xref: /openbmc/qemu/hw/ipmi/ipmi_bmc_sim.c (revision b14df228)
1 /*
2  * IPMI BMC emulation
3  *
4  * Copyright (c) 2015 Corey Minyard, MontaVista Software, LLC
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "sysemu/sysemu.h"
27 #include "qemu/timer.h"
28 #include "hw/ipmi/ipmi.h"
29 #include "qemu/error-report.h"
30 #include "qemu/module.h"
31 #include "hw/loader.h"
32 #include "hw/qdev-properties.h"
33 #include "hw/qdev-properties-system.h"
34 #include "migration/vmstate.h"
35 
36 #define IPMI_NETFN_CHASSIS            0x00
37 
38 #define IPMI_CMD_GET_CHASSIS_CAPABILITIES 0x00
39 #define IPMI_CMD_GET_CHASSIS_STATUS       0x01
40 #define IPMI_CMD_CHASSIS_CONTROL          0x02
41 #define IPMI_CMD_GET_SYS_RESTART_CAUSE    0x09
42 
43 #define IPMI_NETFN_SENSOR_EVENT       0x04
44 
45 #define IPMI_CMD_PLATFORM_EVENT_MSG       0x02
46 #define IPMI_CMD_SET_SENSOR_EVT_ENABLE    0x28
47 #define IPMI_CMD_GET_SENSOR_EVT_ENABLE    0x29
48 #define IPMI_CMD_REARM_SENSOR_EVTS        0x2a
49 #define IPMI_CMD_GET_SENSOR_EVT_STATUS    0x2b
50 #define IPMI_CMD_GET_SENSOR_READING       0x2d
51 #define IPMI_CMD_SET_SENSOR_TYPE          0x2e
52 #define IPMI_CMD_GET_SENSOR_TYPE          0x2f
53 #define IPMI_CMD_SET_SENSOR_READING       0x30
54 
55 /* #define IPMI_NETFN_APP             0x06 In ipmi.h */
56 
57 #define IPMI_CMD_GET_DEVICE_ID            0x01
58 #define IPMI_CMD_COLD_RESET               0x02
59 #define IPMI_CMD_WARM_RESET               0x03
60 #define IPMI_CMD_SET_ACPI_POWER_STATE     0x06
61 #define IPMI_CMD_GET_ACPI_POWER_STATE     0x07
62 #define IPMI_CMD_GET_DEVICE_GUID          0x08
63 #define IPMI_CMD_RESET_WATCHDOG_TIMER     0x22
64 #define IPMI_CMD_SET_WATCHDOG_TIMER       0x24
65 #define IPMI_CMD_GET_WATCHDOG_TIMER       0x25
66 #define IPMI_CMD_SET_BMC_GLOBAL_ENABLES   0x2e
67 #define IPMI_CMD_GET_BMC_GLOBAL_ENABLES   0x2f
68 #define IPMI_CMD_CLR_MSG_FLAGS            0x30
69 #define IPMI_CMD_GET_MSG_FLAGS            0x31
70 #define IPMI_CMD_GET_MSG                  0x33
71 #define IPMI_CMD_SEND_MSG                 0x34
72 #define IPMI_CMD_READ_EVT_MSG_BUF         0x35
73 
74 #define IPMI_NETFN_STORAGE            0x0a
75 
76 #define IPMI_CMD_GET_SDR_REP_INFO         0x20
77 #define IPMI_CMD_GET_SDR_REP_ALLOC_INFO   0x21
78 #define IPMI_CMD_RESERVE_SDR_REP          0x22
79 #define IPMI_CMD_GET_SDR                  0x23
80 #define IPMI_CMD_ADD_SDR                  0x24
81 #define IPMI_CMD_PARTIAL_ADD_SDR          0x25
82 #define IPMI_CMD_DELETE_SDR               0x26
83 #define IPMI_CMD_CLEAR_SDR_REP            0x27
84 #define IPMI_CMD_GET_SDR_REP_TIME         0x28
85 #define IPMI_CMD_SET_SDR_REP_TIME         0x29
86 #define IPMI_CMD_ENTER_SDR_REP_UPD_MODE   0x2A
87 #define IPMI_CMD_EXIT_SDR_REP_UPD_MODE    0x2B
88 #define IPMI_CMD_RUN_INIT_AGENT           0x2C
89 #define IPMI_CMD_GET_FRU_AREA_INFO        0x10
90 #define IPMI_CMD_READ_FRU_DATA            0x11
91 #define IPMI_CMD_WRITE_FRU_DATA           0x12
92 #define IPMI_CMD_GET_SEL_INFO             0x40
93 #define IPMI_CMD_GET_SEL_ALLOC_INFO       0x41
94 #define IPMI_CMD_RESERVE_SEL              0x42
95 #define IPMI_CMD_GET_SEL_ENTRY            0x43
96 #define IPMI_CMD_ADD_SEL_ENTRY            0x44
97 #define IPMI_CMD_PARTIAL_ADD_SEL_ENTRY    0x45
98 #define IPMI_CMD_DELETE_SEL_ENTRY         0x46
99 #define IPMI_CMD_CLEAR_SEL                0x47
100 #define IPMI_CMD_GET_SEL_TIME             0x48
101 #define IPMI_CMD_SET_SEL_TIME             0x49
102 
103 
104 /* Same as a timespec struct. */
105 struct ipmi_time {
106     long tv_sec;
107     long tv_nsec;
108 };
109 
110 #define MAX_SEL_SIZE 128
111 
112 typedef struct IPMISel {
113     uint8_t sel[MAX_SEL_SIZE][16];
114     unsigned int next_free;
115     long time_offset;
116     uint16_t reservation;
117     uint8_t last_addition[4];
118     uint8_t last_clear[4];
119     uint8_t overflow;
120 } IPMISel;
121 
122 #define MAX_SDR_SIZE 16384
123 
124 typedef struct IPMISdr {
125     uint8_t sdr[MAX_SDR_SIZE];
126     unsigned int next_free;
127     uint16_t next_rec_id;
128     uint16_t reservation;
129     uint8_t last_addition[4];
130     uint8_t last_clear[4];
131     uint8_t overflow;
132 } IPMISdr;
133 
134 typedef struct IPMIFru {
135     char *filename;
136     unsigned int nentries;
137     uint16_t areasize;
138     uint8_t *data;
139 } IPMIFru;
140 
141 typedef struct IPMISensor {
142     uint8_t status;
143     uint8_t reading;
144     uint16_t states_suppt;
145     uint16_t assert_suppt;
146     uint16_t deassert_suppt;
147     uint16_t states;
148     uint16_t assert_states;
149     uint16_t deassert_states;
150     uint16_t assert_enable;
151     uint16_t deassert_enable;
152     uint8_t  sensor_type;
153     uint8_t  evt_reading_type_code;
154 } IPMISensor;
155 #define IPMI_SENSOR_GET_PRESENT(s)       ((s)->status & 0x01)
156 #define IPMI_SENSOR_SET_PRESENT(s, v)    ((s)->status = (s->status & ~0x01) | \
157                                              !!(v))
158 #define IPMI_SENSOR_GET_SCAN_ON(s)       ((s)->status & 0x40)
159 #define IPMI_SENSOR_SET_SCAN_ON(s, v)    ((s)->status = (s->status & ~0x40) | \
160                                              ((!!(v)) << 6))
161 #define IPMI_SENSOR_GET_EVENTS_ON(s)     ((s)->status & 0x80)
162 #define IPMI_SENSOR_SET_EVENTS_ON(s, v)  ((s)->status = (s->status & ~0x80) | \
163                                              ((!!(v)) << 7))
164 #define IPMI_SENSOR_GET_RET_STATUS(s)    ((s)->status & 0xc0)
165 #define IPMI_SENSOR_SET_RET_STATUS(s, v) ((s)->status = (s->status & ~0xc0) | \
166                                              (v & 0xc0))
167 #define IPMI_SENSOR_IS_DISCRETE(s) ((s)->evt_reading_type_code != 1)
168 
169 #define MAX_SENSORS 20
170 #define IPMI_WATCHDOG_SENSOR 0
171 
172 #define MAX_NETFNS 64
173 
174 typedef struct IPMIRcvBufEntry {
175     QTAILQ_ENTRY(IPMIRcvBufEntry) entry;
176     uint8_t len;
177     uint8_t buf[MAX_IPMI_MSG_SIZE];
178 } IPMIRcvBufEntry;
179 
180 struct IPMIBmcSim {
181     IPMIBmc parent;
182 
183     QEMUTimer *timer;
184 
185     uint8_t bmc_global_enables;
186     uint8_t msg_flags;
187 
188     bool     watchdog_initialized;
189     uint8_t  watchdog_use;
190     uint8_t  watchdog_action;
191     uint8_t  watchdog_pretimeout; /* In seconds */
192     uint8_t  watchdog_expired;
193     uint16_t watchdog_timeout; /* in 100's of milliseconds */
194 
195     bool     watchdog_running;
196     bool     watchdog_preaction_ran;
197     int64_t  watchdog_expiry;
198 
199     uint8_t device_id;
200     uint8_t ipmi_version;
201     uint8_t device_rev;
202     uint8_t fwrev1;
203     uint8_t fwrev2;
204     uint32_t mfg_id;
205     uint16_t product_id;
206 
207     uint8_t restart_cause;
208 
209     uint8_t acpi_power_state[2];
210     QemuUUID uuid;
211 
212     IPMISel sel;
213     IPMISdr sdr;
214     IPMIFru fru;
215     IPMISensor sensors[MAX_SENSORS];
216     char *sdr_filename;
217 
218     /* Odd netfns are for responses, so we only need the even ones. */
219     const IPMINetfn *netfns[MAX_NETFNS / 2];
220 
221     /* We allow one event in the buffer */
222     uint8_t evtbuf[16];
223 
224     QTAILQ_HEAD(, IPMIRcvBufEntry) rcvbufs;
225 };
226 
227 #define IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK        (1 << 3)
228 #define IPMI_BMC_MSG_FLAG_EVT_BUF_FULL                 (1 << 1)
229 #define IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE                (1 << 0)
230 #define IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK_SET(s) \
231     (IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK & (s)->msg_flags)
232 #define IPMI_BMC_MSG_FLAG_EVT_BUF_FULL_SET(s) \
233     (IPMI_BMC_MSG_FLAG_EVT_BUF_FULL & (s)->msg_flags)
234 #define IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(s) \
235     (IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE & (s)->msg_flags)
236 
237 #define IPMI_BMC_RCV_MSG_QUEUE_INT_BIT    0
238 #define IPMI_BMC_EVBUF_FULL_INT_BIT       1
239 #define IPMI_BMC_EVENT_MSG_BUF_BIT        2
240 #define IPMI_BMC_EVENT_LOG_BIT            3
241 #define IPMI_BMC_MSG_INTS_ON(s) ((s)->bmc_global_enables & \
242                                  (1 << IPMI_BMC_RCV_MSG_QUEUE_INT_BIT))
243 #define IPMI_BMC_EVBUF_FULL_INT_ENABLED(s) ((s)->bmc_global_enables & \
244                                         (1 << IPMI_BMC_EVBUF_FULL_INT_BIT))
245 #define IPMI_BMC_EVENT_LOG_ENABLED(s) ((s)->bmc_global_enables & \
246                                        (1 << IPMI_BMC_EVENT_LOG_BIT))
247 #define IPMI_BMC_EVENT_MSG_BUF_ENABLED(s) ((s)->bmc_global_enables & \
248                                            (1 << IPMI_BMC_EVENT_MSG_BUF_BIT))
249 
250 #define IPMI_BMC_WATCHDOG_USE_MASK 0xc7
251 #define IPMI_BMC_WATCHDOG_ACTION_MASK 0x77
252 #define IPMI_BMC_WATCHDOG_GET_USE(s) ((s)->watchdog_use & 0x7)
253 #define IPMI_BMC_WATCHDOG_GET_DONT_LOG(s) (((s)->watchdog_use >> 7) & 0x1)
254 #define IPMI_BMC_WATCHDOG_GET_DONT_STOP(s) (((s)->watchdog_use >> 6) & 0x1)
255 #define IPMI_BMC_WATCHDOG_GET_PRE_ACTION(s) (((s)->watchdog_action >> 4) & 0x7)
256 #define IPMI_BMC_WATCHDOG_PRE_NONE               0
257 #define IPMI_BMC_WATCHDOG_PRE_SMI                1
258 #define IPMI_BMC_WATCHDOG_PRE_NMI                2
259 #define IPMI_BMC_WATCHDOG_PRE_MSG_INT            3
260 #define IPMI_BMC_WATCHDOG_GET_ACTION(s) ((s)->watchdog_action & 0x7)
261 #define IPMI_BMC_WATCHDOG_ACTION_NONE            0
262 #define IPMI_BMC_WATCHDOG_ACTION_RESET           1
263 #define IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN      2
264 #define IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE     3
265 
266 #define RSP_BUFFER_INITIALIZER { }
267 
268 static inline void rsp_buffer_pushmore(RspBuffer *rsp, uint8_t *bytes,
269                                        unsigned int n)
