path: root/sys/dev/coreboot/coreboot.c

/*
 * Copyright (c) 2026 Abdelkader Boudih <freebsd@seuros.com>
 *
 * SPDX-License-Identifier: BSD-2-Clause
 */

/*
 * coreboot(4) - FreeBSD driver for coreboot firmware tables
 *
 * Discovers the coreboot table by scanning low memory for the "LBIO"
 * signature, follows CB_TAG_FORWARD to the high-memory table, and
 * exposes firmware information through sysctl(9) and character devices.
 */

#include <sys/systm.h>
#include <sys/bus.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/module.h>
#include <sys/rman.h>
#include <sys/sysctl.h>

#include <vm/vm.h>
#include <vm/vm_param.h>
#include <vm/pmap.h>

#include <machine/bus.h>
#include <machine/resource.h>

#include <dev/coreboot/coreboot.h>

static struct coreboot_softc *coreboot_sc;

/*
 * Debug verbosity control, non-zero enables extra output.
 * Tunable via loader.conf: hw.coreboot.debug=1
 * Runtime: sysctl hw.coreboot.debug=1
 * Registered dynamically under hw.coreboot in
 * coreboot_register_sysctls().
 */
static int coreboot_debug = 0;
TUNABLE_INT("hw.coreboot.debug", &coreboot_debug);

struct coreboot_softc *
coreboot_get_softc(void)
{
	return (coreboot_sc);
}

static void	coreboot_identify(driver_t *, device_t);
static int	coreboot_probe(device_t);
static int	coreboot_attach(device_t);
static int	coreboot_detach(device_t);
static int	coreboot_modevent(module_t, int, void *);

/*
 * Scan a physical memory region for the "LBIO" signature.
 * Returns the physical address of the header, or 0 if not found.
 */
static vm_paddr_t
coreboot_scan_region(vm_paddr_t start, vm_paddr_t end)
{
	vm_paddr_t addr;
	void *va;
	struct cb_header *hdr;

	for (addr = (start == 0 ? CB_SCAN_LOW_STEP : start); addr < end;
	    addr += CB_SCAN_LOW_STEP) {
		va = pmap_mapbios(addr, sizeof(struct cb_header));
		if (va == NULL)
			continue;

		hdr = (struct cb_header *)va;
		if (memcmp(hdr->signature, CB_HEADER_SIGNATURE,
		    CB_HEADER_SIG_LEN) == 0) {
			pmap_unmapbios(va, sizeof(struct cb_header));
			return (addr);
		}
		pmap_unmapbios(va, sizeof(struct cb_header));
	}
	return (0);
}

/*
 * Validate length fields in the header before using them for mappings
 * and pointer arithmetic.
 */
static int
coreboot_sanitize_header(const struct cb_header *hdr, vm_size_t *map_size)
{
	uint64_t total;

	if (hdr->header_bytes < sizeof(*hdr) ||
	    hdr->header_bytes > CB_MAX_HEADER_BYTES)
		return (EINVAL);
	if ((hdr->header_bytes % CB_TABLE_ALIGN) != 0)
		return (EINVAL);
	if (hdr->table_bytes > CB_MAX_TABLE_BYTES)
		return (EINVAL);
	if ((hdr->table_bytes % CB_TABLE_ALIGN) != 0)
		return (EINVAL);

	total = (uint64_t)hdr->header_bytes + (uint64_t)hdr->table_bytes;
	if (total > CB_MAX_TABLE_MAP_BYTES)
		return (EINVAL);

	*map_size = (vm_size_t)total;
	return (0);
}

/*
 * Validate the coreboot header checksum.
 * Returns 0 on success, non-zero on failure.
 */
static int
coreboot_validate_header(struct cb_header *hdr, vm_size_t mapped_len)
{
	uint16_t cksum;

	if (hdr->header_bytes > mapped_len)
		return (EINVAL);

	cksum = cb_checksum(hdr, hdr->header_bytes);
	if (cksum != 0)
		return (EINVAL);

	return (0);
}

/*
 * Validate checksum for the table payload.
 */
static int
coreboot_validate_table(struct cb_header *hdr, vm_size_t mapped_len)
{
	const uint8_t *table;
	uint16_t cksum;

	if (hdr->table_bytes == 0)
		return (0);

	if ((uint64_t)hdr->header_bytes + (uint64_t)hdr->table_bytes >
	    mapped_len)
		return (EINVAL);
	if (hdr->table_checksum > UINT16_MAX)
		return (EINVAL);

	table = (const uint8_t *)hdr + hdr->header_bytes;
	cksum = cb_checksum(table, hdr->table_bytes);
	if (cksum != (uint16_t)hdr->table_checksum)
		return (EINVAL);

	return (0);
}

static void
coreboot_copy_bounded_string(const char *src, size_t maxlen, char *dst,
    size_t dstlen)
{
	size_t slen;

	if (dstlen == 0)
		return;

	slen = strnlen(src, maxlen);
	if (slen >= dstlen)
		slen = dstlen - 1;
	memcpy(dst, src, slen);
	dst[slen] = '\0';
}

/*
 * Copy a coreboot string record into a destination buffer.
 */
static void
coreboot_copy_string(const struct cb_string *rec, char *dst, size_t dstlen)
{
	size_t slen;

	slen = rec->size - sizeof(struct cb_record);
	if (slen >= dstlen)
		slen = dstlen - 1;
	memcpy(dst, rec->string, slen);
	dst[slen] = '\0';

	/* Strip trailing whitespace/nulls */
	while (slen > 0 && (dst[slen - 1] == '\0' || dst[slen - 1] == ' ' ||
	    dst[slen - 1] == '\n'))
		dst[--slen] = '\0';
}

/*
 * Extract mainboard vendor and part number from the strings field.
 */
static void
coreboot_parse_mainboard(struct coreboot_softc *sc,
    const struct cb_mainboard *mb)
{
	const char *strings = (const char *)mb->strings;
	size_t total = mb->size - offsetof(struct cb_mainboard, strings);
	uint8_t vendor_off, part_off;

	vendor_off = mb->vendor_idx;
	part_off = mb->part_idx;

	if (vendor_off < total)
		coreboot_copy_bounded_string(strings + vendor_off,
		    total - vendor_off, sc->mb_vendor, sizeof(sc->mb_vendor));
	if (part_off < total)
		coreboot_copy_bounded_string(strings + part_off,
		    total - part_off, sc->mb_part, sizeof(sc->mb_part));
}

