1#ifndef _SMU_H 2#define _SMU_H 3 4/* 5 * Definitions for talking to the SMU chip in newer G5 PowerMacs 6 */ 7#ifdef __KERNEL__ 8#include <linux/list.h> 9#endif 10#include <linux/types.h> 11 12/* 13 * Known SMU commands 14 * 15 * Most of what is below comes from looking at the Open Firmware driver, 16 * though this is still incomplete and could use better documentation here 17 * or there... 18 */ 19 20 21/* 22 * Partition info commands 23 * 24 * These commands are used to retrieve the sdb-partition-XX datas from 25 * the SMU. The lenght is always 2. First byte is the subcommand code 26 * and second byte is the partition ID. 27 * 28 * The reply is 6 bytes: 29 * 30 * - 0..1 : partition address 31 * - 2 : a byte containing the partition ID 32 * - 3 : length (maybe other bits are rest of header ?) 33 * 34 * The data must then be obtained with calls to another command: 35 * SMU_CMD_MISC_ee_GET_DATABLOCK_REC (described below). 36 */ 37#define SMU_CMD_PARTITION_COMMAND 0x3e 38#define SMU_CMD_PARTITION_LATEST 0x01 39#define SMU_CMD_PARTITION_BASE 0x02 40#define SMU_CMD_PARTITION_UPDATE 0x03 41 42 43/* 44 * Fan control 45 * 46 * This is a "mux" for fan control commands. The command seem to 47 * act differently based on the number of arguments. With 1 byte 48 * of argument, this seem to be queries for fans status, setpoint, 49 * etc..., while with 0xe arguments, we will set the fans speeds. 50 * 51 * Queries (1 byte arg): 52 * --------------------- 53 * 54 * arg=0x01: read RPM fans status 55 * arg=0x02: read RPM fans setpoint 56 * arg=0x11: read PWM fans status 57 * arg=0x12: read PWM fans setpoint 58 * 59 * the "status" queries return the current speed while the "setpoint" ones 60 * return the programmed/target speed. It _seems_ that the result is a bit 61 * mask in the first byte of active/available fans, followed by 6 words (16 62 * bits) containing the requested speed. 63 * 64 * Setpoint (14 bytes arg): 65 * ------------------------ 66 * 67 * first arg byte is 0 for RPM fans and 0x10 for PWM. Second arg byte is the 68 * mask of fans affected by the command. Followed by 6 words containing the 69 * setpoint value for selected fans in the mask (or 0 if mask value is 0) 70 */ 71#define SMU_CMD_FAN_COMMAND 0x4a 72 73 74/* 75 * Battery access 76 * 77 * Same command number as the PMU, could it be same syntax ? 78 */ 79#define SMU_CMD_BATTERY_COMMAND 0x6f 80#define SMU_CMD_GET_BATTERY_INFO 0x00 81 82/* 83 * Real time clock control 84 * 85 * This is a "mux", first data byte contains the "sub" command. 86 * The "RTC" part of the SMU controls the date, time, powerup 87 * timer, but also a PRAM 88 * 89 * Dates are in BCD format on 7 bytes: 90 * [sec] [min] [hour] [weekday] [month day] [month] [year] 91 * with month being 1 based and year minus 100 92 */ 93#define SMU_CMD_RTC_COMMAND 0x8e 94#define SMU_CMD_RTC_SET_PWRUP_TIMER 0x00 /* i: 7 bytes date */ 95#define SMU_CMD_RTC_GET_PWRUP_TIMER 0x01 /* o: 7 bytes date */ 96#define SMU_CMD_RTC_STOP_PWRUP_TIMER 0x02 97#define SMU_CMD_RTC_SET_PRAM_BYTE_ACC 0x20 /* i: 1 byte (address?) */ 98#define SMU_CMD_RTC_SET_PRAM_AUTOINC 0x21 /* i: 1 byte (data?) */ 99#define SMU_CMD_RTC_SET_PRAM_LO_BYTES 0x22 /* i: 10 bytes */ 100#define SMU_CMD_RTC_SET_PRAM_HI_BYTES 0x23 /* i: 10 bytes */ 101#define SMU_CMD_RTC_GET_PRAM_BYTE 0x28 /* i: 1 bytes (address?) */ 102#define SMU_CMD_RTC_GET_PRAM_LO_BYTES 0x29 /* o: 10 bytes */ 103#define SMU_CMD_RTC_GET_PRAM_HI_BYTES 0x2a /* o: 10 bytes */ 104#define SMU_CMD_RTC_SET_DATETIME 0x80 /* i: 7 bytes date */ 105#define SMU_CMD_RTC_GET_DATETIME 0x81 /* o: 7 bytes date */ 106 107 /* 108 * i2c commands 109 * 110 * To issue an i2c command, first is to send a parameter block to the 111 * the SMU. This is a command of type 0x9a with 9 bytes of header 112 * eventually followed by data for a write: 113 * 114 * 0: bus number (from device-tree usually, SMU has lots of busses !) 