xref: /openbsd/sys/dev/ipmi.c (revision 09467b48)
1 /*	$OpenBSD: ipmi.c,v 1.112 2020/03/29 09:31:10 kettenis Exp $ */
2 
3 /*
4  * Copyright (c) 2015 Masao Uebayashi
5  * Copyright (c) 2005 Jordan Hargrave
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/device.h>
34 #include <sys/ioctl.h>
35 #include <sys/extent.h>
36 #include <sys/sensors.h>
37 #include <sys/malloc.h>
38 #include <sys/kthread.h>
39 #include <sys/task.h>
40 
41 #include <machine/bus.h>
42 #include <machine/smbiosvar.h>
43 
44 #include <dev/ipmivar.h>
45 #include <dev/ipmi.h>
46 
47 struct ipmi_sensor {
48 	u_int8_t	*i_sdr;
49 	int		i_num;
50 	int		stype;
51 	int		etype;
52 	struct		ksensor i_sensor;
53 	SLIST_ENTRY(ipmi_sensor) list;
54 };
55 
56 int	ipmi_enabled = 0;
57 
58 #define SENSOR_REFRESH_RATE 5	/* seconds */
59 
60 #define DEVNAME(s)  ((s)->sc_dev.dv_xname)
61 
62 #define IPMI_BTMSG_LEN			0
63 #define IPMI_BTMSG_NFLN			1
64 #define IPMI_BTMSG_SEQ			2
65 #define IPMI_BTMSG_CMD			3
66 #define IPMI_BTMSG_CCODE		4
67 #define IPMI_BTMSG_DATASND		4
68 #define IPMI_BTMSG_DATARCV		5
69 
70 #define IPMI_MSG_NFLN			0
71 #define IPMI_MSG_CMD			1
72 #define IPMI_MSG_CCODE			2
73 
74 #define IPMI_SENSOR_TYPE_TEMP		0x0101
75 #define IPMI_SENSOR_TYPE_VOLT		0x0102
76 #define IPMI_SENSOR_TYPE_FAN		0x0104
77 #define IPMI_SENSOR_TYPE_INTRUSION	0x6F05
78 #define IPMI_SENSOR_TYPE_PWRSUPPLY	0x6F08
79 
80 #define IPMI_NAME_UNICODE		0x00
81 #define IPMI_NAME_BCDPLUS		0x01
82 #define IPMI_NAME_ASCII6BIT		0x02
83 #define IPMI_NAME_ASCII8BIT		0x03
84 
85 #define IPMI_ENTITY_PWRSUPPLY		0x0A
86 
87 #define IPMI_INVALID_SENSOR		(1L << 5)
88 #define IPMI_DISABLED_SENSOR		(1L << 6)
89 
90 #define IPMI_SDR_TYPEFULL		1
91 #define IPMI_SDR_TYPECOMPACT		2
92 
93 #define byteof(x) ((x) >> 3)
94 #define bitof(x)  (1L << ((x) & 0x7))
95 #define TB(b,m)	  (data[2+byteof(b)] & bitof(b))
96 
97 #ifdef IPMI_DEBUG
98 int	ipmi_dbg = 0;
99 #define dbg_printf(lvl, fmt...) \
100 	if (ipmi_dbg >= lvl) \
101 		printf(fmt);
102 #define dbg_dump(lvl, msg, len, buf) \
103 	if (len && ipmi_dbg >= lvl) \
104 		dumpb(msg, len, (const u_int8_t *)(buf));
105 #else
106 #define dbg_printf(lvl, fmt...)
107 #define dbg_dump(lvl, msg, len, buf)
108 #endif
109 
110 long signextend(unsigned long, int);
111 
112 SLIST_HEAD(ipmi_sensors_head, ipmi_sensor);
113 struct ipmi_sensors_head ipmi_sensor_list =
114     SLIST_HEAD_INITIALIZER(ipmi_sensor_list);
115 
116 void	dumpb(const char *, int, const u_int8_t *);
117 
118 int	read_sensor(struct ipmi_softc *, struct ipmi_sensor *);
119 int	add_sdr_sensor(struct ipmi_softc *, u_int8_t *, int);
120 int	get_sdr_partial(struct ipmi_softc *, u_int16_t, u_int16_t,
121 	    u_int8_t, u_int8_t, void *, u_int16_t *);
122 int	get_sdr(struct ipmi_softc *, u_int16_t, u_int16_t *);
123 
124 int	ipmi_sendcmd(struct ipmi_cmd *);
125 int	ipmi_recvcmd(struct ipmi_cmd *);
126 void	ipmi_cmd(struct ipmi_cmd *);
127 void	ipmi_cmd_poll(struct ipmi_cmd *);
128 void	ipmi_cmd_wait(struct ipmi_cmd *);
129 void	ipmi_cmd_wait_cb(void *);
130 
131 int	ipmi_watchdog(void *, int);
132 void	ipmi_watchdog_tickle(void *);
133 void	ipmi_watchdog_set(void *);
134 
135 struct ipmi_softc *ipmilookup(dev_t dev);
136 
137 int	ipmiopen(dev_t, int, int, struct proc *);
138 int	ipmiclose(dev_t, int, int, struct proc *);
139 int	ipmiioctl(dev_t, u_long, caddr_t, int, struct proc *);
140 
141 long	ipow(long, int);
142 long	ipmi_convert(u_int8_t, struct sdrtype1 *, long);
143 int	ipmi_sensor_name(char *, int, u_int8_t, u_int8_t *, int);
144 
145 /* BMC Helper Functions */
146 u_int8_t bmc_read(struct ipmi_softc *, int);
147 void	bmc_write(struct ipmi_softc *, int, u_int8_t);
148 int	bmc_io_wait(struct ipmi_softc *, struct ipmi_iowait *);
149 
150 void	bt_buildmsg(struct ipmi_cmd *);
151 void	cmn_buildmsg(struct ipmi_cmd *);
152 
153 int	getbits(u_int8_t *, int, int);
154 int	ipmi_sensor_type(int, int, int);
155 
156 void	ipmi_refresh_sensors(struct ipmi_softc *sc);
157 int	ipmi_map_regs(struct ipmi_softc *sc, struct ipmi_attach_args *ia);
158 void	ipmi_unmap_regs(struct ipmi_softc *);
159 
160 int	ipmi_sensor_status(struct ipmi_softc *, struct ipmi_sensor *,
161     u_int8_t *);
162 
163 int	 add_child_sensors(struct ipmi_softc *, u_int8_t *, int, int, int,
164     int, int, int, const char *);
165 
166 void	ipmi_create_thread(void *);
167 void	ipmi_poll_thread(void *);
168 
169 int	kcs_probe(struct ipmi_softc *);
170 int	kcs_reset(struct ipmi_softc *);
171 int	kcs_sendmsg(struct ipmi_cmd *);
172 int	kcs_recvmsg(struct ipmi_cmd *);
173 
174 int	bt_probe(struct ipmi_softc *);
175 int	bt_reset(struct ipmi_softc *);
176 int	bt_sendmsg(struct ipmi_cmd *);
177 int	bt_recvmsg(struct ipmi_cmd *);
178 
179 int	smic_probe(struct ipmi_softc *);
180 int	smic_reset(struct ipmi_softc *);
181 int	smic_sendmsg(struct ipmi_cmd *);
182 int	smic_recvmsg(struct ipmi_cmd *);
183 
184 struct ipmi_if kcs_if = {
185 	"KCS",
186 	IPMI_IF_KCS_NREGS,
187 	cmn_buildmsg,
188 	kcs_sendmsg,
189 	kcs_recvmsg,
190 	kcs_reset,
191 	kcs_probe,
192 	IPMI_MSG_DATASND,
193 	IPMI_MSG_DATARCV,
194 };
195 
196 struct ipmi_if smic_if = {
197 	"SMIC",
198 	IPMI_IF_SMIC_NREGS,
199 	cmn_buildmsg,
200 	smic_sendmsg,
201 	smic_recvmsg,
202 	smic_reset,
203 	smic_probe,
204 	IPMI_MSG_DATASND,
205 	IPMI_MSG_DATARCV,
206 };
207 
208 struct ipmi_if bt_if = {
209 	"BT",
210 	IPMI_IF_BT_NREGS,
211 	bt_buildmsg,
212 	bt_sendmsg,
213 	bt_recvmsg,
214 	bt_reset,
215 	bt_probe,
216 	IPMI_BTMSG_DATASND,
217 	IPMI_BTMSG_DATARCV,
218 };
219 
220 struct ipmi_if *ipmi_get_if(int);
221 
222 struct ipmi_if *
223 ipmi_get_if(int iftype)
224 {
225 	switch (iftype) {
226 	case IPMI_IF_KCS:
227 		return (&kcs_if);
228 	case IPMI_IF_SMIC:
229 		return (&smic_if);
230 	case IPMI_IF_BT:
231 		return (&bt_if);
232 	}
233 
234 	return (NULL);
235 }
236 
237 /*
238  * BMC Helper Functions
239  */
240 u_int8_t
241 bmc_read(struct ipmi_softc *sc, int offset)
242 {
243 	if (sc->sc_if_iosize == 4)
244 		return (bus_space_read_4(sc->sc_iot, sc->sc_ioh,
245 		    offset * sc->sc_if_iospacing));
246 	else
247 		return (bus_space_read_1(sc->sc_iot, sc->sc_ioh,
248 		    offset * sc->sc_if_iospacing));
249 }
250 
251 void
252 bmc_write(struct ipmi_softc *sc, int offset, u_int8_t val)
253 {
254 	if (sc->sc_if_iosize == 4)
255 		bus_space_write_4(sc->sc_iot, sc->sc_ioh,
256 		    offset * sc->sc_if_iospacing, val);
257 	else
258 		bus_space_write_1(sc->sc_iot, sc->sc_ioh,
259 		    offset * sc->sc_if_iospacing, val);
260 }
261 
262 int
263 bmc_io_wait(struct ipmi_softc *sc, struct ipmi_iowait *a)
264 {
265 	volatile u_int8_t	v;
266 	int			count = 5000000; /* == 5s XXX can be shorter */
267 
268 	while (count--) {
269 		v = bmc_read(sc, a->offset);
270 		if ((v & a->mask) == a->value)
271 			return v;
272 
273 		delay(1);
274 	}
275 
276 	dbg_printf(1, "%s: bmc_io_wait fails : *v=%.2x m=%.2x b=%.2x %s\n",
277 	    DEVNAME(sc), v, a->mask, a->value, a->lbl);
278 	return (-1);
279 
280 }
