/*

* Host communication command constants for ChromeOS EC

*

* Copyright (C) 2012 Google, Inc

*

* This software is licensed under the terms of the GNU General Public

* License version 2, as published by the Free Software Foundation, and

* may be copied, distributed, and modified under those terms.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* The ChromeOS EC multi function device is used to mux all the requests

* to the EC device for its multiple features: keyboard controller,

* battery charging and regulator control, firmware update.

*

* NOTE: This file is copied verbatim from the ChromeOS EC Open Source

* project in an attempt to make future updates easy to make.

*/

#ifndef __CROS_EC_COMMANDS_H

#define __CROS_EC_COMMANDS_H

/*

* Current version of this protocol

*

* TODO(crosbug.com/p/11223): This is effectively useless; protocol is

* determined in other ways. Remove this once the kernel code no longer

* depends on it.

*/

#define EC_PROTO_VERSION 0x00000002

/* Command version mask */

#define EC_VER_MASK(version) (1UL << (version))

/* I/O addresses for ACPI commands */

#define EC_LPC_ADDR_ACPI_DATA 0x62

#define EC_LPC_ADDR_ACPI_CMD 0x66

/* I/O addresses for host command */

#define EC_LPC_ADDR_HOST_DATA 0x200

#define EC_LPC_ADDR_HOST_CMD 0x204

/* I/O addresses for host command args and params */

/* Protocol version 2 */

#define EC_LPC_ADDR_HOST_ARGS 0x800 /* And 0x801, 0x802, 0x803 */

#define EC_LPC_ADDR_HOST_PARAM 0x804 /* For version 2 params; size is

* EC_PROTO2_MAX_PARAM_SIZE */

/* Protocol version 3 */

#define EC_LPC_ADDR_HOST_PACKET 0x800 /* Offset of version 3 packet */

#define EC_LPC_HOST_PACKET_SIZE 0x100 /* Max size of version 3 packet */

/* The actual block is 0x800-0x8ff, but some BIOSes think it's 0x880-0x8ff

* and they tell the kernel that so we have to think of it as two parts. */

#define EC_HOST_CMD_REGION0 0x800

#define EC_HOST_CMD_REGION1 0x880

#define EC_HOST_CMD_REGION_SIZE 0x80

/* EC command register bit functions */

#define EC_LPC_CMDR_DATA (1 << 0) /* Data ready for host to read */

#define EC_LPC_CMDR_PENDING (1 << 1) /* Write pending to EC */

#define EC_LPC_CMDR_BUSY (1 << 2) /* EC is busy processing a command */

#define EC_LPC_CMDR_CMD (1 << 3) /* Last host write was a command */

#define EC_LPC_CMDR_ACPI_BRST (1 << 4) /* Burst mode (not used) */

#define EC_LPC_CMDR_SCI (1 << 5) /* SCI event is pending */

#define EC_LPC_CMDR_SMI (1 << 6) /* SMI event is pending */

#define EC_LPC_ADDR_MEMMAP 0x900

#define EC_MEMMAP_SIZE 255 /* ACPI IO buffer max is 255 bytes */

#define EC_MEMMAP_TEXT_MAX 8 /* Size of a string in the memory map */

/* The offset address of each type of data in mapped memory. */

#define EC_MEMMAP_TEMP_SENSOR 0x00 /* Temp sensors 0x00 - 0x0f */

#define EC_MEMMAP_FAN 0x10 /* Fan speeds 0x10 - 0x17 */

#define EC_MEMMAP_TEMP_SENSOR_B 0x18 /* More temp sensors 0x18 - 0x1f */

#define EC_MEMMAP_ID 0x20 /* 0x20 == 'E', 0x21 == 'C' */

#define EC_MEMMAP_ID_VERSION 0x22 /* Version of data in 0x20 - 0x2f */