115 * 1: transfer type/format (see below) 116 * 2: device address. For combined and combined4 type transfers, this 117 * is the "write" version of the address (bit 0x01 cleared) 118 * 3: subaddress length (0..3) 119 * 4: subaddress byte 0 (or only byte for subaddress length 1) 120 * 5: subaddress byte 1 121 * 6: subaddress byte 2 122 * 7: combined address (device address for combined mode data phase) 123 * 8: data length 124 * 125 * The transfer types are the same good old Apple ones it seems, 126 * that is: 127 * - 0x00: Simple transfer 128 * - 0x01: Subaddress transfer (addr write + data tx, no restart) 129 * - 0x02: Combined transfer (addr write + restart + data tx) 130 * 131 * This is then followed by actual data for a write. 132 * 133 * At this point, the OF driver seems to have a limitation on transfer 134 * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know 135 * wether this is just an OF limit due to some temporary buffer size 136 * or if this is an SMU imposed limit. This driver has the same limitation 137 * for now as I use a 0x10 bytes temporary buffer as well 138 * 139 * Once that is completed, a response is expected from the SMU. This is 140 * obtained via a command of type 0x9a with a length of 1 byte containing 141 * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's 142 * though I can't tell yet if this is actually necessary. Once this command 143 * is complete, at this point, all I can tell is what OF does. OF tests 144 * byte 0 of the reply: 145 * - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ? 146 * - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0) 147 * - on write, < 0 -> failure (immediate exit) 148 * - else, OF just exists (without error, weird) 149 * 150 * So on read, there is this wait-for-busy thing when getting a 0xfc or 151 * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and 152 * doing the above again until either the retries expire or the result 153 * is no longer 0xfe or 0xfc 154 * 155 * The Darwin I2C driver is less subtle though. On any non-success status 156 * from the response command, it waits 5ms and tries again up to 20 times, 157 * it doesn't differenciate between fatal errors or "busy" status. 158 * 159 * This driver provides an asynchronous paramblock based i2c command 160 * interface to be used either directly by low level code or by a higher 161 * level driver interfacing to the linux i2c layer. The current 162 * implementation of this relies on working timers & timer interrupts 163 * though, so be careful of calling context for now. This may be "fixed" 164 * in the future by adding a polling facility. 165 */ 166#define SMU_CMD_I2C_COMMAND 0x9a 167 /* transfer types */ 168#define SMU_I2C_TRANSFER_SIMPLE 0x00 169#define SMU_I2C_TRANSFER_STDSUB 0x01 170#define SMU_I2C_TRANSFER_COMBINED 0x02 171 172/* 173 * Power supply control 174 * 175 * The "sub" command is an ASCII string in the data, the 176 * data lenght is that of the string. 177 * 178 * The VSLEW command can be used to get or set the voltage slewing. 179 * - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of 180 * reply at data offset 6, 7 and 8. 