xref: /openbsd-src/sys/dev/ipmi.c (revision 99fd087599a8791921855f21bd7e36130f39aadc)
1 /*	$OpenBSD: ipmi.c,v 1.109 2020/02/18 00:06:12 cheloha Exp $ */
2 
3 /*
4  * Copyright (c) 2015 Masao Uebayashi
5  * Copyright (c) 2005 Jordan Hargrave
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/device.h>
34 #include <sys/ioctl.h>
35 #include <sys/extent.h>
36 #include <sys/sensors.h>
37 #include <sys/malloc.h>
38 #include <sys/kthread.h>
39 #include <sys/task.h>
40 
41 #include <machine/bus.h>
42 #include <machine/smbiosvar.h>
43 
44 #include <dev/ipmivar.h>
45 #include <dev/ipmi.h>
46 
47 struct ipmi_sensor {
48 	u_int8_t	*i_sdr;
49 	int		i_num;
50 	int		stype;
51 	int		etype;
52 	struct		ksensor i_sensor;
53 	SLIST_ENTRY(ipmi_sensor) list;
54 };
55 
56 int	ipmi_enabled = 0;
57 
58 #define SENSOR_REFRESH_RATE 5	/* seconds */
59 
60 #define DEVNAME(s)  ((s)->sc_dev.dv_xname)
61 
62 #define IPMI_BTMSG_LEN			0
63 #define IPMI_BTMSG_NFLN			1
64 #define IPMI_BTMSG_SEQ			2
65 #define IPMI_BTMSG_CMD			3
66 #define IPMI_BTMSG_CCODE		4
67 #define IPMI_BTMSG_DATASND		4
68 #define IPMI_BTMSG_DATARCV		5
69 
70 #define IPMI_MSG_NFLN			0
71 #define IPMI_MSG_CMD			1
72 #define IPMI_MSG_CCODE			2
73 
74 #define IPMI_SENSOR_TYPE_TEMP		0x0101
75 #define IPMI_SENSOR_TYPE_VOLT		0x0102
76 #define IPMI_SENSOR_TYPE_FAN		0x0104
77 #define IPMI_SENSOR_TYPE_INTRUSION	0x6F05
78 #define IPMI_SENSOR_TYPE_PWRSUPPLY	0x6F08
79 
80 #define IPMI_NAME_UNICODE		0x00
81 #define IPMI_NAME_BCDPLUS		0x01
82 #define IPMI_NAME_ASCII6BIT		0x02
83 #define IPMI_NAME_ASCII8BIT		0x03
84 
85 #define IPMI_ENTITY_PWRSUPPLY		0x0A
86 
87 #define IPMI_INVALID_SENSOR		(1L << 5)
88 #define IPMI_DISABLED_SENSOR		(1L << 6)
89 
90 #define IPMI_SDR_TYPEFULL		1
91 #define IPMI_SDR_TYPECOMPACT		2
92 
93 #define byteof(x) ((x) >> 3)
94 #define bitof(x)  (1L << ((x) & 0x7))
95 #define TB(b,m)	  (data[2+byteof(b)] & bitof(b))
96 
97 #ifdef IPMI_DEBUG
98 int	ipmi_dbg = 0;
99 #define dbg_printf(lvl, fmt...) \
100 	if (ipmi_dbg >= lvl) \
101 		printf(fmt);
102 #define dbg_dump(lvl, msg, len, buf) \
103 	if (len && ipmi_dbg >= lvl) \
104 		dumpb(msg, len, (const u_int8_t *)(buf));
105 #else
106 #define dbg_printf(lvl, fmt...)
107 #define dbg_dump(lvl, msg, len, buf)
108 #endif
109 
110 long signextend(unsigned long, int);
111 
112 SLIST_HEAD(ipmi_sensors_head, ipmi_sensor);
113 struct ipmi_sensors_head ipmi_sensor_list =
114     SLIST_HEAD_INITIALIZER(ipmi_sensor_list);
115 
116 void	dumpb(const char *, int, const u_int8_t *);
117 
118 int	read_sensor(struct ipmi_softc *, struct ipmi_sensor *);
119 int	add_sdr_sensor(struct ipmi_softc *, u_int8_t *, int);
120 int	get_sdr_partial(struct ipmi_softc *, u_int16_t, u_int16_t,
121 	    u_int8_t, u_int8_t, void *, u_int16_t *);
122 int	get_sdr(struct ipmi_softc *, u_int16_t, u_int16_t *);
123 
124 int	ipmi_sendcmd(struct ipmi_cmd *);
125 int	ipmi_recvcmd(struct ipmi_cmd *);
126 void	ipmi_cmd(struct ipmi_cmd *);
127 void	ipmi_cmd_poll(struct ipmi_cmd *);
128 void	ipmi_cmd_wait(struct ipmi_cmd *);
129 void	ipmi_cmd_wait_cb(void *);
130 
131 int	ipmi_watchdog(void *, int);
132 void	ipmi_watchdog_tickle(void *);
133 void	ipmi_watchdog_set(void *);
134 
135 struct ipmi_softc *ipmilookup(dev_t dev);
136 
137 int	ipmiopen(dev_t, int, int, struct proc *);
138 int	ipmiclose(dev_t, int, int, struct proc *);
139 int	ipmiioctl(dev_t, u_long, caddr_t, int, struct proc *);
140 
141 long	ipow(long, int);
142 long	ipmi_convert(u_int8_t, struct sdrtype1 *, long);
143 int	ipmi_sensor_name(char *, int, u_int8_t, u_int8_t *, int);
144 
145 /* BMC Helper Functions */
146 u_int8_t bmc_read(struct ipmi_softc *, int);
147 void	bmc_write(struct ipmi_softc *, int, u_int8_t);
148 int	bmc_io_wait(struct ipmi_softc *, struct ipmi_iowait *);
149 
150 void	bt_buildmsg(struct ipmi_cmd *);
151 void	cmn_buildmsg(struct ipmi_cmd *);
152 
153 int	getbits(u_int8_t *, int, int);
154 int	ipmi_sensor_type(int, int, int);
155 
156 void	ipmi_refresh_sensors(struct ipmi_softc *sc);
157 int	ipmi_map_regs(struct ipmi_softc *sc, struct ipmi_attach_args *ia);
158 void	ipmi_unmap_regs(struct ipmi_softc *);
159 
160 int	ipmi_sensor_status(struct ipmi_softc *, struct ipmi_sensor *,
161     u_int8_t *);
162 
163 int	 add_child_sensors(struct ipmi_softc *, u_int8_t *, int, int, int,
164     int, int, int, const char *);
165 
166 void	ipmi_create_thread(void *);
167 void	ipmi_poll_thread(void *);
168 
169 int	kcs_probe(struct ipmi_softc *);
170 int	kcs_reset(struct ipmi_softc *);
171 int	kcs_sendmsg(struct ipmi_cmd *);
172 int	kcs_recvmsg(struct ipmi_cmd *);
173 
174 int	bt_probe(struct ipmi_softc *);
175 int	bt_reset(struct ipmi_softc *);
176 int	bt_sendmsg(struct ipmi_cmd *);
177 int	bt_recvmsg(struct ipmi_cmd *);
178 
179 int	smic_probe(struct ipmi_softc *);
180 int	smic_reset(struct ipmi_softc *);
181 int	smic_sendmsg(struct ipmi_cmd *);
182 int	smic_recvmsg(struct ipmi_cmd *);
183 
184 struct ipmi_if kcs_if = {
185 	"KCS",
186 	IPMI_IF_KCS_NREGS,
187 	cmn_buildmsg,
188 	kcs_sendmsg,
189 	kcs_recvmsg,
190 	kcs_reset,
191 	kcs_probe,
192 	IPMI_MSG_DATASND,
193 	IPMI_MSG_DATARCV,
194 };
195 
196 struct ipmi_if smic_if = {
197 	"SMIC",
198 	IPMI_IF_SMIC_NREGS,
199 	cmn_buildmsg,
200 	smic_sendmsg,
201 	smic_recvmsg,
202 	smic_reset,
203 	smic_probe,
204 	IPMI_MSG_DATASND,
205 	IPMI_MSG_DATARCV,
206 };
207 
208 struct ipmi_if bt_if = {
209 	"BT",
210 	IPMI_IF_BT_NREGS,
211 	bt_buildmsg,
212 	bt_sendmsg,
213 	bt_recvmsg,
214 	bt_reset,
215 	bt_probe,
216 	IPMI_BTMSG_DATASND,
217 	IPMI_BTMSG_DATARCV,
218 };
219 
220 struct ipmi_if *ipmi_get_if(int);
221 
222 struct ipmi_if *
223 ipmi_get_if(int iftype)
224 {
225 	switch (iftype) {
226 	case IPMI_IF_KCS:
227 		return (&kcs_if);
228 	case IPMI_IF_SMIC:
229 		return (&smic_if);
230 	case IPMI_IF_BT:
231 		return (&bt_if);
232 	}
233 
234 	return (NULL);
235 }
236 
237 /*
238  * BMC Helper Functions
239  */
240 u_int8_t
241 bmc_read(struct ipmi_softc *sc, int offset)
242 {
243 	return (bus_space_read_1(sc->sc_iot, sc->sc_ioh,
244 	    offset * sc->sc_if_iospacing));
245 }
246 
247 void
248 bmc_write(struct ipmi_softc *sc, int offset, u_int8_t val)
249 {
250 	bus_space_write_1(sc->sc_iot, sc->sc_ioh,
251 	    offset * sc->sc_if_iospacing, val);
252 }
253 
254 int
255 bmc_io_wait(struct ipmi_softc *sc, struct ipmi_iowait *a)
256 {
257 	volatile u_int8_t	v;
258 	int			count = 5000000; /* == 5s XXX can be shorter */
259 
260 	while (count--) {
261 		v = bmc_read(sc, a->offset);
262 		if ((v & a->mask) == a->value)
263 			return v;
264 
265 		delay(1);
266 	}
267 
268 	dbg_printf(1, "%s: bmc_io_wait fails : *v=%.2x m=%.2x b=%.2x %s\n",
269 	    DEVNAME(sc), v, a->mask, a->value, a->lbl);
270 	return (-1);
271 
272 }
273 
274 #define RSSA_MASK 0xff
275 #define LUN_MASK 0x3
276 #define NETFN_LUN(nf,ln) (((nf) << 2) | ((ln) & LUN_MASK))
277 
278 /*
279  * BT interface
280  */
