Home | History | Annotate | Line # | Download | only in dev
ipmi.c revision 1.12
      1 /*	$NetBSD: ipmi.c,v 1.12 2024/12/03 22:11:38 riastradh Exp $ */
      2 
      3 /*
      4  * Copyright (c) 2019 Michael van Elst
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     25  *
     26  */
     27 /*
     28  * Copyright (c) 2006 Manuel Bouyer.
     29  *
     30  * Redistribution and use in source and binary forms, with or without
     31  * modification, are permitted provided that the following conditions
     32  * are met:
     33  * 1. Redistributions of source code must retain the above copyright
     34  *    notice, this list of conditions and the following disclaimer.
     35  * 2. Redistributions in binary form must reproduce the above copyright
     36  *    notice, this list of conditions and the following disclaimer in the
     37  *    documentation and/or other materials provided with the distribution.
     38  *
     39  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     40  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     41  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     42  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     43  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     44  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     45  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     46  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     47  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     48  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     49  *
     50  */
     51 
     52 /*
     53  * Copyright (c) 2005 Jordan Hargrave
     54  * All rights reserved.
     55  *
     56  * Redistribution and use in source and binary forms, with or without
     57  * modification, are permitted provided that the following conditions
     58  * are met:
     59  * 1. Redistributions of source code must retain the above copyright
     60  *    notice, this list of conditions and the following disclaimer.
     61  * 2. Redistributions in binary form must reproduce the above copyright
     62  *    notice, this list of conditions and the following disclaimer in the
     63  *    documentation and/or other materials provided with the distribution.
     64  *
     65  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
     66  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     67  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     68  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR
     69  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     70  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     71  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     72  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     73  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     74  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     75  * SUCH DAMAGE.
     76  */
     77 
     78 #include <sys/cdefs.h>
     79 __KERNEL_RCSID(0, "$NetBSD: ipmi.c,v 1.12 2024/12/03 22:11:38 riastradh Exp $");
     80 
     81 #include <sys/types.h>
     82 #include <sys/param.h>
     83 #include <sys/systm.h>
     84 #include <sys/kernel.h>
     85 #include <sys/device.h>
     86 #include <sys/extent.h>
     87 #include <sys/callout.h>
     88 #include <sys/envsys.h>
     89 #include <sys/malloc.h>
     90 #include <sys/kthread.h>
     91 #include <sys/bus.h>
     92 #include <sys/intr.h>
     93 #include <sys/ioctl.h>
     94 #include <sys/poll.h>
     95 #include <sys/conf.h>
     96 
     97 #include <dev/isa/isareg.h>
     98 #include <dev/isa/isavar.h>
     99 
    100 #include <sys/ipmi.h>
    101 #include <dev/ipmivar.h>
    102 
    103 #include <uvm/uvm_extern.h>
    104 
    105 #include "ioconf.h"
    106 
    107 static dev_type_open(ipmi_open);
    108 static dev_type_close(ipmi_close);
    109 static dev_type_ioctl(ipmi_ioctl);
    110 static dev_type_poll(ipmi_poll);
    111 
    112 const struct cdevsw ipmi_cdevsw = {
    113 	.d_open = ipmi_open,
    114 	.d_close = ipmi_close,
    115 	.d_read = noread,
    116 	.d_write = nowrite,
    117 	.d_ioctl = ipmi_ioctl,
    118 	.d_stop = nostop,
    119 	.d_tty = notty,
    120 	.d_poll = ipmi_poll,
    121 	.d_mmap = nommap,
    122 	.d_kqfilter = nokqfilter,
    123 	.d_discard = nodiscard,
    124 	.d_flag = D_OTHER
    125 };
    126 
    127 #define IPMIUNIT(n) (minor(n))
    128 
    129 struct ipmi_sensor {
    130 	uint8_t	*i_sdr;
    131 	int		i_num;
    132 	int		i_stype;
    133 	int		i_etype;
    134 	char		i_envdesc[64];
    135 	int 		i_envtype; /* envsys compatible type */
    136 	int		i_envnum; /* envsys index */
    137 	sysmon_envsys_lim_t i_limits, i_deflims;
    138 	uint32_t	i_props, i_defprops;
    139 	SLIST_ENTRY(ipmi_sensor) i_list;
    140 	int32_t		i_prevval;	/* feed rnd source on change */
    141 };
    142 
    143 #if 0
    144 static	int ipmi_nintr;
    145 #endif
    146 static	int ipmi_dbg = 0;
    147 static	int ipmi_enabled = 0;
    148 
    149 #define SENSOR_REFRESH_RATE (hz / 2)
    150 
    151 #define IPMI_BTMSG_LEN			0
    152 #define IPMI_BTMSG_NFLN			1
    153 #define IPMI_BTMSG_SEQ			2
    154 #define IPMI_BTMSG_CMD			3
    155 #define IPMI_BTMSG_CCODE		4
    156 #define IPMI_BTMSG_DATASND		4
    157 #define IPMI_BTMSG_DATARCV		5
    158 
    159 #define IPMI_MSG_NFLN			0
    160 #define IPMI_MSG_CMD			1
    161 #define IPMI_MSG_CCODE			2
    162 #define IPMI_MSG_DATASND		2
    163 #define IPMI_MSG_DATARCV		3
    164 
    165 #define IPMI_SENSOR_TYPE_TEMP		0x0101
    166 #define IPMI_SENSOR_TYPE_VOLT		0x0102
    167 #define IPMI_SENSOR_TYPE_FAN		0x0104
    168 #define IPMI_SENSOR_TYPE_INTRUSION	0x6F05
    169 #define IPMI_SENSOR_TYPE_PWRSUPPLY	0x6F08
    170 
    171 #define IPMI_NAME_UNICODE		0x00
    172 #define IPMI_NAME_BCDPLUS		0x01
    173 #define IPMI_NAME_ASCII6BIT		0x02
    174 #define IPMI_NAME_ASCII8BIT		0x03
    175 
    176 #define IPMI_ENTITY_PWRSUPPLY		0x0A
    177 
    178 #define IPMI_SENSOR_SCANNING_ENABLED	(1L << 6)
    179 #define IPMI_SENSOR_UNAVAILABLE		(1L << 5)
    180 #define IPMI_INVALID_SENSOR_P(x) \
    181 	(((x) & (IPMI_SENSOR_SCANNING_ENABLED|IPMI_SENSOR_UNAVAILABLE)) \
    182 	!= IPMI_SENSOR_SCANNING_ENABLED)
    183 
    184 #define IPMI_SDR_TYPEFULL		1
    185 #define IPMI_SDR_TYPECOMPACT		2
    186 
    187 #define byteof(x) ((x) >> 3)
    188 #define bitof(x)  (1L << ((x) & 0x7))
    189 #define TB(b,m)	  (data[2+byteof(b)] & bitof(b))
    190 
    191 #define dbg_printf(lvl, fmt...) \
    192 	if (ipmi_dbg >= lvl) \
    193 		printf(fmt);
    194 #define dbg_dump(lvl, msg, len, buf) \
    195 	if (len && ipmi_dbg >= lvl) \
    196 		dumpb(msg, len, (const uint8_t *)(buf));
    197 
    198 static	long signextend(unsigned long, int);
    199 
    200 SLIST_HEAD(ipmi_sensors_head, ipmi_sensor);
    201 static struct ipmi_sensors_head ipmi_sensor_list =
    202     SLIST_HEAD_INITIALIZER(&ipmi_sensor_list);
    203 
    204 static	void dumpb(const char *, int, const uint8_t *);
    205 
    206 static	int read_sensor(struct ipmi_softc *, struct ipmi_sensor *);
    207 static	int add_sdr_sensor(struct ipmi_softc *, uint8_t *);
    208 static	int get_sdr_partial(struct ipmi_softc *, uint16_t, uint16_t,
    209 	    uint8_t, uint8_t, void *, uint16_t *);
    210 static	int get_sdr(struct ipmi_softc *, uint16_t, uint16_t *);
    211 
    212 static	char *ipmi_buf_acquire(struct ipmi_softc *, size_t);
    213 static	void ipmi_buf_release(struct ipmi_softc *, char *);
    214 static	int ipmi_sendcmd(struct ipmi_softc *, int, int, int, int, int, const void*);
    215 static	int ipmi_recvcmd(struct ipmi_softc *, int, int *, void *);
    216 static	void ipmi_delay(struct ipmi_softc *, int);
    217 
    218 static	int ipmi_get_device_id(struct ipmi_softc *, struct ipmi_device_id *);
    219 static	int ipmi_watchdog_setmode(struct sysmon_wdog *);
    220 static	int ipmi_watchdog_tickle(struct sysmon_wdog *);
    221 static	void ipmi_dotickle(struct ipmi_softc *);
    222 
    223 #if 0
    224 static	int ipmi_intr(void *);
    225 #endif
    226 
    227 static	int ipmi_match(device_t, cfdata_t, void *);
    228 static	void ipmi_attach(device_t, device_t, void *);
    229 static	int ipmi_detach(device_t, int);
    230 
    231 static	long	ipmi_convert(uint8_t, struct sdrtype1 *, long);
    232 static	void	ipmi_sensor_name(char *, int, uint8_t, uint8_t *);
    233 
    234 /* BMC Helper Functions */
    235 static	uint8_t bmc_read(struct ipmi_softc *, int);
    236 static	void bmc_write(struct ipmi_softc *, int, uint8_t);
    237 static	int bmc_io_wait(struct ipmi_softc *, int, uint8_t, uint8_t, const char *);
    238 static	int bmc_io_wait_spin(struct ipmi_softc *, int, uint8_t, uint8_t);
    239 static	int bmc_io_wait_sleep(struct ipmi_softc *, int, uint8_t, uint8_t);
    240 
    241 static	void *cmn_buildmsg(struct ipmi_softc *, int, int, int, const void *, int *);
    242 
    243 static	int getbits(uint8_t *, int, int);
    244 static	int ipmi_sensor_type(int, int, int);
    245 
    246 static	void ipmi_refresh_sensors(struct ipmi_softc *);
    247 static	int ipmi_map_regs(struct ipmi_softc *, struct ipmi_attach_args *);
    248 static	void ipmi_unmap_regs(struct ipmi_softc *);
    249 
    250 static	int32_t ipmi_convert_sensor(uint8_t *, struct ipmi_sensor *);
    251 static	void ipmi_set_limits(struct sysmon_envsys *, envsys_data_t *,
    252 		sysmon_envsys_lim_t *, uint32_t *);
    253 static	void ipmi_get_limits(struct sysmon_envsys *, envsys_data_t *,
    254 		sysmon_envsys_lim_t *, uint32_t *);
    255 static	void ipmi_get_sensor_limits(struct ipmi_softc *, struct ipmi_sensor *,
    256 		sysmon_envsys_lim_t *, uint32_t *);
    257 static	int ipmi_sensor_status(struct ipmi_softc *, struct ipmi_sensor *,
    258 		envsys_data_t *, uint8_t *);
    259 
    260 static	int add_child_sensors(struct ipmi_softc *, uint8_t *, int, int, int,
    261 		int, int, int, const char *);
    262 
    263 static	bool ipmi_suspend(device_t, const pmf_qual_t *);
    264 
    265 static	int kcs_probe(struct ipmi_softc *);
    266 static	int kcs_reset(struct ipmi_softc *);
    267 static	int kcs_sendmsg(struct ipmi_softc *, int, const uint8_t *);
    268 static	int kcs_recvmsg(struct ipmi_softc *, int, int *len, uint8_t *);
    269 
    270 static	void *bt_buildmsg(struct ipmi_softc *, int, int, int, const void *, int *);
    271 static	int bt_probe(struct ipmi_softc *);
    272 static	int bt_reset(struct ipmi_softc *);
    273 static	int bt_sendmsg(struct ipmi_softc *, int, const uint8_t *);
    274 static	int bt_recvmsg(struct ipmi_softc *, int, int *, uint8_t *);
    275 
    276 static	int smic_probe(struct ipmi_softc *);
    277 static	int smic_reset(struct ipmi_softc *);
    278 static	int smic_sendmsg(struct ipmi_softc *, int, const uint8_t *);
    279 static	int smic_recvmsg(struct ipmi_softc *, int, int *, uint8_t *);