281 
282 #define RSSA_MASK 0xff
283 #define LUN_MASK 0x3
284 #define NETFN_LUN(nf,ln) (((nf) << 2) | ((ln) & LUN_MASK))
285 
286 /*
287  * BT interface
288  */
289 #define _BT_CTRL_REG			0
290 #define	  BT_CLR_WR_PTR			(1L << 0)
291 #define	  BT_CLR_RD_PTR			(1L << 1)
292 #define	  BT_HOST2BMC_ATN		(1L << 2)
293 #define	  BT_BMC2HOST_ATN		(1L << 3)
294 #define	  BT_EVT_ATN			(1L << 4)
295 #define	  BT_HOST_BUSY			(1L << 6)
296 #define	  BT_BMC_BUSY			(1L << 7)
297 
298 #define	  BT_READY	(BT_HOST_BUSY|BT_HOST2BMC_ATN|BT_BMC2HOST_ATN)
299 
300 #define _BT_DATAIN_REG			1
301 #define _BT_DATAOUT_REG			1
302 
303 #define _BT_INTMASK_REG			2
304 #define	 BT_IM_HIRQ_PEND		(1L << 1)
305 #define	 BT_IM_SCI_EN			(1L << 2)
306 #define	 BT_IM_SMI_EN			(1L << 3)
307 #define	 BT_IM_NMI2SMI			(1L << 4)
308 
309 int bt_read(struct ipmi_softc *, int);
310 int bt_write(struct ipmi_softc *, int, uint8_t);
311 
312 int
313 bt_read(struct ipmi_softc *sc, int reg)
314 {
315 	return bmc_read(sc, reg);
316 }
317 
318 int
319 bt_write(struct ipmi_softc *sc, int reg, uint8_t data)
320 {
321 	struct ipmi_iowait a;
322 
323 	a.offset = _BT_CTRL_REG;
324 	a.mask = BT_BMC_BUSY;
325 	a.value = 0;
326 	a.lbl = "bt_write";
327 	if (bmc_io_wait(sc, &a) < 0)
328 		return (-1);
329 
330 	bmc_write(sc, reg, data);
331 	return (0);
332 }
333 
334 int
335 bt_sendmsg(struct ipmi_cmd *c)
336 {
337 	struct ipmi_softc *sc = c->c_sc;
338 	struct ipmi_iowait a;
339 	int i;
340 
341 	bt_write(sc, _BT_CTRL_REG, BT_CLR_WR_PTR);
342 	for (i = 0; i < c->c_txlen; i++)
343 		bt_write(sc, _BT_DATAOUT_REG, sc->sc_buf[i]);
344 
345 	bt_write(sc, _BT_CTRL_REG, BT_HOST2BMC_ATN);
346 	a.offset = _BT_CTRL_REG;
347 	a.mask = BT_HOST2BMC_ATN | BT_BMC_BUSY;
348 	a.value = 0;
349 	a.lbl = "bt_sendwait";
350 	if (bmc_io_wait(sc, &a) < 0)
351 		return (-1);
352 
353 	return (0);
354 }
355 
356 int
357 bt_recvmsg(struct ipmi_cmd *c)
358 {
359 	struct ipmi_softc *sc = c->c_sc;
360 	struct ipmi_iowait a;
361 	u_int8_t len, v, i, j;
362 
363 	a.offset = _BT_CTRL_REG;
364 	a.mask = BT_BMC2HOST_ATN;
365 	a.value = BT_BMC2HOST_ATN;
366 	a.lbl = "bt_recvwait";
367 	if (bmc_io_wait(sc, &a) < 0)
368 		return (-1);
369 
370 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
371 	bt_write(sc, _BT_CTRL_REG, BT_BMC2HOST_ATN);
372 	bt_write(sc, _BT_CTRL_REG, BT_CLR_RD_PTR);
373 	len = bt_read(sc, _BT_DATAIN_REG);
374 	for (i = IPMI_BTMSG_NFLN, j = 0; i <= len; i++) {
375 		v = bt_read(sc, _BT_DATAIN_REG);
376 		if (i != IPMI_BTMSG_SEQ)
377 			*(sc->sc_buf + j++) = v;
378 	}
379 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
380 	c->c_rxlen = len - 1;
381 
382 	return (0);
383 }
384 
385 int
386 bt_reset(struct ipmi_softc *sc)
387 {
388 	return (-1);
389 }
390 
391 int
392 bt_probe(struct ipmi_softc *sc)
393 {
394 	u_int8_t rv;
395 
396 	rv = bmc_read(sc, _BT_CTRL_REG);
397 	rv &= BT_HOST_BUSY;
398 	rv |= BT_CLR_WR_PTR|BT_CLR_RD_PTR|BT_BMC2HOST_ATN|BT_HOST2BMC_ATN;
399 	bmc_write(sc, _BT_CTRL_REG, rv);
400 
401 	rv = bmc_read(sc, _BT_INTMASK_REG);
402 	rv &= BT_IM_SCI_EN|BT_IM_SMI_EN|BT_IM_NMI2SMI;
403 	rv |= BT_IM_HIRQ_PEND;
404 	bmc_write(sc, _BT_INTMASK_REG, rv);
405 
406 #if 0
407 	printf("bt_probe: %2x\n", v);
408 	printf(" WR    : %2x\n", v & BT_CLR_WR_PTR);
409 	printf(" RD    : %2x\n", v & BT_CLR_RD_PTR);
410 	printf(" H2B   : %2x\n", v & BT_HOST2BMC_ATN);
411 	printf(" B2H   : %2x\n", v & BT_BMC2HOST_ATN);
412 	printf(" EVT   : %2x\n", v & BT_EVT_ATN);
413 	printf(" HBSY  : %2x\n", v & BT_HOST_BUSY);
414 	printf(" BBSY  : %2x\n", v & BT_BMC_BUSY);
415 #endif
416 	return (0);
417 }
418 
419 /*
420  * SMIC interface
421  */
422 #define _SMIC_DATAIN_REG		0
423 #define _SMIC_DATAOUT_REG		0
424 
425 #define _SMIC_CTRL_REG			1
426 #define	  SMS_CC_GET_STATUS		 0x40
427 #define	  SMS_CC_START_TRANSFER		 0x41
428 #define	  SMS_CC_NEXT_TRANSFER		 0x42
429 #define	  SMS_CC_END_TRANSFER		 0x43
430 #define	  SMS_CC_START_RECEIVE		 0x44
431 #define	  SMS_CC_NEXT_RECEIVE		 0x45
432 #define	  SMS_CC_END_RECEIVE		 0x46
433 #define	  SMS_CC_TRANSFER_ABORT		 0x47
434 
435 #define	  SMS_SC_READY			 0xc0
436 #define	  SMS_SC_WRITE_START		 0xc1
437 #define	  SMS_SC_WRITE_NEXT		 0xc2
438 #define	  SMS_SC_WRITE_END		 0xc3
439 #define	  SMS_SC_READ_START		 0xc4
440 #define	  SMS_SC_READ_NEXT		 0xc5
441 #define	  SMS_SC_READ_END		 0xc6
442 
443 #define _SMIC_FLAG_REG			2
444 #define	  SMIC_BUSY			(1L << 0)
445 #define	  SMIC_SMS_ATN			(1L << 2)
446 #define	  SMIC_EVT_ATN			(1L << 3)
447 #define	  SMIC_SMI			(1L << 4)
448 #define	  SMIC_TX_DATA_RDY		(1L << 6)
449 #define	  SMIC_RX_DATA_RDY		(1L << 7)
450 
451 int	smic_wait(struct ipmi_softc *, u_int8_t, u_int8_t, const char *);
452 int	smic_write_cmd_data(struct ipmi_softc *, u_int8_t, const u_int8_t *);
453 int	smic_read_data(struct ipmi_softc *, u_int8_t *);
454 
455 int
456 smic_wait(struct ipmi_softc *sc, u_int8_t mask, u_int8_t val, const char *lbl)
457 {
458 	struct ipmi_iowait a;
459 	int v;
460 
461 	/* Wait for expected flag bits */
462 	a.offset = _SMIC_FLAG_REG;
463 	a.mask = mask;
464 	a.value = val;
465 	a.lbl = "smicwait";
466 	v = bmc_io_wait(sc, &a);
467 	if (v < 0)
468 		return (-1);
469 
470 	/* Return current status */
471 	v = bmc_read(sc, _SMIC_CTRL_REG);
472 	dbg_printf(99, "smic_wait = %.2x\n", v);
473 	return (v);
474 }
475 
476 int
477 smic_write_cmd_data(struct ipmi_softc *sc, u_int8_t cmd, const u_int8_t *data)
478 {
479 	int	sts, v;
480 
481 	dbg_printf(50, "smic_wcd: %.2x %.2x\n", cmd, data ? *data : -1);
482 	sts = smic_wait(sc, SMIC_TX_DATA_RDY | SMIC_BUSY, SMIC_TX_DATA_RDY,
483 	    "smic_write_cmd_data ready");
484 	if (sts < 0)
485 		return (sts);
486 
487 	bmc_write(sc, _SMIC_CTRL_REG, cmd);
488 	if (data)
489 		bmc_write(sc, _SMIC_DATAOUT_REG, *data);
490 
491 	/* Toggle BUSY bit, then wait for busy bit to clear */
492 	v = bmc_read(sc, _SMIC_FLAG_REG);
493 	bmc_write(sc, _SMIC_FLAG_REG, v | SMIC_BUSY);
494 
495 	return (smic_wait(sc, SMIC_BUSY, 0, "smic_write_cmd_data busy"));
496 }
497 
498 int
499 smic_read_data(struct ipmi_softc *sc, u_int8_t *data)
500 {
501 	int sts;
502 
503 	sts = smic_wait(sc, SMIC_RX_DATA_RDY | SMIC_BUSY, SMIC_RX_DATA_RDY,
504 	    "smic_read_data");
505 	if (sts >= 0) {
506 		*data = bmc_read(sc, _SMIC_DATAIN_REG);
507 		dbg_printf(50, "smic_readdata: %.2x\n", *data);
508 	}
509 	return (sts);
510 }
511 
512 #define ErrStat(a,b) if (a) printf(b);
513 
514 int
515 smic_sendmsg(struct ipmi_cmd *c)
516 {
517 	struct ipmi_softc *sc = c->c_sc;
518 	int sts, idx;
519 
520 	sts = smic_write_cmd_data(sc, SMS_CC_START_TRANSFER, &sc->sc_buf[0]);
521 	ErrStat(sts != SMS_SC_WRITE_START, "wstart");
522 	for (idx = 1; idx < c->c_txlen - 1; idx++) {
523 		sts = smic_write_cmd_data(sc, SMS_CC_NEXT_TRANSFER,
524 		    &sc->sc_buf[idx]);
525 		ErrStat(sts != SMS_SC_WRITE_NEXT, "write");
526 	}
527 	sts = smic_write_cmd_data(sc, SMS_CC_END_TRANSFER, &sc->sc_buf[idx]);
528 	if (sts != SMS_SC_WRITE_END) {