/*
 * Parse all records in the coreboot table and populate softc.
 */
static void
coreboot_parse_table(struct coreboot_softc *sc, struct cb_header *hdr)
{
	uint8_t *entry;
	uint8_t *table_end;
	struct cb_record *rec;

	entry = (uint8_t *)hdr + hdr->header_bytes;
	table_end = entry + hdr->table_bytes;

	while ((size_t)(table_end - entry) >= sizeof(struct cb_record)) {
		size_t rec_size;

		rec = (struct cb_record *)entry;
		rec_size = rec->size;

		if (rec_size < sizeof(struct cb_record))
			break;
		if (rec_size > (size_t)(table_end - entry))
			break;

		switch (rec->tag) {
		case CB_TAG_VERSION:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->version, sizeof(sc->version));
			break;

		case CB_TAG_EXTRA_VERSION:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->extra_version, sizeof(sc->extra_version));
			break;

		case CB_TAG_BUILD:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->build, sizeof(sc->build));
			break;

		case CB_TAG_COMPILE_TIME:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->compile_time, sizeof(sc->compile_time));
			break;

		case CB_TAG_COMPILER:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->compiler, sizeof(sc->compiler));
			break;

		case CB_TAG_PLATFORM_BLOB_VERSION:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->platform_blob_version,
			    sizeof(sc->platform_blob_version));
			break;

		case CB_TAG_SERIALNO:
			coreboot_copy_string((struct cb_string *)rec,
			    sc->serialno, sizeof(sc->serialno));
			break;

		case CB_TAG_VERSION_TIMESTAMP: {
			struct cb_version_timestamp *ts =
			    (struct cb_version_timestamp *)rec;

			if (rec_size < sizeof(*ts))
				break;
			sc->version_timestamp = ts->timestamp;
			sc->has_version_timestamp = 1;
			break;
		}

		case CB_TAG_MAINBOARD:
			if (rec_size < offsetof(struct cb_mainboard, strings))
				break;
			coreboot_parse_mainboard(sc,
			    (struct cb_mainboard *)rec);
			break;

		case CB_TAG_SERIAL: {
			struct cb_serial *ser = (struct cb_serial *)rec;

			if (rec_size < sizeof(*ser))
				break;
			sc->serial_baseaddr = ser->baseaddr;
			sc->serial_baud = ser->baud;
			sc->serial_regwidth = ser->regwidth;
			sc->has_serial = 1;
			break;
		}

		case CB_TAG_TSC_INFO: {
			struct cb_tsc_info *tsc = (struct cb_tsc_info *)rec;

			if (rec_size < sizeof(*tsc))
				break;
			sc->tsc_freq_khz = tsc->freq_khz;
			sc->has_tsc_info = 1;
			break;
		}

		case CB_TAG_PCIE: {
			struct cb_pcie *pcie = (struct cb_pcie *)rec;

			if (rec_size < sizeof(*pcie))
				break;
			sc->pcie_ctrl_base = pcie->ctrl_base;
			sc->has_pcie = 1;
			break;
		}

		case CB_TAG_BOOT_MEDIA_PARAMS: {
			struct cb_boot_media_params *bmp =
			    (struct cb_boot_media_params *)rec;

			if (rec_size < sizeof(*bmp))
				break;
			sc->fmap_offset = bmp->fmap_offset;
			sc->cbfs_offset = bmp->cbfs_offset;
			sc->cbfs_size = bmp->cbfs_size;
			sc->boot_media_size = bmp->boot_media_size;
			sc->has_boot_media = 1;
			break;
		}

		case CB_TAG_MMC_INFO: {
			struct cb_mmc_info *mmc = (struct cb_mmc_info *)rec;

			if (rec_size < sizeof(*mmc))
				break;
			sc->mmc_early_cmd1_status = mmc->early_cmd1_status;
			sc->has_mmc_info = 1;
			break;
		}

		case CB_TAG_CBMEM_CONSOLE: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->console_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_console = 1;
			break;
		}

		case CB_TAG_CBMEM_ENTRY: {
			struct cb_cbmem_entry *ent =
			    (struct cb_cbmem_entry *)rec;

			if (rec_size < sizeof(*ent))
				break;
			if (sc->cbmem_count < CB_MAX_CBMEM_ENTRIES) {
				struct cbmem_entry_info *info =
				    &sc->cbmem_entries[sc->cbmem_count];
				info->id = ent->id;
				info->address = ent->address;
				info->size = ent->entry_size;
				strlcpy(info->name, cbmem_id_to_name(ent->id),
				    sizeof(info->name));
				sc->cbmem_count++;
			}
			break;
		}

		case CB_TAG_BOARD_CONFIG: {
			struct cb_board_config *bc =
			    (struct cb_board_config *)rec;

			if (rec_size < sizeof(*bc))
				break;
			sc->fw_config = bc->fw_config;
			sc->board_id = bc->board_id;
			sc->ram_code = bc->ram_code;
			sc->sku_id = bc->sku_id;
			sc->has_board_config = 1;
			break;
		}

		case CB_TAG_MAC_ADDRS: {
			struct cb_macs *macs = (struct cb_macs *)rec;
			uint32_t i, count;

			if (rec_size < sizeof(*macs))
				break;
			count = macs->count;
			if (count > CB_MAX_MAC_ADDRS)
				count = CB_MAX_MAC_ADDRS;
			if (rec_size < sizeof(*macs) +
			    count * sizeof(struct cb_mac_address))
				break;
			for (i = 0; i < count; i++)
				sc->macs[i] = macs->entries[i];
			sc->mac_count = count;
			break;
		}

		case CB_TAG_ACPI_RSDP: {
			struct cb_acpi_rsdp *rsdp =
			    (struct cb_acpi_rsdp *)rec;

			if (rec_size < sizeof(*rsdp))
				break;
			sc->acpi_rsdp = rsdp->rsdp_pointer;
			sc->has_acpi_rsdp = 1;
			break;
		}

		case CB_TAG_SPI_FLASH: {
			struct cb_spi_flash *spi =
			    (struct cb_spi_flash *)rec;

			if (rec_size < sizeof(*spi))
				break;
			sc->spi_flash_size = spi->flash_size;
			sc->spi_sector_size = spi->sector_size;
			sc->spi_erase_cmd = spi->erase_cmd;
			sc->spi_flags = spi->flags;
			sc->has_spi_flash = 1;
			break;
		}

		case CB_TAG_CONSOLE: {
			struct cb_console *con = (struct cb_console *)rec;

			if (rec_size < sizeof(*con))
				break;
			sc->console_type = con->type;
			sc->has_console_type = 1;
			break;
		}

		case CB_TAG_FRAMEBUFFER: {
			struct cb_framebuffer *fb =
			    (struct cb_framebuffer *)rec;

			if (rec_size < CB_FRAMEBUFFER_MIN_SIZE)
				break;
			sc->fb_addr = fb->physical_address;
			sc->fb_x_res = fb->x_resolution;
			sc->fb_y_res = fb->y_resolution;
			sc->fb_stride = fb->bytes_per_line;
			sc->fb_bpp = fb->bits_per_pixel;
			sc->has_framebuffer = 1;
			break;
		}

		case CB_TAG_GPIO: {
			struct cb_gpios *gpios = (struct cb_gpios *)rec;
			uint32_t i, count;