    280 
    281 static struct ipmi_if kcs_if = {
    282 	"KCS",
    283 	IPMI_IF_KCS_NREGS,
    284 	cmn_buildmsg,
    285 	kcs_sendmsg,
    286 	kcs_recvmsg,
    287 	kcs_reset,
    288 	kcs_probe,
    289 };
    290 
    291 static struct ipmi_if smic_if = {
    292 	"SMIC",
    293 	IPMI_IF_SMIC_NREGS,
    294 	cmn_buildmsg,
    295 	smic_sendmsg,
    296 	smic_recvmsg,
    297 	smic_reset,
    298 	smic_probe,
    299 };
    300 
    301 static struct ipmi_if bt_if = {
    302 	"BT",
    303 	IPMI_IF_BT_NREGS,
    304 	bt_buildmsg,
    305 	bt_sendmsg,
    306 	bt_recvmsg,
    307 	bt_reset,
    308 	bt_probe,
    309 };
    310 
    311 static	struct ipmi_if *ipmi_get_if(int);
    312 
    313 static struct ipmi_if *
    314 ipmi_get_if(int iftype)
    315 {
    316 	switch (iftype) {
    317 	case IPMI_IF_KCS:
    318 		return &kcs_if;
    319 	case IPMI_IF_SMIC:
    320 		return &smic_if;
    321 	case IPMI_IF_BT:
    322 		return &bt_if;
    323 	default:
    324 		return NULL;
    325 	}
    326 }
    327 
    328 /*
    329  * BMC Helper Functions
    330  */
    331 static uint8_t
    332 bmc_read(struct ipmi_softc *sc, int offset)
    333 {
    334 	return bus_space_read_1(sc->sc_iot, sc->sc_ioh,
    335 	    offset * sc->sc_if_iospacing);
    336 }
    337 
    338 static void
    339 bmc_write(struct ipmi_softc *sc, int offset, uint8_t val)
    340 {
    341 	bus_space_write_1(sc->sc_iot, sc->sc_ioh,
    342 	    offset * sc->sc_if_iospacing, val);
    343 }
    344 
    345 static int
    346 bmc_io_wait_sleep(struct ipmi_softc *sc, int offset, uint8_t mask,
    347     uint8_t value)
    348 {
    349 	int retries;
    350 	uint8_t v;
    351 
    352 	KASSERT(mutex_owned(&sc->sc_cmd_mtx));
    353 
    354 	for (retries = 0; retries < sc->sc_max_retries; retries++) {
    355 		v = bmc_read(sc, offset);
    356 		if ((v & mask) == value)
    357 			return v;
    358 		mutex_enter(&sc->sc_sleep_mtx);
    359 		cv_timedwait(&sc->sc_cmd_sleep, &sc->sc_sleep_mtx, 1);
    360 		mutex_exit(&sc->sc_sleep_mtx);
    361 	}
    362 	return -1;
    363 }
    364 
    365 static int
    366 bmc_io_wait(struct ipmi_softc *sc, int offset, uint8_t mask, uint8_t value,
    367     const char *lbl)
    368 {
    369 	int v;
    370 
    371 	v = bmc_io_wait_spin(sc, offset, mask, value);
    372 	if (cold || v != -1)
    373 		return v;
    374 
    375 	return bmc_io_wait_sleep(sc, offset, mask, value);
    376 }
    377 
    378 static int
    379 bmc_io_wait_spin(struct ipmi_softc *sc, int offset, uint8_t mask,
    380     uint8_t value)
    381 {
    382 	uint8_t	v;
    383 	int			count = cold ? 15000 : 500;
    384 	/* ~us */
    385 
    386 	while (count--) {
    387 		v = bmc_read(sc, offset);
    388 		if ((v & mask) == value)
    389 			return v;
    390 
    391 		delay(1);
    392 	}
    393 
    394 	return -1;
    395 
    396 }
    397 
    398 #define NETFN_LUN(nf,ln) (((nf) << 2) | ((ln) & 0x3))
    399 #define GET_NETFN(m) (((m) >> 2)
    400 #define GET_LUN(m) ((m) & 0x03)
    401 
    402 /*
    403  * BT interface
    404  */
    405 #define _BT_CTRL_REG			0
    406 #define	  BT_CLR_WR_PTR			(1L << 0)
    407 #define	  BT_CLR_RD_PTR			(1L << 1)
    408 #define	  BT_HOST2BMC_ATN		(1L << 2)
    409 #define	  BT_BMC2HOST_ATN		(1L << 3)
    410 #define	  BT_EVT_ATN			(1L << 4)
    411 #define	  BT_HOST_BUSY			(1L << 6)
    412 #define	  BT_BMC_BUSY			(1L << 7)
    413 
    414 #define	  BT_READY	(BT_HOST_BUSY|BT_HOST2BMC_ATN|BT_BMC2HOST_ATN)
    415 
    416 #define _BT_DATAIN_REG			1
    417 #define _BT_DATAOUT_REG			1
    418 
    419 #define _BT_INTMASK_REG			2
    420 #define	 BT_IM_HIRQ_PEND		(1L << 1)
    421 #define	 BT_IM_SCI_EN			(1L << 2)
    422 #define	 BT_IM_SMI_EN			(1L << 3)
    423 #define	 BT_IM_NMI2SMI			(1L << 4)
    424 
    425 static int bt_read(struct ipmi_softc *, int);
    426 static int bt_write(struct ipmi_softc *, int, uint8_t);
    427 
    428 static int
    429 bt_read(struct ipmi_softc *sc, int reg)
    430 {
    431 	return bmc_read(sc, reg);
    432 }
    433 
    434 static int
    435 bt_write(struct ipmi_softc *sc, int reg, uint8_t data)
    436 {
    437 	if (bmc_io_wait(sc, _BT_CTRL_REG, BT_BMC_BUSY, 0, __func__) < 0)
    438 		return -1;
    439 
    440 	bmc_write(sc, reg, data);
    441 	return 0;
    442 }
    443 
    444 static int
    445 bt_sendmsg(struct ipmi_softc *sc, int len, const uint8_t *data)
    446 {
    447 	int i;
    448 
    449 	bt_write(sc, _BT_CTRL_REG, BT_CLR_WR_PTR);
    450 	for (i = 0; i < len; i++)
    451 		bt_write(sc, _BT_DATAOUT_REG, data[i]);
    452 
    453 	bt_write(sc, _BT_CTRL_REG, BT_HOST2BMC_ATN);
    454 	if (bmc_io_wait(sc, _BT_CTRL_REG, BT_HOST2BMC_ATN | BT_BMC_BUSY, 0,
    455 	    __func__) < 0)
    456 		return -1;
    457 
    458 	return 0;
    459 }
    460 
    461 static int
    462 bt_recvmsg(struct ipmi_softc *sc, int maxlen, int *rxlen, uint8_t *data)
    463 {
    464 	uint8_t len, v, i;
    465 
    466 	if (bmc_io_wait(sc, _BT_CTRL_REG, BT_BMC2HOST_ATN, BT_BMC2HOST_ATN,
    467 	    __func__) < 0)
    468 		return -1;
    469 
    470 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
    471 	bt_write(sc, _BT_CTRL_REG, BT_BMC2HOST_ATN);
    472 	bt_write(sc, _BT_CTRL_REG, BT_CLR_RD_PTR);
    473 	len = bt_read(sc, _BT_DATAIN_REG);
    474 	for (i = IPMI_BTMSG_NFLN; i <= len; i++) {
    475 		v = bt_read(sc, _BT_DATAIN_REG);
    476 		if (i != IPMI_BTMSG_SEQ)
    477 			*(data++) = v;
    478 	}
    479 	bt_write(sc, _BT_CTRL_REG, BT_HOST_BUSY);
    480 	*rxlen = len - 1;
    481 
    482 	return 0;
    483 }
    484 
    485 static int
    486 bt_reset(struct ipmi_softc *sc)
    487 {
    488 	return -1;
    489 }
    490 
    491 static int
    492 bt_probe(struct ipmi_softc *sc)
    493 {
    494 	uint8_t rv;
    495 
    496 	rv = bmc_read(sc, _BT_CTRL_REG);
    497 	rv &= BT_HOST_BUSY;
    498 	rv |= BT_CLR_WR_PTR|BT_CLR_RD_PTR|BT_BMC2HOST_ATN|BT_HOST2BMC_ATN;
    499 	bmc_write(sc, _BT_CTRL_REG, rv);
    500 
    501 	rv = bmc_read(sc, _BT_INTMASK_REG);
    502 	rv &= BT_IM_SCI_EN|BT_IM_SMI_EN|BT_IM_NMI2SMI;
    503 	rv |= BT_IM_HIRQ_PEND;
    504 	bmc_write(sc, _BT_INTMASK_REG, rv);
    505 
    506 #if 0
    507 	printf("%s: %2x\n", __func__, v);
    508 	printf(" WR    : %2x\n", v & BT_CLR_WR_PTR);
    509 	printf(" RD    : %2x\n", v & BT_CLR_RD_PTR);
    510 	printf(" H2B   : %2x\n", v & BT_HOST2BMC_ATN);
    511 	printf(" B2H   : %2x\n", v & BT_BMC2HOST_ATN);
    512 	printf(" EVT   : %2x\n", v & BT_EVT_ATN);
    513 	printf(" HBSY  : %2x\n", v & BT_HOST_BUSY);
    514 	printf(" BBSY  : %2x\n", v & BT_BMC_BUSY);
    515 #endif
    516 	return 0;
    517 }
    518 
    519 /*
    520  * SMIC interface
    521  */
    522 #define _SMIC_DATAIN_REG		0
    523 #define _SMIC_DATAOUT_REG		0
    524 
    525 #define _SMIC_CTRL_REG			1
    526 #define	  SMS_CC_GET_STATUS		 0x40
    527 #define	  SMS_CC_START_TRANSFER		 0x41
    528 #define	  SMS_CC_NEXT_TRANSFER		 0x42
    529 #define	  SMS_CC_END_TRANSFER		 0x43
    530 #define	  SMS_CC_START_RECEIVE		 0x44
    531 #define	  SMS_CC_NEXT_RECEIVE		 0x45
    532 #define	  SMS_CC_END_RECEIVE		 0x46
    533 #define	  SMS_CC_TRANSFER_ABORT		 0x47
    534 
    535 #define	  SMS_SC_READY			 0xc0
    536 #define	  SMS_SC_WRITE_START		 0xc1
    537 #define	  SMS_SC_WRITE_NEXT		 0xc2
    538 #define	  SMS_SC_WRITE_END		 0xc3
    539 #define	  SMS_SC_READ_START		 0xc4
    540 #define	  SMS_SC_READ_NEXT		 0xc5
    541 #define	  SMS_SC_READ_END		 0xc6
    542 
    543 #define _SMIC_FLAG_REG			2
    544 #define	  SMIC_BUSY			(1L << 0)
    545 #define	  SMIC_SMS_ATN			(1L << 2)
    546 #define	  SMIC_EVT_ATN			(1L << 3)
    547 #define	  SMIC_SMI			(1L << 4)
    548 #define	  SMIC_TX_DATA_RDY		(1L << 6)
    549 #define	  SMIC_RX_DATA_RDY		(1L << 7)
    550 
    551 static int smic_wait(struct ipmi_softc *, uint8_t, uint8_t, const char *);
    552 static int smic_write_cmd_data(struct ipmi_softc *, uint8_t, const uint8_t *);
    553 static int smic_read_data(struct ipmi_softc *, uint8_t *);
    554 
    555 static int
    556 smic_wait(struct ipmi_softc *sc, uint8_t mask, uint8_t val, const char *lbl)
    557 {
    558 	int v;
    559 
    560 	/* Wait for expected flag bits */
    561 	v = bmc_io_wait(sc, _SMIC_FLAG_REG, mask, val, __func__);
    562 	if (v < 0)
    563 		return -1;
    564 
    565 	/* Return current status */
    566 	v = bmc_read(sc, _SMIC_CTRL_REG);
    567 	dbg_printf(99, "%s(%s) = %#.2x\n", __func__, lbl, v);
    568 	return v;
    569 }
    570 
    571 static int
    572 smic_write_cmd_data(struct ipmi_softc *sc, uint8_t cmd, const uint8_t *data)
    573 {
    574 	int	sts, v;
    575 
    576 	dbg_printf(50, "%s: %#.2x %#.2x\n", __func__, cmd, data ? *data : -1);
    577 	sts = smic_wait(sc, SMIC_TX_DATA_RDY | SMIC_BUSY, SMIC_TX_DATA_RDY,
    578 	    "smic_write_cmd_data ready");
    579 	if (sts < 0)
    580 		return sts;
    581 
    582 	bmc_write(sc, _SMIC_CTRL_REG, cmd);
    583 	if (data)
    584 		bmc_write(sc, _SMIC_DATAOUT_REG, *data);
    585 
    586 	/* Toggle BUSY bit, then wait for busy bit to clear */
    587 	v = bmc_read(sc, _SMIC_FLAG_REG);
    588 	bmc_write(sc, _SMIC_FLAG_REG, v | SMIC_BUSY);
    589 
    590 	return smic_wait(sc, SMIC_BUSY, 0, __func__);
    591 }
    592 
    593 static int
    594 smic_read_data(struct ipmi_softc *sc, uint8_t *data)
    595 {
    596 	int sts;
    597 
    598 	sts = smic_wait(sc, SMIC_RX_DATA_RDY | SMIC_BUSY, SMIC_RX_DATA_RDY,
    599 	    __func__);
    600 	if (sts >= 0) {
    601 		*data = bmc_read(sc, _SMIC_DATAIN_REG);
    602 		dbg_printf(50, "%s: %#.2x\n", __func__, *data);
    603 	}
    604 	return sts;
    605 }
    606 
    607 #define ErrStat(a, ...) if (a) printf(__VA_ARGS__);
    608 
    609 static int
    610 smic_sendmsg(struct ipmi_softc *sc, int len, const uint8_t *data)
    611 {
    612 	int sts, idx;
    613 
    614 	sts = smic_write_cmd_data(sc, SMS_CC_START_TRANSFER, &data[0]);
    615 	ErrStat(sts != SMS_SC_WRITE_START, "%s: wstart", __func__);
    616 	for (idx = 1; idx < len - 1; idx++) {
    617 		sts = smic_write_cmd_data(sc, SMS_CC_NEXT_TRANSFER,
    618 		    &data[idx]);
    619 		ErrStat(sts != SMS_SC_WRITE_NEXT, "%s: write", __func__);
    620 	}
    621 	sts = smic_write_cmd_data(sc, SMS_CC_END_TRANSFER, &data[idx]);
    622 	if (sts != SMS_SC_WRITE_END) {
    623 		dbg_printf(50, "%s: %d/%d = %#.2x\n", __func__, idx, len, sts);
    624 		return -1;
    625 	}
    626 
    627 	return 0;
    628 }
    629 
    630 static int
    631 smic_recvmsg(struct ipmi_softc *sc, int maxlen, int *len, uint8_t *data)
    632 {
    633 	int sts, idx;
    634 
    635 	*len = 0;
    636 	sts = smic_wait(sc, SMIC_RX_DATA_RDY, SMIC_RX_DATA_RDY, __func__);
    637 	if (sts < 0)
    638 		return -1;
    639 