#define EC_MEMMAP_THERMAL_VERSION 0x23 /* Version of data in 0x00 - 0x1f */

#define EC_MEMMAP_BATTERY_VERSION 0x24 /* Version of data in 0x40 - 0x7f */

#define EC_MEMMAP_SWITCHES_VERSION 0x25 /* Version of data in 0x30 - 0x33 */

#define EC_MEMMAP_EVENTS_VERSION 0x26 /* Version of data in 0x34 - 0x3f */

#define EC_MEMMAP_HOST_CMD_FLAGS 0x27 /* Host cmd interface flags (8 bits) */

/* Unused 0x28 - 0x2f */

#define EC_MEMMAP_SWITCHES 0x30 /* 8 bits */

/* Unused 0x31 - 0x33 */

#define EC_MEMMAP_HOST_EVENTS 0x34 /* 32 bits */

/* Reserve 0x38 - 0x3f for additional host event-related stuff */

/* Battery values are all 32 bits */

#define EC_MEMMAP_BATT_VOLT 0x40 /* Battery Present Voltage */

#define EC_MEMMAP_BATT_RATE 0x44 /* Battery Present Rate */

#define EC_MEMMAP_BATT_CAP 0x48 /* Battery Remaining Capacity */

#define EC_MEMMAP_BATT_FLAG 0x4c /* Battery State, defined below */

#define EC_MEMMAP_BATT_DCAP 0x50 /* Battery Design Capacity */

#define EC_MEMMAP_BATT_DVLT 0x54 /* Battery Design Voltage */

#define EC_MEMMAP_BATT_LFCC 0x58 /* Battery Last Full Charge Capacity */

#define EC_MEMMAP_BATT_CCNT 0x5c /* Battery Cycle Count */

/* Strings are all 8 bytes (EC_MEMMAP_TEXT_MAX) */

#define EC_MEMMAP_BATT_MFGR 0x60 /* Battery Manufacturer String */

#define EC_MEMMAP_BATT_MODEL 0x68 /* Battery Model Number String */

#define EC_MEMMAP_BATT_SERIAL 0x70 /* Battery Serial Number String */

#define EC_MEMMAP_BATT_TYPE 0x78 /* Battery Type String */

#define EC_MEMMAP_ALS 0x80 /* ALS readings in lux (2 X 16 bits) */

/* Unused 0x84 - 0x8f */

#define EC_MEMMAP_ACC_STATUS 0x90 /* Accelerometer status (8 bits )*/

/* Unused 0x91 */

#define EC_MEMMAP_ACC_DATA 0x92 /* Accelerometer data 0x92 - 0x9f */

#define EC_MEMMAP_GYRO_DATA 0xa0 /* Gyroscope data 0xa0 - 0xa5 */

/* Unused 0xa6 - 0xfe (remember, 0xff is NOT part of the memmap region) */

/* Define the format of the accelerometer mapped memory status byte. */

#define EC_MEMMAP_ACC_STATUS_SAMPLE_ID_MASK 0x0f

#define EC_MEMMAP_ACC_STATUS_BUSY_BIT (1 << 4)

#define EC_MEMMAP_ACC_STATUS_PRESENCE_BIT (1 << 7)

/* Number of temp sensors at EC_MEMMAP_TEMP_SENSOR */

#define EC_TEMP_SENSOR_ENTRIES 16

/*

* Number of temp sensors at EC_MEMMAP_TEMP_SENSOR_B.

*

* Valid only if EC_MEMMAP_THERMAL_VERSION returns >= 2.

*/

#define EC_TEMP_SENSOR_B_ENTRIES 8

/* Special values for mapped temperature sensors */

#define EC_TEMP_SENSOR_NOT_PRESENT 0xff

#define EC_TEMP_SENSOR_ERROR 0xfe

#define EC_TEMP_SENSOR_NOT_POWERED 0xfd

#define EC_TEMP_SENSOR_NOT_CALIBRATED 0xfc

/*

* The offset of temperature value stored in mapped memory. This allows

* reporting a temperature range of 200K to 454K = -73C to 181C.

*/

#define EC_TEMP_SENSOR_OFFSET 200

/*

* Number of ALS readings at EC_MEMMAP_ALS

*/

#define EC_ALS_ENTRIES 2

/*

* The default value a temperature sensor will return when it is present but

* has not been read this boot. This is a reasonable number to avoid

* triggering alarms on the host.

*/

#define EC_TEMP_SENSOR_DEFAULT (296 - EC_TEMP_SENSOR_OFFSET)