181 * - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is 182 * used to set the voltage slewing point. The SMU replies with "DONE" 183 * I yet have to figure out their exact meaning of those 3 bytes in 184 * both cases. They seem to be: 185 * x = processor mask 186 * y = op. point index 187 * z = processor freq. step index 188 * I haven't yet decyphered result codes 189 * 190 */ 191#define SMU_CMD_POWER_COMMAND 0xaa 192#define SMU_CMD_POWER_RESTART "RESTART" 193#define SMU_CMD_POWER_SHUTDOWN "SHUTDOWN" 194#define SMU_CMD_POWER_VOLTAGE_SLEW "VSLEW" 195 196/* 197 * Read ADC sensors 198 * 199 * This command takes one byte of parameter: the sensor ID (or "reg" 200 * value in the device-tree) and returns a 16 bits value 201 */ 202#define SMU_CMD_READ_ADC 0xd8 203 204/* Misc commands 205 * 206 * This command seem to be a grab bag of various things 207 */ 208#define SMU_CMD_MISC_df_COMMAND 0xdf 209#define SMU_CMD_MISC_df_SET_DISPLAY_LIT 0x02 /* i: 1 byte */ 210#define SMU_CMD_MISC_df_NMI_OPTION 0x04 211 212/* 213 * Version info commands 214 * 215 * I haven't quite tried to figure out how these work 216 */ 217#define SMU_CMD_VERSION_COMMAND 0xea 218 219 220/* 221 * Misc commands 222 * 223 * This command seem to be a grab bag of various things 224 * 225 * SMU_CMD_MISC_ee_GET_DATABLOCK_REC is used, among others, to 226 * transfer blocks of data from the SMU. So far, I've decrypted it's 227 * usage to retrieve partition data. In order to do that, you have to 228 * break your transfer in "chunks" since that command cannot transfer 229 * more than a chunk at a time. The chunk size used by OF is 0xe bytes, 230 * but it seems that the darwin driver will let you do 0x1e bytes if 231 * your "PMU" version is >= 0x30. You can get the "PMU" version apparently 232 * either in the last 16 bits of property "smu-version-pmu" or as the 16 233 * bytes at offset 1 of "smu-version-info" 234 * 235 * For each chunk, the command takes 7 bytes of arguments: 236 * byte 0: subcommand code (0x02) 237 * byte 1: 0x04 (always, I don't know what it means, maybe the address 238 * space to use or some other nicety. It's hard coded in OF) 239 * byte 2..5: SMU address of the chunk (big endian 32 bits) 240 * byte 6: size to transfer (up to max chunk size) 241 * 242 * The data is returned directly 243 */ 244#define SMU_CMD_MISC_ee_COMMAND 0xee 245#define SMU_CMD_MISC_ee_GET_DATABLOCK_REC 0x02 246#define SMU_CMD_MISC_ee_LEDS_CTRL 0x04 /* i: 00 (00,01) [00] */ 247#define SMU_CMD_MISC_ee_GET_DATA 0x05 /* i: 00 , o: ?? */ 248 249 250 251/* 252 * - Kernel side interface - 253 */ 254 255#ifdef __KERNEL__ 256 257/* 258 * Asynchronous SMU commands 259 * 260 * Fill up this structure and submit it via smu_queue_command(), 261 * and get notified by the optional done() callback, or because 262 * status becomes != 1 263 */ 264 265struct smu_cmd; 266 267struct smu_cmd 268{ 269 /* public */ 270 u8 cmd; /* command */ 271 int data_len; /* data len */ 272 int reply_len; /* reply len */ 273 void *data_buf; /* data buffer */ 274 void *reply_buf; /* reply buffer */ 275 int status; /* command status */ 276 void (*done)(struct smu_cmd *cmd, void *misc); 277 void *misc; 278 279 /* private */ 280 struct list_head link; 281}; 282 283/* 284 * Queues an SMU command, all fields have to be initialized 285 */ 286extern int smu_queue_cmd(struct smu_cmd *cmd); 287 288/* 289 * Simple command wrapper. This structure embeds a small buffer 290 * to ease sending simple SMU commands from the stack 291 */ 292struct smu_simple_cmd 293{ 294 struct smu_cmd cmd; 295 u8 buffer[16]; 296}; 297 298/* 299 * Queues a simple command. All fields will be initialized by that 300 * function 301 */ 302extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command, 303 unsigned int data_len, 304 void (*done)(struct smu_cmd *cmd, void *misc), 305 void *misc, 306 ...); 307 308/* 309 * Completion helper. Pass it to smu_queue_simple or as 'done' 310 * member to smu_queue_cmd, it will call complete() on the struct 311 * completion passed in the "misc" argument 312 */ 313extern void smu_done_complete(struct smu_cmd *cmd, void *misc); 314 315/* 316 * Synchronous helpers. Will spin-wait for completion of a command 317 */ 318extern void smu_spinwait_cmd(struct smu_cmd *cmd); 319 320static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd) 321{ 322 smu_spinwait_cmd(&scmd->cmd); 323} 324 325/* 326 * Poll routine to call if blocked with irqs off 327 */ 328extern void smu_poll(void); 329 330 331/* 332 * Init routine, presence check.... 333 */ 334extern int smu_init(void); 335extern int smu_present(void); 336struct of_device; 337extern struct of_device *smu_get_ofdev(void); 338 339 340/* 341 * Common command wrappers 342 */ 343extern void smu_shutdown(void); 344extern void smu_restart(void); 345struct rtc_time; 346extern int smu_get_rtc_time(struct rtc_time *time, int spinwait); 347extern int smu_set_rtc_time(struct rtc_time *time, int spinwait); 348 349/* 350 * SMU command buffer absolute address, exported by pmac_setup, 351 * this is allocated very early during boot. 352 */ 353extern unsigned long smu_cmdbuf_abs; 354 355 356/* 357 * Kenrel asynchronous i2c interface 358 */ 359 360#define SMU_I2C_READ_MAX 0x1d 361#define SMU_I2C_WRITE_MAX 0x15 362 363/* SMU i2c header, exactly matches i2c header on wire */ 364struct smu_i2c_param 365{ 366 u8 bus; /* SMU bus ID (from device tree) */ 367 u8 type; /* i2c transfer type */ 368 u8 devaddr; /* device address (includes direction) */ 369 u8 sublen; /* subaddress length */ 370 u8 subaddr[3]; /* subaddress */ 371 u8 caddr; /* combined address, filled by SMU driver */ 372 u8 datalen; /* length of transfer */ 373 u8 data[SMU_I2C_READ_MAX]; /* data */ 374}; 375 376struct smu_i2c_cmd 377{ 378 /* public */ 379 struct smu_i2c_param info; 380 void (*done)(struct smu_i2c_cmd *cmd, void *misc); 381 void *misc; 382 int status; /* 1 = pending, 0 = ok, <0 = fail */ 383 384 /* private */ 385 struct smu_cmd scmd; 386 int read; 387 int stage; 388 int retries; 389 u8 pdata[32]; 390 struct list_head link; 391}; 392 393/* 394 * Call this to queue an i2c command to the SMU. You must fill info, 395 * including info.data for a write, done and misc. 396 * For now, no polling interface is provided so you have to use completion 397 * callback. 398 */ 399extern int smu_queue_i2c(struct smu_i2c_cmd *cmd); 400 401 402#endif /* __KERNEL__ */ 403 404 405/* 406 * - SMU "sdb" partitions informations - 407 */ 408 409 410/* 411 * Partition header format 412 */ 413struct smu_sdbp_header { 414 __u8 id; 415 __u8 len; 416 __u8 version; 417 __u8 flags; 418}; 419 420 421 /* 422 * demangle 16 and 32 bits integer in some SMU partitions 423 * (currently, afaik, this concerns only the FVT partition 424 * (0x12) 425 */ 426#define SMU_U16_MIX(x) le16_to_cpu(x); 427#define SMU_U32_MIX(x) ((((x) & 0xff00ff00u) >> 8)|(((x) & 0x00ff00ffu) << 8)) 428 429 430/* This is the definition of the SMU sdb-partition-0x12 table (called 431 * CPU F/V/T operating points in Darwin). The definition for all those 432 * SMU tables should be moved to some separate file 433 */ 434#define SMU_SDB_FVT_ID 0x12 435 436struct smu_sdbp_fvt { 437 __u32 sysclk; /* Base SysClk frequency in Hz for 438 * this operating point. Value need to 439 * be unmixed with SMU_U32_MIX() 440 */ 441 __u8 pad; 442 __u8 maxtemp; /* Max temp. supported by this 443 * operating point 444 */ 445 446 __u16 volts[3]; /* CPU core voltage for the 3 447 * PowerTune modes, a mode with 448 * 0V = not supported. Value need 449 * to be unmixed with SMU_U16_MIX() 450 */ 451}; 452 453/* This partition