--- /dev/null
+/*
+    i2c Support for Apple SMU Controller
+
+    Copyright (c) 2005 Benjamin Herrenschmidt, IBM Corp.
+                       <benh@kernel.crashing.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/i2c.h>
+#include <linux/init.h>
+#include <linux/completion.h>
+#include <linux/device.h>
+#include <asm/prom.h>
+#include <asm/of_device.h>
+#include <asm/smu.h>
+
+static int probe;
+
+MODULE_AUTHOR("Benjamin Herrenschmidt <benh@kernel.crashing.org>");
+MODULE_DESCRIPTION("I2C driver for Apple's SMU");
+MODULE_LICENSE("GPL");
+module_param(probe, bool, 0);
+
+
+/* Physical interface */
+struct smu_iface
+{
+       struct i2c_adapter      adapter;
+       struct completion       complete;
+       u32                     busid;
+};
+
+static void smu_i2c_done(struct smu_i2c_cmd *cmd, void *misc)
+{
+       struct smu_iface        *iface = misc;
+       complete(&iface->complete);
+}
+
+/*
+ * SMBUS-type transfer entrypoint
+ */
+static s32 smu_smbus_xfer(     struct i2c_adapter*     adap,
+                               u16                     addr,
+                               unsigned short          flags,
+                               char                    read_write,
+                               u8                      command,
+                               int                     size,
+                               union i2c_smbus_data*   data)
+{
+       struct smu_iface        *iface = i2c_get_adapdata(adap);
+       struct smu_i2c_cmd      cmd;
+       int                     rc = 0;
+       int                     read = (read_write == I2C_SMBUS_READ);
+
+       cmd.info.bus = iface->busid;
+       cmd.info.devaddr = (addr << 1) | (read ? 0x01 : 0x00);
+
+       /* Prepare datas & select mode */
+       switch (size) {
+        case I2C_SMBUS_QUICK:
+               cmd.info.type = SMU_I2C_TRANSFER_SIMPLE;
+               cmd.info.datalen = 0;
+               break;
+        case I2C_SMBUS_BYTE:
+               cmd.info.type = SMU_I2C_TRANSFER_SIMPLE;
+               cmd.info.datalen = 1;
+               if (!read)
+                       cmd.info.data[0] = data->byte;
+               break;
+        case I2C_SMBUS_BYTE_DATA:
+               cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+               cmd.info.datalen = 1;
+               cmd.info.sublen = 1;
+               cmd.info.subaddr[0] = command;
+               cmd.info.subaddr[1] = 0;
+               cmd.info.subaddr[2] = 0;
+               if (!read)
+                       cmd.info.data[0] = data->byte;
+               break;
+        case I2C_SMBUS_WORD_DATA:
+               cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+               cmd.info.datalen = 2;
+               cmd.info.sublen = 1;
+               cmd.info.subaddr[0] = command;
+               cmd.info.subaddr[1] = 0;
+               cmd.info.subaddr[2] = 0;
+               if (!read) {
+                       cmd.info.data[0] = data->byte & 0xff;
+                       cmd.info.data[1] = (data->byte >> 8) & 0xff;
+               }
+               break;
+       /* Note that these are broken vs. the expected smbus API where
+        * on reads, the lenght is actually returned from the function,
+        * but I think the current API makes no sense and I don't want
+        * any driver that I haven't verified for correctness to go
+        * anywhere near a pmac i2c bus anyway ...
+        */
+        case I2C_SMBUS_BLOCK_DATA:
+               cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+               cmd.info.datalen = data->block[0] + 1;
+               if (cmd.info.datalen > 6)
+                       return -EINVAL;
+               if (!read)
+                       memcpy(cmd.info.data, data->block, cmd.info.datalen);
+               cmd.info.sublen = 1;
+               cmd.info.subaddr[0] = command;
+               cmd.info.subaddr[1] = 0;
+               cmd.info.subaddr[2] = 0;
+               break;
+       case I2C_SMBUS_I2C_BLOCK_DATA:
+               cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+               cmd.info.datalen = data->block[0];
+               if (cmd.info.datalen > 7)
+                       return -EINVAL;
+               if (!read)
+                       memcpy(cmd.info.data, &data->block[1],
+                              cmd.info.datalen);
+               cmd.info.sublen = 1;
+               cmd.info.subaddr[0] = command;
+               cmd.info.subaddr[1] = 0;
+               cmd.info.subaddr[2] = 0;
+               break;
+
+        default:
+               return -EINVAL;
+       }
+
+       /* Turn a standardsub read into a combined mode access */
+       if (read_write == I2C_SMBUS_READ &&
+           cmd.info.type == SMU_I2C_TRANSFER_STDSUB)
+               cmd.info.type = SMU_I2C_TRANSFER_COMBINED;
+
+       /* Finish filling command and submit it */
+       cmd.done = smu_i2c_done;
+       cmd.misc = iface;
+       rc = smu_queue_i2c(&cmd);
+       if (rc < 0)
+               return rc;
+       wait_for_completion(&iface->complete);
+       rc = cmd.status;
+
+       if (!read || rc < 0)
+               return rc;
+
+       switch (size) {
+        case I2C_SMBUS_BYTE:
+        case I2C_SMBUS_BYTE_DATA:
+               data->byte = cmd.info.data[0];
+               break;
+        case I2C_SMBUS_WORD_DATA:
+               data->word = ((u16)cmd.info.data[1]) << 8;
+               data->word |= cmd.info.data[0];
+               break;
+       /* Note that these are broken vs. the expected smbus API where
+        * on reads, the lenght is actually returned from the function,
+        * but I think the current API makes no sense and I don't want
+        * any driver that I haven't verified for correctness to go
+        * anywhere near a pmac i2c bus anyway ...
+        */
+        case I2C_SMBUS_BLOCK_DATA:
+       case I2C_SMBUS_I2C_BLOCK_DATA:
+               memcpy(&data->block[0], cmd.info.data, cmd.info.datalen);
+               break;
+       }
+
+       return rc;
+}
+
+static u32
+smu_smbus_func(struct i2c_adapter * adapter)
+{
+       return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+              I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+              I2C_FUNC_SMBUS_BLOCK_DATA;
+}
+
+/* For now, we only handle combined mode (smbus) */
+static struct i2c_algorithm smu_algorithm = {
+       .smbus_xfer     = smu_smbus_xfer,
+       .functionality  = smu_smbus_func,
+};
+
+static int create_iface(struct device_node *np, struct device *dev)
+{
+       struct smu_iface* iface;
+       u32 *reg, busid;
+       int rc;
+
+       reg = (u32 *)get_property(np, "reg", NULL);
+       if (reg == NULL) {
+               printk(KERN_ERR "i2c-pmac-smu: can't find bus number !\n");
+               return -ENXIO;
+       }
+       busid = *reg;
+
+       iface = kmalloc(sizeof(struct smu_iface), GFP_KERNEL);
+       if (iface == NULL) {
+               printk(KERN_ERR "i2c-pmac-smu: can't allocate inteface !\n");
+               return -ENOMEM;
+       }
+       memset(iface, 0, sizeof(struct smu_iface));
+       init_completion(&iface->complete);
+       iface->busid = busid;
+
+       dev_set_drvdata(dev, iface);
+
+       sprintf(iface->adapter.name, "smu-i2c-%02x", busid);
+       iface->adapter.algo = &smu_algorithm;
+       iface->adapter.algo_data = NULL;
+       iface->adapter.client_register = NULL;
+       iface->adapter.client_unregister = NULL;
+       i2c_set_adapdata(&iface->adapter, iface);
+       iface->adapter.dev.parent = dev;
+
+       rc = i2c_add_adapter(&iface->adapter);
+       if (rc) {
+               printk(KERN_ERR "i2c-pamc-smu.c: Adapter %s registration "
+                      "failed\n", iface->adapter.name);
+               i2c_set_adapdata(&iface->adapter, NULL);
+       }
+
+       if (probe) {
+               unsigned char addr;
+               printk("Probe: ");
+               for (addr = 0x00; addr <= 0x7f; addr++) {
+                       if (i2c_smbus_xfer(&iface->adapter,addr,
+                                          0,0,0,I2C_SMBUS_QUICK,NULL) >= 0)
+                               printk("%02x ", addr);
+               }
+               printk("\n");
+       }
+
+       printk(KERN_INFO "SMU i2c bus %x registered\n", busid);
+
+       return 0;
+}
+
+static int dispose_iface(struct device *dev)
+{
+       struct smu_iface *iface = dev_get_drvdata(dev);
+       int rc;
+
+       rc = i2c_del_adapter(&iface->adapter);
+       i2c_set_adapdata(&iface->adapter, NULL);
+       /* We aren't that prepared to deal with this... */
+       if (rc)
+               printk("i2c-pmac-smu.c: Failed to remove bus %s !\n",
+                      iface->adapter.name);
+       dev_set_drvdata(dev, NULL);
+       kfree(iface);
+
+       return 0;
+}
+
+
+static int create_iface_of_platform(struct of_device* dev,
+                                   const struct of_device_id *match)
+{
+       return create_iface(dev->node, &dev->dev);
+}
+
+
+static int dispose_iface_of_platform(struct of_device* dev)
+{
+       return dispose_iface(&dev->dev);
+}
+
+
+static struct of_device_id i2c_smu_match[] =
+{
+       {
+               .compatible     = "smu-i2c",
+       },
+       {},
+};
+static struct of_platform_driver i2c_smu_of_platform_driver =
+{
+       .name           = "i2c-smu",
+       .match_table    = i2c_smu_match,
+       .probe          = create_iface_of_platform,
+       .remove         = dispose_iface_of_platform
+};
+
+
+static int __init i2c_pmac_smu_init(void)
+{
+       of_register_driver(&i2c_smu_of_platform_driver);
+       return 0;
+}
+
+
+static void __exit i2c_pmac_smu_cleanup(void)
+{
+       of_unregister_driver(&i2c_smu_of_platform_driver);
+}
+
+module_init(i2c_pmac_smu_init);
+module_exit(i2c_pmac_smu_cleanup);
 