270 {
271     if (rsp->len + n >= sizeof(rsp->buffer)) {
272         rsp_buffer_set_error(rsp, IPMI_CC_REQUEST_DATA_TRUNCATED);
273         return;
274     }
275 
276     memcpy(&rsp->buffer[rsp->len], bytes, n);
277     rsp->len += n;
278 }
279 
280 static void ipmi_sim_handle_timeout(IPMIBmcSim *ibs);
281 
282 static void ipmi_gettime(struct ipmi_time *time)
283 {
284     int64_t stime;
285 
286     stime = qemu_clock_get_ns(QEMU_CLOCK_HOST);
287     time->tv_sec = stime / 1000000000LL;
288     time->tv_nsec = stime % 1000000000LL;
289 }
290 
291 static int64_t ipmi_getmonotime(void)
292 {
293     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
294 }
295 
296 static void ipmi_timeout(void *opaque)
297 {
298     IPMIBmcSim *ibs = opaque;
299 
300     ipmi_sim_handle_timeout(ibs);
301 }
302 
303 static void set_timestamp(IPMIBmcSim *ibs, uint8_t *ts)
304 {
305     unsigned int val;
306     struct ipmi_time now;
307 
308     ipmi_gettime(&now);
309     val = now.tv_sec + ibs->sel.time_offset;
310     ts[0] = val & 0xff;
311     ts[1] = (val >> 8) & 0xff;
312     ts[2] = (val >> 16) & 0xff;
313     ts[3] = (val >> 24) & 0xff;
314 }
315 
316 static void sdr_inc_reservation(IPMISdr *sdr)
317 {
318     sdr->reservation++;
319     if (sdr->reservation == 0) {
320         sdr->reservation = 1;
321     }
322 }
323 
324 static int sdr_add_entry(IPMIBmcSim *ibs,
325                          const struct ipmi_sdr_header *sdrh_entry,
326                          unsigned int len, uint16_t *recid)
327 {
328     struct ipmi_sdr_header *sdrh =
329         (struct ipmi_sdr_header *) &ibs->sdr.sdr[ibs->sdr.next_free];
330 
331     if ((len < IPMI_SDR_HEADER_SIZE) || (len > 255)) {
332         return 1;
333     }
334 
335     if (ipmi_sdr_length(sdrh_entry) != len) {
336         return 1;
337     }
338 
339     if (ibs->sdr.next_free + len > MAX_SDR_SIZE) {
340         ibs->sdr.overflow = 1;
341         return 1;
342     }
343 
344     memcpy(sdrh, sdrh_entry, len);
345     sdrh->rec_id[0] = ibs->sdr.next_rec_id & 0xff;
346     sdrh->rec_id[1] = (ibs->sdr.next_rec_id >> 8) & 0xff;
347     sdrh->sdr_version = 0x51; /* Conform to IPMI 1.5 spec */
348 
349     if (recid) {
350         *recid = ibs->sdr.next_rec_id;
351     }
352     ibs->sdr.next_rec_id++;
353     set_timestamp(ibs, ibs->sdr.last_addition);
354     ibs->sdr.next_free += len;
355     sdr_inc_reservation(&ibs->sdr);
356     return 0;
357 }
358 
359 static int sdr_find_entry(IPMISdr *sdr, uint16_t recid,
360                           unsigned int *retpos, uint16_t *nextrec)
361 {
362     unsigned int pos = *retpos;
363 
364     while (pos < sdr->next_free) {
365         struct ipmi_sdr_header *sdrh =
366             (struct ipmi_sdr_header *) &sdr->sdr[pos];
367         uint16_t trec = ipmi_sdr_recid(sdrh);
368         unsigned int nextpos = pos + ipmi_sdr_length(sdrh);
369 
370         if (trec == recid) {
371             if (nextrec) {
372                 if (nextpos >= sdr->next_free) {
373                     *nextrec = 0xffff;
374                 } else {
375                     *nextrec = (sdr->sdr[nextpos] |
376                                 (sdr->sdr[nextpos + 1] << 8));
377                 }
378             }
379             *retpos = pos;
380             return 0;
381         }
382         pos = nextpos;
383     }
384     return 1;
385 }
386 
387 int ipmi_bmc_sdr_find(IPMIBmc *b, uint16_t recid,
388                       const struct ipmi_sdr_compact **sdr, uint16_t *nextrec)
389 
390 {
391     IPMIBmcSim *ibs = IPMI_BMC_SIMULATOR(b);
392     unsigned int pos;
393 
394     pos = 0;
395     if (sdr_find_entry(&ibs->sdr, recid, &pos, nextrec)) {
396         return -1;
397     }
398 
399     *sdr = (const struct ipmi_sdr_compact *) &ibs->sdr.sdr[pos];
400     return 0;
401 }
402 
403 static void sel_inc_reservation(IPMISel *sel)
404 {
405     sel->reservation++;
406     if (sel->reservation == 0) {
407         sel->reservation = 1;
408     }
409 }
410 
411 /* Returns 1 if the SEL is full and can't hold the event. */
412 static int sel_add_event(IPMIBmcSim *ibs, uint8_t *event)
413 {
414     uint8_t ts[4];
415 
416     event[0] = 0xff;
417     event[1] = 0xff;
418     set_timestamp(ibs, ts);
419     if (event[2] < 0xe0) { /* Don't set timestamps for type 0xe0-0xff. */
420         memcpy(event + 3, ts, 4);
421     }
422     if (ibs->sel.next_free == MAX_SEL_SIZE) {
423         ibs->sel.overflow = 1;
424         return 1;
425     }
426     event[0] = ibs->sel.next_free & 0xff;
427     event[1] = (ibs->sel.next_free >> 8) & 0xff;
428     memcpy(ibs->sel.last_addition, ts, 4);
429     memcpy(ibs->sel.sel[ibs->sel.next_free], event, 16);
430     ibs->sel.next_free++;
431     sel_inc_reservation(&ibs->sel);
432     return 0;
433 }
434 
435 static int attn_set(IPMIBmcSim *ibs)
436 {
437     return IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(ibs)
438         || IPMI_BMC_MSG_FLAG_EVT_BUF_FULL_SET(ibs)
439         || IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK_SET(ibs);
440 }
441 
442 static int attn_irq_enabled(IPMIBmcSim *ibs)
443 {
444     return (IPMI_BMC_MSG_INTS_ON(ibs) &&
445             (IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(ibs) ||
446              IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK_SET(ibs)))
447         || (IPMI_BMC_EVBUF_FULL_INT_ENABLED(ibs) &&
448             IPMI_BMC_MSG_FLAG_EVT_BUF_FULL_SET(ibs));
449 }
450 
451 void ipmi_bmc_gen_event(IPMIBmc *b, uint8_t *evt, bool log)
452 {
453     IPMIBmcSim *ibs = IPMI_BMC_SIMULATOR(b);
454     IPMIInterface *s = ibs->parent.intf;
455     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
456 
457     if (!IPMI_BMC_EVENT_MSG_BUF_ENABLED(ibs)) {
458         return;
459     }
460 
461     if (log && IPMI_BMC_EVENT_LOG_ENABLED(ibs)) {
462         sel_add_event(ibs, evt);
463     }
464 
465     if (ibs->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL) {
466         goto out;
467     }
468 
469     memcpy(ibs->evtbuf, evt, 16);
470     ibs->msg_flags |= IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
471     k->set_atn(s, 1, attn_irq_enabled(ibs));
472  out:
473     return;
474 }
475 static void gen_event(IPMIBmcSim *ibs, unsigned int sens_num, uint8_t deassert,
476                       uint8_t evd1, uint8_t evd2, uint8_t evd3)
477 {
478     IPMIInterface *s = ibs->parent.intf;
479     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
480     uint8_t evt[16];
481     IPMISensor *sens = ibs->sensors + sens_num;
482 
483     if (!IPMI_BMC_EVENT_MSG_BUF_ENABLED(ibs)) {
484         return;
485     }
486     if (!IPMI_SENSOR_GET_EVENTS_ON(sens)) {
487         return;
488     }
489 
490     evt[2] = 0x2; /* System event record */
491     evt[7] = ibs->parent.slave_addr;
492     evt[8] = 0;
493     evt[9] = 0x04; /* Format version */
494     evt[10] = sens->sensor_type;
495     evt[11] = sens_num;
496     evt[12] = sens->evt_reading_type_code | (!!deassert << 7);
497     evt[13] = evd1;
498     evt[14] = evd2;
499     evt[15] = evd3;
500 
501     if (IPMI_BMC_EVENT_LOG_ENABLED(ibs)) {
502         sel_add_event(ibs, evt);
503     }
504 
505     if (ibs->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL) {
506         return;
507     }
508 
509     memcpy(ibs->evtbuf, evt, 16);
510     ibs->msg_flags |= IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
511     k->set_atn(s, 1, attn_irq_enabled(ibs));
512 }
513 
514 static void sensor_set_discrete_bit(IPMIBmcSim *ibs, unsigned int sensor,
515                                     unsigned int bit, unsigned int val,
516                                     uint8_t evd1, uint8_t evd2, uint8_t evd3)
517 {
518     IPMISensor *sens;
519     uint16_t mask;
520 
521     if (sensor >= MAX_SENSORS) {
522         return;
523     }
524     if (bit >= 16) {
525         return;
526     }
527 
528     mask = (1 << bit);
529     sens = ibs->sensors + sensor;
530     if (val) {
531         sens->states |= mask & sens->states_suppt;
532         if (sens->assert_states & mask) {
533             return; /* Already asserted */
534         }
535         sens->assert_states |= mask & sens->assert_suppt;
536         if (sens->assert_enable & mask & sens->assert_states) {
537             /* Send an event on assert */
538             gen_event(ibs, sensor, 0, evd1, evd2, evd3);
539         }
540     } else {
541         sens->states &= ~(mask & sens->states_suppt);
542         if (sens->deassert_states & mask) {
543             return; /* Already deasserted */
544         }
545         sens->deassert_states |= mask & sens->deassert_suppt;
546         if (sens->deassert_enable & mask & sens->deassert_states) {
547             /* Send an event on deassert */
548             gen_event(ibs, sensor, 1, evd1, evd2, evd3);
549         }
550     }
551 }
552 
553 static void ipmi_init_sensors_from_sdrs(IPMIBmcSim *s)
554 {
555     unsigned int i, pos;
556     IPMISensor *sens;
557 
558     for (i = 0; i < MAX_SENSORS; i++) {
559         memset(s->sensors + i, 0, sizeof(*sens));
560     }
561 
562     pos = 0;
563     for (i = 0; !sdr_find_entry(&s->sdr, i, &pos, NULL); i++) {
564         struct ipmi_sdr_compact *sdr =
565             (struct ipmi_sdr_compact *) &s->sdr.sdr[pos];
566         unsigned int len = sdr->header.rec_length;
567 
568         if (len < 20) {
569             continue;
570         }
571         if (sdr->header.rec_type != IPMI_SDR_COMPACT_TYPE) {
572             continue; /* Not a sensor SDR we set from */
573         }
574 
575         if (sdr->sensor_owner_number >= MAX_SENSORS) {
576             continue;
577         }
578         sens = s->sensors + sdr->sensor_owner_number;
579 
580         IPMI_SENSOR_SET_PRESENT(sens, 1);
581         IPMI_SENSOR_SET_SCAN_ON(sens, (sdr->sensor_init >> 6) & 1);