#define EC_FAN_SPEED_ENTRIES 4 /* Number of fans at EC_MEMMAP_FAN */

#define EC_FAN_SPEED_NOT_PRESENT 0xffff /* Entry not present */

#define EC_FAN_SPEED_STALLED 0xfffe /* Fan stalled */

/* Battery bit flags at EC_MEMMAP_BATT_FLAG. */

#define EC_BATT_FLAG_AC_PRESENT 0x01

#define EC_BATT_FLAG_BATT_PRESENT 0x02

#define EC_BATT_FLAG_DISCHARGING 0x04

#define EC_BATT_FLAG_CHARGING 0x08

#define EC_BATT_FLAG_LEVEL_CRITICAL 0x10

/* Switch flags at EC_MEMMAP_SWITCHES */

#define EC_SWITCH_LID_OPEN 0x01

#define EC_SWITCH_POWER_BUTTON_PRESSED 0x02

#define EC_SWITCH_WRITE_PROTECT_DISABLED 0x04

/* Was recovery requested via keyboard; now unused. */

#define EC_SWITCH_IGNORE1 0x08

/* Recovery requested via dedicated signal (from servo board) */

#define EC_SWITCH_DEDICATED_RECOVERY 0x10

/* Was fake developer mode switch; now unused. Remove in next refactor. */

#define EC_SWITCH_IGNORE0 0x20

/* Host command interface flags */

/* Host command interface supports LPC args (LPC interface only) */

#define EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED 0x01

/* Host command interface supports version 3 protocol */

#define EC_HOST_CMD_FLAG_VERSION_3 0x02

/* Wireless switch flags */

#define EC_WIRELESS_SWITCH_ALL ~0x00 /* All flags */

#define EC_WIRELESS_SWITCH_WLAN 0x01 /* WLAN radio */

#define EC_WIRELESS_SWITCH_BLUETOOTH 0x02 /* Bluetooth radio */

#define EC_WIRELESS_SWITCH_WWAN 0x04 /* WWAN power */

#define EC_WIRELESS_SWITCH_WLAN_POWER 0x08 /* WLAN power */

/*

* This header file is used in coreboot both in C and ACPI code. The ACPI code

* is pre-processed to handle constants but the ASL compiler is unable to

* handle actual C code so keep it separate.

*/

#ifndef __ACPI__

/*

* Define __packed if someone hasn't beat us to it. Linux kernel style

* checking prefers __packed over __attribute__((packed)).

*/

#ifndef __packed

#define __packed __attribute__((packed))

#endif

/* LPC command status byte masks */

/* EC has written a byte in the data register and host hasn't read it yet */

#define EC_LPC_STATUS_TO_HOST 0x01

/* Host has written a command/data byte and the EC hasn't read it yet */

#define EC_LPC_STATUS_FROM_HOST 0x02

/* EC is processing a command */

#define EC_LPC_STATUS_PROCESSING 0x04

/* Last write to EC was a command, not data */

#define EC_LPC_STATUS_LAST_CMD 0x08

/* EC is in burst mode. Unsupported by Chrome EC, so this bit is never set */

#define EC_LPC_STATUS_BURST_MODE 0x10

/* SCI event is pending (requesting SCI query) */

#define EC_LPC_STATUS_SCI_PENDING 0x20

/* SMI event is pending (requesting SMI query) */

#define EC_LPC_STATUS_SMI_PENDING 0x40

/* (reserved) */

#define EC_LPC_STATUS_RESERVED 0x80

/*

* EC is busy. This covers both the EC processing a command, and the host has

* written a new command but the EC hasn't picked it up yet.

*/

#define EC_LPC_STATUS_BUSY_MASK \

(EC_LPC_STATUS_FROM_HOST | EC_LPC_STATUS_PROCESSING)

/* Host command response codes */

enum ec_status {

EC_RES_SUCCESS = 0,

EC_RES_INVALID_COMMAND = 1,

EC_RES_ERROR = 2,

EC_RES_INVALID_PARAM = 3,

EC_RES_ACCESS_DENIED = 4,

EC_RES_INVALID_RESPONSE = 5,

EC_RES_INVALID_VERSION = 6,

EC_RES_INVALID_CHECKSUM = 7,

EC_RES_IN_PROGRESS = 8, /* Accepted, command in progress */

EC_RES_UNAVAILABLE = 9, /* No response available */

EC_RES_TIMEOUT = 10, /* We got a timeout */

EC_RES_OVERFLOW = 11, /* Table / data overflow */

EC_RES_INVALID_HEADER = 12, /* Header contains invalid data */

EC_RES_REQUEST_TRUNCATED = 13, /* Didn't get the entire request */

EC_RES_RESPONSE_TOO_BIG = 14 /* Response was too big to handle */

};

/*

* Host event codes. Note these are 1-based, not 0-based, because ACPI query

* EC command uses code 0 to mean "no event pending". We explicitly specify

* each value in the enum listing so they won't change if we delete/insert an

* item or rearrange the list (it needs to be stable across platforms, not

* just within a single compiled instance).

*/

enum host_event_code {

EC_HOST_EVENT_LID_CLOSED = 1,

EC_HOST_EVENT_LID_OPEN = 2,

EC_HOST_EVENT_POWER_BUTTON = 3,

EC_HOST_EVENT_AC_CONNECTED = 4,

EC_HOST_EVENT_AC_DISCONNECTED = 5,

EC_HOST_EVENT_BATTERY_LOW = 6,

EC_HOST_EVENT_BATTERY_CRITICAL = 7,

EC_HOST_EVENT_BATTERY = 8,

EC_HOST_EVENT_THERMAL_THRESHOLD = 9,

EC_HOST_EVENT_THERMAL_OVERLOAD = 10,

EC_HOST_EVENT_THERMAL = 11,

EC_HOST_EVENT_USB_CHARGER = 12,

EC_HOST_EVENT_KEY_PRESSED = 13,

/*

* EC has finished initializing the host interface. The host can check

* for this event following sending a EC_CMD_REBOOT_EC command to

* determine when the EC is ready to accept subsequent commands.