    640 	sts = smic_write_cmd_data(sc, SMS_CC_START_RECEIVE, NULL);
    641 	ErrStat(sts != SMS_SC_READ_START, "%s: rstart", __func__);
    642 	for (idx = 0;; ) {
    643 		sts = smic_read_data(sc, &data[idx++]);
    644 		if (sts != SMS_SC_READ_START && sts != SMS_SC_READ_NEXT)
    645 			break;
    646 		smic_write_cmd_data(sc, SMS_CC_NEXT_RECEIVE, NULL);
    647 	}
    648 	ErrStat(sts != SMS_SC_READ_END, "%s: rend", __func__);
    649 
    650 	*len = idx;
    651 
    652 	sts = smic_write_cmd_data(sc, SMS_CC_END_RECEIVE, NULL);
    653 	if (sts != SMS_SC_READY) {
    654 		dbg_printf(50, "%s: %d/%d = %#.2x\n",
    655 		    __func__, idx, maxlen, sts);
    656 		return -1;
    657 	}
    658 
    659 	return 0;
    660 }
    661 
    662 static int
    663 smic_reset(struct ipmi_softc *sc)
    664 {
    665 	return -1;
    666 }
    667 
    668 static int
    669 smic_probe(struct ipmi_softc *sc)
    670 {
    671 	/* Flag register should not be 0xFF on a good system */
    672 	if (bmc_read(sc, _SMIC_FLAG_REG) == 0xFF)
    673 		return -1;
    674 
    675 	return 0;
    676 }
    677 
    678 /*
    679  * KCS interface
    680  */
    681 #define _KCS_DATAIN_REGISTER		0
    682 #define _KCS_DATAOUT_REGISTER		0
    683 #define	  KCS_READ_NEXT			0x68
    684 
    685 #define _KCS_COMMAND_REGISTER		1
    686 #define	  KCS_GET_STATUS		0x60
    687 #define	  KCS_WRITE_START		0x61
    688 #define	  KCS_WRITE_END			0x62
    689 
    690 #define _KCS_STATUS_REGISTER		1
    691 #define	  KCS_OBF			(1L << 0)
    692 #define	  KCS_IBF			(1L << 1)
    693 #define	  KCS_SMS_ATN			(1L << 2)
    694 #define	  KCS_CD			(1L << 3)
    695 #define	  KCS_OEM1			(1L << 4)
    696 #define	  KCS_OEM2			(1L << 5)
    697 #define	  KCS_STATE_MASK		0xc0
    698 #define	    KCS_IDLE_STATE		0x00
    699 #define	    KCS_READ_STATE		0x40
    700 #define	    KCS_WRITE_STATE		0x80
    701 #define	    KCS_ERROR_STATE		0xC0
    702 
    703 static int kcs_wait(struct ipmi_softc *, uint8_t, uint8_t, const char *);
    704 static int kcs_write_cmd(struct ipmi_softc *, uint8_t);
    705 static int kcs_write_data(struct ipmi_softc *, uint8_t);
    706 static int kcs_read_data(struct ipmi_softc *, uint8_t *);
    707 
    708 static int
    709 kcs_wait(struct ipmi_softc *sc, uint8_t mask, uint8_t value, const char *lbl)
    710 {
    711 	int v;
    712 
    713 	v = bmc_io_wait(sc, _KCS_STATUS_REGISTER, mask, value, lbl);
    714 	if (v < 0)
    715 		return v;
    716 
    717 	/* Check if output buffer full, read dummy byte	 */
    718 	if ((v & (KCS_OBF | KCS_STATE_MASK)) == (KCS_OBF | KCS_WRITE_STATE))
    719 		bmc_read(sc, _KCS_DATAIN_REGISTER);
    720 
    721 	/* Check for error state */
    722 	if ((v & KCS_STATE_MASK) == KCS_ERROR_STATE) {
    723 		bmc_write(sc, _KCS_COMMAND_REGISTER, KCS_GET_STATUS);
    724 		while (bmc_read(sc, _KCS_STATUS_REGISTER) & KCS_IBF)
    725 			;
    726 		aprint_error_dev(sc->sc_dev, "error code: %#x\n",
    727 		    bmc_read(sc, _KCS_DATAIN_REGISTER));
    728 	}
    729 
    730 	return v & KCS_STATE_MASK;
    731 }
    732 
    733 static int
    734 kcs_write_cmd(struct ipmi_softc *sc, uint8_t cmd)
    735 {
    736 	/* ASSERT: IBF and OBF are clear */
    737 	dbg_printf(50, "%s: %#.2x\n", __func__, cmd);
    738 	bmc_write(sc, _KCS_COMMAND_REGISTER, cmd);
    739 
    740 	return kcs_wait(sc, KCS_IBF, 0, "write_cmd");
    741 }
    742 
    743 static int
    744 kcs_write_data(struct ipmi_softc *sc, uint8_t data)
    745 {
    746 	/* ASSERT: IBF and OBF are clear */
    747 	dbg_printf(50, "%s: %#.2x\n", __func__, data);
    748 	bmc_write(sc, _KCS_DATAOUT_REGISTER, data);
    749 
    750 	return kcs_wait(sc, KCS_IBF, 0, "write_data");
    751 }
    752 
    753 static int
    754 kcs_read_data(struct ipmi_softc *sc, uint8_t * data)
    755 {
    756 	int sts;
    757 
    758 	sts = kcs_wait(sc, KCS_IBF | KCS_OBF, KCS_OBF, __func__);
    759 	if (sts != KCS_READ_STATE)
    760 		return sts;
    761 
    762 	/* ASSERT: OBF is set read data, request next byte */
    763 	*data = bmc_read(sc, _KCS_DATAIN_REGISTER);
    764 	bmc_write(sc, _KCS_DATAOUT_REGISTER, KCS_READ_NEXT);
    765 
    766 	dbg_printf(50, "%s: %#.2x\n", __func__, *data);
    767 
    768 	return sts;
    769 }
    770 
    771 /* Exported KCS functions */
    772 static int
    773 kcs_sendmsg(struct ipmi_softc *sc, int len, const uint8_t * data)
    774 {
    775 	int idx, sts;
    776 
    777 	/* ASSERT: IBF is clear */
    778 	dbg_dump(50, __func__, len, data);
    779 	sts = kcs_write_cmd(sc, KCS_WRITE_START);
    780 	for (idx = 0; idx < len; idx++) {
    781 		if (idx == len - 1)
    782 			sts = kcs_write_cmd(sc, KCS_WRITE_END);
    783 
    784 		if (sts != KCS_WRITE_STATE)
    785 			break;
    786 
    787 		sts = kcs_write_data(sc, data[idx]);
    788 	}
    789 	if (sts != KCS_READ_STATE) {
    790 		dbg_printf(1, "%s: %d/%d <%#.2x>\n", __func__, idx, len, sts);
    791 		dbg_dump(1, __func__, len, data);
    792 		return -1;
    793 	}
    794 
    795 	return 0;
    796 }
    797 
    798 static int
    799 kcs_recvmsg(struct ipmi_softc *sc, int maxlen, int *rxlen, uint8_t * data)
    800 {
    801 	int idx, sts;
    802 
    803 	for (idx = 0; idx < maxlen; idx++) {
    804 		sts = kcs_read_data(sc, &data[idx]);
    805 		if (sts != KCS_READ_STATE)
    806 			break;
    807 	}
    808 	sts = kcs_wait(sc, KCS_IBF, 0, __func__);
    809 	*rxlen = idx;
    810 	if (sts != KCS_IDLE_STATE) {
    811 		dbg_printf(1, "%s: %d/%d <%#.2x>\n",
    812 		    __func__, idx, maxlen, sts);
    813 		return -1;
    814 	}
    815 
    816 	dbg_dump(50, __func__, idx, data);
    817 
    818 	return 0;
    819 }
    820 
    821 static int
    822 kcs_reset(struct ipmi_softc *sc)
    823 {
    824 	return -1;
    825 }
    826 
    827 static int
    828 kcs_probe(struct ipmi_softc *sc)
    829 {
    830 	uint8_t v;
    831 
    832 	v = bmc_read(sc, _KCS_STATUS_REGISTER);
    833 #if 0
    834 	printf("%s: %2x\n", __func__, v);
    835 	printf(" STS: %2x\n", v & KCS_STATE_MASK);
    836 	printf(" ATN: %2x\n", v & KCS_SMS_ATN);
    837 	printf(" C/D: %2x\n", v & KCS_CD);
    838 	printf(" IBF: %2x\n", v & KCS_IBF);
    839 	printf(" OBF: %2x\n", v & KCS_OBF);
    840 #else
    841 	__USE(v);
    842 #endif
    843 	return 0;
    844 }
    845 
    846 /*
    847  * IPMI code
    848  */
    849 #define READ_SMS_BUFFER		0x37
    850 #define WRITE_I2C		0x50
    851 
    852 #define GET_MESSAGE_CMD		0x33
    853 #define SEND_MESSAGE_CMD	0x34
    854 
    855 #define IPMB_CHANNEL_NUMBER	0
    856 
    857 #define PUBLIC_BUS		0
    858 
    859 #define MIN_I2C_PACKET_SIZE	3
    860 #define MIN_IMB_PACKET_SIZE	7	/* one byte for cksum */
    861 
    862 #define MIN_BTBMC_REQ_SIZE	4
    863 #define MIN_BTBMC_RSP_SIZE	5
    864 #define MIN_BMC_REQ_SIZE	2
    865 #define MIN_BMC_RSP_SIZE	3
    866 
    867 #define BMC_SA			0x20	/* BMC/ESM3 */
    868 #define FPC_SA			0x22	/* front panel */
    869 #define BP_SA			0xC0	/* Primary Backplane */
    870 #define BP2_SA			0xC2	/* Secondary Backplane */
    871 #define PBP_SA			0xC4	/* Peripheral Backplane */
    872 #define DRAC_SA			0x28	/* DRAC-III */
    873 #define DRAC3_SA		0x30	/* DRAC-III */
    874 #define BMC_LUN			0
    875 #define SMS_LUN			2
    876 
    877 struct ipmi_request {
    878 	uint8_t	rsSa;
    879 	uint8_t	rsLun;
    880 	uint8_t	netFn;
    881 	uint8_t	cmd;
    882 	uint8_t	data_len;
    883 	uint8_t	*data;
    884 };
    885 
    886 struct ipmi_response {
    887 	uint8_t	cCode;
    888 	uint8_t	data_len;
    889 	uint8_t	*data;
    890 };
    891 
    892 struct ipmi_bmc_request {
    893 	uint8_t	bmc_nfLn;
    894 	uint8_t	bmc_cmd;
    895 	uint8_t	bmc_data_len;
    896 	uint8_t	bmc_data[1];
    897 };
    898 
    899 struct ipmi_bmc_response {
    900 	uint8_t	bmc_nfLn;
    901 	uint8_t	bmc_cmd;
    902 	uint8_t	bmc_cCode;
    903 	uint8_t	bmc_data_len;
    904 	uint8_t	bmc_data[1];
    905 };
    906 
    907 
    908 CFATTACH_DECL2_NEW(ipmi, sizeof(struct ipmi_softc),
    909     ipmi_match, ipmi_attach, ipmi_detach, NULL, NULL, NULL);
    910 
    911 static void
    912 dumpb(const char *lbl, int len, const uint8_t *data)
    913 {
    914 	int idx;
    915 
    916 	printf("%s: ", lbl);
    917 	for (idx = 0; idx < len; idx++)
    918 		printf("%.2x ", data[idx]);
    919 
    920 	printf("\n");
    921 }
    922 
    923 /*
    924  * bt_buildmsg builds an IPMI message from a nfLun, cmd, and data
    925  * This is used by BT protocol
    926  *
    927  * Returns a buffer to an allocated message, txlen contains length
    928  *   of allocated message
    929  */
    930 static void *
    931 bt_buildmsg(struct ipmi_softc *sc, int nfLun, int cmd, int len,
    932     const void *data, int *txlen)
    933 {
    934 	uint8_t *buf;
    935 
    936 	/* Block transfer needs 4 extra bytes: length/netfn/seq/cmd + data */
    937 	*txlen = len + 4;
    938 	buf = ipmi_buf_acquire(sc, *txlen);
    939 	if (buf == NULL)
    940 		return NULL;
    941 
    942 	buf[IPMI_BTMSG_LEN] = len + 3;
    943 	buf[IPMI_BTMSG_NFLN] = nfLun;
    944 	buf[IPMI_BTMSG_SEQ] = sc->sc_btseq++;
    945 	buf[IPMI_BTMSG_CMD] = cmd;
    946 	if (len && data)
    947 		memcpy(buf + IPMI_BTMSG_DATASND, data, len);
    948 
    949 	return buf;
    950 }
    951 
    952 /*
    953  * cmn_buildmsg builds an IPMI message from a nfLun, cmd, and data
    954  * This is used by both SMIC and KCS protocols
    955  *
    956  * Returns a buffer to an allocated message, txlen contains length
    957  *   of allocated message
    958  */
    959 static void *
    960 cmn_buildmsg(struct ipmi_softc *sc, int nfLun, int cmd, int len,
    961     const void *data, int *txlen)
    962 {
    963 	uint8_t *buf;
    964 
    965 	/* Common needs two extra bytes: nfLun/cmd + data */
    966 	*txlen = len + 2;
    967 	buf = ipmi_buf_acquire(sc, *txlen);
    968 	if (buf == NULL)
    969 		return NULL;
    970 
    971 	buf[IPMI_MSG_NFLN] = nfLun;
    972 	buf[IPMI_MSG_CMD] = cmd;
    973 	if (len && data)
    974 		memcpy(buf + IPMI_MSG_DATASND, data, len);
    975 
    976 	return buf;
    977 }
    978 
    979 /*
    980  * ipmi_sendcmd: caller must hold sc_cmd_mtx.
    981  *
    982  * Send an IPMI command
    983  */
    984 static int
    985 ipmi_sendcmd(struct ipmi_softc *sc, int rssa, int rslun, int netfn, int cmd,
    986     int txlen, const void *data)
    987 {
    988 	uint8_t	*buf;
    989 	int		rc = -1;
    990 
    991 	dbg_printf(50, "%s: rssa=%#.2x nfln=%#.2x cmd=%#.2x len=%#.2x\n",
    992 	    __func__, rssa, NETFN_LUN(netfn, rslun), cmd, txlen);
    993 	dbg_dump(10, __func__, txlen, data);
    994 	if (rssa != BMC_SA) {
    995 #if 0
    996 		buf = sc->sc_if->buildmsg(sc, NETFN_LUN(APP_NETFN, BMC_LUN),
    997 		    APP_SEND_MESSAGE, 7 + txlen, NULL, &txlen);
    998 		pI2C->bus = (sc->if_ver == 0x09) ?