  */
 
 /*
- * For now, this driver includes:
- * - RTC get & set
- * - reboot & shutdown commands
- * all synchronous with IRQ disabled (ugh)
- *
  * TODO:
- *   rework in a way the PMU driver works, that is asynchronous
- *   with a queue of commands. I'll do that as soon as I have an
- *   SMU based machine at hand. Some more cleanup is needed too,
- *   like maybe fitting it into a platform device, etc...
- *   Also check what's up with cache coherency, and if we really
- *   can't do better than flushing the cache, maybe build a table
- *   of command len/reply len like the PMU driver to only flush
- *   what is actually necessary.
- *   --BenH.
+ *  - maybe add timeout to commands ?
+ *  - blocking version of time functions
+ *  - polling version of i2c commands (including timer that works with
+ *    interrutps off)
+ *  - maybe avoid some data copies with i2c by directly using the smu cmd
+ *    buffer and a lower level internal interface
+ *  - understand SMU -> CPU events and implement reception of them via
+ *    the userland interface
  */
 
 #include <linux/config.h>
 #include <linux/jiffies.h>
 #include <linux/interrupt.h>
 #include <linux/rtc.h>
+#include <linux/completion.h>
+#include <linux/miscdevice.h>
+#include <linux/delay.h>
+#include <linux/sysdev.h>
+#include <linux/poll.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
 #include <asm/smu.h>
 #include <asm/sections.h>
 #include <asm/abs_addr.h>
+#include <asm/uaccess.h>
+#include <asm/of_device.h>
+
+#define VERSION "0.6"
+#define AUTHOR  "(c) 2005 Benjamin Herrenschmidt, IBM Corp."
 