281 #define _BT_CTRL_REG			0
282 #define	  BT_CLR_WR_PTR			(1L << 0)
283 #define	  BT_CLR_RD_PTR			(1L << 1)
284 #define	  BT_HOST2BMC_ATN		(1L << 2)
285 #define	  BT_BMC2HOST_ATN		(1L << 3)
286 #define	  BT_EVT_ATN			(1L << 4)
287 #define	  BT_HOST_BUSY			(1L << 6)
288 #define	  BT_BMC_BUSY			(1L << 7)
289 
290 #define	  BT_READY	(BT_HOST_BUSY|BT_HOST2BMC_ATN|BT_BMC2HOST_ATN)
291 
292 #define _BT_DATAIN_REG			1
293 #define _BT_DATAOUT_REG			1
294 
295 #define _BT_INTMASK_REG			2
296 #define	 BT_IM_HIRQ_PEND		(1L << 1)
297 #define	 BT_IM_SCI_EN			(1L << 2)
298 #define	 BT_IM_SMI_EN			(1L << 3)
299 #define	 BT_IM_NMI2SMI			(1L << 4)
300 
301 int bt_read(struct ipmi_softc *, int);
302 int bt_write(struct ipmi_softc *, int, uint8_t);
303 
304 int
305 bt_read(struct ipmi_softc *sc, int reg)
306 {
307 	return bmc_read(sc, reg);
308 }
309 
310 int
311 bt_write(struct ipmi_softc *sc, int reg, uint8_t data)
312 {
313 	struct ipmi_iowait a;
314 
315 	a.offset = _BT_CTRL_REG;
316 	a.mask = BT_BMC_BUSY;
317 	a.value = 0;
318 	a.lbl = "bt_write";
319 	if (bmc_io_wait(sc, &a) < 0)
320 		return (-1);
321 
322 	bmc_write(sc, reg, data);
323 	return (0);
324 }
325 
326 int
327 bt_sendmsg(struct ipmi_cmd *c)
328 {
329 	struct ipmi_softc *sc = c->c_sc;
330 	struct ipmi_iowait a;
331 	int i;
332 
333 	bt_write(sc, _BT_CTRL_REG, BT_CLR_WR_PTR);
334 	for (i = 0; i < c->c_txlen; i++)
335 		bt_write(sc, _BT_DATAOUT_REG, sc->sc_buf[i]);
336 
337 	bt_write(sc, _BT_CTRL_REG, BT_HOST2BMC_ATN);
338 	a.offset = _BT_CTRL_REG;
339 	a.mask = BT_HOST2BMC_ATN | BT_BMC_BUSY;
340 	a.value = 0;
341 	a.lbl = "bt_sendwait";
342 	if (bmc_io_wait(sc, &a) < 0)
343 		return (-1);
344 
345 	return (0);
346 }
347 
348 int
349 bt_recvmsg(struct ipmi_cmd *c)
350 {
351 	struct ipmi_softc *sc = c->c_sc;
352 	struct ipmi_iowait a;
353 	u_int8_t len, v, i, j;
354 
355 	a.offset = _BT_CTRL_REG;
356 	a.mask = BT_BMC2HOST_ATN;
357 	a.value = BT_BMC2HOST_ATN;
358 	a.lbl = "bt_recvwait";
359 	if (bmc_io_wait(sc, &a) < 0)
360 		return (-1);
361 
362 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
363 	bt_write(sc, _BT_CTRL_REG, BT_BMC2HOST_ATN);
364 	bt_write(sc, _BT_CTRL_REG, BT_CLR_RD_PTR);
365 	len = bt_read(sc, _BT_DATAIN_REG);
366 	for (i = IPMI_BTMSG_NFLN, j = 0; i <= len; i++) {
367 		v = bt_read(sc, _BT_DATAIN_REG);
368 		if (i != IPMI_BTMSG_SEQ)
369 			*(sc->sc_buf + j++) = v;
370 	}
371 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
372 	c->c_rxlen = len - 1;
373 
374 	return (0);
375 }
376 
377 int
378 bt_reset(struct ipmi_softc *sc)
379 {
380 	return (-1);
381 }
382 
383 int
384 bt_probe(struct ipmi_softc *sc)
385 {
386 	u_int8_t rv;
387 
388 	rv = bmc_read(sc, _BT_CTRL_REG);
389 	rv &= BT_HOST_BUSY;
390 	rv |= BT_CLR_WR_PTR|BT_CLR_RD_PTR|BT_BMC2HOST_ATN|BT_HOST2BMC_ATN;
391 	bmc_write(sc, _BT_CTRL_REG, rv);
392 
393 	rv = bmc_read(sc, _BT_INTMASK_REG);
394 	rv &= BT_IM_SCI_EN|BT_IM_SMI_EN|BT_IM_NMI2SMI;
395 	rv |= BT_IM_HIRQ_PEND;
396 	bmc_write(sc, _BT_INTMASK_REG, rv);
397 
398 #if 0
399 	printf("bt_probe: %2x\n", v);
400 	printf(" WR    : %2x\n", v & BT_CLR_WR_PTR);
401 	printf(" RD    : %2x\n", v & BT_CLR_RD_PTR);
402 	printf(" H2B   : %2x\n", v & BT_HOST2BMC_ATN);
403 	printf(" B2H   : %2x\n", v & BT_BMC2HOST_ATN);
404 	printf(" EVT   : %2x\n", v & BT_EVT_ATN);
405 	printf(" HBSY  : %2x\n", v & BT_HOST_BUSY);
406 	printf(" BBSY  : %2x\n", v & BT_BMC_BUSY);
407 #endif
408 	return (0);
409 }
410 
411 /*
412  * SMIC interface
413  */
414 #define _SMIC_DATAIN_REG		0
415 #define _SMIC_DATAOUT_REG		0
416 
417 #define _SMIC_CTRL_REG			1
418 #define	  SMS_CC_GET_STATUS		 0x40
419 #define	  SMS_CC_START_TRANSFER		 0x41
420 #define	  SMS_CC_NEXT_TRANSFER		 0x42
421 #define	  SMS_CC_END_TRANSFER		 0x43
422 #define	  SMS_CC_START_RECEIVE		 0x44
423 #define	  SMS_CC_NEXT_RECEIVE		 0x45
424 #define	  SMS_CC_END_RECEIVE		 0x46
425 #define	  SMS_CC_TRANSFER_ABORT		 0x47
426 
427 #define	  SMS_SC_READY			 0xc0
428 #define	  SMS_SC_WRITE_START		 0xc1
429 #define	  SMS_SC_WRITE_NEXT		 0xc2
430 #define	  SMS_SC_WRITE_END		 0xc3
431 #define	  SMS_SC_READ_START		 0xc4
432 #define	  SMS_SC_READ_NEXT		 0xc5
433 #define	  SMS_SC_READ_END		 0xc6
434 
435 #define _SMIC_FLAG_REG			2
436 #define	  SMIC_BUSY			(1L << 0)
437 #define	  SMIC_SMS_ATN			(1L << 2)
438 #define	  SMIC_EVT_ATN			(1L << 3)
439 #define	  SMIC_SMI			(1L << 4)
440 #define	  SMIC_TX_DATA_RDY		(1L << 6)
441 #define	  SMIC_RX_DATA_RDY		(1L << 7)
442 
443 int	smic_wait(struct ipmi_softc *, u_int8_t, u_int8_t, const char *);
444 int	smic_write_cmd_data(struct ipmi_softc *, u_int8_t, const u_int8_t *);
445 int	smic_read_data(struct ipmi_softc *, u_int8_t *);
446 
447 int
448 smic_wait(struct ipmi_softc *sc, u_int8_t mask, u_int8_t val, const char *lbl)
449 {
450 	struct ipmi_iowait a;
451 	int v;
452 
453 	/* Wait for expected flag bits */
454 	a.offset = _SMIC_FLAG_REG;
455 	a.mask = mask;
456 	a.value = val;
457 	a.lbl = "smicwait";
458 	v = bmc_io_wait(sc, &a);
459 	if (v < 0)
460 		return (-1);
461 
462 	/* Return current status */
463 	v = bmc_read(sc, _SMIC_CTRL_REG);
464 	dbg_printf(99, "smic_wait = %.2x\n", v);
465 	return (v);
466 }
467 
468 int
469 smic_write_cmd_data(struct ipmi_softc *sc, u_int8_t cmd, const u_int8_t *data)
470 {
471 	int	sts, v;
472 
473 	dbg_printf(50, "smic_wcd: %.2x %.2x\n", cmd, data ? *data : -1);
474 	sts = smic_wait(sc, SMIC_TX_DATA_RDY | SMIC_BUSY, SMIC_TX_DATA_RDY,
475 	    "smic_write_cmd_data ready");
476 	if (sts < 0)
477 		return (sts);
478 
479 	bmc_write(sc, _SMIC_CTRL_REG, cmd);
480 	if (data)
481 		bmc_write(sc, _SMIC_DATAOUT_REG, *data);
482 
483 	/* Toggle BUSY bit, then wait for busy bit to clear */
484 	v = bmc_read(sc, _SMIC_FLAG_REG);
485 	bmc_write(sc, _SMIC_FLAG_REG, v | SMIC_BUSY);
486 
487 	return (smic_wait(sc, SMIC_BUSY, 0, "smic_write_cmd_data busy"));
488 }
489 
490 int
491 smic_read_data(struct ipmi_softc *sc, u_int8_t *data)
492 {
493 	int sts;
494 
495 	sts = smic_wait(sc, SMIC_RX_DATA_RDY | SMIC_BUSY, SMIC_RX_DATA_RDY,
496 	    "smic_read_data");
497 	if (sts >= 0) {
498 		*data = bmc_read(sc, _SMIC_DATAIN_REG);
499 		dbg_printf(50, "smic_readdata: %.2x\n", *data);
500 	}
501 	return (sts);
502 }
503 
504 #define ErrStat(a,b) if (a) printf(b);
505 
506 int
507 smic_sendmsg(struct ipmi_cmd *c)
508 {
509 	struct ipmi_softc *sc = c->c_sc;
510 	int sts, idx;
511 
512 	sts = smic_write_cmd_data(sc, SMS_CC_START_TRANSFER, &sc->sc_buf[0]);
513 	ErrStat(sts != SMS_SC_WRITE_START, "wstart");
514 	for (idx = 1; idx < c->c_txlen - 1; idx++) {
515 		sts = smic_write_cmd_data(sc, SMS_CC_NEXT_TRANSFER,
516 		    &sc->sc_buf[idx]);
517 		ErrStat(sts != SMS_SC_WRITE_NEXT, "write");
518 	}
519 	sts = smic_write_cmd_data(sc, SMS_CC_END_TRANSFER, &sc->sc_buf[idx]);
520 	if (sts != SMS_SC_WRITE_END) {
521 		dbg_printf(50, "smic_sendmsg %d/%d = %.2x\n", idx, c->c_txlen, sts);
522 		return (-1);
523 	}