			if (rec_size < sizeof(*gpios))
				break;
			count = gpios->count;
			if (count > CB_MAX_GPIOS)
				count = CB_MAX_GPIOS;
			if (rec_size < sizeof(*gpios) +
			    count * sizeof(struct cb_gpio))
				break;
			for (i = 0; i < count; i++)
				sc->gpios[i] = gpios->entries[i];
			sc->gpio_count = count;
			break;
		}

		case CB_TAG_TPM_PPI_HANDOFF: {
			struct cb_tpm_ppi *tpm = (struct cb_tpm_ppi *)rec;

			if (rec_size < sizeof(*tpm))
				break;
			sc->tpm_ppi_addr = tpm->ppi_address;
			sc->tpm_version = tpm->tpm_version;
			sc->has_tpm = 1;
			break;
		}

		case CB_TAG_TIMESTAMPS: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->timestamps_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_timestamps = 1;
			break;
		}

		case CB_TAG_ACPI_GNVS: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->acpi_gnvs_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_acpi_gnvs = 1;
			break;
		}

		case CB_TAG_ACPI_CNVS: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->acpi_cnvs_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_acpi_cnvs = 1;
			break;
		}

		case CB_TAG_VPD: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->vpd_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_vpd = 1;
			break;
		}

		case CB_TAG_WIFI_CALIBRATION: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->wifi_cal_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_wifi_cal = 1;
			break;
		}

		case CB_TAG_FMAP: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->fmap_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_fmap = 1;
			break;
		}

		case CB_TAG_VBOOT_WORKBUF: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->vboot_workbuf_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_vboot_workbuf = 1;
			break;
		}

		case CB_TAG_TYPE_C_INFO: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->type_c_info_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_type_c_info = 1;
			break;
		}

		case CB_TAG_ROOT_BRIDGE_INFO: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->root_bridge_info_paddr =
			    (vm_paddr_t)ref->cbmem_addr;
			sc->has_root_bridge_info = 1;
			break;
		}

		case CB_TAG_TPM_CB_LOG: {
			struct cb_cbmem_ref *ref = (struct cb_cbmem_ref *)rec;

			if (rec_size < sizeof(*ref))
				break;
			sc->tpm_log_paddr = (vm_paddr_t)ref->cbmem_addr;
			sc->has_tpm_log = 1;
			break;
		}

		case CB_TAG_SMMSTOREV2: {
			struct cb_smmstorev2 *smm =
			    (struct cb_smmstorev2 *)rec;

			if (rec_size < CB_SMMSTOREV2_BASE_SIZE)
				break;
			sc->smmstore_num_blocks = smm->num_blocks;
			sc->smmstore_block_size = smm->block_size;
			sc->smmstore_com_buffer = smm->com_buffer;
			sc->smmstore_apm_cmd = smm->apm_cmd;
			/* 64-bit mmap_addr only present in newer coreboot */
			if (rec_size >= sizeof(*smm))
				sc->smmstore_mmap_addr = smm->mmap_addr;
			else
				sc->smmstore_mmap_addr =
				    (uint64_t)smm->mmap_addr_lo;
			sc->has_smmstore = 1;
			break;
		}

		default:
			break;
		}

		entry += rec_size;
	}
}

/*
 * Table-driven sysctl registration.
 *
 * Each leaf descriptor specifies the parent node, name, type, data offset
 * into softc, a guard flag offset (or -1 for unconditional), and flags.
 * Nodes that group related leaves are indexed by cb_sysctl_node.
 */

/* Node indices for parent selection */
enum cb_sysctl_node {
	CB_NODE_ROOT = 0,
	CB_NODE_MAINBOARD,
	CB_NODE_SERIAL,
	CB_NODE_BOARD,
	CB_NODE_BOOT_MEDIA,
	CB_NODE_SPI_FLASH,
	CB_NODE_FRAMEBUFFER,
	CB_NODE_TPM,
	CB_NODE_SMMSTORE,
	CB_NODE_CBMEM_REFS,
	CB_NODE_COUNT
};

/* Sysctl value type discriminator */
enum cb_sysctl_type {
	CB_SYSCTL_U8,
	CB_SYSCTL_U16,
	CB_SYSCTL_U32,
	CB_SYSCTL_S32,
	CB_SYSCTL_U64,
	CB_SYSCTL_ULONG,
	CB_SYSCTL_STRING,
};

/*
 * Guard mode: how to decide whether a leaf should be registered.
 *   STR_NONEMPTY: check that the char[] at guard_off is non-empty
 *   FLAG_SET:     check that the int at guard_off is non-zero
 *   ALWAYS:       unconditional (guard_off ignored)
 */
enum cb_sysctl_guard {
	CB_GUARD_ALWAYS,
	CB_GUARD_FLAG_SET,
	CB_GUARD_STR_NONEMPTY,
};

struct cb_sysctl_node_desc {
	enum cb_sysctl_node	id;
	enum cb_sysctl_node	parent;
	const char		*name;
	const char		*desc;
};

struct cb_sysctl_leaf {
	enum cb_sysctl_node	parent;
	const char		*name;
	enum cb_sysctl_type	type;
	size_t			data_off;
	enum cb_sysctl_guard	guard;
	size_t			guard_off;
	int			flags;
	const char		*desc;
};

/* Helper macros for field offset within coreboot_softc */
#define SC_OFF(field)	offsetof(struct coreboot_softc, field)

static const struct cb_sysctl_node_desc cb_nodes[] = {
	{ CB_NODE_MAINBOARD,	CB_NODE_ROOT,	"mainboard",
	    "Mainboard information" },
	{ CB_NODE_SERIAL,	CB_NODE_ROOT,	"serial",
	    "Serial port" },
	{ CB_NODE_BOARD,	CB_NODE_ROOT,	"board",
	    "Board identification" },
	{ CB_NODE_BOOT_MEDIA,	CB_NODE_ROOT,	"boot_media",
	    "Boot media parameters" },
	{ CB_NODE_SPI_FLASH,	CB_NODE_ROOT,	"spi_flash",
	    "SPI flash parameters" },
	{ CB_NODE_FRAMEBUFFER,	CB_NODE_ROOT,	"framebuffer",
	    "Framebuffer information" },
	{ CB_NODE_TPM,		CB_NODE_ROOT,	"tpm",
	    "TPM information" },
	{ CB_NODE_SMMSTORE,	CB_NODE_ROOT,	"smmstore",
	    "SMMSTORE v2 configuration" },
	{ CB_NODE_CBMEM_REFS,	CB_NODE_ROOT,	"cbmem_refs",
	    "Additional CBMEM reference addresses" },
};