582         IPMI_SENSOR_SET_EVENTS_ON(sens, (sdr->sensor_init >> 5) & 1);
583         sens->assert_suppt = sdr->assert_mask[0] | (sdr->assert_mask[1] << 8);
584         sens->deassert_suppt =
585             sdr->deassert_mask[0] | (sdr->deassert_mask[1] << 8);
586         sens->states_suppt =
587             sdr->discrete_mask[0] | (sdr->discrete_mask[1] << 8);
588         sens->sensor_type = sdr->sensor_type;
589         sens->evt_reading_type_code = sdr->reading_type & 0x7f;
590 
591         /* Enable all the events that are supported. */
592         sens->assert_enable = sens->assert_suppt;
593         sens->deassert_enable = sens->deassert_suppt;
594     }
595 }
596 
597 int ipmi_sim_register_netfn(IPMIBmcSim *s, unsigned int netfn,
598                         const IPMINetfn *netfnd)
599 {
600     if ((netfn & 1) || (netfn >= MAX_NETFNS) || (s->netfns[netfn / 2])) {
601         return -1;
602     }
603     s->netfns[netfn / 2] = netfnd;
604     return 0;
605 }
606 
607 static const IPMICmdHandler *ipmi_get_handler(IPMIBmcSim *ibs,
608                                               unsigned int netfn,
609                                               unsigned int cmd)
610 {
611     const IPMICmdHandler *hdl;
612 
613     if (netfn & 1 || netfn >= MAX_NETFNS || !ibs->netfns[netfn / 2]) {
614         return NULL;
615     }
616 
617     if (cmd >= ibs->netfns[netfn / 2]->cmd_nums) {
618         return NULL;
619     }
620 
621     hdl = &ibs->netfns[netfn / 2]->cmd_handlers[cmd];
622     if (!hdl->cmd_handler) {
623         return NULL;
624     }
625 
626     return hdl;
627 }
628 
629 static void next_timeout(IPMIBmcSim *ibs)
630 {
631     int64_t next;
632     if (ibs->watchdog_running) {
633         next = ibs->watchdog_expiry;
634     } else {
635         /* Wait a minute */
636         next = ipmi_getmonotime() + 60 * 1000000000LL;
637     }
638     timer_mod_ns(ibs->timer, next);
639 }
640 
641 static void ipmi_sim_handle_command(IPMIBmc *b,
642                                     uint8_t *cmd, unsigned int cmd_len,
643                                     unsigned int max_cmd_len,
644                                     uint8_t msg_id)
645 {
646     IPMIBmcSim *ibs = IPMI_BMC_SIMULATOR(b);
647     IPMIInterface *s = ibs->parent.intf;
648     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
649     const IPMICmdHandler *hdl;
650     RspBuffer rsp = RSP_BUFFER_INITIALIZER;
651 
652     /* Set up the response, set the low bit of NETFN. */
653     /* Note that max_rsp_len must be at least 3 */
654     if (sizeof(rsp.buffer) < 3) {
655         rsp_buffer_set_error(&rsp, IPMI_CC_REQUEST_DATA_TRUNCATED);
656         goto out;
657     }
658 
659     rsp_buffer_push(&rsp, cmd[0] | 0x04);
660     rsp_buffer_push(&rsp, cmd[1]);
661     rsp_buffer_push(&rsp, 0); /* Assume success */
662 
663     /* If it's too short or it was truncated, return an error. */
664     if (cmd_len < 2) {
665         rsp_buffer_set_error(&rsp, IPMI_CC_REQUEST_DATA_LENGTH_INVALID);
666         goto out;
667     }
668     if (cmd_len > max_cmd_len) {
669         rsp_buffer_set_error(&rsp, IPMI_CC_REQUEST_DATA_TRUNCATED);
670         goto out;
671     }
672 
673     if ((cmd[0] & 0x03) != 0) {
674         /* Only have stuff on LUN 0 */
675         rsp_buffer_set_error(&rsp, IPMI_CC_COMMAND_INVALID_FOR_LUN);
676         goto out;
677     }
678 
679     hdl = ipmi_get_handler(ibs, cmd[0] >> 2, cmd[1]);
680     if (!hdl) {
681         rsp_buffer_set_error(&rsp, IPMI_CC_INVALID_CMD);
682         goto out;
683     }
684 
685     if (cmd_len < hdl->cmd_len_min) {
686         rsp_buffer_set_error(&rsp, IPMI_CC_REQUEST_DATA_LENGTH_INVALID);
687         goto out;
688     }
689 
690     hdl->cmd_handler(ibs, cmd, cmd_len, &rsp);
691 
692  out:
693     k->handle_rsp(s, msg_id, rsp.buffer, rsp.len);
694 
695     next_timeout(ibs);
696 }
697 
698 static void ipmi_sim_handle_timeout(IPMIBmcSim *ibs)
699 {
700     IPMIInterface *s = ibs->parent.intf;
701     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
702 
703     if (!ibs->watchdog_running) {
704         goto out;
705     }
706 
707     if (!ibs->watchdog_preaction_ran) {
708         switch (IPMI_BMC_WATCHDOG_GET_PRE_ACTION(ibs)) {
709         case IPMI_BMC_WATCHDOG_PRE_NMI:
710             ibs->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
711             k->do_hw_op(s, IPMI_SEND_NMI, 0);
712             sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 8, 1,
713                                     0xc8, (2 << 4) | 0xf, 0xff);
714             break;
715 
716         case IPMI_BMC_WATCHDOG_PRE_MSG_INT:
717             ibs->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
718             k->set_atn(s, 1, attn_irq_enabled(ibs));
719             sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 8, 1,
720                                     0xc8, (3 << 4) | 0xf, 0xff);
721             break;
722 
723         default:
724             goto do_full_expiry;
725         }
726 
727         ibs->watchdog_preaction_ran = 1;
728         /* Issued the pretimeout, do the rest of the timeout now. */
729         ibs->watchdog_expiry = ipmi_getmonotime();
730         ibs->watchdog_expiry += ibs->watchdog_pretimeout * 1000000000LL;
731         goto out;
732     }
733 
734  do_full_expiry:
735     ibs->watchdog_running = 0; /* Stop the watchdog on a timeout */
736     ibs->watchdog_expired |= (1 << IPMI_BMC_WATCHDOG_GET_USE(ibs));
737     switch (IPMI_BMC_WATCHDOG_GET_ACTION(ibs)) {
738     case IPMI_BMC_WATCHDOG_ACTION_NONE:
739         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 0, 1,
740                                 0xc0, ibs->watchdog_use & 0xf, 0xff);
741         break;
742 
743     case IPMI_BMC_WATCHDOG_ACTION_RESET:
744         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 1, 1,
745                                 0xc1, ibs->watchdog_use & 0xf, 0xff);
746         k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);
747         break;
748 
749     case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN:
750         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 2, 1,
751                                 0xc2, ibs->watchdog_use & 0xf, 0xff);
752         k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);
753         break;
754 
755     case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE:
756         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 2, 1,
757                                 0xc3, ibs->watchdog_use & 0xf, 0xff);
758         k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0);
759         break;
760     }
761 
762  out:
763     next_timeout(ibs);
764 }
765 
766 static void chassis_capabilities(IPMIBmcSim *ibs,
767                                  uint8_t *cmd, unsigned int cmd_len,
768                                  RspBuffer *rsp)
769 {
770     rsp_buffer_push(rsp, 0);
771     rsp_buffer_push(rsp, ibs->parent.slave_addr);
772     rsp_buffer_push(rsp, ibs->parent.slave_addr);
773     rsp_buffer_push(rsp, ibs->parent.slave_addr);
774     rsp_buffer_push(rsp, ibs->parent.slave_addr);
775 }
776 
777 static void chassis_status(IPMIBmcSim *ibs,
778                            uint8_t *cmd, unsigned int cmd_len,
779                            RspBuffer *rsp)
780 {
781     rsp_buffer_push(rsp, 0x61); /* Unknown power restore, power is on */
782     rsp_buffer_push(rsp, 0);
783     rsp_buffer_push(rsp, 0);
784     rsp_buffer_push(rsp, 0);
785 }
786 
787 static void chassis_control(IPMIBmcSim *ibs,
788                             uint8_t *cmd, unsigned int cmd_len,
789                             RspBuffer *rsp)
790 {
791     IPMIInterface *s = ibs->parent.intf;
792     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
793 
794     switch (cmd[2] & 0xf) {
795     case 0: /* power down */
796         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0));
797         break;
798     case 1: /* power up */
799         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_POWERON_CHASSIS, 0));
800         break;
801     case 2: /* power cycle */
802         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0));
803         break;
804     case 3: /* hard reset */
805         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_RESET_CHASSIS, 0));
806         break;
807     case 4: /* pulse diagnostic interrupt */
808         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_PULSE_DIAG_IRQ, 0));
809         break;
810     case 5: /* soft shutdown via ACPI by overtemp emulation */
811         rsp_buffer_set_error(rsp, k->do_hw_op(s,
812                                           IPMI_SHUTDOWN_VIA_ACPI_OVERTEMP, 0));
813         break;
814     default:
815         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
816         return;
817     }
818 }
819 
820 static void chassis_get_sys_restart_cause(IPMIBmcSim *ibs,
821                            uint8_t *cmd, unsigned int cmd_len,
822                            RspBuffer *rsp)
823 
824 {
825     rsp_buffer_push(rsp, ibs->restart_cause & 0xf); /* Restart Cause */
826     rsp_buffer_push(rsp, 0);  /* Channel 0 */
827 }
828 
829 static void get_device_id(IPMIBmcSim *ibs,
830                           uint8_t *cmd, unsigned int cmd_len,
831                           RspBuffer *rsp)
832 {
833     rsp_buffer_push(rsp, ibs->device_id);
834     rsp_buffer_push(rsp, ibs->device_rev & 0xf);
835     rsp_buffer_push(rsp, ibs->fwrev1 & 0x7f);
836     rsp_buffer_push(rsp, ibs->fwrev2);
837     rsp_buffer_push(rsp, ibs->ipmi_version);
838     rsp_buffer_push(rsp, 0x07); /* sensor, SDR, and SEL. */
839     rsp_buffer_push(rsp, ibs->mfg_id & 0xff);
840     rsp_buffer_push(rsp, (ibs->mfg_id >> 8) & 0xff);