*/

EC_HOST_EVENT_INTERFACE_READY = 14,

/* Keyboard recovery combo has been pressed */

EC_HOST_EVENT_KEYBOARD_RECOVERY = 15,

/* Shutdown due to thermal overload */

EC_HOST_EVENT_THERMAL_SHUTDOWN = 16,

/* Shutdown due to battery level too low */

EC_HOST_EVENT_BATTERY_SHUTDOWN = 17,

/* Suggest that the AP throttle itself */

EC_HOST_EVENT_THROTTLE_START = 18,

/* Suggest that the AP resume normal speed */

EC_HOST_EVENT_THROTTLE_STOP = 19,

/* Hang detect logic detected a hang and host event timeout expired */

EC_HOST_EVENT_HANG_DETECT = 20,

/* Hang detect logic detected a hang and warm rebooted the AP */

EC_HOST_EVENT_HANG_REBOOT = 21,

/* PD MCU triggering host event */

EC_HOST_EVENT_PD_MCU = 22,

/* EC desires to change state of host-controlled USB mux */

EC_HOST_EVENT_USB_MUX = 28,

/*

* The high bit of the event mask is not used as a host event code. If

* it reads back as set, then the entire event mask should be

* considered invalid by the host. This can happen when reading the

* raw event status via EC_MEMMAP_HOST_EVENTS but the LPC interface is

* not initialized on the EC, or improperly configured on the host.

*/

EC_HOST_EVENT_INVALID = 32

};

/* Host event mask */

#define EC_HOST_EVENT_MASK(event_code) (1UL << ((event_code) - 1))

/* Arguments at EC_LPC_ADDR_HOST_ARGS */

struct ec_lpc_host_args {

uint8_t flags;

uint8_t command_version;

uint8_t data_size;

/*

* Checksum; sum of command + flags + command_version + data_size +

* all params/response data bytes.

*/

uint8_t checksum;

} __packed;

/* Flags for ec_lpc_host_args.flags */

/*

* Args are from host. Data area at EC_LPC_ADDR_HOST_PARAM contains command

* params.

*

* If EC gets a command and this flag is not set, this is an old-style command.

* Command version is 0 and params from host are at EC_LPC_ADDR_OLD_PARAM with

* unknown length. EC must respond with an old-style response (that is,

* withouth setting EC_HOST_ARGS_FLAG_TO_HOST).

*/

#define EC_HOST_ARGS_FLAG_FROM_HOST 0x01

/*

* Args are from EC. Data area at EC_LPC_ADDR_HOST_PARAM contains response.

*

* If EC responds to a command and this flag is not set, this is an old-style

* response. Command version is 0 and response data from EC is at

* EC_LPC_ADDR_OLD_PARAM with unknown length.

*/

#define EC_HOST_ARGS_FLAG_TO_HOST 0x02

/*****************************************************************************/

/*

* Byte codes returned by EC over SPI interface.

*

* These can be used by the AP to debug the EC interface, and to determine

* when the EC is not in a state where it will ever get around to responding

* to the AP.

*

* Example of sequence of bytes read from EC for a current good transfer:

* 1. - - AP asserts chip select (CS#)

* 2. EC_SPI_OLD_READY - AP sends first byte(s) of request

* 3. - - EC starts handling CS# interrupt

* 4. EC_SPI_RECEIVING - AP sends remaining byte(s) of request

* 5. EC_SPI_PROCESSING - EC starts processing request; AP is clocking in

* bytes looking for EC_SPI_FRAME_START

* 6. - - EC finishes processing and sets up response

* 7. EC_SPI_FRAME_START - AP reads frame byte

* 8. (response packet) - AP reads response packet

* 9. EC_SPI_PAST_END - Any additional bytes read by AP

* 10 - - AP deasserts chip select

* 11 - - EC processes CS# interrupt and sets up DMA for

* next request

*

* If the AP is waiting for EC_SPI_FRAME_START and sees any value other than

* the following byte values:

* EC_SPI_OLD_READY

* EC_SPI_RX_READY

* EC_SPI_RECEIVING

* EC_SPI_PROCESSING

*

* Then the EC found an error in the request, or was not ready for the request

* and lost data. The AP should give up waiting for EC_SPI_FRAME_START,

* because the EC is unable to tell when the AP is done sending its request.

*/

/*

* Framing byte which precedes a response packet from the EC. After sending a

* request, the AP will clock in bytes until it sees the framing byte, then

* clock in the response packet.

*/

#define EC_SPI_FRAME_START 0xec

/*

* Padding bytes which are clocked out after the end of a response packet.

*/

#define EC_SPI_PAST_END 0xed

/*

* EC is ready to receive, and has ignored the byte sent by the AP. EC expects

* that the AP will send a valid packet header (starting with

* EC_COMMAND_PROTOCOL_3) in the next 32 bytes.