static const struct cb_sysctl_leaf cb_leaves[] = {
	/* Root-level strings (guarded by non-empty string) */
	{ CB_NODE_ROOT, "version", CB_SYSCTL_STRING,
	    SC_OFF(version), CB_GUARD_STR_NONEMPTY, SC_OFF(version),
	    CTLFLAG_RD, "Firmware version" },
	{ CB_NODE_ROOT, "build", CB_SYSCTL_STRING,
	    SC_OFF(build), CB_GUARD_STR_NONEMPTY, SC_OFF(build),
	    CTLFLAG_RD, "Build date" },
	{ CB_NODE_ROOT, "compile_time", CB_SYSCTL_STRING,
	    SC_OFF(compile_time), CB_GUARD_STR_NONEMPTY, SC_OFF(compile_time),
	    CTLFLAG_RD, "Firmware compile time" },
	{ CB_NODE_ROOT, "compiler", CB_SYSCTL_STRING,
	    SC_OFF(compiler), CB_GUARD_STR_NONEMPTY, SC_OFF(compiler),
	    CTLFLAG_RD, "Compiler info" },
	{ CB_NODE_ROOT, "extra_version", CB_SYSCTL_STRING,
	    SC_OFF(extra_version), CB_GUARD_STR_NONEMPTY, SC_OFF(extra_version),
	    CTLFLAG_RD, "Extra version info" },
	{ CB_NODE_ROOT, "serialno", CB_SYSCTL_STRING,
	    SC_OFF(serialno), CB_GUARD_STR_NONEMPTY, SC_OFF(serialno),
	    CTLFLAG_RD, "Serial number" },
	{ CB_NODE_ROOT, "platform_blob_version", CB_SYSCTL_STRING,
	    SC_OFF(platform_blob_version), CB_GUARD_STR_NONEMPTY,
	    SC_OFF(platform_blob_version),
	    CTLFLAG_RD, "Platform blob version" },

	/* Root-level scalars */
	{ CB_NODE_ROOT, "version_timestamp", CB_SYSCTL_U32,
	    SC_OFF(version_timestamp), CB_GUARD_FLAG_SET,
	    SC_OFF(has_version_timestamp),
	    CTLFLAG_RD, "Firmware version timestamp" },
	{ CB_NODE_ROOT, "table_addr", CB_SYSCTL_U64,
	    SC_OFF(table_paddr), CB_GUARD_ALWAYS, 0,
	    CTLFLAG_RD, "Physical address of coreboot table" },
	{ CB_NODE_ROOT, "table_size", CB_SYSCTL_ULONG,
	    SC_OFF(table_size), CB_GUARD_ALWAYS, 0,
	    CTLFLAG_RD, "Total coreboot table size" },
	{ CB_NODE_ROOT, "tsc_freq_khz", CB_SYSCTL_U32,
	    SC_OFF(tsc_freq_khz), CB_GUARD_FLAG_SET, SC_OFF(has_tsc_info),
	    CTLFLAG_RD, "TSC frequency in kHz" },
	{ CB_NODE_ROOT, "pcie_ctrl_base", CB_SYSCTL_U64,
	    SC_OFF(pcie_ctrl_base), CB_GUARD_FLAG_SET, SC_OFF(has_pcie),
	    CTLFLAG_RD, "PCIe controller base address" },
	{ CB_NODE_ROOT, "acpi_rsdp", CB_SYSCTL_U64,
	    SC_OFF(acpi_rsdp), CB_GUARD_FLAG_SET, SC_OFF(has_acpi_rsdp),
	    CTLFLAG_RD, "ACPI RSDP physical address" },
	{ CB_NODE_ROOT, "mmc_early_cmd1_status", CB_SYSCTL_S32,
	    SC_OFF(mmc_early_cmd1_status), CB_GUARD_FLAG_SET,
	    SC_OFF(has_mmc_info),
	    CTLFLAG_RD, "Early eMMC CMD1 status" },
	{ CB_NODE_ROOT, "console_type", CB_SYSCTL_U16,
	    SC_OFF(console_type), CB_GUARD_FLAG_SET, SC_OFF(has_console_type),
	    CTLFLAG_RD, "Firmware console type" },
	{ CB_NODE_ROOT, "timestamps_addr", CB_SYSCTL_U64,
	    SC_OFF(timestamps_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_timestamps),
	    CTLFLAG_RD, "Timestamps CBMEM physical address" },

	/* Mainboard children */
	{ CB_NODE_MAINBOARD, "vendor", CB_SYSCTL_STRING,
	    SC_OFF(mb_vendor), CB_GUARD_STR_NONEMPTY, SC_OFF(mb_vendor),
	    CTLFLAG_RD, "Board vendor" },
	{ CB_NODE_MAINBOARD, "part", CB_SYSCTL_STRING,
	    SC_OFF(mb_part), CB_GUARD_STR_NONEMPTY, SC_OFF(mb_part),
	    CTLFLAG_RD, "Board part number" },

	/* Serial children */
	{ CB_NODE_SERIAL, "baseaddr", CB_SYSCTL_U32,
	    SC_OFF(serial_baseaddr), CB_GUARD_FLAG_SET, SC_OFF(has_serial),
	    CTLFLAG_RD, "Base address" },
	{ CB_NODE_SERIAL, "baud", CB_SYSCTL_U32,
	    SC_OFF(serial_baud), CB_GUARD_FLAG_SET, SC_OFF(has_serial),
	    CTLFLAG_RD, "Baud rate" },
	{ CB_NODE_SERIAL, "regwidth", CB_SYSCTL_U32,
	    SC_OFF(serial_regwidth), CB_GUARD_FLAG_SET, SC_OFF(has_serial),
	    CTLFLAG_RD, "Register width" },

	/* Board config children */
	{ CB_NODE_BOARD, "fw_config", CB_SYSCTL_U64,
	    SC_OFF(fw_config), CB_GUARD_FLAG_SET, SC_OFF(has_board_config),
	    CTLFLAG_RD, "Firmware configuration bitmask" },
	{ CB_NODE_BOARD, "board_id", CB_SYSCTL_U32,
	    SC_OFF(board_id), CB_GUARD_FLAG_SET, SC_OFF(has_board_config),
	    CTLFLAG_RD, "Board ID" },
	{ CB_NODE_BOARD, "ram_code", CB_SYSCTL_U32,
	    SC_OFF(ram_code), CB_GUARD_FLAG_SET, SC_OFF(has_board_config),
	    CTLFLAG_RD, "RAM code" },
	{ CB_NODE_BOARD, "sku_id", CB_SYSCTL_U32,
	    SC_OFF(sku_id), CB_GUARD_FLAG_SET, SC_OFF(has_board_config),
	    CTLFLAG_RD, "SKU ID" },