    999 		    PUBLIC_BUS :
   1000 		    IPMB_CHANNEL_NUMBER;
   1001 
   1002 		imbreq->rsSa = rssa;
   1003 		imbreq->nfLn = NETFN_LUN(netfn, rslun);
   1004 		imbreq->cSum1 = -(imbreq->rsSa + imbreq->nfLn);
   1005 		imbreq->rqSa = BMC_SA;
   1006 		imbreq->seqLn = NETFN_LUN(sc->imb_seq++, SMS_LUN);
   1007 		imbreq->cmd = cmd;
   1008 		if (txlen)
   1009 			memcpy(imbreq->data, data, txlen);
   1010 		/* Set message checksum */
   1011 		imbreq->data[txlen] = cksum8(&imbreq->rqSa, txlen + 3);
   1012 #endif
   1013 		goto done;
   1014 	} else
   1015 		buf = sc->sc_if->buildmsg(sc, NETFN_LUN(netfn, rslun), cmd,
   1016 		    txlen, data, &txlen);
   1017 
   1018 	if (buf == NULL) {
   1019 		aprint_error_dev(sc->sc_dev, "sendcmd buffer busy\n");
   1020 		goto done;
   1021 	}
   1022 	rc = sc->sc_if->sendmsg(sc, txlen, buf);
   1023 	ipmi_buf_release(sc, buf);
   1024 
   1025 	ipmi_delay(sc, 50); /* give bmc chance to digest command */
   1026 
   1027 done:
   1028 	return rc;
   1029 }
   1030 
   1031 static void
   1032 ipmi_buf_release(struct ipmi_softc *sc, char *buf)
   1033 {
   1034 	KASSERT(sc->sc_buf_rsvd);
   1035 	KASSERT(sc->sc_buf == buf);
   1036 	sc->sc_buf_rsvd = false;
   1037 }
   1038 
   1039 static char *
   1040 ipmi_buf_acquire(struct ipmi_softc *sc, size_t len)
   1041 {
   1042 	KASSERT(len <= sizeof(sc->sc_buf));
   1043 
   1044 	if (sc->sc_buf_rsvd || len > sizeof(sc->sc_buf))
   1045 		return NULL;
   1046 	sc->sc_buf_rsvd = true;
   1047 	return sc->sc_buf;
   1048 }
   1049 
   1050 /*
   1051  * ipmi_recvcmd: caller must hold sc_cmd_mtx.
   1052  */
   1053 static int
   1054 ipmi_recvcmd(struct ipmi_softc *sc, int maxlen, int *rxlen, void *data)
   1055 {
   1056 	uint8_t	*buf, rc = 0;
   1057 	int		rawlen;
   1058 
   1059 	/* Need three extra bytes: netfn/cmd/ccode + data */
   1060 	buf = ipmi_buf_acquire(sc, maxlen + 3);
   1061 	if (buf == NULL) {
   1062 		aprint_error_dev(sc->sc_dev, "%s: malloc fails\n", __func__);
   1063 		return -1;
   1064 	}
   1065 	/* Receive message from interface, copy out result data */
   1066 	if (sc->sc_if->recvmsg(sc, maxlen + 3, &rawlen, buf)) {
   1067 		ipmi_buf_release(sc, buf);
   1068 		return -1;
   1069 	}
   1070 
   1071 	*rxlen = rawlen >= IPMI_MSG_DATARCV ? rawlen - IPMI_MSG_DATARCV : 0;
   1072 	if (*rxlen > 0 && data)
   1073 		memcpy(data, buf + IPMI_MSG_DATARCV, *rxlen);
   1074 
   1075 	if ((rc = buf[IPMI_MSG_CCODE]) != 0)
   1076 		dbg_printf(1, "%s: nfln=%#.2x cmd=%#.2x err=%#.2x\n", __func__,
   1077 		    buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD], buf[IPMI_MSG_CCODE]);
   1078 
   1079 	dbg_printf(50, "%s: nfln=%#.2x cmd=%#.2x err=%#.2x len=%#.2x\n",
   1080 	    __func__, buf[IPMI_MSG_NFLN], buf[IPMI_MSG_CMD],
   1081 	    buf[IPMI_MSG_CCODE], *rxlen);
   1082 	dbg_dump(10, __func__, *rxlen, data);
   1083 
   1084 	ipmi_buf_release(sc, buf);
   1085 
   1086 	return rc;
   1087 }
   1088 
   1089 /*
   1090  * ipmi_delay: caller must hold sc_cmd_mtx.
   1091  */
   1092 static void
   1093 ipmi_delay(struct ipmi_softc *sc, int ms)
   1094 {
   1095 	if (cold) {
   1096 		delay(ms * 1000);
   1097 		return;
   1098 	}
   1099 	mutex_enter(&sc->sc_sleep_mtx);
   1100 	cv_timedwait(&sc->sc_cmd_sleep, &sc->sc_sleep_mtx, mstohz(ms));
   1101 	mutex_exit(&sc->sc_sleep_mtx);
   1102 }
   1103 
   1104 /* Read a partial SDR entry */
   1105 static int
   1106 get_sdr_partial(struct ipmi_softc *sc, uint16_t recordId, uint16_t reserveId,
   1107     uint8_t offset, uint8_t length, void *buffer, uint16_t *nxtRecordId)
   1108 {
   1109 	union {
   1110 		struct {
   1111 			uint16_t	reserveId;
   1112 			uint16_t	recordId;
   1113 			uint8_t		offset;
   1114 			uint8_t		length;
   1115 		} __packed	cmd;
   1116 		struct {
   1117 			uint16_t	nxtRecordId;
   1118 			uint8_t		data[262];
   1119 		} __packed	msg;
   1120 	}		u;
   1121 	int		len;
   1122 
   1123 	__CTASSERT(sizeof(u) == 256 + 8);
   1124 	__CTASSERT(sizeof(u.cmd) == 6);
   1125 	__CTASSERT(offsetof(typeof(u.msg), data) == 2);
   1126 
   1127 	u.cmd.reserveId = reserveId;
   1128 	u.cmd.recordId = recordId;
   1129 	u.cmd.offset = offset;
   1130 	u.cmd.length = length;
   1131 	mutex_enter(&sc->sc_cmd_mtx);
   1132 	if (ipmi_sendcmd(sc, BMC_SA, 0, STORAGE_NETFN, STORAGE_GET_SDR,
   1133 		sizeof(u.cmd), &u.cmd)) {
   1134 		mutex_exit(&sc->sc_cmd_mtx);
   1135 		aprint_error_dev(sc->sc_dev, "%s: sendcmd fails\n", __func__);
   1136 		return -1;
   1137 	}
   1138 	if (ipmi_recvcmd(sc, 8 + length, &len, &u.msg)) {
   1139 		mutex_exit(&sc->sc_cmd_mtx);
   1140 		aprint_error_dev(sc->sc_dev, "%s: recvcmd fails\n", __func__);
   1141 		return -1;
   1142 	}
   1143 	mutex_exit(&sc->sc_cmd_mtx);
   1144 	if (nxtRecordId)
   1145 		*nxtRecordId = u.msg.nxtRecordId;
   1146 	memcpy(buffer, u.msg.data, len - offsetof(typeof(u.msg), data));
   1147 
   1148 	return 0;
   1149 }
   1150 
   1151 static int maxsdrlen = 0x10;
   1152 
   1153 /* Read an entire SDR; pass to add sensor */
   1154 static int
   1155 get_sdr(struct ipmi_softc *sc, uint16_t recid, uint16_t *nxtrec)
   1156 {
   1157 	uint16_t	resid = 0;
   1158 	int		len, sdrlen, offset;
   1159 	uint8_t	*psdr;
   1160 	struct sdrhdr	shdr;
   1161 
   1162 	mutex_enter(&sc->sc_cmd_mtx);
   1163 	/* Reserve SDR */
   1164 	if (ipmi_sendcmd(sc, BMC_SA, 0, STORAGE_NETFN, STORAGE_RESERVE_SDR,
   1165 	    0, NULL)) {
   1166 		mutex_exit(&sc->sc_cmd_mtx);
   1167 		aprint_error_dev(sc->sc_dev, "reserve send fails\n");
   1168 		return -1;
   1169 	}
   1170 	if (ipmi_recvcmd(sc, sizeof(resid), &len, &resid)) {
   1171 		mutex_exit(&sc->sc_cmd_mtx);
   1172 		aprint_error_dev(sc->sc_dev, "reserve recv fails\n");
   1173 		return -1;
   1174 	}
   1175 	mutex_exit(&sc->sc_cmd_mtx);
   1176 	/* Get SDR Header */
   1177 	if (get_sdr_partial(sc, recid, resid, 0, sizeof shdr, &shdr, nxtrec)) {
   1178 		aprint_error_dev(sc->sc_dev, "get header fails\n");
   1179 		return -1;
   1180 	}
   1181 	/* Allocate space for entire SDR Length of SDR in header does not
   1182 	 * include header length */
   1183 	sdrlen = sizeof(shdr) + shdr.record_length;
   1184 	psdr = malloc(sdrlen, M_DEVBUF, M_WAITOK);
   1185 	if (psdr == NULL)
   1186 		return -1;
   1187 
   1188 	memcpy(psdr, &shdr, sizeof(shdr));
   1189 
   1190 	/* Read SDR Data maxsdrlen bytes at a time */
   1191 	for (offset = sizeof(shdr); offset < sdrlen; offset += maxsdrlen) {
   1192 		len = sdrlen - offset;
   1193 		if (len > maxsdrlen)
   1194 			len = maxsdrlen;
   1195 
   1196 		if (get_sdr_partial(sc, recid, resid, offset, len,
   1197 		    psdr + offset, NULL)) {
   1198 			aprint_error_dev(sc->sc_dev,
   1199 			    "get chunk : %d,%d fails\n", offset, len);
   1200 			free(psdr, M_DEVBUF);
   1201 			return -1;
   1202 		}
   1203 	}
   1204 
   1205 	/* Add SDR to sensor list, if not wanted, free buffer */
   1206 	if (add_sdr_sensor(sc, psdr) == 0)
   1207 		free(psdr, M_DEVBUF);
   1208 
   1209 	return 0;
   1210 }
   1211 
   1212 static int
   1213 getbits(uint8_t *bytes, int bitpos, int bitlen)
   1214 {
   1215 	int	v;
   1216 	int	mask;
   1217 
   1218 	bitpos += bitlen - 1;
   1219 	for (v = 0; bitlen--;) {
   1220 		v <<= 1;
   1221 		mask = 1L << (bitpos & 7);
   1222 		if (bytes[bitpos >> 3] & mask)
   1223 			v |= 1;
   1224 		bitpos--;
   1225 	}
   1226 
   1227 	return v;
   1228 }
   1229 
   1230 /* Decode IPMI sensor name */
   1231 static void
   1232 ipmi_sensor_name(char *name, int len, uint8_t typelen, uint8_t *bits)
   1233 {
   1234 	int	i, slen;
   1235 	char	bcdplus[] = "0123456789 -.:,_";
   1236 
   1237 	slen = typelen & 0x1F;
   1238 	switch (typelen >> 6) {
   1239 	case IPMI_NAME_UNICODE:
   1240 		//unicode
   1241 		break;
   1242 
   1243 	case IPMI_NAME_BCDPLUS:
   1244 		/* Characters are encoded in 4-bit BCDPLUS */
   1245 		if (len < slen * 2 + 1)
   1246 			slen = (len >> 1) - 1;
   1247 		for (i = 0; i < slen; i++) {
   1248 			*(name++) = bcdplus[bits[i] >> 4];
   1249 			*(name++) = bcdplus[bits[i] & 0xF];
   1250 		}
   1251 		break;
   1252 
   1253 	case IPMI_NAME_ASCII6BIT:
   1254 		/* Characters are encoded in 6-bit ASCII
   1255 		 *   0x00 - 0x3F maps to 0x20 - 0x5F */
   1256 		/* XXX: need to calculate max len: slen = 3/4 * len */
   1257 		if (len < slen + 1)
   1258 			slen = len - 1;
   1259 		for (i = 0; i < slen * 8; i += 6)
   1260 			*(name++) = getbits(bits, i, 6) + ' ';
   1261 		break;
   1262 
   1263 	case IPMI_NAME_ASCII8BIT:
   1264 		/* Characters are 8-bit ascii */
   1265 		if (len < slen + 1)
   1266 			slen = len - 1;
   1267 		while (slen--)
   1268 			*(name++) = *(bits++);
   1269 		break;
   1270 	}
   1271 	*name = 0;
   1272 }
   1273 
   1274 /* Sign extend a n-bit value */
   1275 static long
   1276 signextend(unsigned long val, int bits)
   1277 {
   1278 	long msk = (1L << (bits-1))-1;
   1279 
   1280 	return -(val & ~msk) | val;
   1281 }
   1282 
   1283 
   1284 /* fixpoint arithmetic */
   1285 #define FIX2INT(x)   ((int64_t)((x) >> 32))
   1286 #define INT2FIX(x)   ((int64_t)((uint64_t)(x) << 32))
   1287 
   1288 #define FIX2            0x0000000200000000ll /* 2.0 */
   1289 #define FIX3            0x0000000300000000ll /* 3.0 */
   1290 #define FIXE            0x00000002b7e15163ll /* 2.71828182845904523536 */
   1291 #define FIX10           0x0000000a00000000ll /* 10.0 */
   1292 #define FIXMONE         0xffffffff00000000ll /* -1.0 */
   1293 #define FIXHALF         0x0000000080000000ll /* 0.5 */
   1294 #define FIXTHIRD        0x0000000055555555ll /* 0.33333333333333333333 */
   1295 
   1296 #define FIX1LOG2        0x0000000171547653ll /* 1.0/log(2) */
   1297 #define FIX1LOGE        0x0000000100000000ll /* 1.0/log(2.71828182845904523536) */
   1298 #define FIX1LOG10       0x000000006F2DEC55ll /* 1.0/log(10) */
   1299 
   1300 #define FIX1E           0x000000005E2D58D9ll /* 1.0/2.71828182845904523536 */
   1301 
   1302 static int64_t fixlog_a[] = {
   1303 	0x0000000100000000ll /* 1.0/1.0 */,
   1304 	0xffffffff80000000ll /* -1.0/2.0 */,
   1305 	0x0000000055555555ll /* 1.0/3.0 */,
   1306 	0xffffffffc0000000ll /* -1.0/4.0 */,
   1307 	0x0000000033333333ll /* 1.0/5.0 */,
   1308 	0x000000002aaaaaabll /* -1.0/6.0 */,
   1309 	0x0000000024924925ll /* 1.0/7.0 */,
   1310 	0x0000000020000000ll /* -1.0/8.0 */,
   1311 	0x000000001c71c71cll /* 1.0/9.0 */
   1312 };
   1313 
   1314 static int64_t fixexp_a[] = {
   1315 	0x0000000100000000ll /* 1.0/1.0 */,
   1316 	0x0000000100000000ll /* 1.0/1.0 */,
   1317 	0x0000000080000000ll /* 1.0/2.0 */,
   1318 	0x000000002aaaaaabll /* 1.0/6.0 */,
   1319 	0x000000000aaaaaabll /* 1.0/24.0 */,
   1320 	0x0000000002222222ll /* 1.0/120.0 */,
   1321 	0x00000000005b05b0ll /* 1.0/720.0 */,
   1322 	0x00000000000d00d0ll /* 1.0/5040.0 */,
   1323 	0x000000000001a01all /* 1.0/40320.0 */
   1324 };
   1325 
   1326 static int64_t
   1327 fixmul(int64_t x, int64_t y)
   1328 {
   1329 	int64_t z;
   1330 	int64_t a,b,c,d;
   1331 	int neg;
   1332 
   1333 	neg = 0;
   1334 	if (x < 0) {
   1335 		x = -x;
   1336 		neg = !neg;
   1337 	}
   1338 	if (y < 0) {
   1339 		y = -y;
   1340 		neg = !neg;