524 
525 	return (0);
526 }
527 
528 int
529 smic_recvmsg(struct ipmi_cmd *c)
530 {
531 	struct ipmi_softc *sc = c->c_sc;
532 	int sts, idx;
533 
534 	c->c_rxlen = 0;
535 	sts = smic_wait(sc, SMIC_RX_DATA_RDY, SMIC_RX_DATA_RDY, "smic_recvmsg");
536 	if (sts < 0)
537 		return (-1);
538 
539 	sts = smic_write_cmd_data(sc, SMS_CC_START_RECEIVE, NULL);
540 	ErrStat(sts != SMS_SC_READ_START, "rstart");
541 	for (idx = 0;; ) {
542 		sts = smic_read_data(sc, &sc->sc_buf[idx++]);
543 		if (sts != SMS_SC_READ_START && sts != SMS_SC_READ_NEXT)
544 			break;
545 		smic_write_cmd_data(sc, SMS_CC_NEXT_RECEIVE, NULL);
546 	}
547 	ErrStat(sts != SMS_SC_READ_END, "rend");
548 
549 	c->c_rxlen = idx;
550 
551 	sts = smic_write_cmd_data(sc, SMS_CC_END_RECEIVE, NULL);
552 	if (sts != SMS_SC_READY) {
553 		dbg_printf(50, "smic_recvmsg %d/%d = %.2x\n", idx, c->c_maxrxlen, sts);
554 		return (-1);
555 	}
556 
557 	return (0);
558 }
559 
560 int
561 smic_reset(struct ipmi_softc *sc)
562 {
563 	return (-1);
564 }
565 
566 int
567 smic_probe(struct ipmi_softc *sc)
568 {
569 	/* Flag register should not be 0xFF on a good system */
570 	if (bmc_read(sc, _SMIC_FLAG_REG) == 0xFF)
571 		return (-1);
572 
573 	return (0);
574 }
575 
576 /*
577  * KCS interface
578  */
579 #define _KCS_DATAIN_REGISTER		0
580 #define _KCS_DATAOUT_REGISTER		0
581 #define	  KCS_READ_NEXT			0x68
582 
583 #define _KCS_COMMAND_REGISTER		1
584 #define	  KCS_GET_STATUS		0x60
585 #define	  KCS_WRITE_START		0x61
586 #define	  KCS_WRITE_END			0x62
587 
588 #define _KCS_STATUS_REGISTER		1
589 #define	  KCS_OBF			(1L << 0)
590 #define	  KCS_IBF			(1L << 1)
591 #define	  KCS_SMS_ATN			(1L << 2)
592 #define	  KCS_CD			(1L << 3)
593 #define	  KCS_OEM1			(1L << 4)
594 #define	  KCS_OEM2			(1L << 5)
595 #define	  KCS_STATE_MASK		0xc0
596 #define	    KCS_IDLE_STATE		0x00
597 #define	    KCS_READ_STATE		0x40
598 #define	    KCS_WRITE_STATE		0x80
599 #define	    KCS_ERROR_STATE		0xC0
600 
601 int	kcs_wait(struct ipmi_softc *, u_int8_t, u_int8_t, const char *);
602 int	kcs_write_cmd(struct ipmi_softc *, u_int8_t);
603 int	kcs_write_data(struct ipmi_softc *, u_int8_t);
604 int	kcs_read_data(struct ipmi_softc *, u_int8_t *);
605 
606 int
607 kcs_wait(struct ipmi_softc *sc, u_int8_t mask, u_int8_t value, const char *lbl)
608 {
609 	struct ipmi_iowait a;
610 	int v;
611 
612 	a.offset = _KCS_STATUS_REGISTER;
613 	a.mask = mask;
614 	a.value = value;
615 	a.lbl = lbl;
616 	v = bmc_io_wait(sc, &a);
617 	if (v < 0)
618 		return (v);
619 
620 	/* Check if output buffer full, read dummy byte	 */
621 	if ((v & (KCS_OBF | KCS_STATE_MASK)) == (KCS_OBF | KCS_WRITE_STATE))
622 		bmc_read(sc, _KCS_DATAIN_REGISTER);
623 
624 	/* Check for error state */
625 	if ((v & KCS_STATE_MASK) == KCS_ERROR_STATE) {
626 		bmc_write(sc, _KCS_COMMAND_REGISTER, KCS_GET_STATUS);
627 		while (bmc_read(sc, _KCS_STATUS_REGISTER) & KCS_IBF)
628 			continue;
629 		printf("%s: error code: %x\n", DEVNAME(sc),
630 		    bmc_read(sc, _KCS_DATAIN_REGISTER));
631 	}
632 
633 	return (v & KCS_STATE_MASK);
634 }
635 
636 int
637 kcs_write_cmd(struct ipmi_softc *sc, u_int8_t cmd)
638 {
639 	/* ASSERT: IBF and OBF are clear */
640 	dbg_printf(50, "kcswritecmd: %.2x\n", cmd);
641 	bmc_write(sc, _KCS_COMMAND_REGISTER, cmd);
642 
643 	return (kcs_wait(sc, KCS_IBF, 0, "write_cmd"));
644 }
645 
646 int
647 kcs_write_data(struct ipmi_softc *sc, u_int8_t data)
648 {
649 	/* ASSERT: IBF and OBF are clear */
650 	dbg_printf(50, "kcswritedata: %.2x\n", data);
651 	bmc_write(sc, _KCS_DATAOUT_REGISTER, data);
652 
653 	return (kcs_wait(sc, KCS_IBF, 0, "write_data"));
654 }
655 
656 int
657 kcs_read_data(struct ipmi_softc *sc, u_int8_t * data)
658 {
659 	int sts;
660 
661 	sts = kcs_wait(sc, KCS_IBF | KCS_OBF, KCS_OBF, "read_data");
662 	if (sts != KCS_READ_STATE)
663 		return (sts);
664 
665 	/* ASSERT: OBF is set read data, request next byte */
666 	*data = bmc_read(sc, _KCS_DATAIN_REGISTER);
667 	bmc_write(sc, _KCS_DATAOUT_REGISTER, KCS_READ_NEXT);
668 
669 	dbg_printf(50, "kcsreaddata: %.2x\n", *data);
670 
671 	return (sts);
672 }
673 
674 /* Exported KCS functions */
675 int
676 kcs_sendmsg(struct ipmi_cmd *c)
677 {
678 	struct ipmi_softc *sc = c->c_sc;
679 	int idx, sts;
680 
681 	/* ASSERT: IBF is clear */
682 	dbg_dump(50, "kcs sendmsg", c->c_txlen, sc->sc_buf);
683 	sts = kcs_write_cmd(sc, KCS_WRITE_START);
684 	for (idx = 0; idx < c->c_txlen; idx++) {
685 		if (idx == c->c_txlen - 1)
686 			sts = kcs_write_cmd(sc, KCS_WRITE_END);
687 
688 		if (sts != KCS_WRITE_STATE)
689 			break;
690 
691 		sts = kcs_write_data(sc, sc->sc_buf[idx]);
692 	}
693 	if (sts != KCS_READ_STATE) {
694 		dbg_printf(1, "kcs sendmsg = %d/%d <%.2x>\n", idx, c->c_txlen, sts);
695 		dbg_dump(1, "kcs_sendmsg", c->c_txlen, sc->sc_buf);
696 		return (-1);
697 	}
698 
699 	return (0);
700 }
701 
702 int
703 kcs_recvmsg(struct ipmi_cmd *c)
704 {
705 	struct ipmi_softc *sc = c->c_sc;
706 	int idx, sts;
707 
708 	for (idx = 0; idx < c->c_maxrxlen; idx++) {
709 		sts = kcs_read_data(sc, &sc->sc_buf[idx]);
710 		if (sts != KCS_READ_STATE)
711 			break;
712 	}
713 	sts = kcs_wait(sc, KCS_IBF, 0, "recv");
714 	c->c_rxlen = idx;
715 	if (sts != KCS_IDLE_STATE) {
716 		dbg_printf(1, "kcs recvmsg = %d/%d <%.2x>\n", idx, c->c_maxrxlen, sts);
717 		return (-1);
718 	}
719 
720 	dbg_dump(50, "kcs recvmsg", idx, sc->sc_buf);
721 
722 	return (0);
723 }
724 
725 int
726 kcs_reset(struct ipmi_softc *sc)
727 {
728 	return (-1);
729 }
730 
731 int
732 kcs_probe(struct ipmi_softc *sc)
733 {
734 	u_int8_t v;
735 
736 	v = bmc_read(sc, _KCS_STATUS_REGISTER);
737 	if ((v & KCS_STATE_MASK) == KCS_ERROR_STATE)
738 		return (1);
739 #if 0
740 	printf("kcs_probe: %2x\n", v);
741 	printf(" STS: %2x\n", v & KCS_STATE_MASK);
742 	printf(" ATN: %2x\n", v & KCS_SMS_ATN);
743 	printf(" C/D: %2x\n", v & KCS_CD);
744 	printf(" IBF: %2x\n", v & KCS_IBF);
745 	printf(" OBF: %2x\n", v & KCS_OBF);
746 #endif
747 	return (0);
748 }
749 
750 /*
751  * IPMI code
752  */
753 #define READ_SMS_BUFFER		0x37
754 #define WRITE_I2C		0x50
755 
756 #define GET_MESSAGE_CMD		0x33
757 #define SEND_MESSAGE_CMD	0x34
758 
759 #define IPMB_CHANNEL_NUMBER	0
760 
761 #define PUBLIC_BUS		0
762 
763 #define MIN_I2C_PACKET_SIZE	3
764 #define MIN_IMB_PACKET_SIZE	7	/* one byte for cksum */
765 
766 #define MIN_BTBMC_REQ_SIZE	4
767 #define MIN_BTBMC_RSP_SIZE	5
768 #define MIN_BMC_REQ_SIZE	2
769 #define MIN_BMC_RSP_SIZE	3
770 
771 #define BMC_SA			0x20	/* BMC/ESM3 */
772 #define FPC_SA			0x22	/* front panel */
773 #define BP_SA			0xC0	/* Primary Backplane */
774 #define BP2_SA			0xC2	/* Secondary Backplane */
775 #define PBP_SA			0xC4	/* Peripheral Backplane */
776 #define DRAC_SA			0x28	/* DRAC-III */
777 #define DRAC3_SA		0x30	/* DRAC-III */
778 #define BMC_LUN			0
779 #define SMS_LUN			2
780 
781 struct ipmi_request {
782 	u_int8_t	rsSa;
783 	u_int8_t	rsLun;
