min] [hour] [weekday] [month day] [month] [year]
  91  * with month being 1 based and year minus 100
  92  */
  93 #define SMU_CMD_RTC_COMMAND                     0x8e
  94 #define   SMU_CMD_RTC_SET_PWRUP_TIMER           0x00 /* i: 7 bytes date */
  95 #define   SMU_CMD_RTC_GET_PWRUP_TIMER           0x01 /* o: 7 bytes date */
  96 #define   SMU_CMD_RTC_STOP_PWRUP_TIMER          0x02
  97 #define   SMU_CMD_RTC_SET_PRAM_BYTE_ACC         0x20 /* i: 1 byte (address?) */
  98 #define   SMU_CMD_RTC_SET_PRAM_AUTOINC          0x21 /* i: 1 byte (data?) */
  99 #define   SMU_CMD_RTC_SET_PRAM_LO_BYTES         0x22 /* i: 10 bytes */
 100 #define   SMU_CMD_RTC_SET_PRAM_HI_BYTES         0x23 /* i: 10 bytes */
 101 #define   SMU_CMD_RTC_GET_PRAM_BYTE             0x28 /* i: 1 bytes (address?) */
 102 #define   SMU_CMD_RTC_GET_PRAM_LO_BYTES         0x29 /* o: 10 bytes */
 103 #define   SMU_CMD_RTC_GET_PRAM_HI_BYTES         0x2a /* o: 10 bytes */
 104 #define   SMU_CMD_RTC_SET_DATETIME              0x80 /* i: 7 bytes date */
 105 #define   SMU_CMD_RTC_GET_DATETIME              0x81 /* o: 7 bytes date */
 106
 107  /*
 108   * i2c commands
 109   *
 110   * To issue an i2c command, first is to send a parameter block to the
 111   * the SMU. This is a command of type 0x9a with 9 bytes of header
 112   * eventually followed by data for a write:
 113   *
 114   * 0: bus number (from device-tree usually, SMU has lots of busses !)
 115   * 1: transfer type/format (see below)
 116   * 2: device address. For combined and combined4 type transfers, this
 117   *    is the "write" version of the address (bit 0x01 cleared)
 118   * 3: subaddress length (0..3)
 119   * 4: subaddress byte 0 (or only byte for subaddress length 1)
 120   * 5: subaddress byte 1
 121   * 6: subaddress byte 2
 122   * 7: combined address (device address for combined mode data phase)
 123   * 8: data length
 124   *
 125   * The transfer types are the same good old Apple ones it seems,
 126   * that is:
 127   *   - 0x00: Simple transfer
 128   *   - 0x01: Subaddress transfer (addr write + data tx, no restart)
 129   *   - 0x02: Combined transfer (addr write + restart + data tx)
 130   *
 131   * This is then followed by actual data for a write.
 132   *
 133   * At this point, the OF driver seems to have a limitation on transfer
 134   * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know
 135   * wether this is just an OF limit due to some temporary buffer size
 136   * or if this is an SMU imposed limit. This driver has the same limitation
 137   * for now as I use a 0x10 bytes temporary buffer as well
 138   *
 139   * Once that is completed, a response is expected from the SMU. This is
 140   * obtained via a command of type 0x9a with a length of 1 byte containing
 141   * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's
 142   * though I can't tell yet if this is actually necessary. Once this command
 143   * is complete, at this point, all I can tell is what OF does. OF tests
 144   * byte 0 of the reply:
 145   *   - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ?
 146   *   - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0)
 147   *   - on write, < 0 -> failure (immediate exit)
 148   *   - else, OF just exists (without error, weird)
 149   *
 150   * So on read, there is this wait-for-busy thing when getting a 0xfc or
 151   * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and
 152   * doing the above again until either the retries expire or the result
 153   * is no longer 0xfe or 0xfc
 154   *
 155   * The Darwin I2C driver is less subtle though. On any non-success status
 156   * from the response command, it waits 5ms and tries again up to 20 times,
 157   * it doesn't differenciate between fatal errors or "busy" status.