*/

#define EC_SPI_RX_READY 0xf8

/*

* EC has started receiving the request from the AP, but hasn't started

* processing it yet.

*/

#define EC_SPI_RECEIVING 0xf9

/* EC has received the entire request from the AP and is processing it. */

#define EC_SPI_PROCESSING 0xfa

/*

* EC received bad data from the AP, such as a packet header with an invalid

* length. EC will ignore all data until chip select deasserts.

*/

#define EC_SPI_RX_BAD_DATA 0xfb

/*

* EC received data from the AP before it was ready. That is, the AP asserted

* chip select and started clocking data before the EC was ready to receive it.

* EC will ignore all data until chip select deasserts.

*/

#define EC_SPI_NOT_READY 0xfc

/*

* EC was ready to receive a request from the AP. EC has treated the byte sent

* by the AP as part of a request packet, or (for old-style ECs) is processing

* a fully received packet but is not ready to respond yet.

*/

#define EC_SPI_OLD_READY 0xfd

/*****************************************************************************/

/*

* Protocol version 2 for I2C and SPI send a request this way:

*

* 0 EC_CMD_VERSION0 + (command version)

* 1 Command number

* 2 Length of params = N

* 3..N+2 Params, if any

* N+3 8-bit checksum of bytes 0..N+2

*

* The corresponding response is:

*

* 0 Result code (EC_RES_*)

* 1 Length of params = M

* 2..M+1 Params, if any

* M+2 8-bit checksum of bytes 0..M+1

*/

#define EC_PROTO2_REQUEST_HEADER_BYTES 3

#define EC_PROTO2_REQUEST_TRAILER_BYTES 1

#define EC_PROTO2_REQUEST_OVERHEAD (EC_PROTO2_REQUEST_HEADER_BYTES + \

EC_PROTO2_REQUEST_TRAILER_BYTES)

#define EC_PROTO2_RESPONSE_HEADER_BYTES 2

#define EC_PROTO2_RESPONSE_TRAILER_BYTES 1

#define EC_PROTO2_RESPONSE_OVERHEAD (EC_PROTO2_RESPONSE_HEADER_BYTES + \

EC_PROTO2_RESPONSE_TRAILER_BYTES)

/* Parameter length was limited by the LPC interface */

#define EC_PROTO2_MAX_PARAM_SIZE 0xfc

/* Maximum request and response packet sizes for protocol version 2 */

#define EC_PROTO2_MAX_REQUEST_SIZE (EC_PROTO2_REQUEST_OVERHEAD + \

EC_PROTO2_MAX_PARAM_SIZE)

#define EC_PROTO2_MAX_RESPONSE_SIZE (EC_PROTO2_RESPONSE_OVERHEAD + \

EC_PROTO2_MAX_PARAM_SIZE)

/*****************************************************************************/

/*

* Value written to legacy command port / prefix byte to indicate protocol

* 3+ structs are being used. Usage is bus-dependent.

*/

#define EC_COMMAND_PROTOCOL_3 0xda

#define EC_HOST_REQUEST_VERSION 3

/* Version 3 request from host */

struct ec_host_request {

/* Struct version (=3)

*

* EC will return EC_RES_INVALID_HEADER if it receives a header with a

* version it doesn't know how to parse.

*/

uint8_t struct_version;

/*

* Checksum of request and data; sum of all bytes including checksum

* should total to 0.

*/

uint8_t checksum;

/* Command code */

uint16_t command;

/* Command version */

uint8_t command_version;

/* Unused byte in current protocol version; set to 0 */

uint8_t reserved;

/* Length of data which follows this header */

uint16_t data_len;

} __packed;

#define EC_HOST_RESPONSE_VERSION 3

/* Version 3 response from EC */

struct ec_host_response {

/* Struct version (=3) */

uint8_t struct_version;

/*

* Checksum of response and data; sum of all bytes including checksum

* should total to 0.

*/

uint8_t checksum;

/* Result code (EC_RES_*) */

uint16_t result;

/* Length of data which follows this header */

uint16_t data_len;

/* Unused bytes in current protocol version; set to 0 */

uint16_t reserved;

} __packed;

/*****************************************************************************/

/*

* Notes on commands:

*

* Each command is an 16-bit command value. Commands which take params or

* return response data specify structs for that data. If no struct is

* specified, the command does not input or output data, respectively.

* Parameter/response length is implicit in the structs. Some underlying

* communication protocols (I2C, SPI) may add length or checksum headers, but

* those are implementation-dependent and not defined here.

*/

/*****************************************************************************/

/* General / test commands */

/*

* Get protocol version, used to deal with non-backward compatible protocol

* changes.

*/

#define EC_CMD_PROTO_VERSION 0x00

struct ec_response_proto_version {

uint32_t version;

} __packed;

/*

* Hello. This is a simple command to test the EC is responsive to

* commands.