784 	u_int8_t	netFn;
785 	u_int8_t	cmd;
786 	u_int8_t	data_len;
787 	u_int8_t	*data;
788 };
789 
790 struct ipmi_response {
791 	u_int8_t	cCode;
792 	u_int8_t	data_len;
793 	u_int8_t	*data;
794 };
795 
796 struct ipmi_bmc_request {
797 	u_int8_t	bmc_nfLn;
798 	u_int8_t	bmc_cmd;
799 	u_int8_t	bmc_data_len;
800 	u_int8_t	bmc_data[1];
801 };
802 
803 struct ipmi_bmc_response {
804 	u_int8_t	bmc_nfLn;
805 	u_int8_t	bmc_cmd;
806 	u_int8_t	bmc_cCode;
807 	u_int8_t	bmc_data_len;
808 	u_int8_t	bmc_data[1];
809 };
810 
811 struct cfdriver ipmi_cd = {
812 	NULL, "ipmi", DV_DULL
813 };
814 
815 void
816 dumpb(const char *lbl, int len, const u_int8_t *data)
817 {
818 	int idx;
819 
820 	printf("%s: ", lbl);
821 	for (idx = 0; idx < len; idx++)
822 		printf("%.2x ", data[idx]);
823 
824 	printf("\n");
825 }
826 
827 /*
828  * bt_buildmsg builds an IPMI message from a nfLun, cmd, and data
829  * This is used by BT protocol
830  */
831 void
832 bt_buildmsg(struct ipmi_cmd *c)
833 {
834 	struct ipmi_softc *sc = c->c_sc;
835 	u_int8_t *buf = sc->sc_buf;
836 
837 	buf[IPMI_BTMSG_LEN] = c->c_txlen + (IPMI_BTMSG_DATASND - 1);
838 	buf[IPMI_BTMSG_NFLN] = NETFN_LUN(c->c_netfn, c->c_rslun);
839 	buf[IPMI_BTMSG_SEQ] = sc->sc_btseq++;
840 	buf[IPMI_BTMSG_CMD] = c->c_cmd;
841 	if (c->c_txlen && c->c_data)
842 		memcpy(buf + IPMI_BTMSG_DATASND, c->c_data, c->c_txlen);
843 }
844 
845 /*
846  * cmn_buildmsg builds an IPMI message from a nfLun, cmd, and data
847  * This is used by both SMIC and KCS protocols
848  */
849 void
850 cmn_buildmsg(struct ipmi_cmd *c)
851 {
852 	struct ipmi_softc *sc = c->c_sc;
853 	u_int8_t *buf = sc->sc_buf;
854 
855 	buf[IPMI_MSG_NFLN] = NETFN_LUN(c->c_netfn, c->c_rslun);
856 	buf[IPMI_MSG_CMD] = c->c_cmd;
857 	if (c->c_txlen && c->c_data)
858 		memcpy(buf + IPMI_MSG_DATASND, c->c_data, c->c_txlen);
859 }
860 
861 /* Send an IPMI command */
862 int
863 ipmi_sendcmd(struct ipmi_cmd *c)
864 {
865 	struct ipmi_softc	*sc = c->c_sc;
866 	int		rc = -1;
867 
868 	dbg_printf(50, "ipmi_sendcmd: rssa=%.2x nfln=%.2x cmd=%.2x len=%.2x\n",
869 	    c->c_rssa, NETFN_LUN(c->c_netfn, c->c_rslun), c->c_cmd, c->c_txlen);
870 	dbg_dump(10, " send", c->c_txlen, c->c_data);
871 	if (c->c_rssa != BMC_SA) {
872 #if 0
873 		sc->sc_if->buildmsg(c);
874 		pI2C->bus = (sc->if_ver == 0x09) ?
875 		    PUBLIC_BUS :
876 		    IPMB_CHANNEL_NUMBER;
877 
878 		imbreq->rsSa = rssa;
879 		imbreq->nfLn = NETFN_LUN(netfn, rslun);
880 		imbreq->cSum1 = -(imbreq->rsSa + imbreq->nfLn);
881 		imbreq->rqSa = BMC_SA;
882 		imbreq->seqLn = NETFN_LUN(sc->imb_seq++, SMS_LUN);
883 		imbreq->cmd = cmd;
884 		if (txlen)
885 			memcpy(imbreq->data, data, txlen);
886 		/* Set message checksum */
887 		imbreq->data[txlen] = cksum8(&imbreq->rqSa, txlen + 3);
888 #endif
889 		goto done;
890 	} else
891 		sc->sc_if->buildmsg(c);
892 
893 	c->c_txlen += sc->sc_if->datasnd;
894 	rc = sc->sc_if->sendmsg(c);
895 
896 done:
897 	return (rc);
898 }
899 
900 /* Receive an IPMI command */
901 int
902 ipmi_recvcmd(struct ipmi_cmd *c)
903 {
904 	struct ipmi_softc *sc = c->c_sc;
905 	u_int8_t	*buf = sc->sc_buf, rc = 0;
906 
907 	/* Receive message from interface, copy out result data */
908 	c->c_maxrxlen += sc->sc_if->datarcv;
909 	if (sc->sc_if->recvmsg(c) ||
910 	    c->c_rxlen < sc->sc_if->datarcv) {
911 		return (-1);
912 	}
913 
914 	c->c_rxlen -= sc->sc_if->datarcv;
915 	if (c->c_rxlen > 0 && c->c_data)
916 		memcpy(c->c_data, buf + sc->sc_if->datarcv, c->c_rxlen);
917 
918 	rc = buf[IPMI_MSG_CCODE];
919 #ifdef IPMI_DEBUG
920 	if (rc != 0)
921 		dbg_printf(1, "ipmi_recvcmd: nfln=%.2x cmd=%.2x err=%.2x\n",
922 		    buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD], buf[IPMI_MSG_CCODE]);
923 #endif
924 
925 	dbg_printf(50, "ipmi_recvcmd: nfln=%.2x cmd=%.2x err=%.2x len=%.2x\n",
926 	    buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD], buf[IPMI_MSG_CCODE],
927 	    c->c_rxlen);
928 	dbg_dump(10, " recv", c->c_rxlen, c->c_data);
929 
930 	return (rc);
931 }
932 
933 void
934 ipmi_cmd(struct ipmi_cmd *c)
935 {
936 	if (cold || panicstr != NULL)
937 		ipmi_cmd_poll(c);
938 	else
939 		ipmi_cmd_wait(c);
940 }
941 
942 void
943 ipmi_cmd_poll(struct ipmi_cmd *c)
944 {
945 	if ((c->c_ccode = ipmi_sendcmd(c)))
946 		printf("%s: sendcmd fails\n", DEVNAME(c->c_sc));
947 	else
948 		c->c_ccode = ipmi_recvcmd(c);
949 }
950 
951 void
952 ipmi_cmd_wait(struct ipmi_cmd *c)
953 {
954 	struct task t;
955 	int res;
956 
957 	task_set(&t, ipmi_cmd_wait_cb, c);
958 	res = task_add(c->c_sc->sc_cmd_taskq, &t);
959 	KASSERT(res == 1);
960 
961 	tsleep_nsec(c, PWAIT, "ipmicmd", INFSLP);
962 
963 	res = task_del(c->c_sc->sc_cmd_taskq, &t);
964 	KASSERT(res == 0);
965 }
966 
967 void
968 ipmi_cmd_wait_cb(void *arg)
969 {
970 	struct ipmi_cmd *c = arg;
971 
972 	ipmi_cmd_poll(c);
973 	wakeup(c);
974 }
975 
976 /* Read a partial SDR entry */
977 int
978 get_sdr_partial(struct ipmi_softc *sc, u_int16_t recordId, u_int16_t reserveId,
979     u_int8_t offset, u_int8_t length, void *buffer, u_int16_t *nxtRecordId)
980 {
981 	u_int8_t	cmd[IPMI_GET_WDOG_MAX + 255];	/* 8 + max of length */
982 	int		len;
983 
984 	((u_int16_t *) cmd)[0] = reserveId;
985 	((u_int16_t *) cmd)[1] = recordId;
986 	cmd[4] = offset;
987 	cmd[5] = length;
988 
989 	struct ipmi_cmd	c;
990 	c.c_sc = sc;
991 	c.c_rssa = BMC_SA;
992 	c.c_rslun = BMC_LUN;
993 	c.c_netfn = STORAGE_NETFN;
994 	c.c_cmd = STORAGE_GET_SDR;
995 	c.c_txlen = IPMI_SET_WDOG_MAX;
996 	c.c_rxlen = 0;
997 	c.c_maxrxlen = 8 + length;
998 	c.c_data = cmd;
999 	ipmi_cmd(&c);
1000 	len = c.c_rxlen;
1001 
1002 	if (nxtRecordId)
1003 		*nxtRecordId = *(uint16_t *) cmd;
1004 	if (len > 2)
1005 		memcpy(buffer, cmd + 2, len - 2);
1006 	else
1007 		return (1);
1008 
1009 	return (0);
1010 }
1011 
1012 int maxsdrlen = 0x10;
1013 
1014 /* Read an entire SDR; pass to add sensor */
1015 int
1016 get_sdr(struct ipmi_softc *sc, u_int16_t recid, u_int16_t *nxtrec)
1017 {
1018 	u_int16_t	resid = 0;
1019 	int		len, sdrlen, offset;
1020 	u_int8_t	*psdr;
1021 	struct sdrhdr	shdr;
1022 
1023 	/* Reserve SDR */
1024 	struct ipmi_cmd	c;
1025 	c.c_sc = sc;
1026 	c.c_rssa = BMC_SA;
1027 	c.c_rslun = BMC_LUN;
1028 	c.c_netfn = STORAGE_NETFN;
1029 	c.c_cmd = STORAGE_RESERVE_SDR;
1030 	c.c_txlen = 0;
1031 	c.c_maxrxlen = sizeof(resid);
1032 	c.c_rxlen = 0;
1033 	c.c_data = &resid;
1034 	ipmi_cmd(&c);
1035 
1036 	/* Get SDR Header */
1037 	if (get_sdr_partial(sc, recid, resid, 0, sizeof shdr, &shdr, nxtrec)) {
1038 		printf("%s: get header fails\n", DEVNAME(sc));
1039 		return (1);
1040 	}
1041 	/* Allocate space for entire SDR Length of SDR in header does not
1042 	 * include header length */
1043 	sdrlen = sizeof(shdr) + shdr.record_length;
1044 	psdr = malloc(sdrlen, M_DEVBUF, M_NOWAIT);
1045 	if (psdr == NULL)
1046 		return (1);
1047 
1048 	memcpy(psdr, &shdr, sizeof(shdr));
1049 