 158   *
 159   * This driver provides an asynchronous paramblock based i2c command
 160   * interface to be used either directly by low level code or by a higher
 161   * level driver interfacing to the linux i2c layer. The current
 162   * implementation of this relies on working timers & timer interrupts
 163   * though, so be careful of calling context for now. This may be "fixed"
 164   * in the future by adding a polling facility.
 165   */
 166 #define SMU_CMD_I2C_COMMAND                     0x9a
 167           /* transfer types */
 168 #define   SMU_I2C_TRANSFER_SIMPLE       0x00
 169 #define   SMU_I2C_TRANSFER_STDSUB       0x01
 170 #define   SMU_I2C_TRANSFER_COMBINED     0x02
 171
 172 /*
 173  * Power supply control
 174  *
 175  * The "sub" command is an ASCII string in the data, the
 176  * data lenght is that of the string.
 177  *
 178  * The VSLEW command can be used to get or set the voltage slewing.
 179  *  - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of
 180  *    reply at data offset 6, 7 and 8.
 181  *  - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is
 182  *    used to set the voltage slewing point. The SMU replies with "DONE"
 183  * I yet have to figure out their exact meaning of those 3 bytes in
 184  * both cases. They seem to be:
 185  *  x = processor mask
 186  *  y = op. point index
 187  *  z = processor freq. step index
 188  * I haven't yet decyphered result codes
 189  *
 190  */
 191 #define SMU_CMD_POWER_COMMAND                   0xaa
 192 #define   SMU_CMD_POWER_RESTART                 "RESTART"
 193 #define   SMU_CMD_POWER_SHUTDOWN                "SHUTDOWN"
 194 #define   SMU_CMD_POWER_VOLTAGE_SLEW            "VSLEW"
 195
 196 /*
 197  * Read ADC sensors
 198  *
 199  * This command takes one byte of parameter: the sensor ID (or "reg"
 200  * value in the device-tree) and returns a 16 bits value
 201  */
 202 #define SMU_CMD_READ_ADC                        0xd8
 203
 204 /* Misc commands
 205  *
 206  * This command seem to be a grab bag of various things
 207  */
 208 #define SMU_CMD_MISC_df_COMMAND                 0xdf
 209 #define   SMU_CMD_MISC_df_SET_DISPLAY_LIT       0x02 /* i: 1 byte */
 210 #define   SMU_CMD_MISC_df_NMI_OPTION            0x04
 211
 212 /*
 213  * Version info commands
 214  *
 215  * I haven't quite tried to figure out how these work
 216  */
 217 #define SMU_CMD_VERSION_COMMAND                 0xea
 218
 219
 220 /*
 221  * Misc commands
 222  *
 223  * This command seem to be a grab bag of various things
 224  *
 225  * SMU_CMD_MISC_ee_GET_DATABLOCK_REC is used, among others, to
 226  * transfer blocks of data from the SMU. So far, I've decrypted it's
 227  * usage to retrieve partition data. In order to do that, you have to
 228  * break your transfer in "chunks" since that command cannot transfer
 229  * more than a chunk at a time. The chunk size used by OF is 0xe bytes,
 230  * but it seems that the darwin driver will let you do 0x1e bytes if
 231  * your "PMU" version is >= 0x30. You can get the "PMU" version apparently
 232  * either in the last 16 bits of property "smu-version-pmu" or as the 16
 233  * bytes at offset 1 of "smu-version-info"
 234  *
 235  * For each chunk, the command takes 7 bytes of arguments:
 236  *  byte 0: subcommand code (0x02)
 237  *  byte 1: 0x04 (always, I don't know what it means, maybe the address
 238  *                space to use or some other nicety. It's hard coded in OF)
 239  *  byte 2..5: SMU address of the chunk (big endian 32 bits)