-#define DEBUG_SMU 1
+#undef DEBUG_SMU
 
 #ifdef DEBUG_SMU
 #define DPRINTK(fmt, args...) do { printk(KERN_DEBUG fmt , ##args); } while (0)
 /*
  * This is the command buffer passed to the SMU hardware
  */
+#define SMU_MAX_DATA   254
+
 struct smu_cmd_buf {
        u8 cmd;
        u8 length;
-       u8 data[0x0FFE];
+       u8 data[SMU_MAX_DATA];
 };
 
 struct smu_device {
        spinlock_t              lock;
        struct device_node      *of_node;
-       int                     db_ack;         /* doorbell ack GPIO */
-       int                     db_req;         /* doorbell req GPIO */
+       struct of_device        *of_dev;
+       int                     doorbell;       /* doorbell gpio */
        u32 __iomem             *db_buf;        /* doorbell buffer */
+       int                     db_irq;
+       int                     msg;
+       int                     msg_irq;
        struct smu_cmd_buf      *cmd_buf;       /* command buffer virtual */
        u32                     cmd_buf_abs;    /* command buffer absolute */
+       struct list_head        cmd_list;
+       struct smu_cmd          *cmd_cur;       /* pending command */
+       struct list_head        cmd_i2c_list;
+       struct smu_i2c_cmd      *cmd_i2c_cur;   /* pending i2c command */
+       struct timer_list       i2c_timer;
 };
 
 /*
  */
 static struct smu_device       *smu;
 
+
 /*
- * SMU low level communication stuff
+ * SMU driver low level stuff
  */
-static inline int smu_cmd_stat(struct smu_cmd_buf *cmd_buf, u8 cmd_ack)
-{
-       rmb();
-       return cmd_buf->cmd == cmd_ack && cmd_buf->length != 0;
-}
 
-static inline u8 smu_save_ack_cmd(struct smu_cmd_buf *cmd_buf)
+static void smu_start_cmd(void)
 {
-       return (~cmd_buf->cmd) & 0xff;
-}
+       unsigned long faddr, fend;
+       struct smu_cmd *cmd;
 
-static void smu_send_cmd(struct smu_device *dev)
-{
-       /* SMU command buf is currently cacheable, we need a physical
-        * address. This isn't exactly a DMA mapping here, I suspect
+       if (list_empty(&smu->cmd_list))
+               return;
+
+       /* Fetch first command in queue */
+       cmd = list_entry(smu->cmd_list.next, struct smu_cmd, link);
+       smu->cmd_cur = cmd;
+       list_del(&cmd->link);
+
+       DPRINTK("SMU: starting cmd %x, %d bytes data\n", cmd->cmd,
+               cmd->data_len);
+       DPRINTK("SMU: data buffer: %02x %02x %02x %02x ...\n",
+               ((u8 *)cmd->data_buf)[0], ((u8 *)cmd->data_buf)[1],
+               ((u8 *)cmd->data_buf)[2], ((u8 *)cmd->data_buf)[3]);
+
+       /* Fill the SMU command buffer */
+       smu->cmd_buf->cmd = cmd->cmd;
+       smu->cmd_buf->length = cmd->data_len;
+       memcpy(smu->cmd_buf->data, cmd->data_buf, cmd->data_len);
+
+       /* Flush command and data to RAM */
+       faddr = (unsigned long)smu->cmd_buf;
+       fend = faddr + smu->cmd_buf->length + 2;
+       flush_inval_dcache_range(faddr, fend);
+
+       /* This isn't exactly a DMA mapping here, I suspect
         * the SMU is actually communicating with us via i2c to the
         * northbridge or the CPU to access RAM.
         */
-       writel(dev->cmd_buf_abs, dev->db_buf);
+       writel(smu->cmd_buf_abs, smu->db_buf);
 
        /* Ring the SMU doorbell */
-       pmac_do_feature_call(PMAC_FTR_WRITE_GPIO, NULL, dev->db_req, 4);
-       pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, dev->db_req, 4);
+       pmac_do_feature_call(PMAC_FTR_WRITE_GPIO, NULL, smu->doorbell, 4);
 }
 
-static int smu_cmd_done(struct smu_device *dev)
+
+static irqreturn_t smu_db_intr(int irq, void *arg, struct pt_regs *regs)
 {
-       unsigned long wait = 0;
-       int gpio;
+       unsigned long flags;
+       struct smu_cmd *cmd;
+       void (*done)(struct smu_cmd *cmd, void *misc) = NULL;
+       void *misc = NULL;
+       u8 gpio;
+       int rc = 0;
 
-       /* Check the SMU doorbell */
-       do  {
-               gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO,
-                                           NULL, dev->db_ack);
-               if ((gpio & 7) == 7)
-                       return 0;
-               udelay(100);
-       } while(++wait < 10000);
+       /* SMU completed the command, well, we hope, let's make sure
+        * of it
+        */
+       spin_lock_irqsave(&smu->lock, flags);
 
-       printk(KERN_ERR "SMU timeout !\n");
-       return -ENXIO;
+       gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, smu->doorbell);
+       if ((gpio & 7) != 7)
+               return IRQ_HANDLED;
+
+       cmd = smu->cmd_cur;
+       smu->cmd_cur = NULL;
+       if (cmd == NULL)
+               goto bail;
+
+       if (rc == 0) {
+               unsigned long faddr;
+               int reply_len;
+               u8 ack;
+
+               /* CPU might have brought back the cache line, so we need
+                * to flush again before peeking at the SMU response. We
+                * flush the entire buffer for now as we haven't read the
+                * reply lenght (it's only 2 cache lines anyway)
+                */
+               faddr = (unsigned long)smu->cmd_buf;
+               flush_inval_dcache_range(faddr, faddr + 256);
+
+               /* Now check ack */
+               ack = (~cmd->cmd) & 0xff;
+               if (ack != smu->cmd_buf->cmd) {
+                       DPRINTK("SMU: incorrect ack, want %x got %x\n",
+                               ack, smu->cmd_buf->cmd);
+                       rc = -EIO;
+               }
+               reply_len = rc == 0 ? smu->cmd_buf->length : 0;
+               DPRINTK("SMU: reply len: %d\n", reply_len);
+               if (reply_len > cmd->reply_len) {
+                       printk(KERN_WARNING "SMU: reply buffer too small,"
+                              "got %d bytes for a %d bytes buffer\n",
+                              reply_len, cmd->reply_len);
+                       reply_len = cmd->reply_len;
+               }
+               cmd->reply_len = reply_len;
+               if (cmd->reply_buf && reply_len)
+                       memcpy(cmd->reply_buf, smu->cmd_buf->data, reply_len);
+       }
+
+       /* Now complete the command. Write status last in order as we lost
+        * ownership of the command structure as soon as it's no longer -1
+        */
+       done = cmd->done;
+       misc = cmd->misc;
+       mb();
+       cmd->status = rc;
+ bail:
+       /* Start next command if any */
+       smu_start_cmd();
+       spin_unlock_irqrestore(&smu->lock, flags);
+
+       /* Call command completion handler if any */
+       if (done)
+               done(cmd, misc);
+
+       /* It's an edge interrupt, nothing to do */
+       return IRQ_HANDLED;
 }
 