   1341 	}
   1342 
   1343 	a = FIX2INT(x);
   1344 	b = x - INT2FIX(a);
   1345 	c = FIX2INT(y);
   1346 	d = y - INT2FIX(c);
   1347 
   1348 	z = INT2FIX(a*c) + a * d + b * c + (b/2 * d/2 >> 30);
   1349 
   1350 	return neg ? -z : z;
   1351 }
   1352 
   1353 static int64_t
   1354 poly(int64_t x0, int64_t x, int64_t a[], int n)
   1355 {
   1356 	int64_t z;
   1357 	int i;
   1358 
   1359 	z  = fixmul(x0, a[0]);
   1360 	for (i=1; i<n; ++i) {
   1361 		x0 = fixmul(x0, x);
   1362 		z  = fixmul(x0, a[i]) + z;
   1363 	}
   1364 	return z;
   1365 }
   1366 
   1367 static int64_t
   1368 logx(int64_t x, int64_t y)
   1369 {
   1370 	int64_t z;
   1371 
   1372 	if (x <= INT2FIX(0)) {
   1373 		z = INT2FIX(-99999);
   1374 		goto done;
   1375 	}
   1376 
   1377 	z = INT2FIX(0);
   1378 	while (x >= FIXE) {
   1379 		x = fixmul(x, FIX1E);
   1380 		z += INT2FIX(1);
   1381 	}
   1382 	while (x < INT2FIX(1)) {
   1383 		x = fixmul(x, FIXE);
   1384 		z -= INT2FIX(1);
   1385 	}
   1386 
   1387 	x -= INT2FIX(1);
   1388 	z += poly(x, x, fixlog_a, sizeof(fixlog_a)/sizeof(fixlog_a[0]));
   1389 	z  = fixmul(z, y);
   1390 
   1391 done:
   1392 	return z;
   1393 }
   1394 
   1395 static int64_t
   1396 powx(int64_t x, int64_t y)
   1397 {
   1398 	int64_t k;
   1399 
   1400 	if (x == INT2FIX(0))
   1401 		goto done;
   1402 
   1403 	x = logx(x,y);
   1404 
   1405 	if (x < INT2FIX(0)) {
   1406 		x = INT2FIX(0) - x;
   1407 		k = -FIX2INT(x);
   1408 		x = INT2FIX(-k) - x;
   1409 	} else {
   1410 		k = FIX2INT(x);
   1411 		x = x - INT2FIX(k);
   1412 	}
   1413 
   1414 	x = poly(INT2FIX(1), x, fixexp_a, sizeof(fixexp_a)/sizeof(fixexp_a[0]));
   1415 
   1416 	while (k < 0) {
   1417 		x = fixmul(x, FIX1E);
   1418 		++k;
   1419 	}
   1420 	while (k > 0) {
   1421 		x = fixmul(x, FIXE);
   1422 		--k;
   1423 	}
   1424 
   1425 done:
   1426 	return x;
   1427 }
   1428 
   1429 /* Convert IPMI reading from sensor factors */
   1430 static long
   1431 ipmi_convert(uint8_t v, struct sdrtype1 *s1, long adj)
   1432 {
   1433 	int64_t	M, B;
   1434 	char	K1, K2;
   1435 	int64_t	val, v1, v2, vs;
   1436 	int sign = (s1->units1 >> 6) & 0x3;
   1437 
   1438 	vs = (sign == 0x1 || sign == 0x2) ? (int8_t)v : v;
   1439 	if ((vs < 0) && (sign == 0x1))
   1440 		vs++;
   1441 
   1442 	/* Calculate linear reading variables */
   1443 	M  = signextend((((short)(s1->m_tolerance & 0xC0)) << 2) + s1->m, 10);
   1444 	B  = signextend((((short)(s1->b_accuracy & 0xC0)) << 2) + s1->b, 10);
   1445 	K1 = signextend(s1->rbexp & 0xF, 4);
   1446 	K2 = signextend(s1->rbexp >> 4, 4);
   1447 
   1448 	/* Calculate sensor reading:
   1449 	 *  y = L((M * v + (B * 10^K1)) * 10^(K2+adj)
   1450 	 *
   1451 	 * This commutes out to:
   1452 	 *  y = L(M*v * 10^(K2+adj) + B * 10^(K1+K2+adj)); */
   1453 	v1 = powx(FIX10, INT2FIX(K2 + adj));
   1454 	v2 = powx(FIX10, INT2FIX(K1 + K2 + adj));
   1455 	val = M * vs * v1 + B * v2;
   1456 
   1457 	/* Linearization function: y = f(x) 0 : y = x 1 : y = ln(x) 2 : y =
   1458 	 * log10(x) 3 : y = log2(x) 4 : y = e^x 5 : y = 10^x 6 : y = 2^x 7 : y
   1459 	 * = 1/x 8 : y = x^2 9 : y = x^3 10 : y = square root(x) 11 : y = cube
   1460 	 * root(x) */
   1461 	switch (s1->linear & 0x7f) {
   1462 	case 0: break;
   1463 	case 1: val = logx(val,FIX1LOGE); break;
   1464 	case 2: val = logx(val,FIX1LOG10); break;
   1465 	case 3: val = logx(val,FIX1LOG2); break;
   1466 	case 4: val = powx(FIXE,val); break;
   1467 	case 5: val = powx(FIX10,val); break;
   1468 	case 6: val = powx(FIX2,val); break;
   1469 	case 7: val = powx(val,FIXMONE); break;
   1470 	case 8: val = powx(val,FIX2); break;
   1471 	case 9: val = powx(val,FIX3); break;
   1472 	case 10: val = powx(val,FIXHALF); break;
   1473 	case 11: val = powx(val,FIXTHIRD); break;
   1474 	}
   1475 
   1476 	return FIX2INT(val);
   1477 }
   1478 
   1479 static int32_t
   1480 ipmi_convert_sensor(uint8_t *reading, struct ipmi_sensor *psensor)
   1481 {
   1482 	struct sdrtype1	*s1 = (struct sdrtype1 *)psensor->i_sdr;
   1483 	int32_t val;
   1484 
   1485 	switch (psensor->i_envtype) {
   1486 	case ENVSYS_STEMP:
   1487 		val = ipmi_convert(reading[0], s1, 6) + 273150000;
   1488 		break;
   1489 
   1490 	case ENVSYS_SVOLTS_DC:
   1491 		val = ipmi_convert(reading[0], s1, 6);
   1492 		break;
   1493 
   1494 	case ENVSYS_SFANRPM:
   1495 		val = ipmi_convert(reading[0], s1, 0);
   1496 		if (((s1->units1>>3)&0x7) == 0x3)
   1497 			val *= 60; /* RPS -> RPM */
   1498 		break;
   1499 	default:
   1500 		val = 0;
   1501 		break;
   1502 	}
   1503 	return val;
   1504 }
   1505 
   1506 static void
   1507 ipmi_set_limits(struct sysmon_envsys *sme, envsys_data_t *edata,
   1508 		sysmon_envsys_lim_t *limits, uint32_t *props)
   1509 {
   1510 	struct ipmi_sensor *ipmi_s;
   1511 
   1512 	/* Find the ipmi_sensor corresponding to this edata */
   1513 	SLIST_FOREACH(ipmi_s, &ipmi_sensor_list, i_list) {
   1514 		if (ipmi_s->i_envnum == edata->sensor) {
   1515 			if (limits == NULL) {
   1516 				limits = &ipmi_s->i_deflims;
   1517 				props  = &ipmi_s->i_defprops;
   1518 			}
   1519 			*props |= PROP_DRIVER_LIMITS;
   1520 			ipmi_s->i_limits = *limits;
   1521 			ipmi_s->i_props  = *props;
   1522 			return;
   1523 		}
   1524 	}
   1525 	return;
   1526 }
   1527 
   1528 static void
   1529 ipmi_get_limits(struct sysmon_envsys *sme, envsys_data_t *edata,
   1530 		sysmon_envsys_lim_t *limits, uint32_t *props)
   1531 {
   1532 	struct ipmi_sensor *ipmi_s;
   1533 	struct ipmi_softc *sc = sme->sme_cookie;
   1534 
   1535 	/* Find the ipmi_sensor corresponding to this edata */
   1536 	SLIST_FOREACH(ipmi_s, &ipmi_sensor_list, i_list) {
   1537 		if (ipmi_s->i_envnum == edata->sensor) {
   1538 			ipmi_get_sensor_limits(sc, ipmi_s, limits, props);
   1539 			ipmi_s->i_limits = *limits;
   1540 			ipmi_s->i_props  = *props;
   1541 			if (ipmi_s->i_defprops == 0) {
   1542 				ipmi_s->i_defprops = *props;
   1543 				ipmi_s->i_deflims  = *limits;
   1544 			}
   1545 			return;
   1546 		}
   1547 	}
   1548 	return;
   1549 }
   1550 
   1551 /* valid bits for (upper,lower) x (non-recoverable, critical, warn) */
   1552 #define UN	0x20
   1553 #define UC	0x10
   1554 #define UW	0x08
   1555 #define LN	0x04
   1556 #define LC	0x02
   1557 #define LW	0x01
   1558 
   1559 static void
   1560 ipmi_get_sensor_limits(struct ipmi_softc *sc, struct ipmi_sensor *psensor,
   1561 		       sysmon_envsys_lim_t *limits, uint32_t *props)
   1562 {
   1563 	struct sdrtype1	*s1 = (struct sdrtype1 *)psensor->i_sdr;
   1564 	bool failure;
   1565 	int	rxlen;
   1566 	uint8_t	data[32], valid;
   1567 	uint32_t prop_critmax, prop_warnmax, prop_critmin, prop_warnmin;
   1568 	int32_t *pcritmax, *pwarnmax, *pcritmin, *pwarnmin;
   1569 
   1570 	*props &= ~(PROP_CRITMIN | PROP_CRITMAX | PROP_WARNMIN | PROP_WARNMAX);
   1571 	data[0] = psensor->i_num;
   1572 	mutex_enter(&sc->sc_cmd_mtx);
   1573 	failure =
   1574 	    ipmi_sendcmd(sc, s1->owner_id, s1->owner_lun,
   1575 			 SE_NETFN, SE_GET_SENSOR_THRESHOLD, 1, data) ||
   1576 	    ipmi_recvcmd(sc, sizeof(data), &rxlen, data);
   1577 	mutex_exit(&sc->sc_cmd_mtx);
   1578 	if (failure)
   1579 		return;
   1580 
   1581 	dbg_printf(25, "%s: %#.2x %#.2x %#.2x %#.2x %#.2x %#.2x %#.2x\n",
   1582 	    __func__, data[0], data[1], data[2], data[3], data[4], data[5],
   1583 	    data[6]);
   1584 
   1585 	switch (s1->linear & 0x7f) {
   1586 	case 7: /* 1/x sensor, exchange upper and lower limits */
   1587 		prop_critmax = PROP_CRITMIN;
   1588 		prop_warnmax = PROP_WARNMIN;
   1589 		prop_critmin = PROP_CRITMAX;
   1590 		prop_warnmin = PROP_WARNMAX;
   1591 		pcritmax = &limits->sel_critmin;
   1592 		pwarnmax = &limits->sel_warnmin;
   1593 		pcritmin = &limits->sel_critmax;
   1594 		pwarnmin = &limits->sel_warnmax;
   1595 		break;
   1596 	default:
   1597 		prop_critmax = PROP_CRITMAX;
   1598 		prop_warnmax = PROP_WARNMAX;
   1599 		prop_critmin = PROP_CRITMIN;
   1600 		prop_warnmin = PROP_WARNMIN;
   1601 		pcritmax = &limits->sel_critmax;
   1602 		pwarnmax = &limits->sel_warnmax;
   1603 		pcritmin = &limits->sel_critmin;
   1604 		pwarnmin = &limits->sel_warnmin;
   1605 		break;
   1606 	}
   1607 
   1608 	valid = data[0];
   1609 
   1610 	/* if upper non-recoverable < warning, ignore it */
   1611 	if ((valid & (UN|UW)) == (UN|UW) && data[6] < data[4])
   1612 		valid ^= UN;
   1613 	/* if upper critical < warning, ignore it */
   1614 	if ((valid & (UC|UW)) == (UC|UW) && data[5] < data[4])
   1615 		valid ^= UC;
   1616 
   1617 	/* if lower non-recoverable > warning, ignore it */
   1618 	if ((data[0] & (LN|LW)) == (LN|LW) && data[3] > data[1])
   1619 		valid ^= LN;
   1620 	/* if lower critical > warning, ignore it */
   1621 	if ((data[0] & (LC|LW)) == (LC|LW) && data[2] > data[1])
   1622 		valid ^= LC;
   1623 
   1624 	if (valid & UN && data[6] != 0xff) {
   1625 		*pcritmax = ipmi_convert_sensor(&data[6], psensor);
   1626 		*props |= prop_critmax;
   1627 	}
   1628 	if (valid & UC && data[5] != 0xff) {
   1629 		*pcritmax = ipmi_convert_sensor(&data[5], psensor);
   1630 		*props |= prop_critmax;
   1631 	}
   1632 	if (valid & UW && data[4] != 0xff) {
   1633 		*pwarnmax = ipmi_convert_sensor(&data[4], psensor);
   1634 		*props |= prop_warnmax;
   1635 	}
   1636 	if (valid & LN && data[3] != 0x00) {
   1637 		*pcritmin = ipmi_convert_sensor(&data[3], psensor);
   1638 		*props |= prop_critmin;
   1639 	}
   1640 	if (valid & LC && data[2] != 0x00) {
   1641 		*pcritmin = ipmi_convert_sensor(&data[2], psensor);
   1642 		*props |= prop_critmin;
   1643 	}
   1644 	if (valid & LW && data[1] != 0x00) {
   1645 		*pwarnmin = ipmi_convert_sensor(&data[1], psensor);
   1646 		*props |= prop_warnmin;
   1647 	}
   1648 	return;
   1649 }
   1650 
   1651 static int
   1652 ipmi_sensor_status(struct ipmi_softc *sc, struct ipmi_sensor *psensor,
   1653     envsys_data_t *edata, uint8_t *reading)
   1654 {
   1655 	int	etype;
   1656 
   1657 	/* Get reading of sensor */
   1658 	edata->value_cur = ipmi_convert_sensor(reading, psensor);
   1659 
   1660 	/* Return Sensor Status */
   1661 	etype = (psensor->i_etype << 8) + psensor->i_stype;
   1662 	switch (etype) {
   1663 	case IPMI_SENSOR_TYPE_TEMP:
   1664 	case IPMI_SENSOR_TYPE_VOLT:
   1665 	case IPMI_SENSOR_TYPE_FAN:
   1666 		if (psensor->i_props & PROP_CRITMAX &&
   1667 		    edata->value_cur > psensor->i_limits.sel_critmax)
   1668 			return ENVSYS_SCRITOVER;
   1669 
   1670 		if (psensor->i_props & PROP_WARNMAX &&
   1671 		    edata->value_cur > psensor->i_limits.sel_warnmax)
   1672 			return ENVSYS_SWARNOVER;
   1673 
   1674 		if (psensor->i_props & PROP_CRITMIN &&
   1675 		    edata->value_cur < psensor->i_limits.sel_critmin)
   1676 			return ENVSYS_SCRITUNDER;
   1677 
   1678 		if (psensor->i_props & PROP_WARNMIN &&
   1679 		    edata->value_cur < psensor->i_limits.sel_warnmin)
   1680 			return ENVSYS_SWARNUNDER;
   1681 
   1682 		break;
   1683 
   1684 	case IPMI_SENSOR_TYPE_INTRUSION:
   1685 		edata->value_cur = (reading[2] & 1) ? 0 : 1;
   1686 		if (reading[2] & 0x1)