1050 	/* Read SDR Data maxsdrlen bytes at a time */
1051 	for (offset = sizeof(shdr); offset < sdrlen; offset += maxsdrlen) {
1052 		len = sdrlen - offset;
1053 		if (len > maxsdrlen)
1054 			len = maxsdrlen;
1055 
1056 		if (get_sdr_partial(sc, recid, resid, offset, len,
1057 		    psdr + offset, NULL)) {
1058 			printf("%s: get chunk: %d,%d fails\n", DEVNAME(sc),
1059 			    offset, len);
1060 			free(psdr, M_DEVBUF, sdrlen);
1061 			return (1);
1062 		}
1063 	}
1064 
1065 	/* Add SDR to sensor list, if not wanted, free buffer */
1066 	if (add_sdr_sensor(sc, psdr, sdrlen) == 0)
1067 		free(psdr, M_DEVBUF, sdrlen);
1068 
1069 	return (0);
1070 }
1071 
1072 int
1073 getbits(u_int8_t *bytes, int bitpos, int bitlen)
1074 {
1075 	int	v;
1076 	int	mask;
1077 
1078 	bitpos += bitlen - 1;
1079 	for (v = 0; bitlen--;) {
1080 		v <<= 1;
1081 		mask = 1L << (bitpos & 7);
1082 		if (bytes[bitpos >> 3] & mask)
1083 			v |= 1;
1084 		bitpos--;
1085 	}
1086 
1087 	return (v);
1088 }
1089 
1090 /* Decode IPMI sensor name */
1091 int
1092 ipmi_sensor_name(char *name, int len, u_int8_t typelen, u_int8_t *bits,
1093     int bitslen)
1094 {
1095 	int	i, slen;
1096 	char	bcdplus[] = "0123456789 -.:,_";
1097 
1098 	slen = typelen & 0x1F;
1099 	switch (typelen >> 6) {
1100 	case IPMI_NAME_UNICODE:
1101 		//unicode
1102 		break;
1103 
1104 	case IPMI_NAME_BCDPLUS:
1105 		/* Characters are encoded in 4-bit BCDPLUS */
1106 		if (len < slen * 2 + 1)
1107 			slen = (len >> 1) - 1;
1108 		if (slen > bitslen)
1109 			return (0);
1110 		for (i = 0; i < slen; i++) {
1111 			*(name++) = bcdplus[bits[i] >> 4];
1112 			*(name++) = bcdplus[bits[i] & 0xF];
1113 		}
1114 		break;
1115 
1116 	case IPMI_NAME_ASCII6BIT:
1117 		/* Characters are encoded in 6-bit ASCII
1118 		 *   0x00 - 0x3F maps to 0x20 - 0x5F */
1119 		/* XXX: need to calculate max len: slen = 3/4 * len */
1120 		if (len < slen + 1)
1121 			slen = len - 1;
1122 		if (slen * 6 / 8 > bitslen)
1123 			return (0);
1124 		for (i = 0; i < slen * 8; i += 6) {
1125 			*(name++) = getbits(bits, i, 6) + ' ';
1126 		}
1127 		break;
1128 
1129 	case IPMI_NAME_ASCII8BIT:
1130 		/* Characters are 8-bit ascii */
1131 		if (len < slen + 1)
1132 			slen = len - 1;
1133 		if (slen > bitslen)
1134 			return (0);
1135 		while (slen--)
1136 			*(name++) = *(bits++);
1137 		break;
1138 	}
1139 	*name = 0;
1140 
1141 	return (1);
1142 }
1143 
1144 /* Calculate val * 10^exp */
1145 long
1146 ipow(long val, int exp)
1147 {
1148 	while (exp > 0) {
1149 		val *= 10;
1150 		exp--;
1151 	}
1152 
1153 	while (exp < 0) {
1154 		val /= 10;
1155 		exp++;
1156 	}
1157 
1158 	return (val);
1159 }
1160 
1161 /* Sign extend a n-bit value */
1162 long
1163 signextend(unsigned long val, int bits)
1164 {
1165 	long msk = (1L << (bits-1))-1;
1166 
1167 	return (-(val & ~msk) | val);
1168 }
1169 
1170 /* Convert IPMI reading from sensor factors */
1171 long
1172 ipmi_convert(u_int8_t v, struct sdrtype1 *s1, long adj)
1173 {
1174 	int16_t	M, B;
1175 	int8_t	K1, K2;
1176 	long	val;
1177 
1178 	/* Calculate linear reading variables */
1179 	M  = signextend((((short)(s1->m_tolerance & 0xC0)) << 2) + s1->m, 10);
1180 	B  = signextend((((short)(s1->b_accuracy & 0xC0)) << 2) + s1->b, 10);
1181 	K1 = signextend(s1->rbexp & 0xF, 4);
1182 	K2 = signextend(s1->rbexp >> 4, 4);
1183 
1184 	/* Calculate sensor reading:
1185 	 *  y = L((M * v + (B * 10^K1)) * 10^(K2+adj)
1186 	 *
1187 	 * This commutes out to:
1188 	 *  y = L(M*v * 10^(K2+adj) + B * 10^(K1+K2+adj)); */
1189 	val = ipow(M * v, K2 + adj) + ipow(B, K1 + K2 + adj);
1190 
1191 	/* Linearization function: y = f(x) 0 : y = x 1 : y = ln(x) 2 : y =
1192 	 * log10(x) 3 : y = log2(x) 4 : y = e^x 5 : y = 10^x 6 : y = 2^x 7 : y
1193 	 * = 1/x 8 : y = x^2 9 : y = x^3 10 : y = square root(x) 11 : y = cube
1194 	 * root(x) */
1195 	return (val);
1196 }
1197 
1198 int
1199 ipmi_sensor_status(struct ipmi_softc *sc, struct ipmi_sensor *psensor,
1200     u_int8_t *reading)
1201 {
1202 	struct sdrtype1	*s1 = (struct sdrtype1 *)psensor->i_sdr;
1203 	int		etype;
1204 
1205 	/* Get reading of sensor */
1206 	switch (psensor->i_sensor.type) {
1207 	case SENSOR_TEMP:
1208 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 6);
1209 		psensor->i_sensor.value += 273150000;
1210 		break;
1211 
1212 	case SENSOR_VOLTS_DC:
1213 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 6);
1214 		break;
1215 
1216 	case SENSOR_FANRPM:
1217 		psensor->i_sensor.value = ipmi_convert(reading[0], s1, 0);
1218 		if (((s1->units1>>3)&0x7) == 0x3)
1219 			psensor->i_sensor.value *= 60; // RPS -> RPM
1220 		break;
1221 	default:
1222 		break;
1223 	}
1224 
1225 	/* Return Sensor Status */
1226 	etype = (psensor->etype << 8) + psensor->stype;
1227 	switch (etype) {
1228 	case IPMI_SENSOR_TYPE_TEMP:
1229 	case IPMI_SENSOR_TYPE_VOLT:
1230 	case IPMI_SENSOR_TYPE_FAN:
1231 		/* non-recoverable threshold */
1232 		if (reading[2] & ((1 << 5) | (1 << 2)))
1233 			return (SENSOR_S_CRIT);
1234 		/* critical threshold */
1235 		else if (reading[2] & ((1 << 4) | (1 << 1)))
1236 			return (SENSOR_S_CRIT);
1237 		/* non-critical threshold */
1238 		else if (reading[2] & ((1 << 3) | (1 << 0)))
1239 			return (SENSOR_S_WARN);
1240 		break;
1241 
1242 	case IPMI_SENSOR_TYPE_INTRUSION:
1243 		psensor->i_sensor.value = (reading[2] & 1) ? 1 : 0;
1244 		if (reading[2] & 0x1)
1245 			return (SENSOR_S_CRIT);
1246 		break;
1247 
1248 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
1249 		/* Reading: 1 = present+powered, 0 = otherwise */
1250 		psensor->i_sensor.value = (reading[2] & 1) ? 1 : 0;
1251 		if (reading[2] & 0x10) {
1252 			/* XXX: Need sysctl type for Power Supply types
1253 			 *   ok: power supply installed && powered
1254 			 * warn: power supply installed && !powered
1255 			 * crit: power supply !installed
1256 			 */
1257 			return (SENSOR_S_CRIT);
1258 		}
1259 		if (reading[2] & 0x08) {
1260 			/* Power supply AC lost */
1261 			return (SENSOR_S_WARN);
1262 		}
1263 		break;
1264 	}
1265 
1266 	return (SENSOR_S_OK);
1267 }
1268 
1269 int
1270 read_sensor(struct ipmi_softc *sc, struct ipmi_sensor *psensor)
1271 {
1272 	struct sdrtype1	*s1 = (struct sdrtype1 *) psensor->i_sdr;
1273 	u_int8_t	data[8];
1274 	int		rv = -1;
1275 
1276 	memset(data, 0, sizeof(data));
1277 	data[0] = psensor->i_num;
1278 
1279 	struct ipmi_cmd	c;
1280 	c.c_sc = sc;
1281 	c.c_rssa = s1->owner_id;
1282 	c.c_rslun = s1->owner_lun;
1283 	c.c_netfn = SE_NETFN;
1284 	c.c_cmd = SE_GET_SENSOR_READING;
1285 	c.c_txlen = 1;
1286 	c.c_maxrxlen = sizeof(data);
1287 	c.c_rxlen = 0;
1288 	c.c_data = data;
1289 	ipmi_cmd(&c);
1290 
1291 	dbg_printf(10, "values=%.2x %.2x %.2x %.2x %s\n",
1292 	    data[0],data[1],data[2],data[3], psensor->i_sensor.desc);
1293 	psensor->i_sensor.flags &= ~SENSOR_FINVALID;
1294 	if ((data[1] & IPMI_INVALID_SENSOR) ||
1295 	    ((data[1] & IPMI_DISABLED_SENSOR) == 0 && data[0] == 0))