contains voltage & current sensor calibration 454 * informations 455 */ 456#define SMU_SDB_CPUVCP_ID 0x21 457 458struct smu_sdbp_cpuvcp { 459 __u16 volt_scale; /* u4.12 fixed point */ 460 __s16 volt_offset; /* s4.12 fixed point */ 461 __u16 curr_scale; /* u4.12 fixed point */ 462 __s16 curr_offset; /* s4.12 fixed point */ 463 __s32 power_quads[3]; /* s4.28 fixed point */ 464}; 465 466/* This partition contains CPU thermal diode calibration 467 */ 468#define SMU_SDB_CPUDIODE_ID 0x18 469 470struct smu_sdbp_cpudiode { 471 __u16 m_value; /* u1.15 fixed point */ 472 __s16 b_value; /* s10.6 fixed point */ 473 474}; 475 476/* This partition contains Slots power calibration 477 */ 478#define SMU_SDB_SLOTSPOW_ID 0x78 479 480struct smu_sdbp_slotspow { 481 __u16 pow_scale; /* u4.12 fixed point */ 482 __s16 pow_offset; /* s4.12 fixed point */ 483}; 484 485/* This partition contains machine specific version information about 486 * the sensor/control layout 487 */ 488#define SMU_SDB_SENSORTREE_ID 0x25 489 490struct smu_sdbp_sensortree { 491 __u8 model_id; 492 __u8 unknown[3]; 493}; 494 495/* This partition contains CPU thermal control PID informations. So far 496 * only single CPU machines have been seen with an SMU, so we assume this 497 * carries only informations for those 498 */ 499#define SMU_SDB_CPUPIDDATA_ID 0x17 500 501struct smu_sdbp_cpupiddata { 502 __u8 unknown1; 503 __u8 target_temp_delta; 504 __u8 unknown2; 505 __u8 history_len; 506 __s16 power_adj; 507 __u16 max_power; 508 __s32 gp,gr,gd; 509}; 510 511 512/* Other partitions without known structures */ 513#define SMU_SDB_DEBUG_SWITCHES_ID 0x05 514 515#ifdef __KERNEL__ 516/* 517 * This returns the pointer to an SMU "sdb" partition data or NULL 518 * if not found. The data format is described below 519 */ 520extern const struct smu_sdbp_header *smu_get_sdb_partition(int id, 521 unsigned int *size); 522 523/* Get "sdb" partition data from an SMU satellite */ 524extern struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, 525 int id, unsigned int *size); 526 527 528#endif /* __KERNEL__ */ 529 530 531/* 532 * - Userland interface - 533 */ 534 535/* 536 * A given instance of the device can be configured for 2 different 537 * things at the moment: 538 * 539 * - sending SMU commands (default at open() time) 540 * - receiving SMU events (not yet implemented) 541 * 542 * Commands are written with write() of a command block. They can be 543 * "driver" commands (for example to switch to event reception mode) 544 * or real SMU commands. They are made of a header followed by command 545 * data if any. 546 * 547 * For SMU commands (not for driver commands), you can then read() back 548 * a reply. The reader will be blocked or not depending on how the device 549 * file is opened. poll() isn't implemented yet. The reply will consist 550 * of a header as well, followed by the reply data if any. You should 551 * always provide a buffer large enough for the maximum reply data, I 552 * recommand one page. 553 * 554 * It is illegal to send SMU commands through a file descriptor configured 555 * for events reception 556 * 557 */ 558struct smu_user_cmd_hdr 559{ 560 __u32 cmdtype; 561#define SMU_CMDTYPE_SMU 0 /* SMU command */ 562#define SMU_CMDTYPE_WANTS_EVENTS 1 /* switch fd to events mode */ 563#define SMU_CMDTYPE_GET_PARTITION 2 /* retrieve an sdb partition */ 564 565 __u8 cmd; /* SMU command byte */ 566 __u8 pad[3]; /* padding */ 567 __u32 data_len; /* Lenght of data following */ 568}; 569 570struct smu_user_reply_hdr 571{ 572 __u32 status; /* Command status */ 573 __u32 reply_len; /* Lenght of data follwing */ 574}; 575 576#endif /* _SMU_H */ 577