-static int smu_do_cmd(struct smu_device *dev)
+
+static irqreturn_t smu_msg_intr(int irq, void *arg, struct pt_regs *regs)
 {
-       int rc;
-       u8 cmd_ack;
+       /* I don't quite know what to do with this one, we seem to never
+        * receive it, so I suspect we have to arm it someway in the SMU
+        * to start getting events that way.
+        */
+
+       printk(KERN_INFO "SMU: message interrupt !\n");
 
-       DPRINTK("SMU do_cmd %02x len=%d %02x\n",
-               dev->cmd_buf->cmd, dev->cmd_buf->length,
-               dev->cmd_buf->data[0]);
+       /* It's an edge interrupt, nothing to do */
+       return IRQ_HANDLED;
+}
 
-       cmd_ack = smu_save_ack_cmd(dev->cmd_buf);
 
-       /* Clear cmd_buf cache lines */
-       flush_inval_dcache_range((unsigned long)dev->cmd_buf,
-                                ((unsigned long)dev->cmd_buf) +
-                                sizeof(struct smu_cmd_buf));
-       smu_send_cmd(dev);
-       rc = smu_cmd_done(dev);
-       if (rc == 0)
-               rc = smu_cmd_stat(dev->cmd_buf, cmd_ack) ? 0 : -1;
+/*
+ * Queued command management.
+ *
+ */
 
-       DPRINTK("SMU do_cmd %02x len=%d %02x => %d (%02x)\n",
-               dev->cmd_buf->cmd, dev->cmd_buf->length,
-               dev->cmd_buf->data[0], rc, cmd_ack);
+int smu_queue_cmd(struct smu_cmd *cmd)
+{
+       unsigned long flags;
 
-       return rc;
+       if (smu == NULL)
+               return -ENODEV;
+       if (cmd->data_len > SMU_MAX_DATA ||
+           cmd->reply_len > SMU_MAX_DATA)
+               return -EINVAL;
+
+       cmd->status = 1;
+       spin_lock_irqsave(&smu->lock, flags);
+       list_add_tail(&cmd->link, &smu->cmd_list);
+       if (smu->cmd_cur == NULL)
+               smu_start_cmd();
+       spin_unlock_irqrestore(&smu->lock, flags);
+
+       return 0;
 }
+EXPORT_SYMBOL(smu_queue_cmd);
 
-/* RTC low level commands */
-static inline int bcd2hex (int n)
+
+int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
+                    unsigned int data_len,
+                    void (*done)(struct smu_cmd *cmd, void *misc),
+                    void *misc, ...)
 {
-       return (((n & 0xf0) >> 4) * 10) + (n & 0xf);
+       struct smu_cmd *cmd = &scmd->cmd;
+       va_list list;
+       int i;
+
+       if (data_len > sizeof(scmd->buffer))
+               return -EINVAL;
+
+       memset(scmd, 0, sizeof(*scmd));
+       cmd->cmd = command;
+       cmd->data_len = data_len;
+       cmd->data_buf = scmd->buffer;
+       cmd->reply_len = sizeof(scmd->buffer);
+       cmd->reply_buf = scmd->buffer;
+       cmd->done = done;
+       cmd->misc = misc;
+
+       va_start(list, misc);
+       for (i = 0; i < data_len; ++i)
+               scmd->buffer[i] = (u8)va_arg(list, int);
+       va_end(list);
+
+       return smu_queue_cmd(cmd);
 }
+EXPORT_SYMBOL(smu_queue_simple);
 
-static inline int hex2bcd (int n)
+
+void smu_poll(void)
 {
-       return ((n / 10) << 4) + (n % 10);
+       u8 gpio;
+
+       if (smu == NULL)
+               return;
+
+       gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, smu->doorbell);
+       if ((gpio & 7) == 7)
+               smu_db_intr(smu->db_irq, smu, NULL);
 }
+EXPORT_SYMBOL(smu_poll);
+
 
-#if 0
-static inline void smu_fill_set_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+void smu_done_complete(struct smu_cmd *cmd, void *misc)
 {
-       cmd_buf->cmd = 0x8e;
-       cmd_buf->length = 8;
-       cmd_buf->data[0] = 0x00;
-       memset(cmd_buf->data + 1, 0, 7);
+       struct completion *comp = misc;
+
+       complete(comp);
 }
+EXPORT_SYMBOL(smu_done_complete);
+
 
-static inline void smu_fill_get_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+void smu_spinwait_cmd(struct smu_cmd *cmd)
 {
-       cmd_buf->cmd = 0x8e;
-       cmd_buf->length = 1;
-       cmd_buf->data[0] = 0x01;
+       while(cmd->status == 1)
+               smu_poll();
+}
+EXPORT_SYMBOL(smu_spinwait_cmd);
+
+
+/* RTC low level commands */
+static inline int bcd2hex (int n)
+{
+       return (((n & 0xf0) >> 4) * 10) + (n & 0xf);
 }
 
-static inline void smu_fill_dis_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+
+static inline int hex2bcd (int n)
 {
-       cmd_buf->cmd = 0x8e;
-       cmd_buf->length = 1;
-       cmd_buf->data[0] = 0x02;
+       return ((n / 10) << 4) + (n % 10);
 }
-#endif
+
 
 static inline void smu_fill_set_rtc_cmd(struct smu_cmd_buf *cmd_buf,
                                        struct rtc_time *time)
        cmd_buf->data[7] = hex2bcd(time->tm_year - 100);
 }
 
-static inline void smu_fill_get_rtc_cmd(struct smu_cmd_buf *cmd_buf)
-{
-       cmd_buf->cmd = 0x8e;
-       cmd_buf->length = 1;
-       cmd_buf->data[0] = 0x81;
-}
 