   1687 			return ENVSYS_SCRITICAL;
   1688 		break;
   1689 
   1690 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
   1691 		/* Reading: 1 = present+powered, 0 = otherwise */
   1692 		edata->value_cur = (reading[2] & 1) ? 0 : 1;
   1693 		if (reading[2] & 0x10) {
   1694 			/* XXX: Need envsys type for Power Supply types
   1695 			 *   ok: power supply installed && powered
   1696 			 * warn: power supply installed && !powered
   1697 			 * crit: power supply !installed
   1698 			 */
   1699 			return ENVSYS_SCRITICAL;
   1700 		}
   1701 		if (reading[2] & 0x08) {
   1702 			/* Power supply AC lost */
   1703 			return ENVSYS_SWARNOVER;
   1704 		}
   1705 		break;
   1706 	}
   1707 
   1708 	return ENVSYS_SVALID;
   1709 }
   1710 
   1711 static int
   1712 read_sensor(struct ipmi_softc *sc, struct ipmi_sensor *psensor)
   1713 {
   1714 	struct sdrtype1	*s1 = (struct sdrtype1 *) psensor->i_sdr;
   1715 	uint8_t	data[8];
   1716 	int		rxlen;
   1717 	envsys_data_t *edata = &sc->sc_sensor[psensor->i_envnum];
   1718 
   1719 	memset(data, 0, sizeof(data));
   1720 	data[0] = psensor->i_num;
   1721 
   1722 	mutex_enter(&sc->sc_cmd_mtx);
   1723 	if (ipmi_sendcmd(sc, s1->owner_id, s1->owner_lun, SE_NETFN,
   1724 	    SE_GET_SENSOR_READING, 1, data))
   1725 		goto err;
   1726 
   1727 	if (ipmi_recvcmd(sc, sizeof(data), &rxlen, data))
   1728 		goto err;
   1729 	mutex_exit(&sc->sc_cmd_mtx);
   1730 
   1731 	dbg_printf(10, "m=%u, m_tolerance=%u, b=%u, b_accuracy=%u, "
   1732 	    "rbexp=%u, linear=%d\n", s1->m, s1->m_tolerance, s1->b,
   1733 	    s1->b_accuracy, s1->rbexp, s1->linear);
   1734 	dbg_printf(10, "values=%#.2x %#.2x %#.2x %#.2x %s\n",
   1735 	    data[0],data[1],data[2],data[3], edata->desc);
   1736 	if (IPMI_INVALID_SENSOR_P(data[1])) {
   1737 		/* Check if sensor is valid */
   1738 		edata->state = ENVSYS_SINVALID;
   1739 	} else {
   1740 		edata->state = ipmi_sensor_status(sc, psensor, edata, data);
   1741 	}
   1742 	return 0;
   1743 err:
   1744 	mutex_exit(&sc->sc_cmd_mtx);
   1745 	return -1;
   1746 }
   1747 
   1748 static int
   1749 ipmi_sensor_type(int type, int ext_type, int entity)
   1750 {
   1751 	switch (ext_type << 8L | type) {
   1752 	case IPMI_SENSOR_TYPE_TEMP:
   1753 		return ENVSYS_STEMP;
   1754 
   1755 	case IPMI_SENSOR_TYPE_VOLT:
   1756 		return ENVSYS_SVOLTS_DC;
   1757 
   1758 	case IPMI_SENSOR_TYPE_FAN:
   1759 		return ENVSYS_SFANRPM;
   1760 
   1761 	case IPMI_SENSOR_TYPE_PWRSUPPLY:
   1762 		if (entity == IPMI_ENTITY_PWRSUPPLY)
   1763 			return ENVSYS_INDICATOR;
   1764 		break;
   1765 
   1766 	case IPMI_SENSOR_TYPE_INTRUSION:
   1767 		return ENVSYS_INDICATOR;
   1768 	}
   1769 
   1770 	return -1;
   1771 }
   1772 
   1773 /* Add Sensor to BSD Sysctl interface */
   1774 static int
   1775 add_sdr_sensor(struct ipmi_softc *sc, uint8_t *psdr)
   1776 {
   1777 	int			rc;
   1778 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
   1779 	struct sdrtype2		*s2 = (struct sdrtype2 *)psdr;
   1780 	char			name[64];
   1781 
   1782 	switch (s1->sdrhdr.record_type) {
   1783 	case IPMI_SDR_TYPEFULL:
   1784 		ipmi_sensor_name(name, sizeof(name), s1->typelen, s1->name);
   1785 		rc = add_child_sensors(sc, psdr, 1, s1->sensor_num,
   1786 		    s1->sensor_type, s1->event_code, 0, s1->entity_id, name);
   1787 		break;
   1788 
   1789 	case IPMI_SDR_TYPECOMPACT:
   1790 		ipmi_sensor_name(name, sizeof(name), s2->typelen, s2->name);
   1791 		rc = add_child_sensors(sc, psdr, s2->share1 & 0xF,
   1792 		    s2->sensor_num, s2->sensor_type, s2->event_code,
   1793 		    s2->share2 & 0x7F, s2->entity_id, name);
   1794 		break;
   1795 
   1796 	default:
   1797 		return 0;
   1798 	}
   1799 
   1800 	return rc;
   1801 }
   1802 
   1803 static int
   1804 ipmi_is_dupname(char *name)
   1805 {
   1806 	struct ipmi_sensor *ipmi_s;
   1807 
   1808 	SLIST_FOREACH(ipmi_s, &ipmi_sensor_list, i_list) {
   1809 		if (strcmp(ipmi_s->i_envdesc, name) == 0) {
   1810 			return 1;
   1811 		}
   1812 	}
   1813 	return 0;
   1814 }
   1815 
   1816 static int
   1817 add_child_sensors(struct ipmi_softc *sc, uint8_t *psdr, int count,
   1818     int sensor_num, int sensor_type, int ext_type, int sensor_base,
   1819     int entity, const char *name)
   1820 {
   1821 	int			typ, idx, dupcnt, c;
   1822 	char			*e;
   1823 	struct ipmi_sensor	*psensor;
   1824 	struct sdrtype1		*s1 = (struct sdrtype1 *)psdr;
   1825 
   1826 	typ = ipmi_sensor_type(sensor_type, ext_type, entity);
   1827 	if (typ == -1) {
   1828 		dbg_printf(5, "Unknown sensor type:%#.2x et:%#.2x sn:%#.2x "
   1829 		    "name:%s\n", sensor_type, ext_type, sensor_num, name);
   1830 		return 0;
   1831 	}
   1832 	dupcnt = 0;
   1833 	sc->sc_nsensors += count;
   1834 	for (idx = 0; idx < count; idx++) {
   1835 		psensor = malloc(sizeof(struct ipmi_sensor), M_DEVBUF,
   1836 		    M_WAITOK);
   1837 		if (psensor == NULL)
   1838 			break;
   1839 
   1840 		memset(psensor, 0, sizeof(struct ipmi_sensor));
   1841 
   1842 		/* Initialize BSD Sensor info */
   1843 		psensor->i_sdr = psdr;
   1844 		psensor->i_num = sensor_num + idx;
   1845 		psensor->i_stype = sensor_type;
   1846 		psensor->i_etype = ext_type;
   1847 		psensor->i_envtype = typ;
   1848 		if (count > 1)
   1849 			snprintf(psensor->i_envdesc,
   1850 			    sizeof(psensor->i_envdesc),
   1851 			    "%s - %d", name, sensor_base + idx);
   1852 		else
   1853 			strlcpy(psensor->i_envdesc, name,
   1854 			    sizeof(psensor->i_envdesc));
   1855 
   1856 		/*
   1857 		 * Check for duplicates.  If there are duplicates,
   1858 		 * make sure there is space in the name (if not,
   1859 		 * truncate to make space) for a count (1-99) to
   1860 		 * add to make the name unique.  If we run the
   1861 		 * counter out, just accept the duplicate (@name99)
   1862 		 * for now.
   1863 		 */
   1864 		if (ipmi_is_dupname(psensor->i_envdesc)) {
   1865 			if (strlen(psensor->i_envdesc) >=
   1866 			    sizeof(psensor->i_envdesc) - 3) {
   1867 				e = psensor->i_envdesc +
   1868 				    sizeof(psensor->i_envdesc) - 3;
   1869 			} else {
   1870 				e = psensor->i_envdesc +
   1871 				    strlen(psensor->i_envdesc);
   1872 			}
   1873 			c = psensor->i_envdesc +
   1874 			    sizeof(psensor->i_envdesc) - e;
   1875 			do {
   1876 				dupcnt++;
   1877 				snprintf(e, c, "%d", dupcnt);
   1878 			} while (dupcnt < 100 &&
   1879 			         ipmi_is_dupname(psensor->i_envdesc));
   1880 		}
   1881 
   1882 		dbg_printf(5, "%s: %#.4x %#.2x:%d ent:%#.2x:%#.2x %s\n",
   1883 		    __func__,
   1884 		    s1->sdrhdr.record_id, s1->sensor_type,
   1885 		    typ, s1->entity_id, s1->entity_instance,
   1886 		    psensor->i_envdesc);
   1887 		SLIST_INSERT_HEAD(&ipmi_sensor_list, psensor, i_list);
   1888 	}
   1889 
   1890 	return 1;
   1891 }
   1892 
   1893 #if 0
   1894 /* Interrupt handler */
   1895 static int
   1896 ipmi_intr(void *arg)
   1897 {
   1898 	struct ipmi_softc	*sc = (struct ipmi_softc *)arg;
   1899 	int			v;
   1900 
   1901 	v = bmc_read(sc, _KCS_STATUS_REGISTER);
   1902 	if (v & KCS_OBF)
   1903 		++ipmi_nintr;
   1904 
   1905 	return 0;
   1906 }
   1907 #endif
   1908 
   1909 /* Handle IPMI Timer - reread sensor values */
   1910 static void
   1911 ipmi_refresh_sensors(struct ipmi_softc *sc)
   1912 {
   1913 
   1914 	if (SLIST_EMPTY(&ipmi_sensor_list))
   1915 		return;
   1916 
   1917 	sc->current_sensor = SLIST_NEXT(sc->current_sensor, i_list);
   1918 	if (sc->current_sensor == NULL)
   1919 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
   1920 
   1921 	if (read_sensor(sc, sc->current_sensor)) {
   1922 		dbg_printf(1, "%s: error reading\n", __func__);
   1923 	}
   1924 }
   1925 
   1926 static int
   1927 ipmi_map_regs(struct ipmi_softc *sc, struct ipmi_attach_args *ia)
   1928 {
   1929 	int error;
   1930 
   1931 	sc->sc_if = ipmi_get_if(ia->iaa_if_type);
   1932 	if (sc->sc_if == NULL)
   1933 		return -1;
   1934 
   1935 	if (ia->iaa_if_iotype == 'i')
   1936 		sc->sc_iot = ia->iaa_iot;
   1937 	else
   1938 		sc->sc_iot = ia->iaa_memt;
   1939 
   1940 	sc->sc_if_rev = ia->iaa_if_rev;
   1941 	sc->sc_if_iospacing = ia->iaa_if_iospacing;
   1942 	if ((error = bus_space_map(sc->sc_iot, ia->iaa_if_iobase,
   1943 	    sc->sc_if->nregs * sc->sc_if_iospacing, 0, &sc->sc_ioh)) != 0) {
   1944 		const char *xname = sc->sc_dev ? device_xname(sc->sc_dev) :
   1945 		    "ipmi0";
   1946 		aprint_error("%s: %s:bus_space_map(..., %" PRIx64 ", %x"
   1947 		    ", 0, %p) type %c failed %d\n",
   1948 		    xname, __func__, (uint64_t)ia->iaa_if_iobase,
   1949 		    sc->sc_if->nregs * sc->sc_if_iospacing, &sc->sc_ioh,
   1950 		    ia->iaa_if_iotype, error);
   1951 		return -1;
   1952 	}
   1953 #if 0
   1954 	if (iaa->if_if_irq != -1)
   1955 		sc->ih = isa_intr_establish(-1, iaa->if_if_irq,
   1956 		    iaa->if_irqlvl, IPL_BIO, ipmi_intr, sc,
   1957 		    device_xname(sc->sc_dev);
   1958 #endif
   1959 	return 0;
   1960 }
   1961 
   1962 static void
   1963 ipmi_unmap_regs(struct ipmi_softc *sc)
   1964 {
   1965 	bus_space_unmap(sc->sc_iot, sc->sc_ioh,
   1966 	    sc->sc_if->nregs * sc->sc_if_iospacing);
   1967 }
   1968 
   1969 static int
   1970 ipmi_match(device_t parent, cfdata_t cf, void *aux)
   1971 {
   1972 	struct ipmi_softc sc;
   1973 	struct ipmi_attach_args *ia = aux;
   1974 	int			rv = 0;
   1975 
   1976 	memset(&sc, 0, sizeof(sc));
   1977 
   1978 	/* Map registers */
   1979 	if (ipmi_map_regs(&sc, ia) != 0)
   1980 		return 0;
   1981 
   1982 	sc.sc_if->probe(&sc);
   1983 
   1984 	mutex_init(&sc.sc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTCLOCK);
   1985 	cv_init(&sc.sc_cmd_sleep, "ipmimtch");
   1986 
   1987 	if (ipmi_get_device_id(&sc, NULL) == 0)
   1988 		rv = 1;
   1989 
   1990 	cv_destroy(&sc.sc_cmd_sleep);
   1991 	mutex_destroy(&sc.sc_cmd_mtx);
   1992 	ipmi_unmap_regs(&sc);
   1993 
   1994 	return rv;
   1995 }
   1996 
   1997 static void
   1998 ipmi_thread(void *cookie)
   1999 {
   2000 	device_t		self = cookie;
   2001 	struct ipmi_softc	*sc = device_private(self);
   2002 	struct ipmi_attach_args *ia = &sc->sc_ia;
   2003 	uint16_t		rec;
   2004 	struct ipmi_sensor *ipmi_s;
   2005 	struct ipmi_device_id	id;
   2006 	int i;
   2007 
   2008 	sc->sc_thread_running = true;
   2009 
   2010 	/* setup ticker */
   2011 	sc->sc_max_retries = hz * 90; /* 90 seconds max */
   2012 
   2013 	/* Map registers */
   2014 	ipmi_map_regs(sc, ia);
   2015 
   2016 	/* Setup Watchdog timer */
   2017 	sc->sc_wdog.smw_name = device_xname(sc->sc_dev);
   2018 	sc->sc_wdog.smw_cookie = sc;
   2019 	sc->sc_wdog.smw_setmode = ipmi_watchdog_setmode;
   2020 	sc->sc_wdog.smw_tickle = ipmi_watchdog_tickle;
   2021 	sysmon_wdog_register(&sc->sc_wdog);
   2022 
   2023 	/* Set up a power handler so we can possibly sleep */
   2024 	if (!pmf_device_register(self, ipmi_suspend, NULL))
   2025                 aprint_error_dev(self, "couldn't establish a power handler\n");
   2026 
   2027 	/*
   2028 	 * Allow boot to proceed -- we'll do the rest asynchronously
   2029 	 * since it requires talking to the device.