841     rsp_buffer_push(rsp, (ibs->mfg_id >> 16) & 0xff);
842     rsp_buffer_push(rsp, ibs->product_id & 0xff);
843     rsp_buffer_push(rsp, (ibs->product_id >> 8) & 0xff);
844 }
845 
846 static void set_global_enables(IPMIBmcSim *ibs, uint8_t val)
847 {
848     IPMIInterface *s = ibs->parent.intf;
849     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
850     bool irqs_on;
851 
852     ibs->bmc_global_enables = val;
853 
854     irqs_on = val & (IPMI_BMC_EVBUF_FULL_INT_BIT |
855                      IPMI_BMC_RCV_MSG_QUEUE_INT_BIT);
856 
857     k->set_irq_enable(s, irqs_on);
858 }
859 
860 static void cold_reset(IPMIBmcSim *ibs,
861                        uint8_t *cmd, unsigned int cmd_len,
862                        RspBuffer *rsp)
863 {
864     IPMIInterface *s = ibs->parent.intf;
865     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
866 
867     /* Disable all interrupts */
868     set_global_enables(ibs, 1 << IPMI_BMC_EVENT_LOG_BIT);
869 
870     if (k->reset) {
871         k->reset(s, true);
872     }
873 }
874 
875 static void warm_reset(IPMIBmcSim *ibs,
876                        uint8_t *cmd, unsigned int cmd_len,
877                        RspBuffer *rsp)
878 {
879     IPMIInterface *s = ibs->parent.intf;
880     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
881 
882     if (k->reset) {
883         k->reset(s, false);
884     }
885 }
886 static void set_acpi_power_state(IPMIBmcSim *ibs,
887                                  uint8_t *cmd, unsigned int cmd_len,
888                                  RspBuffer *rsp)
889 {
890     ibs->acpi_power_state[0] = cmd[2];
891     ibs->acpi_power_state[1] = cmd[3];
892 }
893 
894 static void get_acpi_power_state(IPMIBmcSim *ibs,
895                                  uint8_t *cmd, unsigned int cmd_len,
896                                  RspBuffer *rsp)
897 {
898     rsp_buffer_push(rsp, ibs->acpi_power_state[0]);
899     rsp_buffer_push(rsp, ibs->acpi_power_state[1]);
900 }
901 
902 static void get_device_guid(IPMIBmcSim *ibs,
903                             uint8_t *cmd, unsigned int cmd_len,
904                             RspBuffer *rsp)
905 {
906     unsigned int i;
907 
908     /* An uninitialized uuid is all zeros, use that to know if it is set. */
909     for (i = 0; i < 16; i++) {
910         if (ibs->uuid.data[i]) {
911             goto uuid_set;
912         }
913     }
914     /* No uuid is set, return an error. */
915     rsp_buffer_set_error(rsp, IPMI_CC_INVALID_CMD);
916     return;
917 
918  uuid_set:
919     for (i = 0; i < 16; i++) {
920         rsp_buffer_push(rsp, ibs->uuid.data[i]);
921     }
922 }
923 
924 static void set_bmc_global_enables(IPMIBmcSim *ibs,
925                                    uint8_t *cmd, unsigned int cmd_len,
926                                    RspBuffer *rsp)
927 {
928     set_global_enables(ibs, cmd[2]);
929 }
930 
931 static void get_bmc_global_enables(IPMIBmcSim *ibs,
932                                    uint8_t *cmd, unsigned int cmd_len,
933                                    RspBuffer *rsp)
934 {
935     rsp_buffer_push(rsp, ibs->bmc_global_enables);
936 }
937 
938 static void clr_msg_flags(IPMIBmcSim *ibs,
939                           uint8_t *cmd, unsigned int cmd_len,
940                           RspBuffer *rsp)
941 {
942     IPMIInterface *s = ibs->parent.intf;
943     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
944 
945     ibs->msg_flags &= ~cmd[2];
946     k->set_atn(s, attn_set(ibs), attn_irq_enabled(ibs));
947 }
948 
949 static void get_msg_flags(IPMIBmcSim *ibs,
950                           uint8_t *cmd, unsigned int cmd_len,
951                           RspBuffer *rsp)
952 {
953     rsp_buffer_push(rsp, ibs->msg_flags);
954 }
955 
956 static void read_evt_msg_buf(IPMIBmcSim *ibs,
957                              uint8_t *cmd, unsigned int cmd_len,
958                              RspBuffer *rsp)
959 {
960     IPMIInterface *s = ibs->parent.intf;
961     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
962     unsigned int i;
963 
964     if (!(ibs->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL)) {
965         rsp_buffer_set_error(rsp, 0x80);
966         return;
967     }
968     for (i = 0; i < 16; i++) {
969         rsp_buffer_push(rsp, ibs->evtbuf[i]);
970     }
971     ibs->msg_flags &= ~IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
972     k->set_atn(s, attn_set(ibs), attn_irq_enabled(ibs));
973 }
974 
975 static void get_msg(IPMIBmcSim *ibs,
976                     uint8_t *cmd, unsigned int cmd_len,
977                     RspBuffer *rsp)
978 {
979     IPMIRcvBufEntry *msg;
980 
981     if (QTAILQ_EMPTY(&ibs->rcvbufs)) {
982         rsp_buffer_set_error(rsp, 0x80); /* Queue empty */
983         goto out;
984     }
985     rsp_buffer_push(rsp, 0); /* Channel 0 */
986     msg = QTAILQ_FIRST(&ibs->rcvbufs);
987     rsp_buffer_pushmore(rsp, msg->buf, msg->len);
988     QTAILQ_REMOVE(&ibs->rcvbufs, msg, entry);
989     g_free(msg);
990 
991     if (QTAILQ_EMPTY(&ibs->rcvbufs)) {
992         IPMIInterface *s = ibs->parent.intf;
993         IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
994 
995         ibs->msg_flags &= ~IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE;
996         k->set_atn(s, attn_set(ibs), attn_irq_enabled(ibs));
997     }
998 
999 out:
1000     return;
1001 }
1002 
1003 static unsigned char
1004 ipmb_checksum(unsigned char *data, int size, unsigned char csum)
1005 {
1006     for (; size > 0; size--, data++) {
1007             csum += *data;
1008     }
1009 
1010     return -csum;
1011 }
1012 
1013 static void send_msg(IPMIBmcSim *ibs,
1014                      uint8_t *cmd, unsigned int cmd_len,
1015                      RspBuffer *rsp)
1016 {
1017     IPMIInterface *s = ibs->parent.intf;
1018     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
1019     IPMIRcvBufEntry *msg;
1020     uint8_t *buf;
1021     uint8_t netfn, rqLun, rsLun, rqSeq;
1022 
1023     if (cmd[2] != 0) {
1024         /* We only handle channel 0 with no options */
1025         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1026         return;
1027     }
1028 
1029     if (cmd_len < 10) {
1030         rsp_buffer_set_error(rsp, IPMI_CC_REQUEST_DATA_LENGTH_INVALID);
1031         return;
1032     }
1033 
1034     if (cmd[3] != 0x40) {
1035         /* We only emulate a MC at address 0x40. */
1036         rsp_buffer_set_error(rsp, 0x83); /* NAK on write */
1037         return;
1038     }
1039 
1040     cmd += 3; /* Skip the header. */
1041     cmd_len -= 3;
1042 
1043     /*
1044      * At this point we "send" the message successfully.  Any error will
1045      * be returned in the response.
1046      */
1047     if (ipmb_checksum(cmd, cmd_len, 0) != 0 ||
1048         cmd[3] != 0x20) { /* Improper response address */
1049         return; /* No response */
1050     }
1051 
1052     netfn = cmd[1] >> 2;
1053     rqLun = cmd[4] & 0x3;
1054     rsLun = cmd[1] & 0x3;
1055     rqSeq = cmd[4] >> 2;
1056 
1057     if (rqLun != 2) {
1058         /* We only support LUN 2 coming back to us. */
1059         return;
1060     }
1061 
1062     msg = g_malloc(sizeof(*msg));
1063     msg->buf[0] = ((netfn | 1) << 2) | rqLun; /* NetFN, and make a response */
1064     msg->buf[1] = ipmb_checksum(msg->buf, 1, 0);
1065     msg->buf[2] = cmd[0]; /* rsSA */
1066     msg->buf[3] = (rqSeq << 2) | rsLun;
1067     msg->buf[4] = cmd[5]; /* Cmd */
1068     msg->buf[5] = 0; /* Completion Code */
1069     msg->len = 6;
1070 
1071     if ((cmd[1] >> 2) != IPMI_NETFN_APP || cmd[5] != IPMI_CMD_GET_DEVICE_ID) {
1072         /* Not a command we handle. */
1073         msg->buf[5] = IPMI_CC_INVALID_CMD;
1074         goto end_msg;
1075     }
1076 
1077     buf = msg->buf + msg->len; /* After the CC */
1078     buf[0] = 0;
1079     buf[1] = 0;
1080     buf[2] = 0;
1081     buf[3] = 0;
1082     buf[4] = 0x51;
1083     buf[5] = 0;
1084     buf[6] = 0;
1085     buf[7] = 0;
1086     buf[8] = 0;
1087     buf[9] = 0;
1088     buf[10] = 0;
1089     msg->len += 11;
1090 
1091  end_msg:
1092     msg->buf[msg->len] = ipmb_checksum(msg->buf, msg->len, 0);
1093     msg->len++;
1094     QTAILQ_INSERT_TAIL(&ibs->rcvbufs, msg, entry);
1095     ibs->msg_flags |= IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE;
1096     k->set_atn(s, 1, attn_irq_enabled(ibs));
1097 }
1098 
1099 static void do_watchdog_reset(IPMIBmcSim *ibs)
1100 {
1101     if (IPMI_BMC_WATCHDOG_GET_ACTION(ibs) ==
1102         IPMI_BMC_WATCHDOG_ACTION_NONE) {
1103         ibs->watchdog_running = 0;
1104         return;
1105     }
1106     ibs->watchdog_preaction_ran = 0;
1107 
1108 
1109     /* Timeout is in tenths of a second, offset is in seconds */
1110     ibs->watchdog_expiry = ipmi_getmonotime();
1111     ibs->watchdog_expiry += ibs->watchdog_timeout * 100000000LL;
1112     if (IPMI_BMC_WATCHDOG_GET_PRE_ACTION(ibs) != IPMI_BMC_WATCHDOG_PRE_NONE) {
1113         ibs->watchdog_expiry -= ibs->watchdog_pretimeout * 1000000000LL;
1114     }
1115     ibs->watchdog_running = 1;
1116 }
1117 
1118 static void reset_watchdog_timer(IPMIBmcSim *ibs,
1119                                  uint8_t *cmd, unsigned int cmd_len,
1120                                  RspBuffer *rsp)
1121 {
1122     if (!ibs->watchdog_initialized) {
1123         rsp_buffer_set_error(rsp, 0x80);
1124         return;
1125     }
1126     do_watchdog_reset(ibs);
1127 }
1128 
1129 static void set_watchdog_timer(IPMIBmcSim *ibs,
1130                                uint8_t *cmd, unsigned int cmd_len,
1131                                RspBuffer *rsp)
1132 {
1133     IPMIInterface *s = ibs->parent.intf;
1134     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
1135     unsigned int val;
1136 
1137     val = cmd[2] & 0x7; /* Validate use */
1138     if (val == 0 || val > 5) {