529 		dbg_printf(50, "smic_sendmsg %d/%d = %.2x\n", idx, c->c_txlen, sts);
530 		return (-1);
531 	}
532 
533 	return (0);
534 }
535 
536 int
537 smic_recvmsg(struct ipmi_cmd *c)
538 {
539 	struct ipmi_softc *sc = c->c_sc;
540 	int sts, idx;
541 
542 	c->c_rxlen = 0;
543 	sts = smic_wait(sc, SMIC_RX_DATA_RDY, SMIC_RX_DATA_RDY, "smic_recvmsg");
544 	if (sts < 0)
545 		return (-1);
546 
547 	sts = smic_write_cmd_data(sc, SMS_CC_START_RECEIVE, NULL);
548 	ErrStat(sts != SMS_SC_READ_START, "rstart");
549 	for (idx = 0;; ) {
550 		sts = smic_read_data(sc, &sc->sc_buf[idx++]);
551 		if (sts != SMS_SC_READ_START && sts != SMS_SC_READ_NEXT)
552 			break;
553 		smic_write_cmd_data(sc, SMS_CC_NEXT_RECEIVE, NULL);
554 	}
555 	ErrStat(sts != SMS_SC_READ_END, "rend");
556 
557 	c->c_rxlen = idx;
558 
559 	sts = smic_write_cmd_data(sc, SMS_CC_END_RECEIVE, NULL);
560 	if (sts != SMS_SC_READY) {
561 		dbg_printf(50, "smic_recvmsg %d/%d = %.2x\n", idx, c->c_maxrxlen, sts);
562 		return (-1);
563 	}
564 
565 	return (0);
566 }
567 
568 int
569 smic_reset(struct ipmi_softc *sc)
570 {
571 	return (-1);
572 }
573 
574 int
575 smic_probe(struct ipmi_softc *sc)
576 {
577 	/* Flag register should not be 0xFF on a good system */
578 	if (bmc_read(sc, _SMIC_FLAG_REG) == 0xFF)
579 		return (-1);
580 
581 	return (0);
582 }
583 
584 /*
585  * KCS interface
586  */
587 #define _KCS_DATAIN_REGISTER		0
588 #define _KCS_DATAOUT_REGISTER		0
589 #define	  KCS_READ_NEXT			0x68
590 
591 #define _KCS_COMMAND_REGISTER		1
592 #define	  KCS_GET_STATUS		0x60
593 #define	  KCS_WRITE_START		0x61
594 #define	  KCS_WRITE_END			0x62
595 
596 #define _KCS_STATUS_REGISTER		1
597 #define	  KCS_OBF			(1L << 0)
598 #define	  KCS_IBF			(1L << 1)
599 #define	  KCS_SMS_ATN			(1L << 2)
600 #define	  KCS_CD			(1L << 3)
601 #define	  KCS_OEM1			(1L << 4)
602 #define	  KCS_OEM2			(1L << 5)
603 #define	  KCS_STATE_MASK		0xc0
604 #define	    KCS_IDLE_STATE		0x00
605 #define	    KCS_READ_STATE		0x40
606 #define	    KCS_WRITE_STATE		0x80
607 #define	    KCS_ERROR_STATE		0xC0
608 
609 int	kcs_wait(struct ipmi_softc *, u_int8_t, u_int8_t, const char *);
610 int	kcs_write_cmd(struct ipmi_softc *, u_int8_t);
611 int	kcs_write_data(struct ipmi_softc *, u_int8_t);
612 int	kcs_read_data(struct ipmi_softc *, u_int8_t *);
613 
614 int
615 kcs_wait(struct ipmi_softc *sc, u_int8_t mask, u_int8_t value, const char *lbl)
616 {
617 	struct ipmi_iowait a;
618 	int v;
619 
620 	a.offset = _KCS_STATUS_REGISTER;
621 	a.mask = mask;
622 	a.value = value;
623 	a.lbl = lbl;
624 	v = bmc_io_wait(sc, &a);
625 	if (v < 0)
626 		return (v);
627 
628 	/* Check if output buffer full, read dummy byte	 */
629 	if ((v & (KCS_OBF | KCS_STATE_MASK)) == (KCS_OBF | KCS_WRITE_STATE))
630 		bmc_read(sc, _KCS_DATAIN_REGISTER);
631 
632 	/* Check for error state */
633 	if ((v & KCS_STATE_MASK) == KCS_ERROR_STATE) {
634 		bmc_write(sc, _KCS_COMMAND_REGISTER, KCS_GET_STATUS);
635 		while (bmc_read(sc, _KCS_STATUS_REGISTER) & KCS_IBF)
636 			continue;
637 		printf("%s: error code: %x\n", DEVNAME(sc),
638 		    bmc_read(sc, _KCS_DATAIN_REGISTER));
639 	}
640 
641 	return (v & KCS_STATE_MASK);
642 }
643 
644 int
645 kcs_write_cmd(struct ipmi_softc *sc, u_int8_t cmd)
646 {
647 	/* ASSERT: IBF and OBF are clear */
648 	dbg_printf(50, "kcswritecmd: %.2x\n", cmd);
649 	bmc_write(sc, _KCS_COMMAND_REGISTER, cmd);
650 
651 	return (kcs_wait(sc, KCS_IBF, 0, "write_cmd"));
652 }
653 
654 int
655 kcs_write_data(struct ipmi_softc *sc, u_int8_t data)
656 {
657 	/* ASSERT: IBF and OBF are clear */
658 	dbg_printf(50, "kcswritedata: %.2x\n", data);
659 	bmc_write(sc, _KCS_DATAOUT_REGISTER, data);
660 
661 	return (kcs_wait(sc, KCS_IBF, 0, "write_data"));
662 }
663 
664 int
665 kcs_read_data(struct ipmi_softc *sc, u_int8_t * data)
666 {
667 	int sts;
668 
669 	sts = kcs_wait(sc, KCS_IBF | KCS_OBF, KCS_OBF, "read_data");
670 	if (sts != KCS_READ_STATE)
671 		return (sts);
672 
673 	/* ASSERT: OBF is set read data, request next byte */
674 	*data = bmc_read(sc, _KCS_DATAIN_REGISTER);
675 	bmc_write(sc, _KCS_DATAOUT_REGISTER, KCS_READ_NEXT);
676 
677 	dbg_printf(50, "kcsreaddata: %.2x\n", *data);
678 
679 	return (sts);
680 }
681 
682 /* Exported KCS functions */
683 int
684 kcs_sendmsg(struct ipmi_cmd *c)
685 {
686 	struct ipmi_softc *sc = c->c_sc;
687 	int idx, sts;
688 
689 	/* ASSERT: IBF is clear */
690 	dbg_dump(50, "kcs sendmsg", c->c_txlen, sc->sc_buf);
691 	sts = kcs_write_cmd(sc, KCS_WRITE_START);
692 	for (idx = 0; idx < c->c_txlen; idx++) {
693 		if (idx == c->c_txlen - 1)
694 			sts = kcs_write_cmd(sc, KCS_WRITE_END);
695 
696 		if (sts != KCS_WRITE_STATE)
697 			break;
698 
699 		sts = kcs_write_data(sc, sc->sc_buf[idx]);
700 	}
701 	if (sts != KCS_READ_STATE) {
702 		dbg_printf(1, "kcs sendmsg = %d/%d <%.2x>\n", idx, c->c_txlen, sts);
703 		dbg_dump(1, "kcs_sendmsg", c->c_txlen, sc->sc_buf);
704 		return (-1);
705 	}
706 
707 	return (0);
708 }
709 
710 int
711 kcs_recvmsg(struct ipmi_cmd *c)
712 {
713 	struct ipmi_softc *sc = c->c_sc;
714 	int idx, sts;
715 
716 	for (idx = 0; idx < c->c_maxrxlen; idx++) {
717 		sts = kcs_read_data(sc, &sc->sc_buf[idx]);
718 		if (sts != KCS_READ_STATE)
719 			break;
720 	}
721 	sts = kcs_wait(sc, KCS_IBF, 0, "recv");
722 	c->c_rxlen = idx;
723 	if (sts != KCS_IDLE_STATE) {
724 		dbg_printf(1, "kcs recvmsg = %d/%d <%.2x>\n", idx, c->c_maxrxlen, sts);
725 		return (-1);
726 	}
727 
728 	dbg_dump(50, "kcs recvmsg", idx, sc->sc_buf);
729 
730 	return (0);
731 }
732 
733 int
734 kcs_reset(struct ipmi_softc *sc)
735 {
736 	return (-1);
737 }
738 
739 int
740 kcs_probe(struct ipmi_softc *sc)
741 {
742 	u_int8_t v;
743 
744 	v = bmc_read(sc, _KCS_STATUS_REGISTER);
745 	if ((v & KCS_STATE_MASK) == KCS_ERROR_STATE)
746 		return (1);
747 #if 0
748 	printf("kcs_probe: %2x\n", v);
749 	printf(" STS: %2x\n", v & KCS_STATE_MASK);
750 	printf(" ATN: %2x\n", v & KCS_SMS_ATN);
751 	printf(" C/D: %2x\n", v & KCS_CD);
752 	printf(" IBF: %2x\n", v & KCS_IBF);
753 	printf(" OBF: %2x\n", v & KCS_OBF);
754 #endif
755 	return (0);
756 }
757 
758 /*
759  * IPMI code
760  */
761 #define READ_SMS_BUFFER		0x37
762 #define WRITE_I2C		0x50
763 
764 #define GET_MESSAGE_CMD		0x33
765 #define SEND_MESSAGE_CMD	0x34
766 
767 #define IPMB_CHANNEL_NUMBER	0
768 
769 #define PUBLIC_BUS		0
770 
771 #define MIN_I2C_PACKET_SIZE	3
772 #define MIN_IMB_PACKET_SIZE	7	/* one byte for cksum */
773 
774 #define MIN_BTBMC_REQ_SIZE	4
775 #define MIN_BTBMC_RSP_SIZE	5
776 #define MIN_BMC_REQ_SIZE	2
777 #define MIN_BMC_RSP_SIZE	3
778 
779 #define BMC_SA			0x20	/* BMC/ESM3 */
780 #define FPC_SA			0x22	/* front panel */
781 #define BP_SA			0xC0	/* Primary Backplane */
782 #define BP2_SA			0xC2	/* Secondary Backplane */
783 #define PBP_SA			0xC4	/* Peripheral Backplane */
784 #define DRAC_SA			0x28	/* DRAC-III */
785 #define DRAC3_SA		0x30	/* DRAC-III */
786 #define BMC_LUN			0
787 #define SMS_LUN			2
788 
789 struct ipmi_request {
790 	u_int8_t	rsSa;