1296 		psensor->i_sensor.flags |= SENSOR_FINVALID;
1297 	psensor->i_sensor.status = ipmi_sensor_status(sc, psensor, data);
1298 	rv = 0;
1299 	return (rv);
1300 }
1301 
1302 int
1303 ipmi_sensor_type(int type, int ext_type, int entity)
1304 {
1305 	switch (ext_type << 8L | type) {
1306 	case IPMI_SENSOR_TYPE_TEMP:
1307 		return (SENSOR_TEMP);
1308 
1309 	case IPMI_SENSOR_TYPE_VOLT:
1310 		return (SENSOR_VOLTS_DC);
1311 
1312 	case IPMI_SENSOR_TYPE_FAN:
1313 		return (SENSOR_FANRPM);
1314 
1315 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
1316 		if (entity == IPMI_ENTITY_PWRSUPPLY)
1317 			return (SENSOR_INDICATOR);
1318 		break;
1319 
1320 	case IPMI_SENSOR_TYPE_INTRUSION:
1321 		return (SENSOR_INDICATOR);
1322 	}
1323 
1324 	return (-1);
1325 }
1326 
1327 /* Add Sensor to BSD Sysctl interface */
1328 int
1329 add_sdr_sensor(struct ipmi_softc *sc, u_int8_t *psdr, int sdrlen)
1330 {
1331 	int			rc;
1332 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
1333 	struct sdrtype2		*s2 = (struct sdrtype2 *)psdr;
1334 	char			name[64];
1335 
1336 	switch (s1->sdrhdr.record_type) {
1337 	case IPMI_SDR_TYPEFULL:
1338 		rc = ipmi_sensor_name(name, sizeof(name), s1->typelen,
1339 		    s1->name, sdrlen - (int)offsetof(struct sdrtype1, name));
1340 		if (rc == 0)
1341 			return (0);
1342 		rc = add_child_sensors(sc, psdr, 1, s1->sensor_num,
1343 		    s1->sensor_type, s1->event_code, 0, s1->entity_id, name);
1344 		break;
1345 
1346 	case IPMI_SDR_TYPECOMPACT:
1347 		rc = ipmi_sensor_name(name, sizeof(name), s2->typelen,
1348 		    s2->name, sdrlen - (int)offsetof(struct sdrtype2, name));
1349 		if (rc == 0)
1350 			return (0);
1351 		rc = add_child_sensors(sc, psdr, s2->share1 & 0xF,
1352 		    s2->sensor_num, s2->sensor_type, s2->event_code,
1353 		    s2->share2 & 0x7F, s2->entity_id, name);
1354 		break;
1355 
1356 	default:
1357 		return (0);
1358 	}
1359 
1360 	return rc;
1361 }
1362 
1363 int
1364 add_child_sensors(struct ipmi_softc *sc, u_int8_t *psdr, int count,
1365     int sensor_num, int sensor_type, int ext_type, int sensor_base,
1366     int entity, const char *name)
1367 {
1368 	int			typ, idx;
1369 	struct ipmi_sensor	*psensor;
1370 #ifdef IPMI_DEBUG
1371 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
1372 #endif
1373 
1374 	typ = ipmi_sensor_type(sensor_type, ext_type, entity);
1375 	if (typ == -1) {
1376 		dbg_printf(5, "Unknown sensor type:%.2x et:%.2x sn:%.2x "
1377 		    "name:%s\n", sensor_type, ext_type, sensor_num, name);
1378 		return 0;
1379 	}
1380 	for (idx = 0; idx < count; idx++) {
1381 		psensor = malloc(sizeof(*psensor), M_DEVBUF, M_NOWAIT | M_ZERO);
1382 		if (psensor == NULL)
1383 			break;
1384 
1385 		/* Initialize BSD Sensor info */
1386 		psensor->i_sdr = psdr;
1387 		psensor->i_num = sensor_num + idx;
1388 		psensor->stype = sensor_type;
1389 		psensor->etype = ext_type;
1390 		psensor->i_sensor.type = typ;
1391 		if (count > 1)
1392 			snprintf(psensor->i_sensor.desc,
1393 			    sizeof(psensor->i_sensor.desc),
1394 			    "%s - %d", name, sensor_base + idx);
1395 		else
1396 			strlcpy(psensor->i_sensor.desc, name,
1397 			    sizeof(psensor->i_sensor.desc));
1398 
1399 		dbg_printf(5, "add sensor:%.4x %.2x:%d ent:%.2x:%.2x %s\n",
1400 		    s1->sdrhdr.record_id, s1->sensor_type,
1401 		    typ, s1->entity_id, s1->entity_instance,
1402 		    psensor->i_sensor.desc);
1403 		if (read_sensor(sc, psensor) == 0) {
1404 			SLIST_INSERT_HEAD(&ipmi_sensor_list, psensor, list);
1405 			sensor_attach(&sc->sc_sensordev, &psensor->i_sensor);
1406 			dbg_printf(5, "	 reading: %lld [%s]\n",
1407 			    psensor->i_sensor.value,
1408 			    psensor->i_sensor.desc);
1409 		}
1410 	}
1411 
1412 	return (1);
1413 }
1414 
1415 /* Handle IPMI Timer - reread sensor values */
1416 void
1417 ipmi_refresh_sensors(struct ipmi_softc *sc)
1418 {
1419 	if (SLIST_EMPTY(&ipmi_sensor_list))
1420 		return;
1421 
1422 	sc->current_sensor = SLIST_NEXT(sc->current_sensor, list);
1423 	if (sc->current_sensor == NULL)
1424 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
1425 
1426 	if (read_sensor(sc, sc->current_sensor)) {
1427 		dbg_printf(1, "%s: error reading: %s\n", DEVNAME(sc),
1428 		    sc->current_sensor->i_sensor.desc);
1429 		return;
1430 	}
1431 }
1432 
1433 int
1434 ipmi_map_regs(struct ipmi_softc *sc, struct ipmi_attach_args *ia)
1435 {
1436 	if (sc->sc_if && sc->sc_if->nregs == 0)
1437 		return (0);
1438 
1439 	sc->sc_if = ipmi_get_if(ia->iaa_if_type);
1440 	if (sc->sc_if == NULL)
1441 		return (-1);
1442 
1443 	if (ia->iaa_if_iotype == 'i')
1444 		sc->sc_iot = ia->iaa_iot;
1445 	else
1446 		sc->sc_iot = ia->iaa_memt;
1447 
1448 	sc->sc_if_rev = ia->iaa_if_rev;
1449 	sc->sc_if_iospacing = ia->iaa_if_iospacing;
1450 	if (bus_space_map(sc->sc_iot, ia->iaa_if_iobase,
1451 	    sc->sc_if->nregs * sc->sc_if_iospacing,
1452 	    0, &sc->sc_ioh)) {
1453 		printf("%s: bus_space_map(%lx %lx %x 0 %p) failed\n",
1454 		    DEVNAME(sc),
1455 		    (unsigned long)sc->sc_iot, ia->iaa_if_iobase,
1456 		    sc->sc_if->nregs * sc->sc_if_iospacing, &sc->sc_ioh);
1457 		return (-1);
1458 	}
1459 	return (0);
1460 }
1461 
1462 void
1463 ipmi_unmap_regs(struct ipmi_softc *sc)
1464 {
1465 	if (sc->sc_if->nregs > 0) {
1466 		bus_space_unmap(sc->sc_iot, sc->sc_ioh,
1467 		    sc->sc_if->nregs * sc->sc_if_iospacing);
1468 	}
1469 }
1470 
1471 void
1472 ipmi_poll_thread(void *arg)
1473 {
1474 	struct ipmi_thread	*thread = arg;
1475 	struct ipmi_softc	*sc = thread->sc;
1476 	u_int16_t		rec;
1477 
1478 	/* Scan SDRs, add sensors */
1479 	for (rec = 0; rec != 0xFFFF;) {
1480 		if (get_sdr(sc, rec, &rec)) {
1481 			ipmi_unmap_regs(sc);
1482 			printf("%s: no SDRs IPMI disabled\n", DEVNAME(sc));
1483 			goto done;
1484 		}
1485 		while (tsleep(sc, PWAIT, "ipmirun", 1) != EWOULDBLOCK)
1486 			continue;
1487 	}
1488 
1489 	/* initialize sensor list for thread */
1490 	if (SLIST_EMPTY(&ipmi_sensor_list))
1491 		goto done;
1492 	else
1493 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
1494 
1495 	strlcpy(sc->sc_sensordev.xname, sc->sc_dev.dv_xname,
1496 	    sizeof(sc->sc_sensordev.xname));
1497 	sensordev_install(&sc->sc_sensordev);
1498 
1499 	while (thread->running) {
1500 		ipmi_refresh_sensors(sc);
1501 		tsleep_nsec(thread, PWAIT, "ipmi_poll",
1502 		    SEC_TO_NSEC(SENSOR_REFRESH_RATE));
1503 	}
1504 
1505 done:
1506 	kthread_exit(0);
1507 }
1508 
1509 void
1510 ipmi_create_thread(void *arg)
1511 {
1512 	struct ipmi_softc	*sc = arg;
1513 
1514 	if (kthread_create(ipmi_poll_thread, sc->sc_thread, NULL,
1515 	    DEVNAME(sc)) != 0) {
1516 		printf("%s: unable to create run thread, ipmi disabled\n",
1517 		    DEVNAME(sc));
1518 		return;
1519 	}
1520 }
1521 
1522 void
1523 ipmi_attach_common(struct ipmi_softc *sc, struct ipmi_attach_args *ia)
1524 {
1525 	struct ipmi_cmd		*c = &sc->sc_ioctl.cmd;
1526 
1527 	/* Map registers */