-static void smu_parse_get_rtc_reply(struct smu_cmd_buf *cmd_buf,
-                                   struct rtc_time *time)
+int smu_get_rtc_time(struct rtc_time *time, int spinwait)
 {
-       time->tm_sec = bcd2hex(cmd_buf->data[0]);
-       time->tm_min = bcd2hex(cmd_buf->data[1]);
-       time->tm_hour = bcd2hex(cmd_buf->data[2]);
-       time->tm_wday = bcd2hex(cmd_buf->data[3]);
-       time->tm_mday = bcd2hex(cmd_buf->data[4]);
-       time->tm_mon = bcd2hex(cmd_buf->data[5]) - 1;
-       time->tm_year = bcd2hex(cmd_buf->data[6]) + 100;
-}
-
-int smu_get_rtc_time(struct rtc_time *time)
-{
-       unsigned long flags;
+       struct smu_simple_cmd cmd;
        int rc;
 
        if (smu == NULL)
                return -ENODEV;
 
        memset(time, 0, sizeof(struct rtc_time));
-       spin_lock_irqsave(&smu->lock, flags);
-       smu_fill_get_rtc_cmd(smu->cmd_buf);
-       rc = smu_do_cmd(smu);
-       if (rc == 0)
-               smu_parse_get_rtc_reply(smu->cmd_buf, time);
-       spin_unlock_irqrestore(&smu->lock, flags);
+       rc = smu_queue_simple(&cmd, SMU_CMD_RTC_COMMAND, 1, NULL, NULL,
+                             SMU_CMD_RTC_GET_DATETIME);
+       if (rc)
+               return rc;
+       smu_spinwait_simple(&cmd);
 
-       return rc;
+       time->tm_sec = bcd2hex(cmd.buffer[0]);
+       time->tm_min = bcd2hex(cmd.buffer[1]);
+       time->tm_hour = bcd2hex(cmd.buffer[2]);
+       time->tm_wday = bcd2hex(cmd.buffer[3]);
+       time->tm_mday = bcd2hex(cmd.buffer[4]);
+       time->tm_mon = bcd2hex(cmd.buffer[5]) - 1;
+       time->tm_year = bcd2hex(cmd.buffer[6]) + 100;
+
+       return 0;
 }
 
-int smu_set_rtc_time(struct rtc_time *time)
+
+int smu_set_rtc_time(struct rtc_time *time, int spinwait)
 {
-       unsigned long flags;
+       struct smu_simple_cmd cmd;
        int rc;
 
        if (smu == NULL)
                return -ENODEV;
 
-       spin_lock_irqsave(&smu->lock, flags);
-       smu_fill_set_rtc_cmd(smu->cmd_buf, time);
-       rc = smu_do_cmd(smu);
-       spin_unlock_irqrestore(&smu->lock, flags);
+       rc = smu_queue_simple(&cmd, SMU_CMD_RTC_COMMAND, 8, NULL, NULL,
+                             SMU_CMD_RTC_SET_DATETIME,
+                             hex2bcd(time->tm_sec),
+                             hex2bcd(time->tm_min),
+                             hex2bcd(time->tm_hour),
+                             time->tm_wday,
+                             hex2bcd(time->tm_mday),
+                             hex2bcd(time->tm_mon) + 1,
+                             hex2bcd(time->tm_year - 100));
+       if (rc)
+               return rc;
+       smu_spinwait_simple(&cmd);
 
-       return rc;
+       return 0;
 }
 
+
 void smu_shutdown(void)
 {
-       const unsigned char *command = "SHUTDOWN";
-       unsigned long flags;
+       struct smu_simple_cmd cmd;
 
        if (smu == NULL)
                return;
 
-       spin_lock_irqsave(&smu->lock, flags);
-       smu->cmd_buf->cmd = 0xaa;
-       smu->cmd_buf->length = strlen(command);
-       strcpy(smu->cmd_buf->data, command);
-       smu_do_cmd(smu);
+       if (smu_queue_simple(&cmd, SMU_CMD_POWER_COMMAND, 9, NULL, NULL,
+                            'S', 'H', 'U', 'T', 'D', 'O', 'W', 'N', 0))
+               return;
+       smu_spinwait_simple(&cmd);
        for (;;)
                ;
-       spin_unlock_irqrestore(&smu->lock, flags);
 }
 
+
 void smu_restart(void)
 {
-       const unsigned char *command = "RESTART";
-       unsigned long flags;
+       struct smu_simple_cmd cmd;
 
        if (smu == NULL)
                return;
 
-       spin_lock_irqsave(&smu->lock, flags);
-       smu->cmd_buf->cmd = 0xaa;
-       smu->cmd_buf->length = strlen(command);
-       strcpy(smu->cmd_buf->data, command);
-       smu_do_cmd(smu);
+       if (smu_queue_simple(&cmd, SMU_CMD_POWER_COMMAND, 8, NULL, NULL,
+                            'R', 'E', 'S', 'T', 'A', 'R', 'T', 0))
+               return;
+       smu_spinwait_simple(&cmd);
        for (;;)
                ;
-       spin_unlock_irqrestore(&smu->lock, flags);
 }
 
+
 int smu_present(void)
 {
        return smu != NULL;
 }
+EXPORT_SYMBOL(smu_present);
 
 
 int smu_init (void)
         if (np == NULL)
                return -ENODEV;
 
+       printk(KERN_INFO "SMU driver %s %s\n", VERSION, AUTHOR);
+
        if (smu_cmdbuf_abs == 0) {
                printk(KERN_ERR "SMU: Command buffer not allocated !\n");
                return -EINVAL;
        memset(smu, 0, sizeof(*smu));
 
        spin_lock_init(&smu->lock);
+       INIT_LIST_HEAD(&smu->cmd_list);
+       INIT_LIST_HEAD(&smu->cmd_i2c_list);
        smu->of_node = np;
+       smu->db_irq = NO_IRQ;
+       smu->msg_irq = NO_IRQ;
+       init_timer(&smu->i2c_timer);
+
        /* smu_cmdbuf_abs is in the low 2G of RAM, can be converted to a
         * 32 bits value safely
         */
                goto fail;
        }
        data = (u32 *)get_property(np, "reg", NULL);
-       of_node_put(np);
        if (data == NULL) {
+               of_node_put(np);
                printk(KERN_ERR "SMU: Can't find doorbell GPIO address !\n");
                goto fail;
        }
         * and ack. GPIOs are at 0x50, best would be to find that out
         * in the device-tree though.
         */
-       smu->db_req = 0x50 + *data;
-       smu->db_ack = 0x50 + *data;
+       smu->doorbell = *data;
+       if (smu->doorbell < 0x50)
+               smu->doorbell += 0x50;
+       if (np->n_intrs > 0)
+               smu->db_irq = np->intrs[0].line;
+
+       of_node_put(np);
+
+       /* Now look for the smu-interrupt GPIO */
+       do {
+               np = of_find_node_by_name(NULL, "smu-interrupt");
+               if (np == NULL)
+                       break;
+               data = (u32 *)get_property(np, "reg", NULL);
+               if (data == NULL) {
+                       of_node_put(np);
+                       break;
+               }
+               smu->msg = *data;
+               if (smu->msg < 0x50)
+                       smu->msg += 0x50;
+               if (np->n_intrs > 0)
+                       smu->msg_irq = np->intrs[0].line;
+               of_node_put(np);
+       } while(0);
 