791 	u_int8_t	rsLun;
792 	u_int8_t	netFn;
793 	u_int8_t	cmd;
794 	u_int8_t	data_len;
795 	u_int8_t	*data;
796 };
797 
798 struct ipmi_response {
799 	u_int8_t	cCode;
800 	u_int8_t	data_len;
801 	u_int8_t	*data;
802 };
803 
804 struct ipmi_bmc_request {
805 	u_int8_t	bmc_nfLn;
806 	u_int8_t	bmc_cmd;
807 	u_int8_t	bmc_data_len;
808 	u_int8_t	bmc_data[1];
809 };
810 
811 struct ipmi_bmc_response {
812 	u_int8_t	bmc_nfLn;
813 	u_int8_t	bmc_cmd;
814 	u_int8_t	bmc_cCode;
815 	u_int8_t	bmc_data_len;
816 	u_int8_t	bmc_data[1];
817 };
818 
819 struct cfdriver ipmi_cd = {
820 	NULL, "ipmi", DV_DULL
821 };
822 
823 void
824 dumpb(const char *lbl, int len, const u_int8_t *data)
825 {
826 	int idx;
827 
828 	printf("%s: ", lbl);
829 	for (idx = 0; idx < len; idx++)
830 		printf("%.2x ", data[idx]);
831 
832 	printf("\n");
833 }
834 
835 /*
836  * bt_buildmsg builds an IPMI message from a nfLun, cmd, and data
837  * This is used by BT protocol
838  */
839 void
840 bt_buildmsg(struct ipmi_cmd *c)
841 {
842 	struct ipmi_softc *sc = c->c_sc;
843 	u_int8_t *buf = sc->sc_buf;
844 
845 	buf[IPMI_BTMSG_LEN] = c->c_txlen + (IPMI_BTMSG_DATASND - 1);
846 	buf[IPMI_BTMSG_NFLN] = NETFN_LUN(c->c_netfn, c->c_rslun);
847 	buf[IPMI_BTMSG_SEQ] = sc->sc_btseq++;
848 	buf[IPMI_BTMSG_CMD] = c->c_cmd;
849 	if (c->c_txlen && c->c_data)
850 		memcpy(buf + IPMI_BTMSG_DATASND, c->c_data, c->c_txlen);
851 }
852 
853 /*
854  * cmn_buildmsg builds an IPMI message from a nfLun, cmd, and data
855  * This is used by both SMIC and KCS protocols
856  */
857 void
858 cmn_buildmsg(struct ipmi_cmd *c)
859 {
860 	struct ipmi_softc *sc = c->c_sc;
861 	u_int8_t *buf = sc->sc_buf;
862 
863 	buf[IPMI_MSG_NFLN] = NETFN_LUN(c->c_netfn, c->c_rslun);
864 	buf[IPMI_MSG_CMD] = c->c_cmd;
865 	if (c->c_txlen && c->c_data)
866 		memcpy(buf + IPMI_MSG_DATASND, c->c_data, c->c_txlen);
867 }
868 
869 /* Send an IPMI command */
870 int
871 ipmi_sendcmd(struct ipmi_cmd *c)
872 {
873 	struct ipmi_softc	*sc = c->c_sc;
874 	int		rc = -1;
875 
876 	dbg_printf(50, "ipmi_sendcmd: rssa=%.2x nfln=%.2x cmd=%.2x len=%.2x\n",
877 	    c->c_rssa, NETFN_LUN(c->c_netfn, c->c_rslun), c->c_cmd, c->c_txlen);
878 	dbg_dump(10, " send", c->c_txlen, c->c_data);
879 	if (c->c_rssa != BMC_SA) {
880 #if 0
881 		sc->sc_if->buildmsg(c);
882 		pI2C->bus = (sc->if_ver == 0x09) ?
883 		    PUBLIC_BUS :
884 		    IPMB_CHANNEL_NUMBER;
885 
886 		imbreq->rsSa = rssa;
887 		imbreq->nfLn = NETFN_LUN(netfn, rslun);
888 		imbreq->cSum1 = -(imbreq->rsSa + imbreq->nfLn);
889 		imbreq->rqSa = BMC_SA;
890 		imbreq->seqLn = NETFN_LUN(sc->imb_seq++, SMS_LUN);
891 		imbreq->cmd = cmd;
892 		if (txlen)
893 			memcpy(imbreq->data, data, txlen);
894 		/* Set message checksum */
895 		imbreq->data[txlen] = cksum8(&imbreq->rqSa, txlen + 3);
896 #endif
897 		goto done;
898 	} else
899 		sc->sc_if->buildmsg(c);
900 
901 	c->c_txlen += sc->sc_if->datasnd;
902 	rc = sc->sc_if->sendmsg(c);
903 
904 done:
905 	return (rc);
906 }
907 
908 /* Receive an IPMI command */
909 int
910 ipmi_recvcmd(struct ipmi_cmd *c)
911 {
912 	struct ipmi_softc *sc = c->c_sc;
913 	u_int8_t	*buf = sc->sc_buf, rc = 0;
914 
915 	/* Receive message from interface, copy out result data */
916 	c->c_maxrxlen += sc->sc_if->datarcv;
917 	if (sc->sc_if->recvmsg(c) ||
918 	    c->c_rxlen < sc->sc_if->datarcv) {
919 		return (-1);
920 	}
921 
922 	c->c_rxlen -= sc->sc_if->datarcv;
923 	if (c->c_rxlen > 0 && c->c_data)
924 		memcpy(c->c_data, buf + sc->sc_if->datarcv, c->c_rxlen);
925 
926 	rc = buf[IPMI_MSG_CCODE];
927 #ifdef IPMI_DEBUG
928 	if (rc != 0)
929 		dbg_printf(1, "ipmi_recvcmd: nfln=%.2x cmd=%.2x err=%.2x\n",
930 		    buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD], buf[IPMI_MSG_CCODE]);
931 #endif
932 
933 	dbg_printf(50, "ipmi_recvcmd: nfln=%.2x cmd=%.2x err=%.2x len=%.2x\n",
934 	    buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD], buf[IPMI_MSG_CCODE],
935 	    c->c_rxlen);
936 	dbg_dump(10, " recv", c->c_rxlen, c->c_data);
937 
938 	return (rc);
939 }
940 
941 void
942 ipmi_cmd(struct ipmi_cmd *c)
943 {
944 	if (cold || panicstr != NULL)
945 		ipmi_cmd_poll(c);
946 	else
947 		ipmi_cmd_wait(c);
948 }
949 
950 void
951 ipmi_cmd_poll(struct ipmi_cmd *c)
952 {
953 	if ((c->c_ccode = ipmi_sendcmd(c)))
954 		printf("%s: sendcmd fails\n", DEVNAME(c->c_sc));
955 	else
956 		c->c_ccode = ipmi_recvcmd(c);
957 }
958 
959 void
960 ipmi_cmd_wait(struct ipmi_cmd *c)
961 {
962 	struct task t;
963 	int res;
964 
965 	task_set(&t, ipmi_cmd_wait_cb, c);
966 	res = task_add(c->c_sc->sc_cmd_taskq, &t);
967 	KASSERT(res == 1);
968 
969 	tsleep_nsec(c, PWAIT, "ipmicmd", INFSLP);
970 
971 	res = task_del(c->c_sc->sc_cmd_taskq, &t);
972 	KASSERT(res == 0);
973 }
974 
975 void
976 ipmi_cmd_wait_cb(void *arg)
977 {
978 	struct ipmi_cmd *c = arg;
979 
980 	ipmi_cmd_poll(c);
981 	wakeup(c);
982 }
983 
984 /* Read a partial SDR entry */
985 int
986 get_sdr_partial(struct ipmi_softc *sc, u_int16_t recordId, u_int16_t reserveId,
987     u_int8_t offset, u_int8_t length, void *buffer, u_int16_t *nxtRecordId)
988 {
989 	u_int8_t	cmd[IPMI_GET_WDOG_MAX + 255];	/* 8 + max of length */
990 	int		len;
991 
992 	((u_int16_t *) cmd)[0] = reserveId;
993 	((u_int16_t *) cmd)[1] = recordId;
994 	cmd[4] = offset;
995 	cmd[5] = length;
996 
997 	struct ipmi_cmd	c;
998 	c.c_sc = sc;
999 	c.c_rssa = BMC_SA;
1000 	c.c_rslun = BMC_LUN;
1001 	c.c_netfn = STORAGE_NETFN;
1002 	c.c_cmd = STORAGE_GET_SDR;
1003 	c.c_txlen = IPMI_SET_WDOG_MAX;
1004 	c.c_rxlen = 0;
1005 	c.c_maxrxlen = 8 + length;
1006 	c.c_data = cmd;
1007 	ipmi_cmd(&c);
1008 	len = c.c_rxlen;
1009 
1010 	if (nxtRecordId)
1011 		*nxtRecordId = *(uint16_t *) cmd;
1012 	if (len > 2)
1013 		memcpy(buffer, cmd + 2, len - 2);
1014 	else
1015 		return (1);
1016 
1017 	return (0);
1018 }
1019 
1020 int maxsdrlen = 0x10;
1021 
1022 /* Read an entire SDR; pass to add sensor */
1023 int
1024 get_sdr(struct ipmi_softc *sc, u_int16_t recid, u_int16_t *nxtrec)
1025 {
1026 	u_int16_t	resid = 0;
1027 	int		len, sdrlen, offset;
1028 	u_int8_t	*psdr;
1029 	struct sdrhdr	shdr;
1030 
1031 	/* Reserve SDR */
1032 	struct ipmi_cmd	c;
1033 	c.c_sc = sc;
1034 	c.c_rssa = BMC_SA;
1035 	c.c_rslun = BMC_LUN;
1036 	c.c_netfn = STORAGE_NETFN;
1037 	c.c_cmd = STORAGE_RESERVE_SDR;
1038 	c.c_txlen = 0;
1039 	c.c_maxrxlen = sizeof(resid);
1040 	c.c_rxlen = 0;
1041 	c.c_data = &resid;
1042 	ipmi_cmd(&c);
1043 
1044 	/* Get SDR Header */
1045 	if (get_sdr_partial(sc, recid, resid, 0, sizeof shdr, &shdr, nxtrec)) {
1046 		printf("%s: get header fails\n", DEVNAME(sc));
1047 		return (1);
1048 	}
1049 	/* Allocate space for entire SDR Length of SDR in header does not
1050 	 * include header length */
1051 	sdrlen = sizeof(shdr) + shdr.record_length;
1052 	psdr = malloc(sdrlen, M_DEVBUF, M_NOWAIT);
1053 	if (psdr == NULL)
1054 		return (1);
1055 
1056 	memcpy(psdr, &shdr, sizeof(shdr));
1057 
1058 	/* Read SDR Data maxsdrlen bytes at a time */