*/

#define EC_CMD_HELLO 0x01

struct ec_params_hello {

uint32_t in_data; /* Pass anything here */

} __packed;

struct ec_response_hello {

uint32_t out_data; /* Output will be in_data + 0x01020304 */

} __packed;

/* Get version number */

#define EC_CMD_GET_VERSION 0x02

enum ec_current_image {

EC_IMAGE_UNKNOWN = 0,

EC_IMAGE_RO,

EC_IMAGE_RW

};

struct ec_response_get_version {

/* Null-terminated version strings for RO, RW */

char version_string_ro[32];

char version_string_rw[32];

char reserved[32]; /* Was previously RW-B string */

uint32_t current_image; /* One of ec_current_image */

} __packed;

/* Read test */

#define EC_CMD_READ_TEST 0x03

struct ec_params_read_test {

uint32_t offset; /* Starting value for read buffer */

uint32_t size; /* Size to read in bytes */

} __packed;

struct ec_response_read_test {

uint32_t data[32];

} __packed;

/*

* Get build information

*

* Response is null-terminated string.

*/

#define EC_CMD_GET_BUILD_INFO 0x04

/* Get chip info */

#define EC_CMD_GET_CHIP_INFO 0x05

struct ec_response_get_chip_info {

/* Null-terminated strings */

char vendor[32];

char name[32];

char revision[32]; /* Mask version */

} __packed;

/* Get board HW version */

#define EC_CMD_GET_BOARD_VERSION 0x06

struct ec_response_board_version {

uint16_t board_version; /* A monotonously incrementing number. */

} __packed;

/*

* Read memory-mapped data.

*

* This is an alternate interface to memory-mapped data for bus protocols

* which don't support direct-mapped memory - I2C, SPI, etc.

*

* Response is params.size bytes of data.

*/

#define EC_CMD_READ_MEMMAP 0x07

struct ec_params_read_memmap {

uint8_t offset; /* Offset in memmap (EC_MEMMAP_*) */

uint8_t size; /* Size to read in bytes */

} __packed;

/* Read versions supported for a command */

#define EC_CMD_GET_CMD_VERSIONS 0x08

struct ec_params_get_cmd_versions {

uint8_t cmd; /* Command to check */

} __packed;

struct ec_params_get_cmd_versions_v1 {

uint16_t cmd; /* Command to check */

} __packed;

struct ec_response_get_cmd_versions {

/*

* Mask of supported versions; use EC_VER_MASK() to compare with a

* desired version.

*/

uint32_t version_mask;

} __packed;

/*

* Check EC communcations status (busy). This is needed on i2c/spi but not

* on lpc since it has its own out-of-band busy indicator.

*

* lpc must read the status from the command register. Attempting this on

* lpc will overwrite the args/parameter space and corrupt its data.

*/

#define EC_CMD_GET_COMMS_STATUS 0x09

/* Avoid using ec_status which is for return values */

enum ec_comms_status {

EC_COMMS_STATUS_PROCESSING = 1 << 0, /* Processing cmd */

};

struct ec_response_get_comms_status {

uint32_t flags; /* Mask of enum ec_comms_status */

} __packed;

/* Fake a variety of responses, purely for testing purposes. */

#define EC_CMD_TEST_PROTOCOL 0x0a

/* Tell the EC what to send back to us. */

struct ec_params_test_protocol {

uint32_t ec_result;

uint32_t ret_len;

uint8_t buf[32];

} __packed;

/* Here it comes... */

struct ec_response_test_protocol {

uint8_t buf[32];

} __packed;

/* Get prococol information */

#define EC_CMD_GET_PROTOCOL_INFO 0x0b

/* Flags for ec_response_get_protocol_info.flags */

/* EC_RES_IN_PROGRESS may be returned if a command is slow */

#define EC_PROTOCOL_INFO_IN_PROGRESS_SUPPORTED (1 << 0)

struct ec_response_get_protocol_info {

/* Fields which exist if at least protocol version 3 supported */

/* Bitmask of protocol versions supported (1 << n means version n)*/

uint32_t protocol_versions;

/* Maximum request packet size, in bytes */

uint16_t max_request_packet_size;

/* Maximum response packet size, in bytes */

uint16_t max_response_packet_size;

/* Flags; see EC_PROTOCOL_INFO_* */

uint32_t flags;

} __packed;

/*****************************************************************************/

/* Get/Set miscellaneous values */

/* The upper byte of .flags tells what to do (nothing means "get") */

#define EC_GSV_SET 0x80000000

/* The lower three bytes of .flags identifies the parameter, if that has

meaning for an individual command. */

#define EC_GSV_PARAM_MASK 0x00ffffff

struct ec_params_get_set_value {

uint32_t flags;

uint32_t value;

} __packed;

struct ec_response_get_set_value {

uint32_t flags;

uint32_t value;

} __packed;

/* More than one command can use these structs to get/set paramters. */

#define EC_CMD_GSV_PAUSE_IN_S5 0x0c

/*****************************************************************************/

/* List the features supported by the firmware */

#define EC_CMD_GET_FEATURES 0x0d

/* Supported features */

enum ec_feature_code {

/*

* This image contains a limited set of features. Another image

* in RW partition may support more features.