	/* Boot media children */
	{ CB_NODE_BOOT_MEDIA, "fmap_offset", CB_SYSCTL_U64,
	    SC_OFF(fmap_offset), CB_GUARD_FLAG_SET, SC_OFF(has_boot_media),
	    CTLFLAG_RD, "FMAP offset from boot media start" },
	{ CB_NODE_BOOT_MEDIA, "cbfs_offset", CB_SYSCTL_U64,
	    SC_OFF(cbfs_offset), CB_GUARD_FLAG_SET, SC_OFF(has_boot_media),
	    CTLFLAG_RD, "CBFS offset from boot media start" },
	{ CB_NODE_BOOT_MEDIA, "cbfs_size", CB_SYSCTL_U64,
	    SC_OFF(cbfs_size), CB_GUARD_FLAG_SET, SC_OFF(has_boot_media),
	    CTLFLAG_RD, "CBFS size in bytes" },
	{ CB_NODE_BOOT_MEDIA, "size", CB_SYSCTL_U64,
	    SC_OFF(boot_media_size), CB_GUARD_FLAG_SET, SC_OFF(has_boot_media),
	    CTLFLAG_RD, "Boot media size in bytes" },

	/* SPI flash children */
	{ CB_NODE_SPI_FLASH, "size", CB_SYSCTL_U32,
	    SC_OFF(spi_flash_size), CB_GUARD_FLAG_SET, SC_OFF(has_spi_flash),
	    CTLFLAG_RD, "Flash size in bytes" },
	{ CB_NODE_SPI_FLASH, "sector_size", CB_SYSCTL_U32,
	    SC_OFF(spi_sector_size), CB_GUARD_FLAG_SET, SC_OFF(has_spi_flash),
	    CTLFLAG_RD, "Sector size in bytes" },
	{ CB_NODE_SPI_FLASH, "erase_cmd", CB_SYSCTL_U8,
	    SC_OFF(spi_erase_cmd), CB_GUARD_FLAG_SET, SC_OFF(has_spi_flash),
	    CTLFLAG_RD, "Erase command byte" },

	/* Framebuffer children */
	{ CB_NODE_FRAMEBUFFER, "addr", CB_SYSCTL_U64,
	    SC_OFF(fb_addr), CB_GUARD_FLAG_SET, SC_OFF(has_framebuffer),
	    CTLFLAG_RD, "Physical address" },
	{ CB_NODE_FRAMEBUFFER, "x_res", CB_SYSCTL_U32,
	    SC_OFF(fb_x_res), CB_GUARD_FLAG_SET, SC_OFF(has_framebuffer),
	    CTLFLAG_RD, "Horizontal resolution" },
	{ CB_NODE_FRAMEBUFFER, "y_res", CB_SYSCTL_U32,
	    SC_OFF(fb_y_res), CB_GUARD_FLAG_SET, SC_OFF(has_framebuffer),
	    CTLFLAG_RD, "Vertical resolution" },
	{ CB_NODE_FRAMEBUFFER, "bpp", CB_SYSCTL_U8,
	    SC_OFF(fb_bpp), CB_GUARD_FLAG_SET, SC_OFF(has_framebuffer),
	    CTLFLAG_RD, "Bits per pixel" },

	/* TPM children */
	{ CB_NODE_TPM, "version", CB_SYSCTL_U8,
	    SC_OFF(tpm_version), CB_GUARD_FLAG_SET, SC_OFF(has_tpm),
	    CTLFLAG_RD, "TPM version (1=1.2, 2=2.0)" },
	{ CB_NODE_TPM, "ppi_addr", CB_SYSCTL_U32,
	    SC_OFF(tpm_ppi_addr), CB_GUARD_FLAG_SET, SC_OFF(has_tpm),
	    CTLFLAG_RD, "PPI address" },
	{ CB_NODE_TPM, "cblog_addr", CB_SYSCTL_U64,
	    SC_OFF(tpm_log_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_tpm_log),
	    CTLFLAG_RD, "TPM event log physical address" },

	/* SMMSTORE children */
	{ CB_NODE_SMMSTORE, "num_blocks", CB_SYSCTL_U32,
	    SC_OFF(smmstore_num_blocks), CB_GUARD_FLAG_SET,
	    SC_OFF(has_smmstore),
	    CTLFLAG_RD, "Number of blocks" },
	{ CB_NODE_SMMSTORE, "block_size", CB_SYSCTL_U32,
	    SC_OFF(smmstore_block_size), CB_GUARD_FLAG_SET,
	    SC_OFF(has_smmstore),
	    CTLFLAG_RD, "Block size in bytes" },
	{ CB_NODE_SMMSTORE, "mmap_addr", CB_SYSCTL_U64,
	    SC_OFF(smmstore_mmap_addr), CB_GUARD_FLAG_SET,
	    SC_OFF(has_smmstore),
	    CTLFLAG_RD, "Memory-mapped address" },
	{ CB_NODE_SMMSTORE, "com_buffer", CB_SYSCTL_U32,
	    SC_OFF(smmstore_com_buffer), CB_GUARD_FLAG_SET,
	    SC_OFF(has_smmstore),
	    CTLFLAG_RD, "Communication buffer address" },
	{ CB_NODE_SMMSTORE, "apm_cmd", CB_SYSCTL_U8,
	    SC_OFF(smmstore_apm_cmd), CB_GUARD_FLAG_SET,
	    SC_OFF(has_smmstore),
	    CTLFLAG_RD, "APM command byte" },

	/* CBMEM reference addresses */
	{ CB_NODE_CBMEM_REFS, "acpi_gnvs", CB_SYSCTL_U64,
	    SC_OFF(acpi_gnvs_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_acpi_gnvs),
	    CTLFLAG_RD, "ACPI GNVS CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "acpi_cnvs", CB_SYSCTL_U64,
	    SC_OFF(acpi_cnvs_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_acpi_cnvs),
	    CTLFLAG_RD, "ACPI CNVS CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "vpd", CB_SYSCTL_U64,
	    SC_OFF(vpd_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_vpd),
	    CTLFLAG_RD, "VPD CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "wifi_calibration", CB_SYSCTL_U64,
	    SC_OFF(wifi_cal_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_wifi_cal),
	    CTLFLAG_RD, "WiFi calibration CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "fmap", CB_SYSCTL_U64,
	    SC_OFF(fmap_paddr), CB_GUARD_FLAG_SET, SC_OFF(has_fmap),
	    CTLFLAG_RD, "FMAP CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "vboot_workbuf", CB_SYSCTL_U64,
	    SC_OFF(vboot_workbuf_paddr), CB_GUARD_FLAG_SET,
	    SC_OFF(has_vboot_workbuf),
	    CTLFLAG_RD, "Vboot work buffer CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "type_c_info", CB_SYSCTL_U64,
	    SC_OFF(type_c_info_paddr), CB_GUARD_FLAG_SET,
	    SC_OFF(has_type_c_info),
	    CTLFLAG_RD, "Type-C info CBMEM physical address" },
	{ CB_NODE_CBMEM_REFS, "root_bridge_info", CB_SYSCTL_U64,
	    SC_OFF(root_bridge_info_paddr), CB_GUARD_FLAG_SET,
	    SC_OFF(has_root_bridge_info),
	    CTLFLAG_RD, "Root bridge info CBMEM physical address" },
};