1059 	for (offset = sizeof(shdr); offset < sdrlen; offset += maxsdrlen) {
1060 		len = sdrlen - offset;
1061 		if (len > maxsdrlen)
1062 			len = maxsdrlen;
1063 
1064 		if (get_sdr_partial(sc, recid, resid, offset, len,
1065 		    psdr + offset, NULL)) {
1066 			printf("%s: get chunk: %d,%d fails\n", DEVNAME(sc),
1067 			    offset, len);
1068 			free(psdr, M_DEVBUF, sdrlen);
1069 			return (1);
1070 		}
1071 	}
1072 
1073 	/* Add SDR to sensor list, if not wanted, free buffer */
1074 	if (add_sdr_sensor(sc, psdr, sdrlen) == 0)
1075 		free(psdr, M_DEVBUF, sdrlen);
1076 
1077 	return (0);
1078 }
1079 
1080 int
1081 getbits(u_int8_t *bytes, int bitpos, int bitlen)
1082 {
1083 	int	v;
1084 	int	mask;
1085 
1086 	bitpos += bitlen - 1;
1087 	for (v = 0; bitlen--;) {
1088 		v <<= 1;
1089 		mask = 1L << (bitpos & 7);
1090 		if (bytes[bitpos >> 3] & mask)
1091 			v |= 1;
1092 		bitpos--;
1093 	}
1094 
1095 	return (v);
1096 }
1097 
1098 /* Decode IPMI sensor name */
1099 int
1100 ipmi_sensor_name(char *name, int len, u_int8_t typelen, u_int8_t *bits,
1101     int bitslen)
1102 {
1103 	int	i, slen;
1104 	char	bcdplus[] = "0123456789 -.:,_";
1105 
1106 	slen = typelen & 0x1F;
1107 	switch (typelen >> 6) {
1108 	case IPMI_NAME_UNICODE:
1109 		//unicode
1110 		break;
1111 
1112 	case IPMI_NAME_BCDPLUS:
1113 		/* Characters are encoded in 4-bit BCDPLUS */
1114 		if (len < slen * 2 + 1)
1115 			slen = (len >> 1) - 1;
1116 		if (slen > bitslen)
1117 			return (0);
1118 		for (i = 0; i < slen; i++) {
1119 			*(name++) = bcdplus[bits[i] >> 4];
1120 			*(name++) = bcdplus[bits[i] & 0xF];
1121 		}
1122 		break;
1123 
1124 	case IPMI_NAME_ASCII6BIT:
1125 		/* Characters are encoded in 6-bit ASCII
1126 		 *   0x00 - 0x3F maps to 0x20 - 0x5F */
1127 		/* XXX: need to calculate max len: slen = 3/4 * len */
1128 		if (len < slen + 1)
1129 			slen = len - 1;
1130 		if (slen * 6 / 8 > bitslen)
1131 			return (0);
1132 		for (i = 0; i < slen * 8; i += 6) {
1133 			*(name++) = getbits(bits, i, 6) + ' ';
1134 		}
1135 		break;
1136 
1137 	case IPMI_NAME_ASCII8BIT:
1138 		/* Characters are 8-bit ascii */
1139 		if (len < slen + 1)
1140 			slen = len - 1;
1141 		if (slen > bitslen)
1142 			return (0);
1143 		while (slen--)
1144 			*(name++) = *(bits++);
1145 		break;
1146 	}
1147 	*name = 0;
1148 
1149 	return (1);
1150 }
1151 
1152 /* Calculate val * 10^exp */
1153 long
1154 ipow(long val, int exp)
1155 {
1156 	while (exp > 0) {
1157 		val *= 10;
1158 		exp--;
1159 	}
1160 
1161 	while (exp < 0) {
1162 		val /= 10;
1163 		exp++;
1164 	}
1165 
1166 	return (val);
1167 }
1168 
1169 /* Sign extend a n-bit value */
1170 long
1171 signextend(unsigned long val, int bits)
1172 {
1173 	long msk = (1L << (bits-1))-1;
1174 
1175 	return (-(val & ~msk) | val);
1176 }
1177 
1178 /* Convert IPMI reading from sensor factors */
1179 long
1180 ipmi_convert(u_int8_t v, struct sdrtype1 *s1, long adj)
1181 {
1182 	int16_t	M, B;
1183 	int8_t	K1, K2;
1184 	long	val;
1185 
1186 	/* Calculate linear reading variables */
1187 	M  = signextend((((short)(s1->m_tolerance & 0xC0)) << 2) + s1->m, 10);
1188 	B  = signextend((((short)(s1->b_accuracy & 0xC0)) << 2) + s1->b, 10);
1189 	K1 = signextend(s1->rbexp & 0xF, 4);
1190 	K2 = signextend(s1->rbexp >> 4, 4);
1191 
1192 	/* Calculate sensor reading:
1193 	 *  y = L((M * v + (B * 10^K1)) * 10^(K2+adj)
1194 	 *
1195 	 * This commutes out to:
1196 	 *  y = L(M*v * 10^(K2+adj) + B * 10^(K1+K2+adj)); */
1197 	val = ipow(M * v, K2 + adj) + ipow(B, K1 + K2 + adj);
1198 
1199 	/* Linearization function: y = f(x) 0 : y = x 1 : y = ln(x) 2 : y =
1200 	 * log10(x) 3 : y = log2(x) 4 : y = e^x 5 : y = 10^x 6 : y = 2^x 7 : y
1201 	 * = 1/x 8 : y = x^2 9 : y = x^3 10 : y = square root(x) 11 : y = cube
1202 	 * root(x) */
1203 	return (val);
1204 }
1205 
1206 int
1207 ipmi_sensor_status(struct ipmi_softc *sc, struct ipmi_sensor *psensor,
1208     u_int8_t *reading)
1209 {
1210 	struct sdrtype1	*s1 = (struct sdrtype1 *)psensor->i_sdr;
1211 	int		etype;
1212 
1213 	/* Get reading of sensor */
1214 	switch (psensor->i_sensor.type) {
1215 	case SENSOR_TEMP:
1216 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 6);
1217 		psensor->i_sensor.value += 273150000;
1218 		break;
1219 
1220 	case SENSOR_VOLTS_DC:
1221 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 6);
1222 		break;
1223 
1224 	case SENSOR_FANRPM:
1225 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 0);
1226 		if (((s1->units1>>3)&0x7) == 0x3)
1227 			psensor->i_sensor.value *= 60; // RPS -> RPM
1228 		break;
1229 	default:
1230 		break;
1231 	}
1232 
1233 	/* Return Sensor Status */
1234 	etype = (psensor->etype << 8) + psensor->stype;
1235 	switch (etype) {
1236 	case IPMI_SENSOR_TYPE_TEMP:
1237 	case IPMI_SENSOR_TYPE_VOLT:
1238 	case IPMI_SENSOR_TYPE_FAN:
1239 		/* non-recoverable threshold */
1240 		if (reading[2] & ((1 << 5) | (1 << 2)))
1241 			return (SENSOR_S_CRIT);
1242 		/* critical threshold */
1243 		else if (reading[2] & ((1 << 4) | (1 << 1)))
1244 			return (SENSOR_S_CRIT);
1245 		/* non-critical threshold */
1246 		else if (reading[2] & ((1 << 3) | (1 << 0)))
1247 			return (SENSOR_S_WARN);
1248 		break;
1249 
1250 	case IPMI_SENSOR_TYPE_INTRUSION:
1251 		psensor->i_sensor.value = (reading[2] & 1) ? 1 : 0;
1252 		if (reading[2] & 0x1)
1253 			return (SENSOR_S_CRIT);
1254 		break;
1255 
1256 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
1257 		/* Reading: 1 = present+powered, 0 = otherwise */
1258 		psensor->i_sensor.value = (reading[2] & 1) ? 1 : 0;
1259 		if (reading[2] & 0x10) {
1260 			/* XXX: Need sysctl type for Power Supply types
1261 			 *   ok: power supply installed && powered
1262 			 * warn: power supply installed && !powered
1263 			 * crit: power supply !installed
1264 			 */
1265 			return (SENSOR_S_CRIT);
1266 		}
1267 		if (reading[2] & 0x08) {
1268 			/* Power supply AC lost */
1269 			return (SENSOR_S_WARN);
1270 		}
1271 		break;
1272 	}
1273 
1274 	return (SENSOR_S_OK);
1275 }
1276 
1277 int
1278 read_sensor(struct ipmi_softc *sc, struct ipmi_sensor *psensor)
1279 {
1280 	struct sdrtype1	*s1 = (struct sdrtype1 *) psensor->i_sdr;
1281 	u_int8_t	data[8];
1282 	int		rv = -1;
1283 
1284 	memset(data, 0, sizeof(data));
1285 	data[0] = psensor->i_num;
1286 
1287 	struct ipmi_cmd	c;
1288 	c.c_sc = sc;
1289 	c.c_rssa = s1->owner_id;
1290 	c.c_rslun = s1->owner_lun;
1291 	c.c_netfn = SE_NETFN;
1292 	c.c_cmd = SE_GET_SENSOR_READING;
1293 	c.c_txlen = 1;
1294 	c.c_maxrxlen = sizeof(data);
1295 	c.c_rxlen = 0;
1296 	c.c_data = data;
1297 	ipmi_cmd(&c);
1298 
1299 	if (c.c_ccode != 0) {
1300 		dbg_printf(1, "sensor reading command for %s failed: %.2x\n",
1301 			psensor->i_sensor.desc, c.c_ccode);
1302 		return (rv);
1303 	}
1304 	dbg_printf(10, "values=%.2x %.2x %.2x %.2x %s\n",
1305 	    data[0],data[1],data[2],data[3], psensor->i_sensor.desc);
1306 	psensor->i_sensor.flags &= ~SENSOR_FINVALID;
1307 	if ((data[1] & IPMI_INVALID_SENSOR) ||