        /* Doorbell buffer is currently hard-coded, I didn't find a proper
         * device-tree entry giving the address. Best would probably to use
        return -ENXIO;
 
 }
+
+
+static int smu_late_init(void)
+{
+       if (!smu)
+               return 0;
+
+       /*
+        * Try to request the interrupts
+        */
+
+       if (smu->db_irq != NO_IRQ) {
+               if (request_irq(smu->db_irq, smu_db_intr,
+                               SA_SHIRQ, "SMU doorbell", smu) < 0) {
+                       printk(KERN_WARNING "SMU: can't "
+                              "request interrupt %d\n",
+                              smu->db_irq);
+                       smu->db_irq = NO_IRQ;
+               }
+       }
+
+       if (smu->msg_irq != NO_IRQ) {
+               if (request_irq(smu->msg_irq, smu_msg_intr,
+                               SA_SHIRQ, "SMU message", smu) < 0) {
+                       printk(KERN_WARNING "SMU: can't "
+                              "request interrupt %d\n",
+                              smu->msg_irq);
+                       smu->msg_irq = NO_IRQ;
+               }
+       }
+
+       return 0;
+}
+arch_initcall(smu_late_init);
+
+/*
+ * sysfs visibility
+ */
+
+static void smu_expose_childs(void *unused)
+{
+       struct device_node *np;
+
+       for (np = NULL; (np = of_get_next_child(smu->of_node, np)) != NULL;) {
+               if (device_is_compatible(np, "smu-i2c")) {
+                       char name[32];
+                       u32 *reg = (u32 *)get_property(np, "reg", NULL);
+
+                       if (reg == NULL)
+                               continue;
+                       sprintf(name, "smu-i2c-%02x", *reg);
+                       of_platform_device_create(np, name, &smu->of_dev->dev);
+               }
+       }
+
+}
+
+static DECLARE_WORK(smu_expose_childs_work, smu_expose_childs, NULL);
+
+static int smu_platform_probe(struct of_device* dev,
+                             const struct of_device_id *match)
+{
+       if (!smu)
+               return -ENODEV;
+       smu->of_dev = dev;
+
+       /*
+        * Ok, we are matched, now expose all i2c busses. We have to defer
+        * that unfortunately or it would deadlock inside the device model
+        */
+       schedule_work(&smu_expose_childs_work);
+
+       return 0;
+}
+
+static struct of_device_id smu_platform_match[] =
+{
+       {
+               .type           = "smu",
+       },
+       {},
+};
+
+static struct of_platform_driver smu_of_platform_driver =
+{
+       .name           = "smu",
+       .match_table    = smu_platform_match,
+       .probe          = smu_platform_probe,
+};
+
+static int __init smu_init_sysfs(void)
+{
+       int rc;
+
+       /*
+        * Due to sysfs bogosity, a sysdev is not a real device, so
+        * we should in fact create both if we want sysdev semantics
+        * for power management.
+        * For now, we don't power manage machines with an SMU chip,
+        * I'm a bit too far from figuring out how that works with those
+        * new chipsets, but that will come back and bite us
+        */
+       rc = of_register_driver(&smu_of_platform_driver);
+       return 0;
+}
+
+device_initcall(smu_init_sysfs);
+
+struct of_device *smu_get_ofdev(void)
+{
+       if (!smu)
+               return NULL;
+       return smu->of_dev;
+}
+
+EXPORT_SYMBOL_GPL(smu_get_ofdev);
+
+/*
+ * i2c interface
+ */
+
+static void smu_i2c_complete_command(struct smu_i2c_cmd *cmd, int fail)
+{
+       void (*done)(struct smu_i2c_cmd *cmd, void *misc) = cmd->done;
+       void *misc = cmd->misc;
+       unsigned long flags;
+
+       /* Check for read case */
+       if (!fail && cmd->read) {
+               if (cmd->pdata[0] < 1)
+                       fail = 1;
+               else
+                       memcpy(cmd->info.data, &cmd->pdata[1],
+                              cmd->info.datalen);
+       }
+
+       DPRINTK("SMU: completing, success: %d\n", !fail);
+
+       /* Update status and mark no pending i2c command with lock
+        * held so nobody comes in while we dequeue an eventual
+        * pending next i2c command
+        */
+       spin_lock_irqsave(&smu->lock, flags);
+       smu->cmd_i2c_cur = NULL;
+       wmb();
+       cmd->status = fail ? -EIO : 0;
+
+       /* Is there another i2c command waiting ? */
+       if (!list_empty(&smu->cmd_i2c_list)) {
+               struct smu_i2c_cmd *newcmd;
+
+               /* Fetch it, new current, remove from list */
+               newcmd = list_entry(smu->cmd_i2c_list.next,
+                                   struct smu_i2c_cmd, link);
+               smu->cmd_i2c_cur = newcmd;
+               list_del(&cmd->link);
+
+               /* Queue with low level smu */
+               list_add_tail(&cmd->scmd.link, &smu->cmd_list);
+               if (smu->cmd_cur == NULL)
+                       smu_start_cmd();
+       }
+       spin_unlock_irqrestore(&smu->lock, flags);
+
+       /* Call command completion handler if any */
+       if (done)
+               done(cmd, misc);
+
+}
+
+
+static void smu_i2c_retry(unsigned long data)
+{
+       struct smu_i2c_cmd      *cmd = (struct smu_i2c_cmd *)data;
+
+       DPRINTK("SMU: i2c failure, requeuing...\n");
+
+       /* requeue command simply by resetting reply_len */
+       cmd->pdata[0] = 0xff;
+       cmd->scmd.reply_len = 0x10;
+       smu_queue_cmd(&cmd->scmd);
+}
+
+
+static void smu_i2c_low_completion(struct smu_cmd *scmd, void *misc)
+{
+       struct smu_i2c_cmd      *cmd = misc;
+       int                     fail = 0;
+
+       DPRINTK("SMU: i2c compl. stage=%d status=%x pdata[0]=%x rlen: %x\n",
+               cmd->stage, scmd->status, cmd->pdata[0], scmd->reply_len);