/*
 * Check whether a leaf's guard condition is satisfied.
 */
static int
cb_sysctl_guard_check(const struct cb_sysctl_leaf *leaf,
    const struct coreboot_softc *sc)
{
	const char *base;

	base = (const char *)sc;
	switch (leaf->guard) {
	case CB_GUARD_ALWAYS:
		return (1);
	case CB_GUARD_FLAG_SET:
		return (*(const int *)(base + leaf->guard_off) != 0);
	case CB_GUARD_STR_NONEMPTY:
		return (*(base + leaf->guard_off) != '\0');
	}
	return (0);
}

/*
 * Type-to-handler mapping for sysctl_add_oid().
 * Mirrors the SYSCTL_ADD_* macros but avoids their CTASSERT on flags.
 */
static const struct {
	int		ctltype;
	int		(*handler)(SYSCTL_HANDLER_ARGS);
	const char	*fmt;
} cb_sysctl_types[] = {
	[CB_SYSCTL_U8]     = { CTLTYPE_U8,	sysctl_handle_8,	"CU" },
	[CB_SYSCTL_U16]    = { CTLTYPE_U16,	sysctl_handle_16,	"SU" },
	[CB_SYSCTL_U32]    = { CTLTYPE_U32,	sysctl_handle_32,	"IU" },
	[CB_SYSCTL_S32]    = { CTLTYPE_S32,	sysctl_handle_32,	"I" },
	[CB_SYSCTL_U64]    = { CTLTYPE_U64,	sysctl_handle_64,	"QU" },
	[CB_SYSCTL_ULONG]  = { CTLTYPE_ULONG,	sysctl_handle_long,	"LU" },
	[CB_SYSCTL_STRING] = { CTLTYPE_STRING,	sysctl_handle_string,	"A" },
};

/*
 * Add a single sysctl leaf under the given parent OID.
 */
static void
cb_sysctl_add_leaf(struct sysctl_ctx_list *ctx, struct sysctl_oid *parent,
    const struct cb_sysctl_leaf *leaf, struct coreboot_softc *sc)
{
	void *ptr;

	ptr = (char *)sc + leaf->data_off;

	sysctl_add_oid(ctx, SYSCTL_CHILDREN(parent), OID_AUTO,
	    leaf->name,
	    cb_sysctl_types[leaf->type].ctltype | CTLFLAG_MPSAFE | leaf->flags,
	    ptr, 0,
	    cb_sysctl_types[leaf->type].handler,
	    cb_sysctl_types[leaf->type].fmt,
	    __DESCR(leaf->desc), NULL);
}

/*
 * Register the sysctl tree under hw.coreboot.*
 *
 * Static leaves and nodes are driven by the cb_leaves[] and cb_nodes[]
 * tables.  Dynamic entries (CBMEM, MAC, GPIO) that require loops over
 * runtime-determined counts are handled explicitly below the table loop.
 */
static void
coreboot_register_sysctls(struct coreboot_softc *sc)
{
	struct sysctl_oid *nodes[CB_NODE_COUNT];
	struct sysctl_oid *oid_cbmem, *oid_entry;
	struct sysctl_oid *oid_mac, *oid_gpio, *oid_pin;
	char numstr[8];
	uint32_t i;
	int any_cbref;

	sysctl_ctx_init(&sc->sysctl_ctx);
	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
	    SYSCTL_STATIC_CHILDREN(_hw), OID_AUTO, "coreboot",
	    CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "coreboot firmware information");

	if (sc->sysctl_tree == NULL)
		return;

	memset(nodes, 0, sizeof(nodes));
	nodes[CB_NODE_ROOT] = sc->sysctl_tree;

	SYSCTL_ADD_INT(&sc->sysctl_ctx,
	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "debug",
	    CTLFLAG_RW, &coreboot_debug, 0,
	    "Enable verbose coreboot diagnostics");

	/*
	 * Create intermediate nodes on demand.
	 *
	 * The mainboard node is special: it appears when either vendor or
	 * part is present.  The TPM node appears when has_tpm or has_tpm_log
	 * is set.  The cbmem_refs node appears when any of its children
	 * would be registered.  All other nodes are gated by the guard
	 * flags on their children (a node is created the first time a child
	 * needs it).
	 */

	/* Pre-create mainboard node if either string is populated */
	if (sc->mb_vendor[0] != '\0' || sc->mb_part[0] != '\0')
		nodes[CB_NODE_MAINBOARD] = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "mainboard",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "Mainboard information");

	/* TPM node appears for has_tpm OR has_tpm_log */
	if (sc->has_tpm || sc->has_tpm_log)
		nodes[CB_NODE_TPM] = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "tpm",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "TPM information");

	/* cbmem_refs node: created if any ref address is present */
	any_cbref = sc->has_acpi_gnvs || sc->has_acpi_cnvs || sc->has_vpd ||
	    sc->has_wifi_cal || sc->has_fmap || sc->has_vboot_workbuf ||
	    sc->has_type_c_info || sc->has_root_bridge_info;
	if (any_cbref)
		nodes[CB_NODE_CBMEM_REFS] = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "cbmem_refs",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
		    "Additional CBMEM reference addresses");

	/* Walk the leaf table and register matching entries */
	for (i = 0; i < nitems(cb_leaves); i++) {
		const struct cb_sysctl_leaf *leaf = &cb_leaves[i];
		enum cb_sysctl_node nid = leaf->parent;

		if (!cb_sysctl_guard_check(leaf, sc))
			continue;

		/* Lazily create the parent node if not yet instantiated */
		if (nodes[nid] == NULL) {
			const struct cb_sysctl_node_desc *nd;
			uint32_t j;

			for (j = 0; j < nitems(cb_nodes); j++) {
				if (cb_nodes[j].id == nid)
					break;
			}
			if (j >= nitems(cb_nodes))
				continue;
			nd = &cb_nodes[j];
			nodes[nid] = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(nodes[nd->parent]), OID_AUTO,
			    nd->name, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
			    nd->desc);
			if (nodes[nid] == NULL)
				continue;
		}

		cb_sysctl_add_leaf(&sc->sysctl_ctx, nodes[nid], leaf, sc);
	}

	/* --- Dynamic entries that don't fit the static table --- */

	/* CBMEM entry enumeration */
	if (sc->cbmem_count > 0) {
		oid_cbmem = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "cbmem",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "CBMEM entries");

		for (i = 0; i < sc->cbmem_count; i++) {
			struct cbmem_entry_info *info = &sc->cbmem_entries[i];

			snprintf(numstr, sizeof(numstr), "%u", i);
			oid_entry = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_cbmem), OID_AUTO, numstr,
			    CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
			    "CBMEM entry");

			SYSCTL_ADD_STRING(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_entry), OID_AUTO, "name",
			    CTLFLAG_RD, info->name, 0, "Entry name");

			SYSCTL_ADD_U32(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_entry), OID_AUTO, "id",
			    CTLFLAG_RD, &info->id, 0, "Entry ID (hex)");