1308 	    ((data[1] & IPMI_DISABLED_SENSOR) == 0 && data[0] == 0))
1309 		psensor->i_sensor.flags |= SENSOR_FINVALID;
1310 	psensor->i_sensor.status = ipmi_sensor_status(sc, psensor, data);
1311 	rv = 0;
1312 	return (rv);
1313 }
1314 
1315 int
1316 ipmi_sensor_type(int type, int ext_type, int entity)
1317 {
1318 	switch (ext_type << 8L | type) {
1319 	case IPMI_SENSOR_TYPE_TEMP:
1320 		return (SENSOR_TEMP);
1321 
1322 	case IPMI_SENSOR_TYPE_VOLT:
1323 		return (SENSOR_VOLTS_DC);
1324 
1325 	case IPMI_SENSOR_TYPE_FAN:
1326 		return (SENSOR_FANRPM);
1327 
1328 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
1329 		if (entity == IPMI_ENTITY_PWRSUPPLY)
1330 			return (SENSOR_INDICATOR);
1331 		break;
1332 
1333 	case IPMI_SENSOR_TYPE_INTRUSION:
1334 		return (SENSOR_INDICATOR);
1335 	}
1336 
1337 	return (-1);
1338 }
1339 
1340 /* Add Sensor to BSD Sysctl interface */
1341 int
1342 add_sdr_sensor(struct ipmi_softc *sc, u_int8_t *psdr, int sdrlen)
1343 {
1344 	int			rc;
1345 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
1346 	struct sdrtype2		*s2 = (struct sdrtype2 *)psdr;
1347 	char			name[64];
1348 
1349 	switch (s1->sdrhdr.record_type) {
1350 	case IPMI_SDR_TYPEFULL:
1351 		rc = ipmi_sensor_name(name, sizeof(name), s1->typelen,
1352 		    s1->name, sdrlen - (int)offsetof(struct sdrtype1, name));
1353 		if (rc == 0)
1354 			return (0);
1355 		rc = add_child_sensors(sc, psdr, 1, s1->sensor_num,
1356 		    s1->sensor_type, s1->event_code, 0, s1->entity_id, name);
1357 		break;
1358 
1359 	case IPMI_SDR_TYPECOMPACT:
1360 		rc = ipmi_sensor_name(name, sizeof(name), s2->typelen,
1361 		    s2->name, sdrlen - (int)offsetof(struct sdrtype2, name));
1362 		if (rc == 0)
1363 			return (0);
1364 		rc = add_child_sensors(sc, psdr, s2->share1 & 0xF,
1365 		    s2->sensor_num, s2->sensor_type, s2->event_code,
1366 		    s2->share2 & 0x7F, s2->entity_id, name);
1367 		break;
1368 
1369 	default:
1370 		return (0);
1371 	}
1372 
1373 	return rc;
1374 }
1375 
1376 int
1377 add_child_sensors(struct ipmi_softc *sc, u_int8_t *psdr, int count,
1378     int sensor_num, int sensor_type, int ext_type, int sensor_base,
1379     int entity, const char *name)
1380 {
1381 	int			typ, idx;
1382 	struct ipmi_sensor	*psensor;
1383 #ifdef IPMI_DEBUG
1384 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
1385 #endif
1386 
1387 	typ = ipmi_sensor_type(sensor_type, ext_type, entity);
1388 	if (typ == -1) {
1389 		dbg_printf(5, "Unknown sensor type:%.2x et:%.2x sn:%.2x "
1390 		    "name:%s\n", sensor_type, ext_type, sensor_num, name);
1391 		return 0;
1392 	}
1393 	for (idx = 0; idx < count; idx++) {
1394 		psensor = malloc(sizeof(*psensor), M_DEVBUF, M_NOWAIT | M_ZERO);
1395 		if (psensor == NULL)
1396 			break;
1397 
1398 		/* Initialize BSD Sensor info */
1399 		psensor->i_sdr = psdr;
1400 		psensor->i_num = sensor_num + idx;
1401 		psensor->stype = sensor_type;
1402 		psensor->etype = ext_type;
1403 		psensor->i_sensor.type = typ;
1404 		if (count > 1)
1405 			snprintf(psensor->i_sensor.desc,
1406 			    sizeof(psensor->i_sensor.desc),
1407 			    "%s - %d", name, sensor_base + idx);
1408 		else
1409 			strlcpy(psensor->i_sensor.desc, name,
1410 			    sizeof(psensor->i_sensor.desc));
1411 
1412 		dbg_printf(5, "add sensor:%.4x %.2x:%d ent:%.2x:%.2x %s\n",
1413 		    s1->sdrhdr.record_id, s1->sensor_type,
1414 		    typ, s1->entity_id, s1->entity_instance,
1415 		    psensor->i_sensor.desc);
1416 		if (read_sensor(sc, psensor) == 0) {
1417 			SLIST_INSERT_HEAD(&ipmi_sensor_list, psensor, list);
1418 			sensor_attach(&sc->sc_sensordev, &psensor->i_sensor);
1419 			dbg_printf(5, "	 reading: %lld [%s]\n",
1420 			    psensor->i_sensor.value,
1421 			    psensor->i_sensor.desc);
1422 		} else
1423 			free(psensor, M_DEVBUF, sizeof(*psensor));
1424 	}
1425 
1426 	return (1);
1427 }
1428 
1429 /* Handle IPMI Timer - reread sensor values */
1430 void
1431 ipmi_refresh_sensors(struct ipmi_softc *sc)
1432 {
1433 	if (SLIST_EMPTY(&ipmi_sensor_list))
1434 		return;
1435 
1436 	sc->current_sensor = SLIST_NEXT(sc->current_sensor, list);
1437 	if (sc->current_sensor == NULL)
1438 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
1439 
1440 	if (read_sensor(sc, sc->current_sensor)) {
1441 		dbg_printf(1, "%s: error reading: %s\n", DEVNAME(sc),
1442 		    sc->current_sensor->i_sensor.desc);
1443 		return;
1444 	}
1445 }
1446 
1447 int
1448 ipmi_map_regs(struct ipmi_softc *sc, struct ipmi_attach_args *ia)
1449 {
1450 	if (sc->sc_if && sc->sc_if->nregs == 0)
1451 		return (0);
1452 
1453 	sc->sc_if = ipmi_get_if(ia->iaa_if_type);
1454 	if (sc->sc_if == NULL)
1455 		return (-1);
1456 
1457 	if (ia->iaa_if_iotype == 'i')
1458 		sc->sc_iot = ia->iaa_iot;
1459 	else
1460 		sc->sc_iot = ia->iaa_memt;
1461 
1462 	sc->sc_if_rev = ia->iaa_if_rev;
1463 	sc->sc_if_iosize = ia->iaa_if_iosize;
1464 	sc->sc_if_iospacing = ia->iaa_if_iospacing;
1465 	if (bus_space_map(sc->sc_iot, ia->iaa_if_iobase,
1466 	    sc->sc_if->nregs * sc->sc_if_iospacing,
1467 	    0, &sc->sc_ioh)) {
1468 		printf("%s: bus_space_map(%lx %lx %x 0 %p) failed\n",
1469 		    DEVNAME(sc),
1470 		    (unsigned long)sc->sc_iot, ia->iaa_if_iobase,
1471 		    sc->sc_if->nregs * sc->sc_if_iospacing, &sc->sc_ioh);
1472 		return (-1);
1473 	}
1474 	return (0);
1475 }
1476 
1477 void
1478 ipmi_unmap_regs(struct ipmi_softc *sc)
1479 {
1480 	if (sc->sc_if->nregs > 0) {
1481 		bus_space_unmap(sc->sc_iot, sc->sc_ioh,
1482 		    sc->sc_if->nregs * sc->sc_if_iospacing);
1483 	}
1484 }
1485 
1486 void
1487 ipmi_poll_thread(void *arg)
1488 {
1489 	struct ipmi_thread	*thread = arg;
1490 	struct ipmi_softc	*sc = thread->sc;
1491 	u_int16_t		rec;
1492 
1493 	/* Scan SDRs, add sensors */
1494 	for (rec = 0; rec != 0xFFFF;) {
1495 		if (get_sdr(sc, rec, &rec)) {
1496 			ipmi_unmap_regs(sc);
1497 			printf("%s: no SDRs IPMI disabled\n", DEVNAME(sc));
1498 			goto done;
1499 		}
1500 		while (tsleep(sc, PWAIT, "ipmirun", 1) != EWOULDBLOCK)
1501 			continue;
1502 	}
1503 
1504 	/* initialize sensor list for thread */
1505 	if (SLIST_EMPTY(&ipmi_sensor_list))
1506 		goto done;
1507 	else
1508 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
1509 
1510 	strlcpy(sc->sc_sensordev.xname, sc->sc_dev.dv_xname,
1511 	    sizeof(sc->sc_sensordev.xname));
1512 	sensordev_install(&sc->sc_sensordev);
1513 
1514 	while (thread->running) {
1515 		ipmi_refresh_sensors(sc);
1516 		tsleep_nsec(thread, PWAIT, "ipmi_poll",
1517 		    SEC_TO_NSEC(SENSOR_REFRESH_RATE));
1518 	}
1519 
1520 done:
1521 	kthread_exit(0);
1522 }
1523 
1524 void
1525 ipmi_create_thread(void *arg)
1526 {
1527 	struct ipmi_softc	*sc = arg;
1528 
1529 	if (kthread_create(ipmi_poll_thread, sc->sc_thread, NULL,
1530 	    DEVNAME(sc)) != 0) {
1531 		printf("%s: unable to create run thread, ipmi disabled\n",
1532 		    DEVNAME(sc));
1533 		return;
1534 	}
1535 }
1536 
1537 void
1538 ipmi_attach_common(struct ipmi_softc *sc, struct ipmi_attach_args *ia)
1539 {