   2030 	 */
   2031 	config_pending_decr(self);
   2032 
   2033 	memset(&id, 0, sizeof(id));
   2034 	if (ipmi_get_device_id(sc, &id))
   2035 		aprint_error_dev(self, "Failed to re-query device ID\n");
   2036 
   2037 	/* Scan SDRs, add sensors to list */
   2038 	for (rec = 0; rec != 0xFFFF;)
   2039 		if (get_sdr(sc, rec, &rec))
   2040 			break;
   2041 
   2042 	/* allocate and fill sensor arrays */
   2043 	sc->sc_sensor = malloc(sizeof(sc->sc_sensor[0]) * sc->sc_nsensors,
   2044 	    M_DEVBUF, M_WAITOK | M_ZERO);
   2045 
   2046 	sc->sc_envsys = sysmon_envsys_create();
   2047 	sc->sc_envsys->sme_cookie = sc;
   2048 	sc->sc_envsys->sme_get_limits = ipmi_get_limits;
   2049 	sc->sc_envsys->sme_set_limits = ipmi_set_limits;
   2050 
   2051 	i = 0;
   2052 	SLIST_FOREACH(ipmi_s, &ipmi_sensor_list, i_list) {
   2053 		ipmi_s->i_props = 0;
   2054 		ipmi_s->i_envnum = -1;
   2055 		sc->sc_sensor[i].units = ipmi_s->i_envtype;
   2056 		sc->sc_sensor[i].state = ENVSYS_SINVALID;
   2057 		sc->sc_sensor[i].flags |= ENVSYS_FHAS_ENTROPY;
   2058 		/*
   2059 		 * Monitor threshold limits in the sensors.
   2060 		 */
   2061 		switch (sc->sc_sensor[i].units) {
   2062 		case ENVSYS_STEMP:
   2063 		case ENVSYS_SVOLTS_DC:
   2064 		case ENVSYS_SFANRPM:
   2065 			sc->sc_sensor[i].flags |= ENVSYS_FMONLIMITS;
   2066 			break;
   2067 		default:
   2068 			sc->sc_sensor[i].flags |= ENVSYS_FMONCRITICAL;
   2069 		}
   2070 		(void)strlcpy(sc->sc_sensor[i].desc, ipmi_s->i_envdesc,
   2071 		    sizeof(sc->sc_sensor[i].desc));
   2072 		++i;
   2073 
   2074 		if (sysmon_envsys_sensor_attach(sc->sc_envsys,
   2075 						&sc->sc_sensor[i-1]))
   2076 			continue;
   2077 
   2078 		/* get reference number from envsys */
   2079 		ipmi_s->i_envnum = sc->sc_sensor[i-1].sensor;
   2080 	}
   2081 
   2082 	sc->sc_envsys->sme_name = device_xname(sc->sc_dev);
   2083 	sc->sc_envsys->sme_flags = SME_DISABLE_REFRESH;
   2084 
   2085 	if (sysmon_envsys_register(sc->sc_envsys)) {
   2086 		aprint_error_dev(self, "unable to register with sysmon\n");
   2087 		sysmon_envsys_destroy(sc->sc_envsys);
   2088 		sc->sc_envsys = NULL;
   2089 	}
   2090 
   2091 	/* initialize sensor list for thread */
   2092 	if (!SLIST_EMPTY(&ipmi_sensor_list))
   2093 		sc->current_sensor = SLIST_FIRST(&ipmi_sensor_list);
   2094 
   2095 	aprint_verbose_dev(self, "version %d.%d interface %s %sbase "
   2096 	    "0x%" PRIx64 "/%#x spacing %d\n",
   2097 	    ia->iaa_if_rev >> 4, ia->iaa_if_rev & 0xF, sc->sc_if->name,
   2098 	    ia->iaa_if_iotype == 'i' ? "io" : "mem",
   2099 	    (uint64_t)ia->iaa_if_iobase,
   2100 	    ia->iaa_if_iospacing * sc->sc_if->nregs, ia->iaa_if_iospacing);
   2101 	if (ia->iaa_if_irq != -1)
   2102 		aprint_verbose_dev(self, " irq %d\n", ia->iaa_if_irq);
   2103 
   2104 	if (id.deviceid != 0) {
   2105 		aprint_normal_dev(self, "ID %u.%u IPMI %x.%x%s%s\n",
   2106 			id.deviceid, (id.revision & 0xf),
   2107 			(id.version & 0xf), (id.version >> 4) & 0xf,
   2108 			(id.fwrev1 & 0x80) ? " Initializing" : " Available",
   2109 			(id.revision & 0x80) ? " +SDRs" : "");
   2110 		if (id.additional != 0)
   2111 			aprint_verbose_dev(self, "Additional%s%s%s%s%s%s%s%s\n",
   2112 				(id.additional & 0x80) ? " Chassis" : "",
   2113 				(id.additional & 0x40) ? " Bridge" : "",
   2114 				(id.additional & 0x20) ? " IPMBGen" : "",
   2115 				(id.additional & 0x10) ? " IPMBRcv" : "",
   2116 				(id.additional & 0x08) ? " FRU" : "",
   2117 				(id.additional & 0x04) ? " SEL" : "",
   2118 				(id.additional & 0x02) ? " SDR" : "",
   2119 				(id.additional & 0x01) ? " Sensor" : "");
   2120 		aprint_verbose_dev(self, "Manufacturer %05x Product %04x\n",
   2121 			(id.manufacturer[2] & 0xf) << 16
   2122 			    | id.manufacturer[1] << 8
   2123 			    | id.manufacturer[0],
   2124 			id.product[1] << 8
   2125 			    | id.manufacturer[0]);
   2126 		aprint_verbose_dev(self, "Firmware %u.%x\n",
   2127 			(id.fwrev1 & 0x7f), id.fwrev2);
   2128 	}
   2129 
   2130 	/* setup flag to exclude iic */
   2131 	ipmi_enabled = 1;
   2132 
   2133 	mutex_enter(&sc->sc_poll_mtx);
   2134 	sc->sc_thread_ready = true;
   2135 	cv_broadcast(&sc->sc_mode_cv);
   2136 	while (sc->sc_thread_running) {
   2137 		while (sc->sc_mode == IPMI_MODE_COMMAND)
   2138 			cv_wait(&sc->sc_mode_cv, &sc->sc_poll_mtx);
   2139 		sc->sc_mode = IPMI_MODE_ENVSYS;
   2140 
   2141 		if (sc->sc_tickle_due) {
   2142 			ipmi_dotickle(sc);
   2143 			sc->sc_tickle_due = false;
   2144 		}
   2145 		ipmi_refresh_sensors(sc);
   2146 
   2147 		sc->sc_mode = IPMI_MODE_IDLE;
   2148 		cv_broadcast(&sc->sc_mode_cv);
   2149 		cv_timedwait(&sc->sc_poll_cv, &sc->sc_poll_mtx,
   2150 		    SENSOR_REFRESH_RATE);
   2151 	}
   2152 	mutex_exit(&sc->sc_poll_mtx);
   2153 	kthread_exit(0);
   2154 }
   2155 
   2156 static void
   2157 ipmi_attach(device_t parent, device_t self, void *aux)
   2158 {
   2159 	struct ipmi_softc	*sc = device_private(self);
   2160 
   2161 	sc->sc_ia = *(struct ipmi_attach_args *)aux;
   2162 	sc->sc_dev = self;
   2163 	aprint_naive("\n");
   2164 	aprint_normal("\n");
   2165 
   2166 	/* lock around read_sensor so that no one messes with the bmc regs */
   2167 	mutex_init(&sc->sc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTCLOCK);
   2168 	mutex_init(&sc->sc_sleep_mtx, MUTEX_DEFAULT, IPL_SOFTCLOCK);
   2169 	cv_init(&sc->sc_cmd_sleep, "ipmicmd");
   2170 
   2171 	mutex_init(&sc->sc_poll_mtx, MUTEX_DEFAULT, IPL_SOFTCLOCK);
   2172 	cv_init(&sc->sc_poll_cv, "ipmipoll");
   2173 	cv_init(&sc->sc_mode_cv, "ipmimode");
   2174 
   2175 	if (kthread_create(PRI_NONE, KTHREAD_MUSTJOIN, NULL, ipmi_thread, self,
   2176 	    &sc->sc_kthread, "%s", device_xname(self)) != 0) {
   2177 		aprint_error_dev(self, "unable to create thread, disabled\n");
   2178 	} else
   2179 		config_pending_incr(self);
   2180 }
   2181 
   2182 static int
   2183 ipmi_detach(device_t self, int flags)
   2184 {
   2185 	struct ipmi_sensor *i;
   2186 	int rc;
   2187 	struct ipmi_softc *sc = device_private(self);
   2188 
   2189 	mutex_enter(&sc->sc_poll_mtx);
   2190 	sc->sc_thread_running = false;
   2191 	cv_signal(&sc->sc_poll_cv);
   2192 	mutex_exit(&sc->sc_poll_mtx);
   2193 	if (sc->sc_kthread)
   2194 		(void)kthread_join(sc->sc_kthread);
   2195 
   2196 	if ((rc = sysmon_wdog_unregister(&sc->sc_wdog)) != 0) {
   2197 		if (rc == ERESTART)
   2198 			rc = EINTR;
   2199 		return rc;
   2200 	}
   2201 
   2202 	/* cancel any pending countdown */
   2203 	sc->sc_wdog.smw_mode &= ~WDOG_MODE_MASK;
   2204 	sc->sc_wdog.smw_mode |= WDOG_MODE_DISARMED;
   2205 	sc->sc_wdog.smw_period = WDOG_PERIOD_DEFAULT;
   2206 
   2207 	if ((rc = ipmi_watchdog_setmode(&sc->sc_wdog)) != 0)
   2208 		return rc;
   2209 
   2210 	ipmi_enabled = 0;
   2211 
   2212 	if (sc->sc_envsys != NULL) {
   2213 		/* _unregister also destroys */
   2214 		sysmon_envsys_unregister(sc->sc_envsys);
   2215 		sc->sc_envsys = NULL;
   2216 	}
   2217 
   2218 	while ((i = SLIST_FIRST(&ipmi_sensor_list)) != NULL) {
   2219 		SLIST_REMOVE_HEAD(&ipmi_sensor_list, i_list);
   2220 		free(i, M_DEVBUF);
   2221 	}
   2222 
   2223 	if (sc->sc_sensor != NULL) {
   2224 		free(sc->sc_sensor, M_DEVBUF);
   2225 		sc->sc_sensor = NULL;
   2226 	}
   2227 
   2228 	ipmi_unmap_regs(sc);
   2229 
   2230 	cv_destroy(&sc->sc_mode_cv);
   2231 	cv_destroy(&sc->sc_poll_cv);
   2232 	mutex_destroy(&sc->sc_poll_mtx);
   2233 	cv_destroy(&sc->sc_cmd_sleep);
   2234 	mutex_destroy(&sc->sc_sleep_mtx);
   2235 	mutex_destroy(&sc->sc_cmd_mtx);
   2236 
   2237 	return 0;
   2238 }
   2239 
   2240 static int
   2241 ipmi_get_device_id(struct ipmi_softc *sc, struct ipmi_device_id *res)
   2242 {
   2243 	uint8_t		buf[32];
   2244 	int		len;
   2245 	int		rc;
   2246 
   2247 	mutex_enter(&sc->sc_cmd_mtx);
   2248 	/* Identify BMC device early to detect lying bios */
   2249 	rc = ipmi_sendcmd(sc, BMC_SA, 0, APP_NETFN, APP_GET_DEVICE_ID, 0, NULL);
   2250 	if (rc) {
   2251 		dbg_printf(1, ": unable to send get device id "
   2252 		    "command\n");
   2253 		goto done;
   2254 	}
   2255 	rc = ipmi_recvcmd(sc, sizeof(buf), &len, buf);
   2256 	if (rc) {
   2257 		dbg_printf(1, ": unable to retrieve device id\n");
   2258 	}
   2259 done:
   2260 	mutex_exit(&sc->sc_cmd_mtx);
   2261 
   2262 	if (rc == 0 && res != NULL)
   2263 		memcpy(res, buf, MIN(sizeof(*res), len));
   2264 
   2265 	return rc;
   2266 }
   2267 
   2268 static int
   2269 ipmi_watchdog_setmode(struct sysmon_wdog *smwdog)
   2270 {
   2271 	struct ipmi_softc	*sc = smwdog->smw_cookie;
   2272 	struct ipmi_get_watchdog gwdog;
   2273 	struct ipmi_set_watchdog swdog;
   2274 	int			rc, len;
   2275 
   2276 	if (smwdog->smw_period < 10)
   2277 		return EINVAL;
   2278 	if (smwdog->smw_period == WDOG_PERIOD_DEFAULT)