			SYSCTL_ADD_U64(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_entry), OID_AUTO, "address",
			    CTLFLAG_RD, (uint64_t *)&info->address, 0,
			    "Physical address");

			SYSCTL_ADD_U32(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_entry), OID_AUTO, "size",
			    CTLFLAG_RD, &info->size, 0, "Entry size");
		}
	}

	/* Factory MAC addresses */
	if (sc->mac_count > 0) {
		oid_mac = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "mac",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
		    "Factory MAC addresses");

		for (i = 0; i < sc->mac_count; i++) {
			uint8_t *m = sc->macs[i].mac_addr;

			snprintf(numstr, sizeof(numstr), "%u", i);
			snprintf(sc->mac_strs[i], sizeof(sc->mac_strs[i]),
			    "%02x:%02x:%02x:%02x:%02x:%02x",
			    m[0], m[1], m[2], m[3], m[4], m[5]);

			SYSCTL_ADD_STRING(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_mac), OID_AUTO, numstr,
			    CTLFLAG_RD, sc->mac_strs[i], 0,
			    "MAC address");
		}
	}

	/* GPIO pins */
	if (sc->gpio_count > 0) {
		oid_gpio = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "gpio",
		    CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
		    "GPIO pin states");

		for (i = 0; i < sc->gpio_count; i++) {
			struct cb_gpio *g = &sc->gpios[i];

			snprintf(numstr, sizeof(numstr), "%u", i);
			oid_pin = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_gpio), OID_AUTO, numstr,
			    CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
			    "GPIO pin");

			/* Ensure name is NUL-terminated */
			g->name[sizeof(g->name) - 1] = '\0';
			SYSCTL_ADD_STRING(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_pin), OID_AUTO, "name",
			    CTLFLAG_RD, g->name, 0, "Pin name");

			SYSCTL_ADD_U32(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_pin), OID_AUTO, "port",
			    CTLFLAG_RD, &g->port, 0, "Port number");

			SYSCTL_ADD_U32(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_pin), OID_AUTO, "value",
			    CTLFLAG_RD, &g->value, 0, "Pin value");

			SYSCTL_ADD_U32(&sc->sysctl_ctx,
			    SYSCTL_CHILDREN(oid_pin), OID_AUTO, "polarity",
			    CTLFLAG_RD, &g->polarity, 0, "Pin polarity");
		}
	}

	/* Timestamp PROC sysctl */
	if (sc->has_timestamps)
		coreboot_timestamps_register(sc, sc->sysctl_tree);
}

/*
 * Map and validate a coreboot table at physical address pa.
 * On success, *vap points to the mapped table and *sizep is the total size.
 * The caller must pmap_unmapbios(*vap, *sizep) when done.
 */
static int
coreboot_map_table(vm_paddr_t pa, void **vap, vm_size_t *sizep)
{
	struct cb_header *hdr;
	void *va;
	vm_size_t map_size;
	int error;

	va = pmap_mapbios(pa, sizeof(struct cb_header));
	if (va == NULL)
		return (ENOMEM);

	hdr = (struct cb_header *)va;
	if (memcmp(hdr->signature, CB_HEADER_SIGNATURE,
	    CB_HEADER_SIG_LEN) != 0) {
		pmap_unmapbios(va, sizeof(struct cb_header));
		return (ENXIO);
	}

	error = coreboot_sanitize_header(hdr, &map_size);
	pmap_unmapbios(va, sizeof(struct cb_header));
	if (error != 0)
		return (ENXIO);

	va = pmap_mapbios(pa, map_size);
	if (va == NULL)
		return (ENOMEM);

	hdr = (struct cb_header *)va;
	if (coreboot_validate_header(hdr, map_size) != 0 ||
	    coreboot_validate_table(hdr, map_size) != 0) {
		pmap_unmapbios(va, map_size);
		return (ENXIO);
	}

	*vap = va;
	*sizep = map_size;
	return (0);
}

/*
 * Identify: scan low memory for "LBIO" signature and register a child
 */
static void
coreboot_identify(driver_t *driver, device_t parent)
{
	vm_paddr_t low_addr, real_addr;
	struct cb_header *hdr;
	uint8_t *entry, *table_end;
	struct cb_record *rec;
	device_t child;
	void *va;
	vm_size_t map_size;
	int error;

	if (!device_is_alive(parent))
		return;

	if (device_find_child(parent, "coreboot", -1) != NULL)
		return;

	low_addr = coreboot_scan_region(CB_SCAN_LOW_START, CB_SCAN_LOW_END);
	if (low_addr == 0)
		return;

	va = pmap_mapbios(low_addr, sizeof(struct cb_header));
	if (va == NULL)
		return;

	/* Scan already verified the signature; re-read to get sizes. */
	hdr = (struct cb_header *)va;
	error = coreboot_sanitize_header(hdr, &map_size);
	pmap_unmapbios(va, sizeof(struct cb_header));
	if (error != 0)
		return;

	va = pmap_mapbios(low_addr, map_size);
	if (va == NULL)
		return;

	hdr = (struct cb_header *)va;
	if (coreboot_validate_header(hdr, map_size) != 0 ||
	    coreboot_validate_table(hdr, map_size) != 0) {
		pmap_unmapbios(va, map_size);
		return;
	}

	/* Look for CB_TAG_FORWARD to find the real table in high memory */
	real_addr = low_addr;
	entry = (uint8_t *)hdr + hdr->header_bytes;
	table_end = entry + hdr->table_bytes;
	while ((size_t)(table_end - entry) >= sizeof(struct cb_record)) {
		size_t rec_size;

		rec = (struct cb_record *)entry;
		rec_size = rec->size;
		if (rec_size < sizeof(struct cb_record))
			break;
		if (rec_size > (size_t)(table_end - entry))
			break;
		if (rec->tag == CB_TAG_FORWARD) {
			if (rec_size >= sizeof(struct cb_forward)) {
				struct cb_forward *fwd;

				fwd = (struct cb_forward *)entry;
				real_addr = (vm_paddr_t)fwd->forward;
			}
			break;
		}
		entry += rec_size;
	}
	pmap_unmapbios(va, map_size);

	child = BUS_ADD_CHILD(parent, 5, "coreboot", DEVICE_UNIT_ANY);
	if (child == NULL)
		return;
	device_set_driver(child, driver);

	bus_set_resource(child, SYS_RES_MEMORY, 0, real_addr, PAGE_SIZE);
	device_set_desc(child, "coreboot firmware table");
}