1540 	struct ipmi_cmd		*c = &sc->sc_ioctl.cmd;
1541 
1542 	/* Map registers */
1543 	ipmi_map_regs(sc, ia);
1544 
1545 	sc->sc_thread = malloc(sizeof(struct ipmi_thread), M_DEVBUF, M_NOWAIT);
1546 	if (sc->sc_thread == NULL) {
1547 		printf(": unable to allocate thread\n");
1548 		return;
1549 	}
1550 	sc->sc_thread->sc = sc;
1551 	sc->sc_thread->running = 1;
1552 
1553 	/* Setup threads */
1554 	kthread_create_deferred(ipmi_create_thread, sc);
1555 
1556 	printf(": version %d.%d interface %s",
1557 	    ia->iaa_if_rev >> 4, ia->iaa_if_rev & 0xF, sc->sc_if->name);
1558 	if (sc->sc_if->nregs > 0)
1559 		printf(" %sbase 0x%lx/%x spacing %d",
1560 		    ia->iaa_if_iotype == 'i' ? "io" : "mem", ia->iaa_if_iobase,
1561 		    ia->iaa_if_iospacing * sc->sc_if->nregs,
1562 		    ia->iaa_if_iospacing);
1563 	if (ia->iaa_if_irq != -1)
1564 		printf(" irq %d", ia->iaa_if_irq);
1565 	printf("\n");
1566 
1567 	/* setup flag to exclude iic */
1568 	ipmi_enabled = 1;
1569 
1570 	/* Setup Watchdog timer */
1571 	sc->sc_wdog_period = 0;
1572 	task_set(&sc->sc_wdog_tickle_task, ipmi_watchdog_tickle, sc);
1573 	wdog_register(ipmi_watchdog, sc);
1574 
1575 	rw_init(&sc->sc_ioctl.lock, DEVNAME(sc));
1576 	sc->sc_ioctl.req.msgid = -1;
1577 	c->c_sc = sc;
1578 	c->c_ccode = -1;
1579 
1580 	sc->sc_cmd_taskq = taskq_create("ipmicmd", 1, IPL_NONE, TASKQ_MPSAFE);
1581 }
1582 
1583 int
1584 ipmi_activate(struct device *self, int act)
1585 {
1586 	switch (act) {
1587 	case DVACT_POWERDOWN:
1588 		wdog_shutdown(self);
1589 		break;
1590 	}
1591 
1592 	return (0);
1593 }
1594 
1595 struct ipmi_softc *
1596 ipmilookup(dev_t dev)
1597 {
1598 	return (struct ipmi_softc *)device_lookup(&ipmi_cd, minor(dev));
1599 }
1600 
1601 int
1602 ipmiopen(dev_t dev, int flags, int mode, struct proc *p)
1603 {
1604 	struct ipmi_softc	*sc = ipmilookup(dev);
1605 
1606 	if (sc == NULL)
1607 		return (ENXIO);
1608 	return (0);
1609 }
1610 
1611 int
1612 ipmiclose(dev_t dev, int flags, int mode, struct proc *p)
1613 {
1614 	struct ipmi_softc	*sc = ipmilookup(dev);
1615 
1616 	if (sc == NULL)
1617 		return (ENXIO);
1618 	return (0);
1619 }
1620 
1621 int
1622 ipmiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *proc)
1623 {
1624 	struct ipmi_softc	*sc = ipmilookup(dev);
1625 	struct ipmi_req		*req = (struct ipmi_req *)data;
1626 	struct ipmi_recv	*recv = (struct ipmi_recv *)data;
1627 	struct ipmi_cmd		*c = &sc->sc_ioctl.cmd;
1628 	int			iv;
1629 	int			len;
1630 	u_char			ccode;
1631 	int			rc = 0;
1632 
1633 	if (sc == NULL)
1634 		return (ENXIO);
1635 
1636 	rw_enter_write(&sc->sc_ioctl.lock);
1637 
1638 	c->c_maxrxlen = sizeof(sc->sc_ioctl.buf);
1639 	c->c_data = sc->sc_ioctl.buf;
1640 
1641 	switch (cmd) {
1642 	case IPMICTL_SEND_COMMAND:
1643 		if (req->msgid == -1) {
1644 			rc = EINVAL;
1645 			goto reset;
1646 		}
1647 		if (sc->sc_ioctl.req.msgid != -1) {
1648 			rc = EBUSY;
1649 			goto reset;
1650 		}
1651 		len = req->msg.data_len;
1652 		if (len < 0) {
1653 			rc = EINVAL;
1654 			goto reset;
1655 		}
1656 		if (len > c->c_maxrxlen) {
1657 			rc = E2BIG;
1658 			goto reset;
1659 		}
1660 		sc->sc_ioctl.req = *req;
1661 		c->c_ccode = -1;
1662 		rc = copyin(req->msg.data, c->c_data, len);
1663 		if (rc != 0)
1664 			goto reset;
1665 		KASSERT(c->c_ccode == -1);
1666 
1667 		/* Execute a command synchronously. */
1668 		c->c_netfn = req->msg.netfn;
1669 		c->c_cmd = req->msg.cmd;
1670 		c->c_txlen = req->msg.data_len;
1671 		c->c_rxlen = 0;
1672 		ipmi_cmd(c);
1673 		break;
1674 	case IPMICTL_RECEIVE_MSG_TRUNC:
1675 	case IPMICTL_RECEIVE_MSG:
1676 		if (sc->sc_ioctl.req.msgid == -1) {
1677 			rc = EINVAL;
1678 			goto reset;
1679 		}
1680 		if (c->c_ccode == -1) {
1681 			rc = EAGAIN;
1682 			goto reset;
1683 		}
1684 		ccode = c->c_ccode & 0xff;
1685 		rc = copyout(&ccode, recv->msg.data, 1);
1686 		if (rc != 0)
1687 			goto reset;
1688 
1689 		/* Return a command result. */
1690 		recv->recv_type = IPMI_RESPONSE_RECV_TYPE;
1691 		recv->msgid = sc->sc_ioctl.req.msgid;
1692 		recv->msg.netfn = sc->sc_ioctl.req.msg.netfn;
1693 		recv->msg.cmd = sc->sc_ioctl.req.msg.cmd;
1694 		recv->msg.data_len = c->c_rxlen + 1;
1695 
1696 		rc = copyout(c->c_data, recv->msg.data + 1, c->c_rxlen);
1697 		/* Always reset state after command completion. */
1698 		goto reset;
1699 	case IPMICTL_SET_MY_ADDRESS_CMD:
1700 		iv = *(int *)data;
1701 		if (iv < 0 || iv > RSSA_MASK) {
1702 			rc = EINVAL;
1703 			goto reset;
1704 		}
1705 		c->c_rssa = iv;
1706 		break;
1707 	case IPMICTL_GET_MY_ADDRESS_CMD:
1708 		*(int *)data = c->c_rssa;
1709 		break;
1710 	case IPMICTL_SET_MY_LUN_CMD:
1711 		iv = *(int *)data;
1712 		if (iv < 0 || iv > LUN_MASK) {
1713 			rc = EINVAL;
1714 			goto reset;
1715 		}
1716 		c->c_rslun = iv;
1717 		break;
1718 	case IPMICTL_GET_MY_LUN_CMD:
1719 		*(int *)data = c->c_rslun;
1720 		break;
1721 	case IPMICTL_SET_GETS_EVENTS_CMD:
1722 		break;
1723 	case IPMICTL_REGISTER_FOR_CMD:
1724 	case IPMICTL_UNREGISTER_FOR_CMD:
1725 	default:
1726 		break;
1727 	}
1728 done:
1729 	rw_exit_write(&sc->sc_ioctl.lock);
1730 	return (rc);
1731 reset:
1732 	sc->sc_ioctl.req.msgid = -1;
1733 	c->c_ccode = -1;
1734 	goto done;
1735 }
1736 
1737 #define		MIN_PERIOD	10
1738 
1739 int
1740 ipmi_watchdog(void *arg, int period)
1741 {
1742 	struct ipmi_softc	*sc = arg;
1743 
1744 	if (sc->sc_wdog_period == period) {
1745 		if (period != 0) {
1746 			struct task *t;
1747 			int res;
1748 
1749 			t = &sc->sc_wdog_tickle_task;
1750 			(void)task_del(systq, t);
1751 			res = task_add(systq, t);
1752 			KASSERT(res == 1);
1753 		}
1754 		return (period);
1755 	}
1756 
1757 	if (period < MIN_PERIOD && period > 0)
1758 		period = MIN_PERIOD;
1759 	sc->sc_wdog_period = period;
1760 	ipmi_watchdog_set(sc);
1761 	printf("%s: watchdog %sabled\n", DEVNAME(sc),
1762 	    (period == 0) ? "dis" : "en");
1763 	return (period);
1764 }
1765 
1766 void
1767 ipmi_watchdog_tickle(void *arg)
1768 {
1769 	struct ipmi_softc	*sc = arg;
1770 	struct ipmi_cmd		c;
1771 
1772 	c.c_sc = sc;
1773 	c.c_rssa = BMC_SA;
1774 	c.c_rslun = BMC_LUN;
1775 	c.c_netfn = APP_NETFN;
1776 	c.c_cmd = APP_RESET_WATCHDOG;
1777 	c.c_txlen = 0;
1778 	c.c_maxrxlen = 0;
1779 	c.c_rxlen = 0;
1780 	c.c_data = NULL;
1781 	ipmi_cmd(&c);
1782 }
1783 
1784 void
1785 ipmi_watchdog_set(void *arg)
1786 {
1787 	struct ipmi_softc	*sc = arg;
1788 	uint8_t			wdog[IPMI_GET_WDOG_MAX];
1789 	struct ipmi_cmd		c;
1790 
1791 	c.c_sc = sc;
1792 	c.c_rssa = BMC_SA;
1793 	c.c_rslun = BMC_LUN;
1794 	c.c_netfn = APP_NETFN;
1795 	c.c_cmd = APP_GET_WATCHDOG_TIMER;
1796 	c.c_txlen = 0;
1797 	c.c_maxrxlen = IPMI_GET_WDOG_MAX;
1798 	c.c_rxlen = 0;
1799 	c.c_data = wdog;
1800 	ipmi_cmd(&c);
1801 
1802 	/* Period is 10ths/sec */
1803 	uint16_t timo = htole16(sc->sc_wdog_period * 10);
1804 
1805 	memcpy(&wdog[IPMI_SET_WDOG_TIMOL], &timo, 2);
1806 	wdog[IPMI_SET_WDOG_TIMER] &= ~IPMI_WDOG_DONTSTOP;
1807 	wdog[IPMI_SET_WDOG_TIMER] |= (sc->sc_wdog_period == 0) ?