 240  *  byte 6: size to transfer (up to max chunk size)
 241  *
 242  * The data is returned directly
 243  */
 244 #define SMU_CMD_MISC_ee_COMMAND                 0xee
 245 #define   SMU_CMD_MISC_ee_GET_DATABLOCK_REC     0x02
 246 #define   SMU_CMD_MISC_ee_LEDS_CTRL             0x04 /* i: 00 (00,01) [00] */
 247 #define   SMU_CMD_MISC_ee_GET_DATA              0x05 /* i: 00 , o: ?? */
 248
 249
 250
 251 /*
 252  * - Kernel side interface -
 253  */
 254
 255 #ifdef __KERNEL__
 256
 257 /*
 258  * Asynchronous SMU commands
 259  *
 260  * Fill up this structure and submit it via smu_queue_command(),
 261  * and get notified by the optional done() callback, or because
 262  * status becomes != 1
 263  */
 264
 265 struct smu_cmd;
 266
 267 struct smu_cmd
 268 {
 269         /* public */
 270         u8                      cmd;            /* command */
 271         int                     data_len;       /* data len */
 272         int                     reply_len;      /* reply len */
 273         void                    *data_buf;      /* data buffer */
 274         void                    *reply_buf;     /* reply buffer */
 275         int                     status;         /* command status */
 276         void                    (*done)(struct smu_cmd *cmd, void *misc);
 277         void                    *misc;
 278
 279         /* private */
 280         struct list_head        link;
 281 };
 282
 283 /*
 284  * Queues an SMU command, all fields have to be initialized
 285  */
 286 extern int smu_queue_cmd(struct smu_cmd *cmd);
 287
 288 /*
 289  * Simple command wrapper. This structure embeds a small buffer
 290  * to ease sending simple SMU commands from the stack
 291  */
 292 struct smu_simple_cmd
 293 {
 294         struct smu_cmd  cmd;
 295         u8              buffer[16];
 296 };
 297
 298 /*
 299  * Queues a simple command. All fields will be initialized by that
 300  * function
 301  */
 302 extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
 303                             unsigned int data_len,
 304                             void (*done)(struct smu_cmd *cmd, void *misc),
 305                             void *misc,
 306                             ...);
 307
 308 /*
 309  * Completion helper. Pass it to smu_queue_simple or as 'done'
 310  * member to smu_queue_cmd, it will call complete() on the struct
 311  * completion passed in the "misc" argument
 312  */
 313 extern void smu_done_complete(struct smu_cmd *cmd, void *misc);
 314
 315 /*
 316  * Synchronous helpers. Will spin-wait for completion of a command
 317  */
 318 extern void smu_spinwait_cmd(struct smu_cmd *cmd);
 319
 320 static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd)
 321 {
 322         smu_spinwait_cmd(&scmd->cmd);
 323 }
 324
 325 /*
 326  * Poll routine to call if blocked with irqs off
 327  */
 328 extern void smu_poll(void);
 329
 330
 331 /*
 332  * Init routine, presence check....
 333  */
 334 extern int smu_init(void);
 335 extern int smu_present(void);
 336 struct of_device;
 337 extern struct of_device *smu_get_ofdev(void);
 338
 339
 340 /*
 341  * Common command wrappers
 342  */
 343 extern void smu_shutdown(void);
 344 extern void smu_restart(void);
 345 struct rtc_time;
 346 extern int smu_get_rtc_time(struct rtc_time *time, int spinwait);
 347 extern int smu_set_rtc_time(struct rtc_time *time, int spinwait);
 348
 349 /*
 350  * SMU command buffer absolute address, exported by pmac_setup,
 351  * this is allocated very early during boot.