/*
 * Probe: validate the coreboot header at the discovered address
 */
static int
coreboot_probe(device_t dev)
{
	vm_paddr_t pa;
	void *va;
	vm_size_t map_size;
	int error;

	pa = bus_get_resource_start(dev, SYS_RES_MEMORY, 0);
	if (pa == 0)
		return (ENXIO);

	error = coreboot_map_table(pa, &va, &map_size);
	if (error != 0)
		return (error);

	pmap_unmapbios(va, map_size);
	return (BUS_PROBE_SPECIFIC);
}

/*
 * Attach: map the full table, parse records, register sysctls and cdevs
 */
static int
coreboot_attach(device_t dev)
{
	struct coreboot_softc *sc;
	struct cb_header *hdr;
	vm_paddr_t pa;
	void *va;
	vm_size_t map_size;
	int error;

	sc = device_get_softc(dev);
	sc->dev = dev;

	pa = bus_get_resource_start(dev, SYS_RES_MEMORY, 0);

	error = coreboot_map_table(pa, &va, &map_size);
	if (error != 0) {
		device_printf(dev, "coreboot table validation failed at %#jx\n",
		    (uintmax_t)pa);
		return (error);
	}

	sc->table_paddr = pa;
	sc->table_size = map_size;
	sc->table_vaddr = va;

	hdr = (struct cb_header *)va;
	device_printf(dev, "coreboot table at %#jx (%u entries, %u bytes)\n",
	    (uintmax_t)pa, hdr->table_entries, hdr->table_bytes);

	coreboot_parse_table(sc, hdr);

	if (sc->version[0] != '\0')
		device_printf(dev, "firmware: %s\n", sc->version);
	if (sc->mb_vendor[0] != '\0')
		device_printf(dev, "mainboard: %s %s\n", sc->mb_vendor,
		    sc->mb_part);
	if (sc->has_console)
		device_printf(dev, "CBMEM console at %#jx\n",
		    (uintmax_t)sc->console_paddr);
	device_printf(dev, "CBMEM entries: %u\n", sc->cbmem_count);
	if (sc->has_board_config)
		device_printf(dev,
		    "board: id=%u sku=%u fw_config=%#jx\n",
		    sc->board_id, sc->sku_id,
		    (uintmax_t)sc->fw_config);
	if (sc->mac_count > 0)
		device_printf(dev, "factory MAC addresses: %u\n",
		    sc->mac_count);
	if (sc->has_acpi_rsdp)
		device_printf(dev, "ACPI RSDP at %#jx\n",
		    (uintmax_t)sc->acpi_rsdp);
	if (sc->has_pcie)
		device_printf(dev, "PCIe controller at %#jx\n",
		    (uintmax_t)sc->pcie_ctrl_base);
	if (sc->has_boot_media)
		device_printf(dev, "boot media: %#jx bytes, CBFS %#jx+%#jx\n",
		    (uintmax_t)sc->boot_media_size,
		    (uintmax_t)sc->cbfs_offset, (uintmax_t)sc->cbfs_size);
	if (sc->has_mmc_info)
		device_printf(dev, "MMC early CMD1 status: %d\n",
		    sc->mmc_early_cmd1_status);

	if (bootverbose) {
		if (sc->has_spi_flash)
			device_printf(dev,
			    "SPI flash: %u bytes, sector %u, erase %#x\n",
			    sc->spi_flash_size, sc->spi_sector_size,
			    sc->spi_erase_cmd);
		if (sc->has_console_type)
			device_printf(dev, "console type: %u\n",
			    sc->console_type);
		if (sc->has_framebuffer)
			device_printf(dev,
			    "framebuffer: %ux%u@%ubpp at %#jx\n",
			    sc->fb_x_res, sc->fb_y_res, sc->fb_bpp,
			    (uintmax_t)sc->fb_addr);
		if (sc->gpio_count > 0)
			device_printf(dev, "GPIO pins: %u\n",
			    sc->gpio_count);
		if (sc->has_tpm)
			device_printf(dev, "TPM %u.%u PPI at %#x\n",
			    sc->tpm_version == 2 ? 2 : 1,
			    sc->tpm_version == 2 ? 0 : 2,
			    sc->tpm_ppi_addr);
	}

	if (coreboot_debug) {
		if (sc->has_smmstore)
			device_printf(dev,
			    "SMMSTORE v2: %u blocks x %u bytes, "
			    "apm_cmd=%#x\n",
			    sc->smmstore_num_blocks,
			    sc->smmstore_block_size,
			    sc->smmstore_apm_cmd);
		if (sc->has_timestamps)
			device_printf(dev, "timestamps at %#jx\n",
			    (uintmax_t)sc->timestamps_paddr);
		if (sc->has_tpm_log)
			device_printf(dev, "TPM CB log at %#jx\n",
			    (uintmax_t)sc->tpm_log_paddr);
		if (sc->has_fmap)
			device_printf(dev, "FMAP at %#jx\n",
			    (uintmax_t)sc->fmap_paddr);
	}

	coreboot_register_sysctls(sc);

	coreboot_sc = sc;

	if (sc->has_console) {
		error = coreboot_console_create(sc);
		if (error != 0)
			device_printf(dev,
			    "failed to create /dev/coreboot_console (%d)\n",
			    error);
	}
	if (sc->cbmem_count > 0) {
		error = coreboot_cbmem_create(sc);
		if (error != 0)
			device_printf(dev, "failed to create /dev/cbmem (%d)\n",
			    error);
	}

	return (0);
}

/*
 * Detach: unmap table, destroy cdevs and sysctls
 */
static int
coreboot_detach(device_t dev)
{
	struct coreboot_softc *sc;

	sc = device_get_softc(dev);

	coreboot_cbmem_destroy(sc);
	coreboot_console_destroy(sc);

	coreboot_sc = NULL;

	sysctl_ctx_free(&sc->sysctl_ctx);

	if (sc->table_vaddr != NULL) {
		pmap_unmapbios(sc->table_vaddr, sc->table_size);
		sc->table_vaddr = NULL;
	}

	if (sc->console_vaddr != NULL) {
		pmap_unmapbios(sc->console_vaddr, sc->console_size);
		sc->console_vaddr = NULL;
		sc->console_size = 0;
		sc->console_data_size = 0;
	}

	return (0);
}

static int
coreboot_modevent(module_t mod, int what, void *arg)
{
	device_t *devs;
	int count, i;

	switch (what) {
	case MOD_LOAD:
		break;
	case MOD_UNLOAD:
		devclass_get_devices(devclass_find("coreboot"), &devs, &count);
		for (i = 0; i < count; i++)
			device_delete_child(device_get_parent(devs[i]),
			    devs[i]);
		free(devs, M_TEMP);
		break;
	default:
		break;
	}

	return (0);
}

static device_method_t coreboot_methods[] = {
	DEVMETHOD(device_identify,	coreboot_identify),
	DEVMETHOD(device_probe,		coreboot_probe),
	DEVMETHOD(device_attach,	coreboot_attach),
	DEVMETHOD(device_detach,	coreboot_detach),
	DEVMETHOD_END
};

static driver_t coreboot_driver = {
	"coreboot",
	coreboot_methods,
	sizeof(struct coreboot_softc),
};

DRIVER_MODULE(coreboot, nexus, coreboot_driver, coreboot_modevent, NULL);
MODULE_VERSION(coreboot, 1);