1528 	ipmi_map_regs(sc, ia);
1529 
1530 	sc->sc_thread = malloc(sizeof(struct ipmi_thread), M_DEVBUF, M_NOWAIT);
1531 	if (sc->sc_thread == NULL) {
1532 		printf(": unable to allocate thread\n");
1533 		return;
1534 	}
1535 	sc->sc_thread->sc = sc;
1536 	sc->sc_thread->running = 1;
1537 
1538 	/* Setup threads */
1539 	kthread_create_deferred(ipmi_create_thread, sc);
1540 
1541 	printf(": version %d.%d interface %s",
1542 	    ia->iaa_if_rev >> 4, ia->iaa_if_rev & 0xF, sc->sc_if->name);
1543 	if (sc->sc_if->nregs > 0)
1544 		printf(" %sbase 0x%lx/%x spacing %d",
1545 		    ia->iaa_if_iotype == 'i' ? "io" : "mem", ia->iaa_if_iobase,
1546 		    ia->iaa_if_iospacing * sc->sc_if->nregs,
1547 		    ia->iaa_if_iospacing);
1548 	if (ia->iaa_if_irq != -1)
1549 		printf(" irq %d", ia->iaa_if_irq);
1550 	printf("\n");
1551 
1552 	/* setup flag to exclude iic */
1553 	ipmi_enabled = 1;
1554 
1555 	/* Setup Watchdog timer */
1556 	sc->sc_wdog_period = 0;
1557 	task_set(&sc->sc_wdog_tickle_task, ipmi_watchdog_tickle, sc);
1558 	wdog_register(ipmi_watchdog, sc);
1559 
1560 	rw_init(&sc->sc_ioctl.lock, DEVNAME(sc));
1561 	sc->sc_ioctl.req.msgid = -1;
1562 	c->c_sc = sc;
1563 	c->c_ccode = -1;
1564 
1565 	sc->sc_cmd_taskq = taskq_create("ipmicmd", 1, IPL_NONE, TASKQ_MPSAFE);
1566 }
1567 
1568 int
1569 ipmi_activate(struct device *self, int act)
1570 {
1571 	switch (act) {
1572 	case DVACT_POWERDOWN:
1573 		wdog_shutdown(self);
1574 		break;
1575 	}
1576 
1577 	return (0);
1578 }
1579 
1580 struct ipmi_softc *
1581 ipmilookup(dev_t dev)
1582 {
1583 	return (struct ipmi_softc *)device_lookup(&ipmi_cd, minor(dev));
1584 }
1585 
1586 int
1587 ipmiopen(dev_t dev, int flags, int mode, struct proc *p)
1588 {
1589 	struct ipmi_softc	*sc = ipmilookup(dev);
1590 
1591 	if (sc == NULL)
1592 		return (ENXIO);
1593 	return (0);
1594 }
1595 
1596 int
1597 ipmiclose(dev_t dev, int flags, int mode, struct proc *p)
1598 {
1599 	struct ipmi_softc	*sc = ipmilookup(dev);
1600 
1601 	if (sc == NULL)
1602 		return (ENXIO);
1603 	return (0);
1604 }
1605 
1606 int
1607 ipmiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *proc)
1608 {
1609 	struct ipmi_softc	*sc = ipmilookup(dev);
1610 	struct ipmi_req		*req = (struct ipmi_req *)data;
1611 	struct ipmi_recv	*recv = (struct ipmi_recv *)data;
1612 	struct ipmi_cmd		*c = &sc->sc_ioctl.cmd;
1613 	int			iv;
1614 	int			len;
1615 	u_char			ccode;
1616 	int			rc = 0;
1617 
1618 	if (sc == NULL)
1619 		return (ENXIO);
1620 
1621 	rw_enter_write(&sc->sc_ioctl.lock);
1622 
1623 	c->c_maxrxlen = sizeof(sc->sc_ioctl.buf);
1624 	c->c_data = sc->sc_ioctl.buf;
1625 
1626 	switch (cmd) {
1627 	case IPMICTL_SEND_COMMAND:
1628 		if (req->msgid == -1) {
1629 			rc = EINVAL;
1630 			goto reset;
1631 		}
1632 		if (sc->sc_ioctl.req.msgid != -1) {
1633 			rc = EBUSY;
1634 			goto reset;
1635 		}
1636 		len = req->msg.data_len;
1637 		if (len < 0) {
1638 			rc = EINVAL;
1639 			goto reset;
1640 		}
1641 		if (len > c->c_maxrxlen) {
1642 			rc = E2BIG;
1643 			goto reset;
1644 		}
1645 		sc->sc_ioctl.req = *req;
1646 		c->c_ccode = -1;
1647 		rc = copyin(req->msg.data, c->c_data, len);
1648 		if (rc != 0)
1649 			goto reset;
1650 		KASSERT(c->c_ccode == -1);
1651 
1652 		/* Execute a command synchronously. */
1653 		c->c_netfn = req->msg.netfn;
1654 		c->c_cmd = req->msg.cmd;
1655 		c->c_txlen = req->msg.data_len;
1656 		c->c_rxlen = 0;
1657 		ipmi_cmd(c);
1658 		break;
1659 	case IPMICTL_RECEIVE_MSG_TRUNC:
1660 	case IPMICTL_RECEIVE_MSG:
1661 		if (sc->sc_ioctl.req.msgid == -1) {
1662 			rc = EINVAL;
1663 			goto reset;
1664 		}
1665 		if (c->c_ccode == -1) {
1666 			rc = EAGAIN;
1667 			goto reset;
1668 		}
1669 		ccode = c->c_ccode & 0xff;
1670 		rc = copyout(&ccode, recv->msg.data, 1);
1671 		if (rc != 0)
1672 			goto reset;
1673 
1674 		/* Return a command result. */
1675 		recv->recv_type = IPMI_RESPONSE_RECV_TYPE;
1676 		recv->msgid = sc->sc_ioctl.req.msgid;
1677 		recv->msg.netfn = sc->sc_ioctl.req.msg.netfn;
1678 		recv->msg.cmd = sc->sc_ioctl.req.msg.cmd;
1679 		recv->msg.data_len = c->c_rxlen + 1;
1680 
1681 		rc = copyout(c->c_data, recv->msg.data + 1, c->c_rxlen);
1682 		/* Always reset state after command completion. */
1683 		goto reset;
1684 	case IPMICTL_SET_MY_ADDRESS_CMD:
1685 		iv = *(int *)data;
1686 		if (iv < 0 || iv > RSSA_MASK) {
1687 			rc = EINVAL;
1688 			goto reset;
1689 		}
1690 		c->c_rssa = iv;
1691 		break;
1692 	case IPMICTL_GET_MY_ADDRESS_CMD:
1693 		*(int *)data = c->c_rssa;
1694 		break;
1695 	case IPMICTL_SET_MY_LUN_CMD:
1696 		iv = *(int *)data;
1697 		if (iv < 0 || iv > LUN_MASK) {
1698 			rc = EINVAL;
1699 			goto reset;
1700 		}
1701 		c->c_rslun = iv;
1702 		break;
1703 	case IPMICTL_GET_MY_LUN_CMD:
1704 		*(int *)data = c->c_rslun;
1705 		break;
1706 	case IPMICTL_SET_GETS_EVENTS_CMD:
1707 		break;
1708 	case IPMICTL_REGISTER_FOR_CMD:
1709 	case IPMICTL_UNREGISTER_FOR_CMD:
1710 	default:
1711 		break;
1712 	}
1713 done:
1714 	rw_exit_write(&sc->sc_ioctl.lock);
1715 	return (rc);
1716 reset:
1717 	sc->sc_ioctl.req.msgid = -1;
1718 	c->c_ccode = -1;
1719 	goto done;
1720 }
1721 
1722 #define		MIN_PERIOD	10
1723 
1724 int
1725 ipmi_watchdog(void *arg, int period)
1726 {
1727 	struct ipmi_softc	*sc = arg;
1728 
1729 	if (sc->sc_wdog_period == period) {
1730 		if (period != 0) {
1731 			struct task *t;
1732 			int res;
1733 
1734 			t = &sc->sc_wdog_tickle_task;
1735 			(void)task_del(systq, t);
1736 			res = task_add(systq, t);
1737 			KASSERT(res == 1);
1738 		}
1739 		return (period);
1740 	}
1741 
1742 	if (period < MIN_PERIOD && period > 0)
1743 		period = MIN_PERIOD;
1744 	sc->sc_wdog_period = period;
1745 	ipmi_watchdog_set(sc);
1746 	printf("%s: watchdog %sabled\n", DEVNAME(sc),
1747 	    (period == 0) ? "dis" : "en");
1748 	return (period);
1749 }
1750 
1751 void
1752 ipmi_watchdog_tickle(void *arg)
1753 {
1754 	struct ipmi_softc	*sc = arg;
1755 	struct ipmi_cmd		c;
1756 
1757 	c.c_sc = sc;
1758 	c.c_rssa = BMC_SA;
1759 	c.c_rslun = BMC_LUN;
1760 	c.c_netfn = APP_NETFN;
1761 	c.c_cmd = APP_RESET_WATCHDOG;
1762 	c.c_txlen = 0;
1763 	c.c_maxrxlen = 0;
1764 	c.c_rxlen = 0;
1765 	c.c_data = NULL;
1766 	ipmi_cmd(&c);
1767 }
1768 
1769 void
1770 ipmi_watchdog_set(void *arg)
1771 {
1772 	struct ipmi_softc	*sc = arg;
1773 	uint8_t			wdog[IPMI_GET_WDOG_MAX];
1774 	struct ipmi_cmd		c;
1775 
1776 	c.c_sc = sc;
1777 	c.c_rssa = BMC_SA;
1778 	c.c_rslun = BMC_LUN;
1779 	c.c_netfn = APP_NETFN;
1780 	c.c_cmd = APP_GET_WATCHDOG_TIMER;
1781 	c.c_txlen = 0;
1782 	c.c_maxrxlen = IPMI_GET_WDOG_MAX;
1783 	c.c_rxlen = 0;
1784 	c.c_data = wdog;
1785 	ipmi_cmd(&c);
1786 
1787 	/* Period is 10ths/sec */
1788 	uint16_t timo = htole16(sc->sc_wdog_period * 10);
1789 
1790 	memcpy(&wdog[IPMI_SET_WDOG_TIMOL], &timo, 2);
1791 	wdog[IPMI_SET_WDOG_TIMER] &= ~IPMI_WDOG_DONTSTOP;
1792 	wdog[IPMI_SET_WDOG_TIMER] |= (sc->sc_wdog_period == 0) ?