1139         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1140         return;
1141     }
1142     val = cmd[3] & 0x7; /* Validate action */
1143     switch (val) {
1144     case IPMI_BMC_WATCHDOG_ACTION_NONE:
1145         break;
1146 
1147     case IPMI_BMC_WATCHDOG_ACTION_RESET:
1148         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_RESET_CHASSIS, 1));
1149         break;
1150 
1151     case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN:
1152         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 1));
1153         break;
1154 
1155     case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE:
1156         rsp_buffer_set_error(rsp, k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 1));
1157         break;
1158 
1159     default:
1160         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1161     }
1162     if (rsp->buffer[2]) {
1163         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1164         return;
1165     }
1166 
1167     val = (cmd[3] >> 4) & 0x7; /* Validate preaction */
1168     switch (val) {
1169     case IPMI_BMC_WATCHDOG_PRE_MSG_INT:
1170     case IPMI_BMC_WATCHDOG_PRE_NONE:
1171         break;
1172 
1173     case IPMI_BMC_WATCHDOG_PRE_NMI:
1174         if (k->do_hw_op(s, IPMI_SEND_NMI, 1)) {
1175             /* NMI not supported. */
1176             rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1177             return;
1178         }
1179         break;
1180 
1181     default:
1182         /* We don't support PRE_SMI */
1183         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1184         return;
1185     }
1186 
1187     ibs->watchdog_initialized = 1;
1188     ibs->watchdog_use = cmd[2] & IPMI_BMC_WATCHDOG_USE_MASK;
1189     ibs->watchdog_action = cmd[3] & IPMI_BMC_WATCHDOG_ACTION_MASK;
1190     ibs->watchdog_pretimeout = cmd[4];
1191     ibs->watchdog_expired &= ~cmd[5];
1192     ibs->watchdog_timeout = cmd[6] | (((uint16_t) cmd[7]) << 8);
1193     if (ibs->watchdog_running & IPMI_BMC_WATCHDOG_GET_DONT_STOP(ibs)) {
1194         do_watchdog_reset(ibs);
1195     } else {
1196         ibs->watchdog_running = 0;
1197     }
1198 }
1199 
1200 static void get_watchdog_timer(IPMIBmcSim *ibs,
1201                                uint8_t *cmd, unsigned int cmd_len,
1202                                RspBuffer *rsp)
1203 {
1204     rsp_buffer_push(rsp, ibs->watchdog_use);
1205     rsp_buffer_push(rsp, ibs->watchdog_action);
1206     rsp_buffer_push(rsp, ibs->watchdog_pretimeout);
1207     rsp_buffer_push(rsp, ibs->watchdog_expired);
1208     rsp_buffer_push(rsp, ibs->watchdog_timeout & 0xff);
1209     rsp_buffer_push(rsp, (ibs->watchdog_timeout >> 8) & 0xff);
1210     if (ibs->watchdog_running) {
1211         long timeout;
1212         timeout = ((ibs->watchdog_expiry - ipmi_getmonotime() + 50000000)
1213                    / 100000000);
1214         rsp_buffer_push(rsp, timeout & 0xff);
1215         rsp_buffer_push(rsp, (timeout >> 8) & 0xff);
1216     } else {
1217         rsp_buffer_push(rsp, 0);
1218         rsp_buffer_push(rsp, 0);
1219     }
1220 }
1221 
1222 static void get_sdr_rep_info(IPMIBmcSim *ibs,
1223                              uint8_t *cmd, unsigned int cmd_len,
1224                              RspBuffer *rsp)
1225 {
1226     unsigned int i;
1227 
1228     rsp_buffer_push(rsp, 0x51); /* Conform to IPMI 1.5 spec */
1229     rsp_buffer_push(rsp, ibs->sdr.next_rec_id & 0xff);
1230     rsp_buffer_push(rsp, (ibs->sdr.next_rec_id >> 8) & 0xff);
1231     rsp_buffer_push(rsp, (MAX_SDR_SIZE - ibs->sdr.next_free) & 0xff);
1232     rsp_buffer_push(rsp, ((MAX_SDR_SIZE - ibs->sdr.next_free) >> 8) & 0xff);
1233     for (i = 0; i < 4; i++) {
1234         rsp_buffer_push(rsp, ibs->sdr.last_addition[i]);
1235     }
1236     for (i = 0; i < 4; i++) {
1237         rsp_buffer_push(rsp, ibs->sdr.last_clear[i]);
1238     }
1239     /* Only modal support, reserve supported */
1240     rsp_buffer_push(rsp, (ibs->sdr.overflow << 7) | 0x22);
1241 }
1242 
1243 static void reserve_sdr_rep(IPMIBmcSim *ibs,
1244                             uint8_t *cmd, unsigned int cmd_len,
1245                             RspBuffer *rsp)
1246 {
1247     rsp_buffer_push(rsp, ibs->sdr.reservation & 0xff);
1248     rsp_buffer_push(rsp, (ibs->sdr.reservation >> 8) & 0xff);
1249 }
1250 
1251 static void get_sdr(IPMIBmcSim *ibs,
1252                     uint8_t *cmd, unsigned int cmd_len,
1253                     RspBuffer *rsp)
1254 {
1255     unsigned int pos;
1256     uint16_t nextrec;
1257     struct ipmi_sdr_header *sdrh;
1258 
1259     if (cmd[6]) {
1260         if ((cmd[2] | (cmd[3] << 8)) != ibs->sdr.reservation) {
1261             rsp_buffer_set_error(rsp, IPMI_CC_INVALID_RESERVATION);
1262             return;
1263         }
1264     }
1265 
1266     pos = 0;
1267     if (sdr_find_entry(&ibs->sdr, cmd[4] | (cmd[5] << 8),
1268                        &pos, &nextrec)) {
1269         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1270         return;
1271     }
1272 
1273     sdrh = (struct ipmi_sdr_header *) &ibs->sdr.sdr[pos];
1274 
1275     if (cmd[6] > ipmi_sdr_length(sdrh)) {
1276         rsp_buffer_set_error(rsp, IPMI_CC_PARM_OUT_OF_RANGE);
1277         return;
1278     }
1279 
1280     rsp_buffer_push(rsp, nextrec & 0xff);
1281     rsp_buffer_push(rsp, (nextrec >> 8) & 0xff);
1282 
1283     if (cmd[7] == 0xff) {
1284         cmd[7] = ipmi_sdr_length(sdrh) - cmd[6];
1285     }
1286 
1287     if ((cmd[7] + rsp->len) > sizeof(rsp->buffer)) {
1288         rsp_buffer_set_error(rsp, IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES);
1289         return;
1290     }
1291 
1292     rsp_buffer_pushmore(rsp, ibs->sdr.sdr + pos + cmd[6], cmd[7]);
1293 }
1294 
1295 static void add_sdr(IPMIBmcSim *ibs,
1296                     uint8_t *cmd, unsigned int cmd_len,
1297                     RspBuffer *rsp)
1298 {
1299     uint16_t recid;
1300     struct ipmi_sdr_header *sdrh = (struct ipmi_sdr_header *) cmd + 2;
1301 
1302     if (sdr_add_entry(ibs, sdrh, cmd_len - 2, &recid)) {
1303         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1304         return;
1305     }
1306     rsp_buffer_push(rsp, recid & 0xff);
1307     rsp_buffer_push(rsp, (recid >> 8) & 0xff);
1308 }
1309 
1310 static void clear_sdr_rep(IPMIBmcSim *ibs,
1311                           uint8_t *cmd, unsigned int cmd_len,
1312                           RspBuffer *rsp)
1313 {
1314     if ((cmd[2] | (cmd[3] << 8)) != ibs->sdr.reservation) {
1315         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_RESERVATION);
1316         return;
1317     }
1318 
1319     if (cmd[4] != 'C' || cmd[5] != 'L' || cmd[6] != 'R') {
1320         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1321         return;
1322     }
1323     if (cmd[7] == 0xaa) {
1324         ibs->sdr.next_free = 0;
1325         ibs->sdr.overflow = 0;
1326         set_timestamp(ibs, ibs->sdr.last_clear);
1327         rsp_buffer_push(rsp, 1); /* Erasure complete */
1328         sdr_inc_reservation(&ibs->sdr);
1329     } else if (cmd[7] == 0) {
1330         rsp_buffer_push(rsp, 1); /* Erasure complete */
1331     } else {
1332         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1333         return;
1334     }
1335 }
1336 
1337 static void get_sel_info(IPMIBmcSim *ibs,
1338                          uint8_t *cmd, unsigned int cmd_len,
1339                          RspBuffer *rsp)
1340 {
1341     unsigned int i, val;
1342 
1343     rsp_buffer_push(rsp, 0x51); /* Conform to IPMI 1.5 */
1344     rsp_buffer_push(rsp, ibs->sel.next_free & 0xff);
1345     rsp_buffer_push(rsp, (ibs->sel.next_free >> 8) & 0xff);
1346     val = (MAX_SEL_SIZE - ibs->sel.next_free) * 16;
1347     rsp_buffer_push(rsp, val & 0xff);
1348     rsp_buffer_push(rsp, (val >> 8) & 0xff);
1349     for (i = 0; i < 4; i++) {
1350         rsp_buffer_push(rsp, ibs->sel.last_addition[i]);
1351     }
1352     for (i = 0; i < 4; i++) {
1353         rsp_buffer_push(rsp, ibs->sel.last_clear[i]);
1354     }
1355     /* Only support Reserve SEL */
1356     rsp_buffer_push(rsp, (ibs->sel.overflow << 7) | 0x02);
1357 }
1358 
1359 static void get_fru_area_info(IPMIBmcSim *ibs,
1360                          uint8_t *cmd, unsigned int cmd_len,
1361                          RspBuffer *rsp)
1362 {
1363     uint8_t fruid;
1364     uint16_t fru_entry_size;
1365 
1366     fruid = cmd[2];
1367 
1368     if (fruid >= ibs->fru.nentries) {
1369         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1370         return;
1371     }
1372 
1373     fru_entry_size = ibs->fru.areasize;
1374 
1375     rsp_buffer_push(rsp, fru_entry_size & 0xff);
1376     rsp_buffer_push(rsp, fru_entry_size >> 8 & 0xff);
1377     rsp_buffer_push(rsp, 0x0);
1378 }
1379 
1380 static void read_fru_data(IPMIBmcSim *ibs,
1381                          uint8_t *cmd, unsigned int cmd_len,
1382                          RspBuffer *rsp)
1383 {
1384     uint8_t fruid;
1385     uint16_t offset;
1386     int i;
1387     uint8_t *fru_entry;
1388     unsigned int count;
1389 
1390     fruid = cmd[2];
1391     offset = (cmd[3] | cmd[4] << 8);
1392 
1393     if (fruid >= ibs->fru.nentries) {
1394         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1395         return;
1396     }
1397 
1398     if (offset >= ibs->fru.areasize - 1) {
1399         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1400         return;
1401     }
1402 
1403     fru_entry = &ibs->fru.data[fruid * ibs->fru.areasize];
1404 
1405     count = MIN(cmd[5], ibs->fru.areasize - offset);
1406 
1407     rsp_buffer_push(rsp, count & 0xff);
1408     for (i = 0; i < count; i++) {
1409         rsp_buffer_push(rsp, fru_entry[offset + i]);
1410     }
1411 }
1412 
1413 static void write_fru_data(IPMIBmcSim *ibs,