 352  */
 353 extern unsigned long smu_cmdbuf_abs;
 354
 355
 356 /*
 357  * Kenrel asynchronous i2c interface
 358  */
 359
 360 #define SMU_I2C_READ_MAX        0x1d
 361 #define SMU_I2C_WRITE_MAX       0x15
 362
 363 /* SMU i2c header, exactly matches i2c header on wire */
 364 struct smu_i2c_param
 365 {
 366         u8      bus;            /* SMU bus ID (from device tree) */
 367         u8      type;           /* i2c transfer type */
 368         u8      devaddr;        /* device address (includes direction) */
 369         u8      sublen;         /* subaddress length */
 370         u8      subaddr[3];     /* subaddress */
 371         u8      caddr;          /* combined address, filled by SMU driver */
 372         u8      datalen;        /* length of transfer */
 373         u8      data[SMU_I2C_READ_MAX]; /* data */
 374 };
 375
 376 struct smu_i2c_cmd
 377 {
 378         /* public */
 379         struct smu_i2c_param    info;
 380         void                    (*done)(struct smu_i2c_cmd *cmd, void *misc);
 381         void                    *misc;
 382         int                     status; /* 1 = pending, 0 = ok, <0 = fail */
 383
 384         /* private */
 385         struct smu_cmd          scmd;
 386         int                     read;
 387         int                     stage;
 388         int                     retries;
 389         u8                      pdata[32];
 390         struct list_head        link;
 391 };
 392
 393 /*
 394  * Call this to queue an i2c command to the SMU. You must fill info,
 395  * including info.data for a write, done and misc.
 396  * For now, no polling interface is provided so you have to use completion
 397  * callback.
 398  */
 399 extern int smu_queue_i2c(struct smu_i2c_cmd *cmd);
 400
 401
 402 #endif /* __KERNEL__ */
 403
 404
 405 /*
 406  * - SMU "sdb" partitions informations -
 407  */
 408
 409
 410 /*
 411  * Partition header format
 412  */
 413 struct smu_sdbp_header {
 414         __u8    id;
 415         __u8    len;
 416         __u8    version;
 417         __u8    flags;
 418 };
 419
 420
 421  /*
 422  * demangle 16 and 32 bits integer in some SMU partitions
 423  * (currently, afaik, this concerns only the FVT partition
 424  * (0x12)
 425  */
 426 #define SMU_U16_MIX(x)  le16_to_cpu(x);
 427 #define SMU_U32_MIX(x)  ((((x) & 0xff00ff00u) >> 8)|(((x) & 0x00ff00ffu) << 8))
 428
 429
 430 /* This is the definition of the SMU sdb-partition-0x12 table (called
 431  * CPU F/V/T operating points in Darwin). The definition for all those
 432  * SMU tables should be moved to some separate file
 433  */
 434 #define SMU_SDB_FVT_ID                  0x12
 435
 436 struct smu_sdbp_fvt {
 437         __u32   sysclk;                 /* Base SysClk frequency in Hz for
 438                                          * this operating point. Value need to
 439                                          * be unmixed with SMU_U32_MIX()
 440                                          */
 441         __u8    pad;
 442         __u8    maxtemp;                /* Max temp. supported by this
 443                                          * operating point
 444                                          */
 445
 446         __u16   volts[3];               /* CPU core voltage for the 3
 447                                          * PowerTune modes, a mode with
 448                                          * 0V = not supported. Value need
 449                                          * to be unmixed with SMU_U16_MIX()
 450                                          */
 451 };
 452
 453 /* This partition contains voltage & current sensor calibration
 454  * informations
 455  */
 456 #define SMU_SDB_CPUVCP_ID               0x21
 457
 458 struct smu_sdbp_cpuvcp {
 459         __u16   volt_scale;             /* u4.12 fixed point */
 460         __s16   volt_offset;            /* s4.12 fixed point */
 461         __u16   curr_scale;             /* u4.12 fixed point */
 462         __s16   curr_offset;            /* s4.12 fixed point */