+
+       /* Check for possible status */
+       if (scmd->status < 0)
+               fail = 1;
+       else if (cmd->read) {
+               if (cmd->stage == 0)
+                       fail = cmd->pdata[0] != 0;
+               else
+                       fail = cmd->pdata[0] >= 0x80;
+       } else {
+               fail = cmd->pdata[0] != 0;
+       }
+
+       /* Handle failures by requeuing command, after 5ms interval
+        */
+       if (fail && --cmd->retries > 0) {
+               DPRINTK("SMU: i2c failure, starting timer...\n");
+               smu->i2c_timer.function = smu_i2c_retry;
+               smu->i2c_timer.data = (unsigned long)cmd;
+               smu->i2c_timer.expires = jiffies + msecs_to_jiffies(5);
+               add_timer(&smu->i2c_timer);
+               return;
+       }
+
+       /* If failure or stage 1, command is complete */
+       if (fail || cmd->stage != 0) {
+               smu_i2c_complete_command(cmd, fail);
+               return;
+       }
+
+       DPRINTK("SMU: going to stage 1\n");
+
+       /* Ok, initial command complete, now poll status */
+       scmd->reply_buf = cmd->pdata;
+       scmd->reply_len = 0x10;
+       scmd->data_buf = cmd->pdata;
+       scmd->data_len = 1;
+       cmd->pdata[0] = 0;
+       cmd->stage = 1;
+       cmd->retries = 20;
+       smu_queue_cmd(scmd);
+}
+
+
+int smu_queue_i2c(struct smu_i2c_cmd *cmd)
+{
+       unsigned long flags;
+
+       if (smu == NULL)
+               return -ENODEV;
+
+       /* Fill most fields of scmd */
+       cmd->scmd.cmd = SMU_CMD_I2C_COMMAND;
+       cmd->scmd.done = smu_i2c_low_completion;
+       cmd->scmd.misc = cmd;
+       cmd->scmd.reply_buf = cmd->pdata;
+       cmd->scmd.reply_len = 0x10;
+       cmd->scmd.data_buf = (u8 *)(char *)&cmd->info;
+       cmd->scmd.status = 1;
+       cmd->stage = 0;
+       cmd->pdata[0] = 0xff;
+       cmd->retries = 20;
+       cmd->status = 1;
+
+       /* Check transfer type, sanitize some "info" fields
+        * based on transfer type and do more checking
+        */
+       cmd->info.caddr = cmd->info.devaddr;
+       cmd->read = cmd->info.devaddr & 0x01;
+       switch(cmd->info.type) {
+       case SMU_I2C_TRANSFER_SIMPLE:
+               memset(&cmd->info.sublen, 0, 4);
+               break;
+       case SMU_I2C_TRANSFER_COMBINED:
+               cmd->info.devaddr &= 0xfe;
+       case SMU_I2C_TRANSFER_STDSUB:
+               if (cmd->info.sublen > 3)
+                       return -EINVAL;
+               break;
+       default:
+               return -EINVAL;
+       }
+
+       /* Finish setting up command based on transfer direction
+        */
+       if (cmd->read) {
+               if (cmd->info.datalen > SMU_I2C_READ_MAX)
+                       return -EINVAL;
+               memset(cmd->info.data, 0xff, cmd->info.datalen);
+               cmd->scmd.data_len = 9;
+       } else {
+               if (cmd->info.datalen > SMU_I2C_WRITE_MAX)
+                       return -EINVAL;
+               cmd->scmd.data_len = 9 + cmd->info.datalen;
+       }
+
+       DPRINTK("SMU: i2c enqueuing command\n");
+       DPRINTK("SMU:   %s, len=%d bus=%x addr=%x sub0=%x type=%x\n",
+               cmd->read ? "read" : "write", cmd->info.datalen,
+               cmd->info.bus, cmd->info.caddr,
+               cmd->info.subaddr[0], cmd->info.type);
+
+
+       /* Enqueue command in i2c list, and if empty, enqueue also in
+        * main command list
+        */
+       spin_lock_irqsave(&smu->lock, flags);
+       if (smu->cmd_i2c_cur == NULL) {
+               smu->cmd_i2c_cur = cmd;
+               list_add_tail(&cmd->scmd.link, &smu->cmd_list);
+               if (smu->cmd_cur == NULL)
+                       smu_start_cmd();
+       } else
+               list_add_tail(&cmd->link, &smu->cmd_i2c_list);
+       spin_unlock_irqrestore(&smu->lock, flags);
+
+       return 0;
+}
+
+
+
+/*
+ * Userland driver interface
+ */
+
+
+static LIST_HEAD(smu_clist);
+static DEFINE_SPINLOCK(smu_clist_lock);
+
+enum smu_file_mode {
+       smu_file_commands,
+       smu_file_events,
+       smu_file_closing
+};
+
+struct smu_private
+{
+       struct list_head        list;
+       enum smu_file_mode      mode;
+       int                     busy;
+       struct smu_cmd          cmd;
+       spinlock_t              lock;
+       wait_queue_head_t       wait;
+       u8                      buffer[SMU_MAX_DATA];
+};
+
+
+static int smu_open(struct inode *inode, struct file *file)
+{
+       struct smu_private *pp;
+       unsigned long flags;
+
+       pp = kmalloc(sizeof(struct smu_private), GFP_KERNEL);
+       if (pp == 0)
+               return -ENOMEM;
+       memset(pp, 0, sizeof(struct smu_private));
+       spin_lock_init(&pp->lock);
+       pp->mode = smu_file_commands;
+       init_waitqueue_head(&pp->wait);
+
+       spin_lock_irqsave(&smu_clist_lock, flags);
+       list_add(&pp->list, &smu_clist);
+       spin_unlock_irqrestore(&smu_clist_lock, flags);
+       file->private_data = pp;
+
+       return 0;
+}
+
+
+static void smu_user_cmd_done(struct smu_cmd *cmd, void *misc)
+{
+       struct smu_private *pp = misc;
+
+       wake_up_all(&pp->wait);
+}
+
+
+static ssize_t smu_write(struct file *file, const char __user *buf,
+                        size_t count, loff_t *ppos)
+{
+       struct smu_private *pp = file->private_data;
+       unsigned long flags;
+       struct smu_user_cmd_hdr hdr;
+       int rc = 0;
+
+       if (pp->busy)
+               return -EBUSY;
+       else if (copy_from_user(&hdr, buf, sizeof(hdr)))
+               return -EFAULT;
+       else if (hdr.cmdtype == SMU_CMDTYPE_WANTS_EVENTS) {
+               pp->mode = smu_file_events;
+               return 0;