   2279 		sc->sc_wdog.smw_period = 10;
   2280 	else
   2281 		sc->sc_wdog.smw_period = smwdog->smw_period;
   2282 
   2283 	/* Wait until the device is initialized */
   2284 	rc = 0;
   2285 	mutex_enter(&sc->sc_poll_mtx);
   2286 	while (sc->sc_thread_ready)
   2287 		rc = cv_wait_sig(&sc->sc_mode_cv, &sc->sc_poll_mtx);
   2288 	mutex_exit(&sc->sc_poll_mtx);
   2289 	if (rc)
   2290 		return rc;
   2291 
   2292 	mutex_enter(&sc->sc_cmd_mtx);
   2293 	/* see if we can properly task to the watchdog */
   2294 	rc = ipmi_sendcmd(sc, BMC_SA, BMC_LUN, APP_NETFN,
   2295 	    APP_GET_WATCHDOG_TIMER, 0, NULL);
   2296 	rc = ipmi_recvcmd(sc, sizeof(gwdog), &len, &gwdog);
   2297 	mutex_exit(&sc->sc_cmd_mtx);
   2298 	if (rc) {
   2299 		aprint_error_dev(sc->sc_dev,
   2300 		    "APP_GET_WATCHDOG_TIMER returned %#x\n", rc);
   2301 		return EIO;
   2302 	}
   2303 
   2304 	memset(&swdog, 0, sizeof(swdog));
   2305 	/* Period is 10ths/sec */
   2306 	swdog.wdog_timeout = htole16(sc->sc_wdog.smw_period * 10);
   2307 	if ((smwdog->smw_mode & WDOG_MODE_MASK) == WDOG_MODE_DISARMED)
   2308 		swdog.wdog_action = IPMI_WDOG_ACT_DISABLED;
   2309 	else
   2310 		swdog.wdog_action = IPMI_WDOG_ACT_RESET;
   2311 	swdog.wdog_use = IPMI_WDOG_USE_USE_OS;
   2312 
   2313 	mutex_enter(&sc->sc_cmd_mtx);
   2314 	if ((rc = ipmi_sendcmd(sc, BMC_SA, BMC_LUN, APP_NETFN,
   2315 	    APP_SET_WATCHDOG_TIMER, sizeof(swdog), &swdog)) == 0)
   2316 		rc = ipmi_recvcmd(sc, 0, &len, NULL);
   2317 	mutex_exit(&sc->sc_cmd_mtx);
   2318 	if (rc) {
   2319 		aprint_error_dev(sc->sc_dev,
   2320 		    "APP_SET_WATCHDOG_TIMER returned %#x\n", rc);
   2321 		return EIO;
   2322 	}
   2323 
   2324 	return 0;
   2325 }
   2326 
   2327 static int
   2328 ipmi_watchdog_tickle(struct sysmon_wdog *smwdog)
   2329 {
   2330 	struct ipmi_softc	*sc = smwdog->smw_cookie;
   2331 
   2332 	mutex_enter(&sc->sc_poll_mtx);
   2333 	sc->sc_tickle_due = true;
   2334 	cv_signal(&sc->sc_poll_cv);
   2335 	mutex_exit(&sc->sc_poll_mtx);
   2336 	return 0;
   2337 }
   2338 
   2339 static void
   2340 ipmi_dotickle(struct ipmi_softc *sc)
   2341 {
   2342 	int			rc, len;
   2343 
   2344 	mutex_enter(&sc->sc_cmd_mtx);
   2345 	/* tickle the watchdog */
   2346 	if ((rc = ipmi_sendcmd(sc, BMC_SA, BMC_LUN, APP_NETFN,
   2347 	    APP_RESET_WATCHDOG, 0, NULL)) == 0)
   2348 		rc = ipmi_recvcmd(sc, 0, &len, NULL);
   2349 	mutex_exit(&sc->sc_cmd_mtx);
   2350 	if (rc != 0) {
   2351 		aprint_error_dev(sc->sc_dev, "watchdog tickle returned %#x\n",
   2352 		    rc);
   2353 	}
   2354 }
   2355 
   2356 static bool
   2357 ipmi_suspend(device_t dev, const pmf_qual_t *qual)
   2358 {
   2359 	struct ipmi_softc *sc = device_private(dev);
   2360 
   2361 	/* Don't allow suspend if watchdog is armed */
   2362 	if ((sc->sc_wdog.smw_mode & WDOG_MODE_MASK) != WDOG_MODE_DISARMED)
   2363 		return false;
   2364 	return true;
   2365 }
   2366 
   2367 static int
   2368 ipmi_open(dev_t dev, int flag, int fmt, lwp_t *l)
   2369 {
   2370 	struct ipmi_softc *sc;
   2371 	int unit;
   2372 
   2373 	unit = IPMIUNIT(dev);
   2374 	if ((sc = device_lookup_private(&ipmi_cd, unit)) == NULL)
   2375 		return (ENXIO);
   2376 
   2377 	return 0;
   2378 }
   2379 
   2380 static int
   2381 ipmi_close(dev_t dev, int flag, int fmt, lwp_t *l)
   2382 {
   2383 	struct ipmi_softc *sc;
   2384 	int unit;
   2385 
   2386 	unit = IPMIUNIT(dev);
   2387 	if ((sc = device_lookup_private(&ipmi_cd, unit)) == NULL)
   2388 		return (ENXIO);
   2389 
   2390 	mutex_enter(&sc->sc_poll_mtx);
   2391 	if (sc->sc_mode == IPMI_MODE_COMMAND) {
   2392 		sc->sc_mode = IPMI_MODE_IDLE;
   2393 		cv_broadcast(&sc->sc_mode_cv);
   2394 	}
   2395 	mutex_exit(&sc->sc_poll_mtx);
   2396 	return 0;
   2397 }
   2398 
   2399 static int
   2400 ipmi_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
   2401 {
   2402 	struct ipmi_softc *sc;
   2403 	int unit, error = 0, len;
   2404 	struct ipmi_req *req;
   2405 	struct ipmi_recv *recv;
   2406 	struct ipmi_addr addr;
   2407 	unsigned char ccode, *buf = NULL;
   2408 
   2409 	unit = IPMIUNIT(dev);
   2410 	if ((sc = device_lookup_private(&ipmi_cd, unit)) == NULL)
   2411 		return (ENXIO);
   2412 
   2413 	switch (cmd) {
   2414 	case IPMICTL_SEND_COMMAND:
   2415 		mutex_enter(&sc->sc_poll_mtx);
   2416 		while (sc->sc_mode == IPMI_MODE_ENVSYS) {
   2417 			error = cv_wait_sig(&sc->sc_mode_cv, &sc->sc_poll_mtx);
   2418 			if (error == EINTR) {
   2419 				mutex_exit(&sc->sc_poll_mtx);
   2420 				return error;
   2421 			}
   2422 		}
   2423 		sc->sc_mode = IPMI_MODE_COMMAND;
   2424 		mutex_exit(&sc->sc_poll_mtx);
   2425 		break;
   2426 	}
   2427 
   2428 	mutex_enter(&sc->sc_cmd_mtx);
   2429 
   2430 	switch (cmd) {
   2431 	case IPMICTL_SEND_COMMAND:
   2432 		req = data;
   2433 		buf = malloc(IPMI_MAX_RX, M_DEVBUF, M_WAITOK);
   2434 
   2435 		len = req->msg.data_len;
   2436 		if (len < 0 || len > IPMI_MAX_RX) {
   2437 			error = EINVAL;
   2438 			break;
   2439 		}
   2440 
   2441 		/* clear pending result */
   2442 		if (sc->sc_sent)
   2443 			(void)ipmi_recvcmd(sc, IPMI_MAX_RX, &len, buf);
   2444 
   2445 		/* XXX */
   2446 		error = copyin(req->addr, &addr, sizeof(addr));
   2447 		if (error)
   2448 			break;
   2449 
   2450 		error = copyin(req->msg.data, buf, len);
   2451 		if (error)
   2452 			break;
   2453 
   2454 		/* save for receive */
   2455 		sc->sc_msgid = req->msgid;
   2456 		sc->sc_netfn = req->msg.netfn;
   2457 		sc->sc_cmd = req->msg.cmd;
   2458 
   2459 		if (ipmi_sendcmd(sc, BMC_SA, 0, req->msg.netfn,
   2460 		    req->msg.cmd, len, buf)) {
   2461 			error = EIO;
   2462 			break;
   2463 		}
   2464 		sc->sc_sent = true;
   2465 		break;
   2466 	case IPMICTL_RECEIVE_MSG_TRUNC:
   2467 	case IPMICTL_RECEIVE_MSG:
   2468 		recv = data;
   2469 		buf = malloc(IPMI_MAX_RX, M_DEVBUF, M_WAITOK);
   2470 
   2471 		if (recv->msg.data_len < 1) {
   2472 			error = EINVAL;
   2473 			break;
   2474 		}
   2475 
   2476 		/* XXX */
   2477 		error = copyin(recv->addr, &addr, sizeof(addr));
   2478 		if (error)
   2479 			break;
   2480 
   2481 
   2482 		if (!sc->sc_sent) {
   2483 			error = EIO;
   2484 			break;
   2485 		}
   2486 
   2487 		len = 0;
   2488 		error = ipmi_recvcmd(sc, IPMI_MAX_RX, &len, buf);
   2489 		if (error < 0) {
   2490 			error = EIO;
   2491 			break;
   2492 		}
   2493 		ccode = (unsigned char)error;
   2494 		sc->sc_sent = false;
   2495 
   2496 		if (len > recv->msg.data_len - 1) {
   2497 			if (cmd == IPMICTL_RECEIVE_MSG) {
   2498 				error = EMSGSIZE;
   2499 				break;
   2500 			}
   2501 			len = recv->msg.data_len - 1;
   2502 		}
   2503 
   2504 		addr.channel = IPMI_BMC_CHANNEL;
   2505 
   2506 		recv->recv_type = IPMI_RESPONSE_RECV_TYPE;
   2507 		recv->msgid = sc->sc_msgid;
   2508 		recv->msg.netfn = sc->sc_netfn;
   2509 		recv->msg.cmd = sc->sc_cmd;
   2510 		recv->msg.data_len = len+1;
   2511 
   2512 		error = copyout(&addr, recv->addr, sizeof(addr));
   2513 		if (error == 0)
   2514 			error = copyout(&ccode, recv->msg.data, 1);
   2515 		if (error == 0)
   2516 			error = copyout(buf, recv->msg.data+1, len);
   2517 		break;
   2518 	case IPMICTL_SET_MY_ADDRESS_CMD:
   2519 		sc->sc_address = *(int *)data;
   2520 		break;
   2521 	case IPMICTL_GET_MY_ADDRESS_CMD:
   2522 		*(int *)data = sc->sc_address;
   2523 		break;
   2524 	case IPMICTL_SET_MY_LUN_CMD:
   2525 		sc->sc_lun = *(int *)data & 0x3;
   2526 		break;
   2527 	case IPMICTL_GET_MY_LUN_CMD:
   2528 		*(int *)data = sc->sc_lun;
   2529 		break;
   2530 	case IPMICTL_SET_GETS_EVENTS_CMD:
   2531 		break;
   2532 	case IPMICTL_REGISTER_FOR_CMD:
   2533 	case IPMICTL_UNREGISTER_FOR_CMD:
   2534 		error = EOPNOTSUPP;
   2535 		break;
   2536 	default:
   2537 		error = ENODEV;
   2538 		break;
   2539 	}
   2540 
   2541 	if (buf)
   2542 		free(buf, M_DEVBUF);
   2543 
   2544 	mutex_exit(&sc->sc_cmd_mtx);
   2545 
   2546 	switch (cmd) {
   2547 	case IPMICTL_RECEIVE_MSG:
   2548 	case IPMICTL_RECEIVE_MSG_TRUNC:
   2549 		mutex_enter(&sc->sc_poll_mtx);
   2550 		sc->sc_mode = IPMI_MODE_IDLE;
   2551 		cv_broadcast(&sc->sc_mode_cv);
   2552 		mutex_exit(&sc->sc_poll_mtx);
   2553 		break;
   2554 	}
   2555 
   2556 	return error;
   2557 }
   2558 
   2559 static int
   2560 ipmi_poll(dev_t dev, int events, lwp_t *l)
   2561 {
   2562 	struct ipmi_softc *sc;
   2563 	int unit, revents = 0;
   2564 
   2565 	unit = IPMIUNIT(dev);
   2566 	if ((sc = device_lookup_private(&ipmi_cd, unit)) == NULL)
   2567 		return (ENXIO);
   2568 
   2569 	mutex_enter(&sc->sc_cmd_mtx);
   2570 	if (events & (POLLIN | POLLRDNORM)) {
   2571 		if (sc->sc_sent)
   2572 			revents |= events & (POLLIN | POLLRDNORM);
   2573 	}
   2574 	mutex_exit(&sc->sc_cmd_mtx);
   2575 
   2576 	return revents;
   2577 }
   2578