1414                          uint8_t *cmd, unsigned int cmd_len,
1415                          RspBuffer *rsp)
1416 {
1417     uint8_t fruid;
1418     uint16_t offset;
1419     uint8_t *fru_entry;
1420     unsigned int count;
1421 
1422     fruid = cmd[2];
1423     offset = (cmd[3] | cmd[4] << 8);
1424 
1425     if (fruid >= ibs->fru.nentries) {
1426         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1427         return;
1428     }
1429 
1430     if (offset >= ibs->fru.areasize - 1) {
1431         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1432         return;
1433     }
1434 
1435     fru_entry = &ibs->fru.data[fruid * ibs->fru.areasize];
1436 
1437     count = MIN(cmd_len - 5, ibs->fru.areasize - offset);
1438 
1439     memcpy(fru_entry + offset, cmd + 5, count);
1440 
1441     rsp_buffer_push(rsp, count & 0xff);
1442 }
1443 
1444 static void reserve_sel(IPMIBmcSim *ibs,
1445                         uint8_t *cmd, unsigned int cmd_len,
1446                         RspBuffer *rsp)
1447 {
1448     rsp_buffer_push(rsp, ibs->sel.reservation & 0xff);
1449     rsp_buffer_push(rsp, (ibs->sel.reservation >> 8) & 0xff);
1450 }
1451 
1452 static void get_sel_entry(IPMIBmcSim *ibs,
1453                           uint8_t *cmd, unsigned int cmd_len,
1454                           RspBuffer *rsp)
1455 {
1456     unsigned int val;
1457 
1458     if (cmd[6]) {
1459         if ((cmd[2] | (cmd[3] << 8)) != ibs->sel.reservation) {
1460             rsp_buffer_set_error(rsp, IPMI_CC_INVALID_RESERVATION);
1461             return;
1462         }
1463     }
1464     if (ibs->sel.next_free == 0) {
1465         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1466         return;
1467     }
1468     if (cmd[6] > 15) {
1469         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1470         return;
1471     }
1472     if (cmd[7] == 0xff) {
1473         cmd[7] = 16;
1474     } else if ((cmd[7] + cmd[6]) > 16) {
1475         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1476         return;
1477     } else {
1478         cmd[7] += cmd[6];
1479     }
1480 
1481     val = cmd[4] | (cmd[5] << 8);
1482     if (val == 0xffff) {
1483         val = ibs->sel.next_free - 1;
1484     } else if (val >= ibs->sel.next_free) {
1485         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1486         return;
1487     }
1488     if ((val + 1) == ibs->sel.next_free) {
1489         rsp_buffer_push(rsp, 0xff);
1490         rsp_buffer_push(rsp, 0xff);
1491     } else {
1492         rsp_buffer_push(rsp, (val + 1) & 0xff);
1493         rsp_buffer_push(rsp, ((val + 1) >> 8) & 0xff);
1494     }
1495     for (; cmd[6] < cmd[7]; cmd[6]++) {
1496         rsp_buffer_push(rsp, ibs->sel.sel[val][cmd[6]]);
1497     }
1498 }
1499 
1500 static void add_sel_entry(IPMIBmcSim *ibs,
1501                           uint8_t *cmd, unsigned int cmd_len,
1502                           RspBuffer *rsp)
1503 {
1504     if (sel_add_event(ibs, cmd + 2)) {
1505         rsp_buffer_set_error(rsp, IPMI_CC_OUT_OF_SPACE);
1506         return;
1507     }
1508     /* sel_add_event fills in the record number. */
1509     rsp_buffer_push(rsp, cmd[2]);
1510     rsp_buffer_push(rsp, cmd[3]);
1511 }
1512 
1513 static void clear_sel(IPMIBmcSim *ibs,
1514                       uint8_t *cmd, unsigned int cmd_len,
1515                       RspBuffer *rsp)
1516 {
1517     if ((cmd[2] | (cmd[3] << 8)) != ibs->sel.reservation) {
1518         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_RESERVATION);
1519         return;
1520     }
1521 
1522     if (cmd[4] != 'C' || cmd[5] != 'L' || cmd[6] != 'R') {
1523         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1524         return;
1525     }
1526     if (cmd[7] == 0xaa) {
1527         ibs->sel.next_free = 0;
1528         ibs->sel.overflow = 0;
1529         set_timestamp(ibs, ibs->sdr.last_clear);
1530         rsp_buffer_push(rsp, 1); /* Erasure complete */
1531         sel_inc_reservation(&ibs->sel);
1532     } else if (cmd[7] == 0) {
1533         rsp_buffer_push(rsp, 1); /* Erasure complete */
1534     } else {
1535         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1536         return;
1537     }
1538 }
1539 
1540 static void get_sel_time(IPMIBmcSim *ibs,
1541                          uint8_t *cmd, unsigned int cmd_len,
1542                          RspBuffer *rsp)
1543 {
1544     uint32_t val;
1545     struct ipmi_time now;
1546 
1547     ipmi_gettime(&now);
1548     val = now.tv_sec + ibs->sel.time_offset;
1549     rsp_buffer_push(rsp, val & 0xff);
1550     rsp_buffer_push(rsp, (val >> 8) & 0xff);
1551     rsp_buffer_push(rsp, (val >> 16) & 0xff);
1552     rsp_buffer_push(rsp, (val >> 24) & 0xff);
1553 }
1554 
1555 static void set_sel_time(IPMIBmcSim *ibs,
1556                          uint8_t *cmd, unsigned int cmd_len,
1557                          RspBuffer *rsp)
1558 {
1559     uint32_t val;
1560     struct ipmi_time now;
1561 
1562     val = cmd[2] | (cmd[3] << 8) | (cmd[4] << 16) | (cmd[5] << 24);
1563     ipmi_gettime(&now);
1564     ibs->sel.time_offset = now.tv_sec - ((long) val);
1565 }
1566 
1567 static void platform_event_msg(IPMIBmcSim *ibs,
1568                                uint8_t *cmd, unsigned int cmd_len,
1569                                RspBuffer *rsp)
1570 {
1571     uint8_t event[16];
1572 
1573     event[2] = 2; /* System event record */
1574     event[7] = cmd[2]; /* Generator ID */
1575     event[8] = 0;
1576     event[9] = cmd[3]; /* EvMRev */
1577     event[10] = cmd[4]; /* Sensor type */
1578     event[11] = cmd[5]; /* Sensor number */
1579     event[12] = cmd[6]; /* Event dir / Event type */
1580     event[13] = cmd[7]; /* Event data 1 */
1581     event[14] = cmd[8]; /* Event data 2 */
1582     event[15] = cmd[9]; /* Event data 3 */
1583 
1584     if (sel_add_event(ibs, event)) {
1585         rsp_buffer_set_error(rsp, IPMI_CC_OUT_OF_SPACE);
1586     }
1587 }
1588 
1589 static void set_sensor_evt_enable(IPMIBmcSim *ibs,
1590                                   uint8_t *cmd, unsigned int cmd_len,
1591                                   RspBuffer *rsp)
1592 {
1593     IPMISensor *sens;
1594 
1595     if ((cmd[2] >= MAX_SENSORS) ||
1596             !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1597         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1598         return;
1599     }
1600     sens = ibs->sensors + cmd[2];
1601     switch ((cmd[3] >> 4) & 0x3) {
1602     case 0: /* Do not change */
1603         break;
1604     case 1: /* Enable bits */
1605         if (cmd_len > 4) {
1606             sens->assert_enable |= cmd[4];
1607         }
1608         if (cmd_len > 5) {
1609             sens->assert_enable |= cmd[5] << 8;
1610         }
1611         if (cmd_len > 6) {
1612             sens->deassert_enable |= cmd[6];
1613         }
1614         if (cmd_len > 7) {
1615             sens->deassert_enable |= cmd[7] << 8;
1616         }
1617         break;
1618     case 2: /* Disable bits */
1619         if (cmd_len > 4) {
1620             sens->assert_enable &= ~cmd[4];
1621         }
1622         if (cmd_len > 5) {
1623             sens->assert_enable &= ~(cmd[5] << 8);
1624         }
1625         if (cmd_len > 6) {
1626             sens->deassert_enable &= ~cmd[6];
1627         }
1628         if (cmd_len > 7) {
1629             sens->deassert_enable &= ~(cmd[7] << 8);
1630         }
1631         break;
1632     case 3:
1633         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1634         return;
1635     }
1636     IPMI_SENSOR_SET_RET_STATUS(sens, cmd[3]);
1637 }
1638 
1639 static void get_sensor_evt_enable(IPMIBmcSim *ibs,
1640                                   uint8_t *cmd, unsigned int cmd_len,
1641                                   RspBuffer *rsp)
1642 {
1643     IPMISensor *sens;
1644 
1645     if ((cmd[2] >= MAX_SENSORS) ||
1646         !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1647         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1648         return;
1649     }
1650     sens = ibs->sensors + cmd[2];
1651     rsp_buffer_push(rsp, IPMI_SENSOR_GET_RET_STATUS(sens));
1652     rsp_buffer_push(rsp, sens->assert_enable & 0xff);
1653     rsp_buffer_push(rsp, (sens->assert_enable >> 8) & 0xff);
1654     rsp_buffer_push(rsp, sens->deassert_enable & 0xff);
1655     rsp_buffer_push(rsp, (sens->deassert_enable >> 8) & 0xff);
1656 }
1657 
1658 static void rearm_sensor_evts(IPMIBmcSim *ibs,
1659                               uint8_t *cmd, unsigned int cmd_len,
1660                               RspBuffer *rsp)
1661 {
1662     IPMISensor *sens;
1663 
1664     if ((cmd[2] >= MAX_SENSORS) ||
1665         !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1666         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1667         return;
1668     }
1669     sens = ibs->sensors + cmd[2];
1670 
1671     if ((cmd[3] & 0x80) == 0) {
1672         /* Just clear everything */
1673         sens->states = 0;
1674         return;
1675     }
1676 }
1677 
1678 static void get_sensor_evt_status(IPMIBmcSim *ibs,
1679                                   uint8_t *cmd, unsigned int cmd_len,
1680                                   RspBuffer *rsp)
1681 {
1682     IPMISensor *sens;
1683 
1684     if ((cmd[2] >= MAX_SENSORS) ||
1685         !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1686         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1687         return;
1688     }
1689     sens = ibs->sensors + cmd[2];
1690     rsp_buffer_push(rsp, sens->reading);
1691     rsp_buffer_push(rsp, IPMI_SENSOR_GET_RET_STATUS(sens));
1692     rsp_buffer_push(rsp, sens->assert_states & 0xff);
1693     rsp_buffer_push(rsp, (sens->assert_states >> 8) & 0xff);
1694     rsp_buffer_push(rsp, sens->deassert_states & 0xff);