 463         __s32   power_quads[3];         /* s4.28 fixed point */
 464 };
 465
 466 /* This partition contains CPU thermal diode calibration
 467  */
 468 #define SMU_SDB_CPUDIODE_ID             0x18
 469
 470 struct smu_sdbp_cpudiode {
 471         __u16   m_value;                /* u1.15 fixed point */
 472         __s16   b_value;                /* s10.6 fixed point */
 473
 474 };
 475
 476 /* This partition contains Slots power calibration
 477  */
 478 #define SMU_SDB_SLOTSPOW_ID             0x78
 479
 480 struct smu_sdbp_slotspow {
 481         __u16   pow_scale;              /* u4.12 fixed point */
 482         __s16   pow_offset;             /* s4.12 fixed point */
 483 };
 484
 485 /* This partition contains machine specific version information about
 486  * the sensor/control layout
 487  */
 488 #define SMU_SDB_SENSORTREE_ID           0x25
 489
 490 struct smu_sdbp_sensortree {
 491         __u8    model_id;
 492         __u8    unknown[3];
 493 };
 494
 495 /* This partition contains CPU thermal control PID informations. So far
 496  * only single CPU machines have been seen with an SMU, so we assume this
 497  * carries only informations for those
 498  */
 499 #define SMU_SDB_CPUPIDDATA_ID           0x17
 500
 501 struct smu_sdbp_cpupiddata {
 502         __u8    unknown1;
 503         __u8    target_temp_delta;
 504         __u8    unknown2;
 505         __u8    history_len;
 506         __s16   power_adj;
 507         __u16   max_power;
 508         __s32   gp,gr,gd;
 509 };
 510
 511
 512 /* Other partitions without known structures */
 513 #define SMU_SDB_DEBUG_SWITCHES_ID       0x05
 514
 515 #ifdef __KERNEL__
 516 /*
 517  * This returns the pointer to an SMU "sdb" partition data or NULL
 518  * if not found. The data format is described below
 519  */
 520 extern const struct smu_sdbp_header *smu_get_sdb_partition(int id,
 521                                         unsigned int *size);
 522
 523 /* Get "sdb" partition data from an SMU satellite */
 524 extern struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id,
 525                                         int id, unsigned int *size);
 526
 527
 528 #endif /* __KERNEL__ */
 529
 530
 531 /*
 532  * - Userland interface -
 533  */
 534
 535 /*
 536  * A given instance of the device can be configured for 2 different
 537  * things at the moment:
 538  *
 539  *  - sending SMU commands (default at open() time)
 540  *  - receiving SMU events (not yet implemented)
 541  *
 542  * Commands are written with write() of a command block. They can be
 543  * "driver" commands (for example to switch to event reception mode)
 544  * or real SMU commands. They are made of a header followed by command
 545  * data if any.
 546  *
 547  * For SMU commands (not for driver commands), you can then read() back
 548  * a reply. The reader will be blocked or not depending on how the device
 549  * file is opened. poll() isn't implemented yet. The reply will consist
 550  * of a header as well, followed by the reply data if any. You should
 551  * always provide a buffer large enough for the maximum reply data, I
 552  * recommand one page.
 553  *
 554  * It is illegal to send SMU commands through a file descriptor configured
 555  * for events reception
 556  *
 557  */
 558 struct smu_user_cmd_hdr
 559 {
 560         __u32           cmdtype;
 561 #define SMU_CMDTYPE_SMU                 0       /* SMU command */
 562 #define SMU_CMDTYPE_WANTS_EVENTS        1       /* switch fd to events mode */
 563 #define SMU_CMDTYPE_GET_PARTITION       2       /* retrieve an sdb partition */
 564
 565         __u8            cmd;                    /* SMU command byte */
 566         __u8            pad[3];                 /* padding */
 567         __u32           data_len;               /* Lenght of data following */
 568 };
 569
 570 struct smu_user_reply_hdr
 571 {
 572         __u32           status;                 /* Command status */
 573         __u32           reply_len;              /* Lenght of data follwing */
 574 };
 575
 576 #endif /*  _SMU_H */