1793 	    0 : IPMI_WDOG_DONTSTOP;
1794 	wdog[IPMI_SET_WDOG_ACTION] &= ~IPMI_WDOG_MASK;
1795 	wdog[IPMI_SET_WDOG_ACTION] |= (sc->sc_wdog_period == 0) ?
1796 	    IPMI_WDOG_DISABLED : IPMI_WDOG_REBOOT;
1797 
1798 	c.c_cmd = APP_SET_WATCHDOG_TIMER;
1799 	c.c_txlen = IPMI_SET_WDOG_MAX;
1800 	c.c_maxrxlen = 0;
1801 	c.c_rxlen = 0;
1802 	c.c_data = wdog;
1803 	ipmi_cmd(&c);
1804 }
1805 
1806 #if defined(__amd64__) || defined(__i386__)
1807 
1808 #include <dev/isa/isareg.h>
1809 #include <dev/isa/isavar.h>
1810 
1811 /*
1812  * Format of SMBIOS IPMI Flags
1813  *
1814  * bit0: interrupt trigger mode (1=level, 0=edge)
1815  * bit1: interrupt polarity (1=active high, 0=active low)
1816  * bit2: reserved
1817  * bit3: address LSB (1=odd,0=even)
1818  * bit4: interrupt (1=specified, 0=not specified)
1819  * bit5: reserved
1820  * bit6/7: register spacing (1,4,2,err)
1821  */
1822 #define SMIPMI_FLAG_IRQLVL		(1L << 0)
1823 #define SMIPMI_FLAG_IRQEN		(1L << 3)
1824 #define SMIPMI_FLAG_ODDOFFSET		(1L << 4)
1825 #define SMIPMI_FLAG_IFSPACING(x)	(((x)>>6)&0x3)
1826 #define	 IPMI_IOSPACING_BYTE		 0
1827 #define	 IPMI_IOSPACING_WORD		 2
1828 #define	 IPMI_IOSPACING_DWORD		 1
1829 
1830 struct dmd_ipmi {
1831 	u_int8_t	dmd_sig[4];		/* Signature 'IPMI' */
1832 	u_int8_t	dmd_i2c_address;	/* Address of BMC */
1833 	u_int8_t	dmd_nvram_address;	/* Address of NVRAM */
1834 	u_int8_t	dmd_if_type;		/* IPMI Interface Type */
1835 	u_int8_t	dmd_if_rev;		/* IPMI Interface Revision */
1836 } __packed;
1837 
1838 void	*scan_sig(long, long, int, int, const void *);
1839 
1840 void	ipmi_smbios_probe(struct smbios_ipmi *, struct ipmi_attach_args *);
1841 int	ipmi_match(struct device *, void *, void *);
1842 void	ipmi_attach(struct device *, struct device *, void *);
1843 
1844 struct cfattach ipmi_ca = {
1845 	sizeof(struct ipmi_softc), ipmi_match, ipmi_attach,
1846 	NULL, ipmi_activate
1847 };
1848 
1849 int
1850 ipmi_match(struct device *parent, void *match, void *aux)
1851 {
1852 	struct ipmi_softc	*sc;
1853 	struct ipmi_attach_args *ia = aux;
1854 	struct cfdata		*cf = match;
1855 	u_int8_t		cmd[32];
1856 	int			rv = 0;
1857 
1858 	if (strcmp(ia->iaa_name, cf->cf_driver->cd_name))
1859 		return (0);
1860 
1861 	/* XXX local softc is wrong wrong wrong */
1862 	sc = malloc(sizeof(*sc), M_TEMP, M_WAITOK | M_ZERO);
1863 	strlcpy(sc->sc_dev.dv_xname, "ipmi0", sizeof(sc->sc_dev.dv_xname));
1864 
1865 	/* Map registers */
1866 	if (ipmi_map_regs(sc, ia) == 0) {
1867 		sc->sc_if->probe(sc);
1868 
1869 		/* Identify BMC device early to detect lying bios */
1870 		struct ipmi_cmd c;
1871 		c.c_sc = sc;
1872 		c.c_rssa = BMC_SA;
1873 		c.c_rslun = BMC_LUN;
1874 		c.c_netfn = APP_NETFN;
1875 		c.c_cmd = APP_GET_DEVICE_ID;
1876 		c.c_txlen = 0;
1877 		c.c_maxrxlen = sizeof(cmd);
1878 		c.c_rxlen = 0;
1879 		c.c_data = cmd;
1880 		ipmi_cmd(&c);
1881 
1882 		dbg_dump(1, "bmc data", c.c_rxlen, cmd);
1883 		rv = 1; /* GETID worked, we got IPMI */
1884 		ipmi_unmap_regs(sc);
1885 	}
1886 
1887 	free(sc, M_TEMP, sizeof(*sc));
1888 
1889 	return (rv);
1890 }
1891 
1892 void
1893 ipmi_attach(struct device *parent, struct device *self, void *aux)
1894 {
1895 	ipmi_attach_common((struct ipmi_softc *)self, aux);
1896 }
1897 
1898 /* Scan memory for signature */
1899 void *
1900 scan_sig(long start, long end, int skip, int len, const void *data)
1901 {
1902 	void *va;
1903 
1904 	while (start < end) {
1905 		va = ISA_HOLE_VADDR(start);
1906 		if (memcmp(va, data, len) == 0)
1907 			return (va);
1908 
1909 		start += skip;
1910 	}
1911 
1912 	return (NULL);
1913 }
1914 
1915 void
1916 ipmi_smbios_probe(struct smbios_ipmi *pipmi, struct ipmi_attach_args *ia)
1917 {
1918 
1919 	dbg_printf(1, "ipmi_smbios_probe: %02x %02x %02x %02x %08llx %02x "
1920 	    "%02x\n",
1921 	    pipmi->smipmi_if_type,
1922 	    pipmi->smipmi_if_rev,
1923 	    pipmi->smipmi_i2c_address,
1924 	    pipmi->smipmi_nvram_address,
1925 	    pipmi->smipmi_base_address,
1926 	    pipmi->smipmi_base_flags,
1927 	    pipmi->smipmi_irq);
1928 
1929 	ia->iaa_if_type = pipmi->smipmi_if_type;
1930 	ia->iaa_if_rev = pipmi->smipmi_if_rev;
1931 	ia->iaa_if_irq = (pipmi->smipmi_base_flags & SMIPMI_FLAG_IRQEN) ?
1932 	    pipmi->smipmi_irq : -1;
1933 	ia->iaa_if_irqlvl = (pipmi->smipmi_base_flags & SMIPMI_FLAG_IRQLVL) ?
1934 	    IST_LEVEL : IST_EDGE;
1935 
1936 	switch (SMIPMI_FLAG_IFSPACING(pipmi->smipmi_base_flags)) {
1937 	case IPMI_IOSPACING_BYTE:
1938 		ia->iaa_if_iospacing = 1;
1939 		break;
1940 
1941 	case IPMI_IOSPACING_DWORD:
1942 		ia->iaa_if_iospacing = 4;
1943 		break;
1944 
1945 	case IPMI_IOSPACING_WORD:
1946 		ia->iaa_if_iospacing = 2;
1947 		break;
1948 
1949 	default:
1950 		ia->iaa_if_iospacing = 1;
1951 		printf("ipmi: unknown register spacing\n");
1952 	}
1953 
1954 	/* Calculate base address (PCI BAR format) */
1955 	if (pipmi->smipmi_base_address & 0x1) {
1956 		ia->iaa_if_iotype = 'i';
1957 		ia->iaa_if_iobase = pipmi->smipmi_base_address & ~0x1;
1958 	} else {
1959 		ia->iaa_if_iotype = 'm';
1960 		ia->iaa_if_iobase = pipmi->smipmi_base_address & ~0xF;
1961 	}
1962 	if (pipmi->smipmi_base_flags & SMIPMI_FLAG_ODDOFFSET)
1963 		ia->iaa_if_iobase++;
1964 
1965 	if (pipmi->smipmi_base_flags == 0x7f) {
1966 		/* IBM 325 eServer workaround */
1967 		ia->iaa_if_iospacing = 1;
1968 		ia->iaa_if_iobase = pipmi->smipmi_base_address;
1969 		ia->iaa_if_iotype = 'i';
1970 		return;
1971 	}
1972 }
1973 
1974 int
1975 ipmi_probe(void *aux)
1976 {
1977 	struct ipmi_attach_args *ia = aux;
1978 	struct dmd_ipmi *pipmi;
1979 	struct smbtable tbl;
1980 
1981 	tbl.cookie = 0;
1982 	if (smbios_find_table(SMBIOS_TYPE_IPMIDEV, &tbl))
1983 		ipmi_smbios_probe(tbl.tblhdr, ia);
1984 	else {
1985 		pipmi = (struct dmd_ipmi *)scan_sig(0xC0000L, 0xFFFFFL, 16, 4,
1986 		    "IPMI");
1987 		/* XXX hack to find Dell PowerEdge 8450 */
1988 		if (pipmi == NULL) {
1989 			/* no IPMI found */
1990 			return (0);
1991 		}
1992 
1993 		/* we have an IPMI signature, fill in attach arg structure */
1994 		ia->iaa_if_type = pipmi->dmd_if_type;
1995 		ia->iaa_if_rev = pipmi->dmd_if_rev;
1996 	}
1997 
1998 	return (1);
1999 }
2000 
2001 #endif
2002