1695     rsp_buffer_push(rsp, (sens->deassert_states >> 8) & 0xff);
1696 }
1697 
1698 static void get_sensor_reading(IPMIBmcSim *ibs,
1699                                uint8_t *cmd, unsigned int cmd_len,
1700                                RspBuffer *rsp)
1701 {
1702     IPMISensor *sens;
1703 
1704     if ((cmd[2] >= MAX_SENSORS) ||
1705             !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1706         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1707         return;
1708     }
1709     sens = ibs->sensors + cmd[2];
1710     rsp_buffer_push(rsp, sens->reading);
1711     rsp_buffer_push(rsp, IPMI_SENSOR_GET_RET_STATUS(sens));
1712     rsp_buffer_push(rsp, sens->states & 0xff);
1713     if (IPMI_SENSOR_IS_DISCRETE(sens)) {
1714         rsp_buffer_push(rsp, (sens->states >> 8) & 0xff);
1715     }
1716 }
1717 
1718 static void set_sensor_type(IPMIBmcSim *ibs,
1719                             uint8_t *cmd, unsigned int cmd_len,
1720                             RspBuffer *rsp)
1721 {
1722     IPMISensor *sens;
1723 
1724 
1725     if ((cmd[2] >= MAX_SENSORS) ||
1726             !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1727         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1728         return;
1729     }
1730     sens = ibs->sensors + cmd[2];
1731     sens->sensor_type = cmd[3];
1732     sens->evt_reading_type_code = cmd[4] & 0x7f;
1733 }
1734 
1735 static void get_sensor_type(IPMIBmcSim *ibs,
1736                             uint8_t *cmd, unsigned int cmd_len,
1737                             RspBuffer *rsp)
1738 {
1739     IPMISensor *sens;
1740 
1741 
1742     if ((cmd[2] >= MAX_SENSORS) ||
1743             !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1744         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1745         return;
1746     }
1747     sens = ibs->sensors + cmd[2];
1748     rsp_buffer_push(rsp, sens->sensor_type);
1749     rsp_buffer_push(rsp, sens->evt_reading_type_code);
1750 }
1751 
1752 /*
1753  * bytes   parameter
1754  *    1    sensor number
1755  *    2    operation (see below for bits meaning)
1756  *    3    sensor reading
1757  *  4:5    assertion states (optional)
1758  *  6:7    deassertion states (optional)
1759  *  8:10   event data 1,2,3 (optional)
1760  */
1761 static void set_sensor_reading(IPMIBmcSim *ibs,
1762                                uint8_t *cmd, unsigned int cmd_len,
1763                                RspBuffer *rsp)
1764 {
1765     IPMISensor *sens;
1766     uint8_t evd1 = 0;
1767     uint8_t evd2 = 0;
1768     uint8_t evd3 = 0;
1769     uint8_t new_reading = 0;
1770     uint16_t new_assert_states = 0;
1771     uint16_t new_deassert_states = 0;
1772     bool change_reading = false;
1773     bool change_assert = false;
1774     bool change_deassert = false;
1775     enum {
1776         SENSOR_GEN_EVENT_NONE,
1777         SENSOR_GEN_EVENT_DATA,
1778         SENSOR_GEN_EVENT_BMC,
1779     } do_gen_event = SENSOR_GEN_EVENT_NONE;
1780 
1781     if ((cmd[2] >= MAX_SENSORS) ||
1782             !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
1783         rsp_buffer_set_error(rsp, IPMI_CC_REQ_ENTRY_NOT_PRESENT);
1784         return;
1785     }
1786 
1787     sens = ibs->sensors + cmd[2];
1788 
1789     /* [1:0] Sensor Reading operation */
1790     switch ((cmd[3]) & 0x3) {
1791     case 0: /* Do not change */
1792         break;
1793     case 1: /* write given value to sensor reading byte */
1794         new_reading = cmd[4];
1795         if (sens->reading != new_reading) {
1796             change_reading = true;
1797         }
1798         break;
1799     case 2:
1800     case 3:
1801         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1802         return;
1803     }
1804 
1805     /* [3:2] Deassertion bits operation */
1806     switch ((cmd[3] >> 2) & 0x3) {
1807     case 0: /* Do not change */
1808         break;
1809     case 1: /* write given value */
1810         if (cmd_len > 7) {
1811             new_deassert_states = cmd[7];
1812             change_deassert = true;
1813         }
1814         if (cmd_len > 8) {
1815             new_deassert_states |= (cmd[8] << 8);
1816         }
1817         break;
1818 
1819     case 2: /* mask on */
1820         if (cmd_len > 7) {
1821             new_deassert_states = (sens->deassert_states | cmd[7]);
1822             change_deassert = true;
1823         }
1824         if (cmd_len > 8) {
1825             new_deassert_states |= (sens->deassert_states | (cmd[8] << 8));
1826         }
1827         break;
1828 
1829     case 3: /* mask off */
1830         if (cmd_len > 7) {
1831             new_deassert_states = (sens->deassert_states & cmd[7]);
1832             change_deassert = true;
1833         }
1834         if (cmd_len > 8) {
1835             new_deassert_states |= (sens->deassert_states & (cmd[8] << 8));
1836         }
1837         break;
1838     }
1839 
1840     if (change_deassert && (new_deassert_states == sens->deassert_states)) {
1841         change_deassert = false;
1842     }
1843 
1844     /* [5:4] Assertion bits operation */
1845     switch ((cmd[3] >> 4) & 0x3) {
1846     case 0: /* Do not change */
1847         break;
1848     case 1: /* write given value */
1849         if (cmd_len > 5) {
1850             new_assert_states = cmd[5];
1851             change_assert = true;
1852         }
1853         if (cmd_len > 6) {
1854             new_assert_states |= (cmd[6] << 8);
1855         }
1856         break;
1857 
1858     case 2: /* mask on */
1859         if (cmd_len > 5) {
1860             new_assert_states = (sens->assert_states | cmd[5]);
1861             change_assert = true;
1862         }
1863         if (cmd_len > 6) {
1864             new_assert_states |= (sens->assert_states | (cmd[6] << 8));
1865         }
1866         break;
1867 
1868     case 3: /* mask off */
1869         if (cmd_len > 5) {
1870             new_assert_states = (sens->assert_states & cmd[5]);
1871             change_assert = true;
1872         }
1873         if (cmd_len > 6) {
1874             new_assert_states |= (sens->assert_states & (cmd[6] << 8));
1875         }
1876         break;
1877     }
1878 
1879     if (change_assert && (new_assert_states == sens->assert_states)) {
1880         change_assert = false;
1881     }
1882 
1883     if (cmd_len > 9) {
1884         evd1 = cmd[9];
1885     }
1886     if (cmd_len > 10) {
1887         evd2 = cmd[10];
1888     }
1889     if (cmd_len > 11) {
1890         evd3 = cmd[11];
1891     }
1892 
1893     /* [7:6] Event Data Bytes operation */
1894     switch ((cmd[3] >> 6) & 0x3) {
1895     case 0: /*
1896              * Don’t use Event Data bytes from this command. BMC will
1897              * generate it's own Event Data bytes based on its sensor
1898              * implementation.
1899              */
1900         evd1 = evd2 = evd3 = 0x0;
1901         do_gen_event = SENSOR_GEN_EVENT_BMC;
1902         break;
1903     case 1: /*
1904              * Write given values to event data bytes including bits
1905              * [3:0] Event Data 1.
1906              */
1907         do_gen_event = SENSOR_GEN_EVENT_DATA;
1908         break;
1909     case 2: /*
1910              * Write given values to event data bytes excluding bits
1911              * [3:0] Event Data 1.
1912              */
1913         evd1 &= 0xf0;
1914         do_gen_event = SENSOR_GEN_EVENT_DATA;
1915         break;
1916     case 3:
1917         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1918         return;
1919     }
1920 
1921     /*
1922      * Event Data Bytes operation and parameter are inconsistent. The
1923      * Specs are not clear on that topic but generating an error seems
1924      * correct.
1925      */
1926     if (do_gen_event == SENSOR_GEN_EVENT_DATA && cmd_len < 10) {
1927         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
1928         return;
1929     }
1930 
1931     /* commit values */
1932     if (change_reading) {
1933         sens->reading = new_reading;
1934     }
1935 
1936     if (change_assert) {
1937         sens->assert_states = new_assert_states;
1938     }
1939 
1940     if (change_deassert) {
1941         sens->deassert_states = new_deassert_states;
1942     }
1943 
1944     /* TODO: handle threshold sensor */
1945     if (!IPMI_SENSOR_IS_DISCRETE(sens)) {
1946         return;
1947     }
1948 
1949     switch (do_gen_event) {
1950     case SENSOR_GEN_EVENT_DATA: {
1951         unsigned int bit = evd1 & 0xf;
1952         uint16_t mask = (1 << bit);
1953 
1954         if (sens->assert_states & mask & sens->assert_enable) {
1955             gen_event(ibs, cmd[2], 0, evd1, evd2, evd3);
1956         }
1957 
1958         if (sens->deassert_states & mask & sens->deassert_enable) {
1959             gen_event(ibs, cmd[2], 1, evd1, evd2, evd3);
1960         }
1961         break;
1962     }
1963     case SENSOR_GEN_EVENT_BMC:
1964         /*
1965          * TODO: generate event and event data bytes depending on the
1966          * sensor
1967          */
1968         break;
1969     case SENSOR_GEN_EVENT_NONE:
1970         break;
1971     }
1972 }
1973 
1974 static const IPMICmdHandler chassis_cmds[] = {
1975     [IPMI_CMD_GET_CHASSIS_CAPABILITIES] = { chassis_capabilities },
1976     [IPMI_CMD_GET_CHASSIS_STATUS] = { chassis_status },
1977     [IPMI_CMD_CHASSIS_CONTROL] = { chassis_control, 3 },
1978     [IPMI_CMD_GET_SYS_RESTART_CAUSE] = { chassis_get_sys_restart_cause }
1979 };
1980 static const IPMINetfn chassis_netfn = {
1981     .cmd_nums = ARRAY_SIZE(chassis_cmds),
1982     .cmd_handlers = chassis_cmds
1983 };
1984 
1985 static const IPMICmdHandler sensor_event_cmds[] = {
1986     [IPMI_CMD_PLATFORM_EVENT_MSG] = { platform_event_msg, 10 },
1987     [IPMI_CMD_SET_SENSOR_EVT_ENABLE] = { set_sensor_evt_enable, 4 },