*/

EC_FEATURE_LIMITED = 0,

/*

* Commands for probing/reading/writing/erasing the flash in the

* EC are present.

*/

EC_FEATURE_FLASH = 1,

/*

* Can control the fan speed directly.

*/

EC_FEATURE_PWM_FAN = 2,

/*

* Can control the intensity of the keyboard backlight.

*/

EC_FEATURE_PWM_KEYB = 3,

/*

* Support Google lightbar, introduced on Pixel.

*/

EC_FEATURE_LIGHTBAR = 4,

/* Control of LEDs */

EC_FEATURE_LED = 5,

/* Exposes an interface to control gyro and sensors.

* The host goes through the EC to access these sensors.

* In addition, the EC may provide composite sensors, like lid angle.

*/

EC_FEATURE_MOTION_SENSE = 6,

/* The keyboard is controlled by the EC */

EC_FEATURE_KEYB = 7,

/* The AP can use part of the EC flash as persistent storage. */

EC_FEATURE_PSTORE = 8,

/* The EC monitors BIOS port 80h, and can return POST codes. */

EC_FEATURE_PORT80 = 9,

/*

* Thermal management: include TMP specific commands.

* Higher level than direct fan control.

*/

EC_FEATURE_THERMAL = 10,

/* Can switch the screen backlight on/off */

EC_FEATURE_BKLIGHT_SWITCH = 11,

/* Can switch the wifi module on/off */

EC_FEATURE_WIFI_SWITCH = 12,

/* Monitor host events, through for example SMI or SCI */

EC_FEATURE_HOST_EVENTS = 13,

/* The EC exposes GPIO commands to control/monitor connected devices. */

EC_FEATURE_GPIO = 14,

/* The EC can send i2c messages to downstream devices. */

EC_FEATURE_I2C = 15,

/* Command to control charger are included */

EC_FEATURE_CHARGER = 16,

/* Simple battery support. */

EC_FEATURE_BATTERY = 17,

/*

* Support Smart battery protocol

* (Common Smart Battery System Interface Specification)

*/

EC_FEATURE_SMART_BATTERY = 18,

/* EC can dectect when the host hangs. */

EC_FEATURE_HANG_DETECT = 19,

/* Report power information, for pit only */

EC_FEATURE_PMU = 20,

/* Another Cros EC device is present downstream of this one */

EC_FEATURE_SUB_MCU = 21,

/* Support USB Power delivery (PD) commands */

EC_FEATURE_USB_PD = 22,

/* Control USB multiplexer, for audio through USB port for instance. */

EC_FEATURE_USB_MUX = 23,

/* Motion Sensor code has an internal software FIFO */

EC_FEATURE_MOTION_SENSE_FIFO = 24,

};

#define EC_FEATURE_MASK_0(event_code) (1UL << (event_code % 32))

#define EC_FEATURE_MASK_1(event_code) (1UL << (event_code - 32))

struct ec_response_get_features {

uint32_t flags[2];

} __packed;

/*****************************************************************************/

/* Flash commands */

/* Get flash info */

#define EC_CMD_FLASH_INFO 0x10

/* Version 0 returns these fields */

struct ec_response_flash_info {

/* Usable flash size, in bytes */

uint32_t flash_size;

/*

* Write block size. Write offset and size must be a multiple

* of this.

*/

uint32_t write_block_size;

/*

* Erase block size. Erase offset and size must be a multiple

* of this.

*/

uint32_t erase_block_size;

/*

* Protection block size. Protection offset and size must be a

* multiple of this.

*/

uint32_t protect_block_size;

} __packed;

/* Flags for version 1+ flash info command */

/* EC flash erases bits to 0 instead of 1 */

#define EC_FLASH_INFO_ERASE_TO_0 (1 << 0)

/*

* Version 1 returns the same initial fields as version 0, with additional

* fields following.

*

* gcc anonymous structs don't seem to get along with the __packed directive;

* if they did we'd define the version 0 struct as a sub-struct of this one.

*/

struct ec_response_flash_info_1 {

/* Version 0 fields; see above for description */

uint32_t flash_size;

uint32_t write_block_size;

uint32_t erase_block_size;

uint32_t protect_block_size;

/* Version 1 adds these fields: */

/*

* Ideal write size in bytes. Writes will be fastest if size is

* exactly this and offset is a multiple of this. For example, an EC

* may have a write buffer which can do half-page operations if data is

* aligned, and a slower word-at-a-time write mode.