1808 	    0 : IPMI_WDOG_DONTSTOP;
1809 	wdog[IPMI_SET_WDOG_ACTION] &= ~IPMI_WDOG_MASK;
1810 	wdog[IPMI_SET_WDOG_ACTION] |= (sc->sc_wdog_period == 0) ?
1811 	    IPMI_WDOG_DISABLED : IPMI_WDOG_REBOOT;
1812 
1813 	c.c_cmd = APP_SET_WATCHDOG_TIMER;
1814 	c.c_txlen = IPMI_SET_WDOG_MAX;
1815 	c.c_maxrxlen = 0;
1816 	c.c_rxlen = 0;
1817 	c.c_data = wdog;
1818 	ipmi_cmd(&c);
1819 }
1820 
1821 #if defined(__amd64__) || defined(__i386__)
1822 
1823 #include <dev/isa/isareg.h>
1824 #include <dev/isa/isavar.h>
1825 
1826 /*
1827  * Format of SMBIOS IPMI Flags
1828  *
1829  * bit0: interrupt trigger mode (1=level, 0=edge)
1830  * bit1: interrupt polarity (1=active high, 0=active low)
1831  * bit2: reserved
1832  * bit3: address LSB (1=odd,0=even)
1833  * bit4: interrupt (1=specified, 0=not specified)
1834  * bit5: reserved
1835  * bit6/7: register spacing (1,4,2,err)
1836  */
1837 #define SMIPMI_FLAG_IRQLVL		(1L << 0)
1838 #define SMIPMI_FLAG_IRQEN		(1L << 3)
1839 #define SMIPMI_FLAG_ODDOFFSET		(1L << 4)
1840 #define SMIPMI_FLAG_IFSPACING(x)	(((x)>>6)&0x3)
1841 #define	 IPMI_IOSPACING_BYTE		 0
1842 #define	 IPMI_IOSPACING_WORD		 2
1843 #define	 IPMI_IOSPACING_DWORD		 1
1844 
1845 struct dmd_ipmi {
1846 	u_int8_t	dmd_sig[4];		/* Signature 'IPMI' */
1847 	u_int8_t	dmd_i2c_address;	/* Address of BMC */
1848 	u_int8_t	dmd_nvram_address;	/* Address of NVRAM */
1849 	u_int8_t	dmd_if_type;		/* IPMI Interface Type */
1850 	u_int8_t	dmd_if_rev;		/* IPMI Interface Revision */
1851 } __packed;
1852 
1853 void	*scan_sig(long, long, int, int, const void *);
1854 
1855 void	ipmi_smbios_probe(struct smbios_ipmi *, struct ipmi_attach_args *);
1856 int	ipmi_match(struct device *, void *, void *);
1857 void	ipmi_attach(struct device *, struct device *, void *);
1858 
1859 struct cfattach ipmi_ca = {
1860 	sizeof(struct ipmi_softc), ipmi_match, ipmi_attach,
1861 	NULL, ipmi_activate
1862 };
1863 
1864 int
1865 ipmi_match(struct device *parent, void *match, void *aux)
1866 {
1867 	struct ipmi_softc	*sc;
1868 	struct ipmi_attach_args *ia = aux;
1869 	struct cfdata		*cf = match;
1870 	u_int8_t		cmd[32];
1871 	int			rv = 0;
1872 
1873 	if (strcmp(ia->iaa_name, cf->cf_driver->cd_name))
1874 		return (0);
1875 
1876 	/* XXX local softc is wrong wrong wrong */
1877 	sc = malloc(sizeof(*sc), M_TEMP, M_WAITOK | M_ZERO);
1878 	strlcpy(sc->sc_dev.dv_xname, "ipmi0", sizeof(sc->sc_dev.dv_xname));
1879 
1880 	/* Map registers */
1881 	if (ipmi_map_regs(sc, ia) == 0) {
1882 		sc->sc_if->probe(sc);
1883 
1884 		/* Identify BMC device early to detect lying bios */
1885 		struct ipmi_cmd c;
1886 		c.c_sc = sc;
1887 		c.c_rssa = BMC_SA;
1888 		c.c_rslun = BMC_LUN;
1889 		c.c_netfn = APP_NETFN;
1890 		c.c_cmd = APP_GET_DEVICE_ID;
1891 		c.c_txlen = 0;
1892 		c.c_maxrxlen = sizeof(cmd);
1893 		c.c_rxlen = 0;
1894 		c.c_data = cmd;
1895 		ipmi_cmd(&c);
1896 
1897 		dbg_dump(1, "bmc data", c.c_rxlen, cmd);
1898 		rv = 1; /* GETID worked, we got IPMI */
1899 		ipmi_unmap_regs(sc);
1900 	}
1901 
1902 	free(sc, M_TEMP, sizeof(*sc));
1903 
1904 	return (rv);
1905 }
1906 
1907 void
1908 ipmi_attach(struct device *parent, struct device *self, void *aux)
1909 {
1910 	ipmi_attach_common((struct ipmi_softc *)self, aux);
1911 }
1912 
1913 /* Scan memory for signature */
1914 void *
1915 scan_sig(long start, long end, int skip, int len, const void *data)
1916 {
1917 	void *va;
1918 
1919 	while (start < end) {
1920 		va = ISA_HOLE_VADDR(start);
1921 		if (memcmp(va, data, len) == 0)
1922 			return (va);
1923 
1924 		start += skip;
1925 	}
1926 
1927 	return (NULL);
1928 }
1929 
1930 void
1931 ipmi_smbios_probe(struct smbios_ipmi *pipmi, struct ipmi_attach_args *ia)
1932 {
1933 
1934 	dbg_printf(1, "ipmi_smbios_probe: %02x %02x %02x %02x %08llx %02x "
1935 	    "%02x\n",
1936 	    pipmi->smipmi_if_type,
1937 	    pipmi->smipmi_if_rev,
1938 	    pipmi->smipmi_i2c_address,
1939 	    pipmi->smipmi_nvram_address,
1940 	    pipmi->smipmi_base_address,
1941 	    pipmi->smipmi_base_flags,
1942 	    pipmi->smipmi_irq);
1943 
1944 	ia->iaa_if_type = pipmi->smipmi_if_type;
1945 	ia->iaa_if_rev = pipmi->smipmi_if_rev;
1946 	ia->iaa_if_irq = (pipmi->smipmi_base_flags & SMIPMI_FLAG_IRQEN) ?
1947 	    pipmi->smipmi_irq : -1;
1948 	ia->iaa_if_irqlvl = (pipmi->smipmi_base_flags & SMIPMI_FLAG_IRQLVL) ?
1949 	    IST_LEVEL : IST_EDGE;
1950 	ia->iaa_if_iosize = 1;
1951 
1952 	switch (SMIPMI_FLAG_IFSPACING(pipmi->smipmi_base_flags)) {
1953 	case IPMI_IOSPACING_BYTE:
1954 		ia->iaa_if_iospacing = 1;
1955 		break;
1956 
1957 	case IPMI_IOSPACING_DWORD:
1958 		ia->iaa_if_iospacing = 4;
1959 		break;
1960 
1961 	case IPMI_IOSPACING_WORD:
1962 		ia->iaa_if_iospacing = 2;
1963 		break;
1964 
1965 	default:
1966 		ia->iaa_if_iospacing = 1;
1967 		printf("ipmi: unknown register spacing\n");
1968 	}
1969 
1970 	/* Calculate base address (PCI BAR format) */
1971 	if (pipmi->smipmi_base_address & 0x1) {
1972 		ia->iaa_if_iotype = 'i';
1973 		ia->iaa_if_iobase = pipmi->smipmi_base_address & ~0x1;
1974 	} else {
1975 		ia->iaa_if_iotype = 'm';
1976 		ia->iaa_if_iobase = pipmi->smipmi_base_address & ~0xF;
1977 	}
1978 	if (pipmi->smipmi_base_flags & SMIPMI_FLAG_ODDOFFSET)
1979 		ia->iaa_if_iobase++;
1980 
1981 	if (pipmi->smipmi_base_flags == 0x7f) {
1982 		/* IBM 325 eServer workaround */
1983 		ia->iaa_if_iospacing = 1;
1984 		ia->iaa_if_iobase = pipmi->smipmi_base_address;
1985 		ia->iaa_if_iotype = 'i';
1986 		return;
1987 	}
1988 }
1989 
1990 int
1991 ipmi_probe(void *aux)
1992 {
1993 	struct ipmi_attach_args *ia = aux;
1994 	struct dmd_ipmi *pipmi;
1995 	struct smbtable tbl;
1996 
1997 	tbl.cookie = 0;
1998 	if (smbios_find_table(SMBIOS_TYPE_IPMIDEV, &tbl))
1999 		ipmi_smbios_probe(tbl.tblhdr, ia);
2000 	else {
2001 		pipmi = (struct dmd_ipmi *)scan_sig(0xC0000L, 0xFFFFFL, 16, 4,
2002 		    "IPMI");
2003 		/* XXX hack to find Dell PowerEdge 8450 */
2004 		if (pipmi == NULL) {
2005 			/* no IPMI found */
2006 			return (0);
2007 		}
2008 
2009 		/* we have an IPMI signature, fill in attach arg structure */
2010 		ia->iaa_if_type = pipmi->dmd_if_type;
2011 		ia->iaa_if_rev = pipmi->dmd_if_rev;
2012 	}
2013 
2014 	return (1);
2015 }
2016 
2017 #endif
2018