1988     [IPMI_CMD_GET_SENSOR_EVT_ENABLE] = { get_sensor_evt_enable, 3 },
1989     [IPMI_CMD_REARM_SENSOR_EVTS] = { rearm_sensor_evts, 4 },
1990     [IPMI_CMD_GET_SENSOR_EVT_STATUS] = { get_sensor_evt_status, 3 },
1991     [IPMI_CMD_GET_SENSOR_READING] = { get_sensor_reading, 3 },
1992     [IPMI_CMD_SET_SENSOR_TYPE] = { set_sensor_type, 5 },
1993     [IPMI_CMD_GET_SENSOR_TYPE] = { get_sensor_type, 3 },
1994     [IPMI_CMD_SET_SENSOR_READING] = { set_sensor_reading, 5 },
1995 };
1996 static const IPMINetfn sensor_event_netfn = {
1997     .cmd_nums = ARRAY_SIZE(sensor_event_cmds),
1998     .cmd_handlers = sensor_event_cmds
1999 };
2000 
2001 static const IPMICmdHandler app_cmds[] = {
2002     [IPMI_CMD_GET_DEVICE_ID] = { get_device_id },
2003     [IPMI_CMD_COLD_RESET] = { cold_reset },
2004     [IPMI_CMD_WARM_RESET] = { warm_reset },
2005     [IPMI_CMD_SET_ACPI_POWER_STATE] = { set_acpi_power_state, 4 },
2006     [IPMI_CMD_GET_ACPI_POWER_STATE] = { get_acpi_power_state },
2007     [IPMI_CMD_GET_DEVICE_GUID] = { get_device_guid },
2008     [IPMI_CMD_SET_BMC_GLOBAL_ENABLES] = { set_bmc_global_enables, 3 },
2009     [IPMI_CMD_GET_BMC_GLOBAL_ENABLES] = { get_bmc_global_enables },
2010     [IPMI_CMD_CLR_MSG_FLAGS] = { clr_msg_flags, 3 },
2011     [IPMI_CMD_GET_MSG_FLAGS] = { get_msg_flags },
2012     [IPMI_CMD_GET_MSG] = { get_msg },
2013     [IPMI_CMD_SEND_MSG] = { send_msg, 3 },
2014     [IPMI_CMD_READ_EVT_MSG_BUF] = { read_evt_msg_buf },
2015     [IPMI_CMD_RESET_WATCHDOG_TIMER] = { reset_watchdog_timer },
2016     [IPMI_CMD_SET_WATCHDOG_TIMER] = { set_watchdog_timer, 8 },
2017     [IPMI_CMD_GET_WATCHDOG_TIMER] = { get_watchdog_timer },
2018 };
2019 static const IPMINetfn app_netfn = {
2020     .cmd_nums = ARRAY_SIZE(app_cmds),
2021     .cmd_handlers = app_cmds
2022 };
2023 
2024 static const IPMICmdHandler storage_cmds[] = {
2025     [IPMI_CMD_GET_FRU_AREA_INFO] = { get_fru_area_info, 3 },
2026     [IPMI_CMD_READ_FRU_DATA] = { read_fru_data, 5 },
2027     [IPMI_CMD_WRITE_FRU_DATA] = { write_fru_data, 5 },
2028     [IPMI_CMD_GET_SDR_REP_INFO] = { get_sdr_rep_info },
2029     [IPMI_CMD_RESERVE_SDR_REP] = { reserve_sdr_rep },
2030     [IPMI_CMD_GET_SDR] = { get_sdr, 8 },
2031     [IPMI_CMD_ADD_SDR] = { add_sdr },
2032     [IPMI_CMD_CLEAR_SDR_REP] = { clear_sdr_rep, 8 },
2033     [IPMI_CMD_GET_SEL_INFO] = { get_sel_info },
2034     [IPMI_CMD_RESERVE_SEL] = { reserve_sel },
2035     [IPMI_CMD_GET_SEL_ENTRY] = { get_sel_entry, 8 },
2036     [IPMI_CMD_ADD_SEL_ENTRY] = { add_sel_entry, 18 },
2037     [IPMI_CMD_CLEAR_SEL] = { clear_sel, 8 },
2038     [IPMI_CMD_GET_SEL_TIME] = { get_sel_time },
2039     [IPMI_CMD_SET_SEL_TIME] = { set_sel_time, 6 },
2040 };
2041 
2042 static const IPMINetfn storage_netfn = {
2043     .cmd_nums = ARRAY_SIZE(storage_cmds),
2044     .cmd_handlers = storage_cmds
2045 };
2046 
2047 static void register_cmds(IPMIBmcSim *s)
2048 {
2049     ipmi_sim_register_netfn(s, IPMI_NETFN_CHASSIS, &chassis_netfn);
2050     ipmi_sim_register_netfn(s, IPMI_NETFN_SENSOR_EVENT, &sensor_event_netfn);
2051     ipmi_sim_register_netfn(s, IPMI_NETFN_APP, &app_netfn);
2052     ipmi_sim_register_netfn(s, IPMI_NETFN_STORAGE, &storage_netfn);
2053 }
2054 
2055 static uint8_t init_sdrs[] = {
2056     /* Watchdog device */
2057     0x00, 0x00, 0x51, 0x02,   35, 0x20, 0x00, 0x00,
2058     0x23, 0x01, 0x63, 0x00, 0x23, 0x6f, 0x0f, 0x01,
2059     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2060     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc8,
2061     'W',  'a',  't',  'c',  'h',  'd',  'o',  'g',
2062 };
2063 
2064 static void ipmi_sdr_init(IPMIBmcSim *ibs)
2065 {
2066     unsigned int i;
2067     int len;
2068     size_t sdrs_size;
2069     uint8_t *sdrs;
2070 
2071     sdrs_size = sizeof(init_sdrs);
2072     sdrs = init_sdrs;
2073     if (ibs->sdr_filename &&
2074         !g_file_get_contents(ibs->sdr_filename, (gchar **) &sdrs, &sdrs_size,
2075                              NULL)) {
2076         error_report("failed to load sdr file '%s'", ibs->sdr_filename);
2077         sdrs_size = sizeof(init_sdrs);
2078         sdrs = init_sdrs;
2079     }
2080 
2081     for (i = 0; i < sdrs_size; i += len) {
2082         struct ipmi_sdr_header *sdrh;
2083 
2084         if (i + IPMI_SDR_HEADER_SIZE > sdrs_size) {
2085             error_report("Problem with recid 0x%4.4x", i);
2086             break;
2087         }
2088         sdrh = (struct ipmi_sdr_header *) &sdrs[i];
2089         len = ipmi_sdr_length(sdrh);
2090         if (i + len > sdrs_size) {
2091             error_report("Problem with recid 0x%4.4x", i);
2092             break;
2093         }
2094         sdr_add_entry(ibs, sdrh, len, NULL);
2095     }
2096 
2097     if (sdrs != init_sdrs) {
2098         g_free(sdrs);
2099     }
2100 }
2101 
2102 static const VMStateDescription vmstate_ipmi_sim = {
2103     .name = TYPE_IPMI_BMC_SIMULATOR,
2104     .version_id = 1,
2105     .minimum_version_id = 1,
2106     .fields      = (VMStateField[]) {
2107         VMSTATE_UINT8(bmc_global_enables, IPMIBmcSim),
2108         VMSTATE_UINT8(msg_flags, IPMIBmcSim),
2109         VMSTATE_BOOL(watchdog_initialized, IPMIBmcSim),
2110         VMSTATE_UINT8(watchdog_use, IPMIBmcSim),
2111         VMSTATE_UINT8(watchdog_action, IPMIBmcSim),
2112         VMSTATE_UINT8(watchdog_pretimeout, IPMIBmcSim),
2113         VMSTATE_UINT8(watchdog_expired, IPMIBmcSim),
2114         VMSTATE_UINT16(watchdog_timeout, IPMIBmcSim),
2115         VMSTATE_BOOL(watchdog_running, IPMIBmcSim),
2116         VMSTATE_BOOL(watchdog_preaction_ran, IPMIBmcSim),
2117         VMSTATE_INT64(watchdog_expiry, IPMIBmcSim),
2118         VMSTATE_UINT8_ARRAY(evtbuf, IPMIBmcSim, 16),
2119         VMSTATE_UINT8(sensors[IPMI_WATCHDOG_SENSOR].status, IPMIBmcSim),
2120         VMSTATE_UINT8(sensors[IPMI_WATCHDOG_SENSOR].reading, IPMIBmcSim),
2121         VMSTATE_UINT16(sensors[IPMI_WATCHDOG_SENSOR].states, IPMIBmcSim),
2122         VMSTATE_UINT16(sensors[IPMI_WATCHDOG_SENSOR].assert_states, IPMIBmcSim),
2123         VMSTATE_UINT16(sensors[IPMI_WATCHDOG_SENSOR].deassert_states,
2124                        IPMIBmcSim),
2125         VMSTATE_UINT16(sensors[IPMI_WATCHDOG_SENSOR].assert_enable, IPMIBmcSim),
2126         VMSTATE_END_OF_LIST()
2127     }
2128 };
2129 
2130 static void ipmi_fru_init(IPMIFru *fru)
2131 {
2132     int fsize;
2133     int size = 0;
2134 
2135     if (!fru->filename) {
2136         goto out;
2137     }
2138 
2139     fsize = get_image_size(fru->filename);
2140     if (fsize > 0) {
2141         size = QEMU_ALIGN_UP(fsize, fru->areasize);
2142         fru->data = g_malloc0(size);
2143         if (load_image_size(fru->filename, fru->data, fsize) != fsize) {
2144             error_report("Could not load file '%s'", fru->filename);
2145             g_free(fru->data);
2146             fru->data = NULL;
2147         }
2148     }
2149 
2150 out:
2151     if (!fru->data) {
2152         /* give one default FRU */
2153         size = fru->areasize;
2154         fru->data = g_malloc0(size);
2155     }
2156 
2157     fru->nentries = size / fru->areasize;
2158 }
2159 
2160 static void ipmi_sim_realize(DeviceState *dev, Error **errp)
2161 {
2162     IPMIBmc *b = IPMI_BMC(dev);
2163     unsigned int i;
2164     IPMIBmcSim *ibs = IPMI_BMC_SIMULATOR(b);
2165 
2166     QTAILQ_INIT(&ibs->rcvbufs);
2167 
2168     ibs->bmc_global_enables = (1 << IPMI_BMC_EVENT_LOG_BIT);
2169     ibs->device_id = 0x20;
2170     ibs->ipmi_version = 0x02; /* IPMI 2.0 */
2171     ibs->restart_cause = 0;
2172     for (i = 0; i < 4; i++) {
2173         ibs->sel.last_addition[i] = 0xff;
2174         ibs->sel.last_clear[i] = 0xff;
2175         ibs->sdr.last_addition[i] = 0xff;
2176         ibs->sdr.last_clear[i] = 0xff;
2177     }
2178 
2179     ipmi_sdr_init(ibs);
2180 
2181     ipmi_fru_init(&ibs->fru);
2182 
2183     ibs->acpi_power_state[0] = 0;
2184     ibs->acpi_power_state[1] = 0;
2185 
2186     ipmi_init_sensors_from_sdrs(ibs);
2187     register_cmds(ibs);
2188 
2189     ibs->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ipmi_timeout, ibs);
2190 
2191     vmstate_register(NULL, 0, &vmstate_ipmi_sim, ibs);
2192 }
2193 
2194 static Property ipmi_sim_properties[] = {
2195     DEFINE_PROP_UINT16("fruareasize", IPMIBmcSim, fru.areasize, 1024),
2196     DEFINE_PROP_STRING("frudatafile", IPMIBmcSim, fru.filename),
2197     DEFINE_PROP_STRING("sdrfile", IPMIBmcSim, sdr_filename),
2198     DEFINE_PROP_UINT8("device_id", IPMIBmcSim, device_id, 0x20),
2199     DEFINE_PROP_UINT8("ipmi_version", IPMIBmcSim, ipmi_version, 0x02),
2200     DEFINE_PROP_UINT8("device_rev", IPMIBmcSim, device_rev, 0),
2201     DEFINE_PROP_UINT8("fwrev1", IPMIBmcSim, fwrev1, 0),
2202     DEFINE_PROP_UINT8("fwrev2", IPMIBmcSim, fwrev2, 0),
2203     DEFINE_PROP_UINT32("mfg_id", IPMIBmcSim, mfg_id, 0),
2204     DEFINE_PROP_UINT16("product_id", IPMIBmcSim, product_id, 0),
2205     DEFINE_PROP_UUID_NODEFAULT("guid", IPMIBmcSim, uuid),
2206     DEFINE_PROP_END_OF_LIST(),
2207 };
2208 
2209 static void ipmi_sim_class_init(ObjectClass *oc, void *data)
2210 {
2211     DeviceClass *dc = DEVICE_CLASS(oc);
2212     IPMIBmcClass *bk = IPMI_BMC_CLASS(oc);
2213 
2214     dc->hotpluggable = false;
2215     dc->realize = ipmi_sim_realize;
2216     device_class_set_props(dc, ipmi_sim_properties);
2217     bk->handle_command = ipmi_sim_handle_command;
2218 }
2219 
2220 static const TypeInfo ipmi_sim_type = {
2221     .name          = TYPE_IPMI_BMC_SIMULATOR,
2222     .parent        = TYPE_IPMI_BMC,
2223     .instance_size = sizeof(IPMIBmcSim),
2224     .class_init    = ipmi_sim_class_init,
2225 };
2226 
2227 static void ipmi_sim_register_types(void)
2228 {
2229     type_register_static(&ipmi_sim_type);
2230 }
2231 
2232 type_init(ipmi_sim_register_types)
2233