*/

uint32_t write_ideal_size;

/* Flags; see EC_FLASH_INFO_* */

uint32_t flags;

} __packed;

/*

* Read flash

*

* Response is params.size bytes of data.

*/

#define EC_CMD_FLASH_READ 0x11

struct ec_params_flash_read {

uint32_t offset; /* Byte offset to read */

uint32_t size; /* Size to read in bytes */

} __packed;

/* Write flash */

#define EC_CMD_FLASH_WRITE 0x12

#define EC_VER_FLASH_WRITE 1

/* Version 0 of the flash command supported only 64 bytes of data */

#define EC_FLASH_WRITE_VER0_SIZE 64

struct ec_params_flash_write {

uint32_t offset; /* Byte offset to write */

uint32_t size; /* Size to write in bytes */

/* Followed by data to write */

} __packed;

/* Erase flash */

#define EC_CMD_FLASH_ERASE 0x13

struct ec_params_flash_erase {

uint32_t offset; /* Byte offset to erase */

uint32_t size; /* Size to erase in bytes */

} __packed;

/*

* Get/set flash protection.

*

* If mask!=0, sets/clear the requested bits of flags. Depending on the

* firmware write protect GPIO, not all flags will take effect immediately;

* some flags require a subsequent hard reset to take effect. Check the

* returned flags bits to see what actually happened.

*

* If mask=0, simply returns the current flags state.

*/

#define EC_CMD_FLASH_PROTECT 0x15

#define EC_VER_FLASH_PROTECT 1 /* Command version 1 */

/* Flags for flash protection */

/* RO flash code protected when the EC boots */

#define EC_FLASH_PROTECT_RO_AT_BOOT (1 << 0)

/*

* RO flash code protected now. If this bit is set, at-boot status cannot

* be changed.

*/

#define EC_FLASH_PROTECT_RO_NOW (1 << 1)

/* Entire flash code protected now, until reboot. */

#define EC_FLASH_PROTECT_ALL_NOW (1 << 2)

/* Flash write protect GPIO is asserted now */

#define EC_FLASH_PROTECT_GPIO_ASSERTED (1 << 3)

/* Error - at least one bank of flash is stuck locked, and cannot be unlocked */

#define EC_FLASH_PROTECT_ERROR_STUCK (1 << 4)

/*

* Error - flash protection is in inconsistent state. At least one bank of

* flash which should be protected is not protected. Usually fixed by

* re-requesting the desired flags, or by a hard reset if that fails.

*/

#define EC_FLASH_PROTECT_ERROR_INCONSISTENT (1 << 5)

/* Entile flash code protected when the EC boots */

#define EC_FLASH_PROTECT_ALL_AT_BOOT (1 << 6)

struct ec_params_flash_protect {

uint32_t mask; /* Bits in flags to apply */

uint32_t flags; /* New flags to apply */

} __packed;

struct ec_response_flash_protect {

/* Current value of flash protect flags */

uint32_t flags;

/*

* Flags which are valid on this platform. This allows the caller

* to distinguish between flags which aren't set vs. flags which can't

* be set on this platform.

*/

uint32_t valid_flags;

/* Flags which can be changed given the current protection state */

uint32_t writable_flags;

} __packed;

/*

* Note: commands 0x14 - 0x19 version 0 were old commands to get/set flash

* write protect. These commands may be reused with version > 0.

*/

/* Get the region offset/size */

#define EC_CMD_FLASH_REGION_INFO 0x16

#define EC_VER_FLASH_REGION_INFO 1

enum ec_flash_region {

/* Region which holds read-only EC image */

EC_FLASH_REGION_RO = 0,

/* Region which holds rewritable EC image */

EC_FLASH_REGION_RW,

/*

* Region which should be write-protected in the factory (a superset of

* EC_FLASH_REGION_RO)

*/

EC_FLASH_REGION_WP_RO,

/* Number of regions */

EC_FLASH_REGION_COUNT,

};

struct ec_params_flash_region_info {

uint32_t region; /* enum ec_flash_region */

} __packed;

struct ec_response_flash_region_info {

uint32_t offset;

uint32_t size;

} __packed;

/* Read/write VbNvContext */

#define EC_CMD_VBNV_CONTEXT 0x17

#define EC_VER_VBNV_CONTEXT 1

#define EC_VBNV_BLOCK_SIZE 16

enum ec_vbnvcontext_op {

EC_VBNV_CONTEXT_OP_READ,

EC_VBNV_CONTEXT_OP_WRITE,

};

struct ec_params_vbnvcontext {

uint32_t op;

uint8_t block[EC_VBNV_BLOCK_SIZE];

} __packed;