+       } else if (hdr.cmdtype != SMU_CMDTYPE_SMU)
+               return -EINVAL;
+       else if (pp->mode != smu_file_commands)
+               return -EBADFD;
+       else if (hdr.data_len > SMU_MAX_DATA)
+               return -EINVAL;
+
+       spin_lock_irqsave(&pp->lock, flags);
+       if (pp->busy) {
+               spin_unlock_irqrestore(&pp->lock, flags);
+               return -EBUSY;
+       }
+       pp->busy = 1;
+       pp->cmd.status = 1;
+       spin_unlock_irqrestore(&pp->lock, flags);
+
+       if (copy_from_user(pp->buffer, buf + sizeof(hdr), hdr.data_len)) {
+               pp->busy = 0;
+               return -EFAULT;
+       }
+
+       pp->cmd.cmd = hdr.cmd;
+       pp->cmd.data_len = hdr.data_len;
+       pp->cmd.reply_len = SMU_MAX_DATA;
+       pp->cmd.data_buf = pp->buffer;
+       pp->cmd.reply_buf = pp->buffer;
+       pp->cmd.done = smu_user_cmd_done;
+       pp->cmd.misc = pp;
+       rc = smu_queue_cmd(&pp->cmd);
+       if (rc < 0)
+               return rc;
+       return count;
+}
+
+
+static ssize_t smu_read_command(struct file *file, struct smu_private *pp,
+                               char __user *buf, size_t count)
+{
+       DECLARE_WAITQUEUE(wait, current);
+       struct smu_user_reply_hdr hdr;
+       unsigned long flags;
+       int size, rc = 0;
+
+       if (!pp->busy)
+               return 0;
+       if (count < sizeof(struct smu_user_reply_hdr))
+               return -EOVERFLOW;
+       spin_lock_irqsave(&pp->lock, flags);
+       if (pp->cmd.status == 1) {
+               if (file->f_flags & O_NONBLOCK)
+                       return -EAGAIN;
+               add_wait_queue(&pp->wait, &wait);
+               for (;;) {
+                       set_current_state(TASK_INTERRUPTIBLE);
+                       rc = 0;
+                       if (pp->cmd.status != 1)
+                               break;
+                       rc = -ERESTARTSYS;
+                       if (signal_pending(current))
+                               break;
+                       spin_unlock_irqrestore(&pp->lock, flags);
+                       schedule();
+                       spin_lock_irqsave(&pp->lock, flags);
+               }
+               set_current_state(TASK_RUNNING);
+               remove_wait_queue(&pp->wait, &wait);
+       }
+       spin_unlock_irqrestore(&pp->lock, flags);
+       if (rc)
+               return rc;
+       if (pp->cmd.status != 0)
+               pp->cmd.reply_len = 0;
+       size = sizeof(hdr) + pp->cmd.reply_len;
+       if (count < size)
+               size = count;
+       rc = size;
+       hdr.status = pp->cmd.status;
+       hdr.reply_len = pp->cmd.reply_len;
+       if (copy_to_user(buf, &hdr, sizeof(hdr)))
+               return -EFAULT;
+       size -= sizeof(hdr);
+       if (size && copy_to_user(buf + sizeof(hdr), pp->buffer, size))
+               return -EFAULT;
+       pp->busy = 0;
+
+       return rc;
+}
+
+
+static ssize_t smu_read_events(struct file *file, struct smu_private *pp,
+                              char __user *buf, size_t count)
+{
+       /* Not implemented */
+       msleep_interruptible(1000);
+       return 0;
+}
+
+
+static ssize_t smu_read(struct file *file, char __user *buf,
+                       size_t count, loff_t *ppos)
+{
+       struct smu_private *pp = file->private_data;
+
+       if (pp->mode == smu_file_commands)
+               return smu_read_command(file, pp, buf, count);
+       if (pp->mode == smu_file_events)
+               return smu_read_events(file, pp, buf, count);
+
+       return -EBADFD;
+}
+
+static unsigned int smu_fpoll(struct file *file, poll_table *wait)
+{
+       struct smu_private *pp = file->private_data;
+       unsigned int mask = 0;
+       unsigned long flags;
+
+       if (pp == 0)
+               return 0;
+
+       if (pp->mode == smu_file_commands) {
+               poll_wait(file, &pp->wait, wait);
+
+               spin_lock_irqsave(&pp->lock, flags);
+               if (pp->busy && pp->cmd.status != 1)
+                       mask |= POLLIN;
+               spin_unlock_irqrestore(&pp->lock, flags);
+       } if (pp->mode == smu_file_events) {
+               /* Not yet implemented */
+       }
+       return mask;
+}
+
+static int smu_release(struct inode *inode, struct file *file)
+{
+       struct smu_private *pp = file->private_data;
+       unsigned long flags;
+       unsigned int busy;
+
+       if (pp == 0)
+               return 0;
+
+       file->private_data = NULL;
+
+       /* Mark file as closing to avoid races with new request */
+       spin_lock_irqsave(&pp->lock, flags);
+       pp->mode = smu_file_closing;
+       busy = pp->busy;
+
+       /* Wait for any pending request to complete */
+       if (busy && pp->cmd.status == 1) {
+               DECLARE_WAITQUEUE(wait, current);
+
+               add_wait_queue(&pp->wait, &wait);
+               for (;;) {
+                       set_current_state(TASK_UNINTERRUPTIBLE);
+                       if (pp->cmd.status != 1)
+                               break;
+                       spin_lock_irqsave(&pp->lock, flags);
+                       schedule();
+                       spin_unlock_irqrestore(&pp->lock, flags);
+               }
+               set_current_state(TASK_RUNNING);
+               remove_wait_queue(&pp->wait, &wait);
+       }
+       spin_unlock_irqrestore(&pp->lock, flags);
+
+       spin_lock_irqsave(&smu_clist_lock, flags);
+       list_del(&pp->list);
+       spin_unlock_irqrestore(&smu_clist_lock, flags);
+       kfree(pp);
+
+       return 0;
+}
+
+
+static struct file_operations smu_device_fops __pmacdata = {
+       .llseek         = no_llseek,
+       .read           = smu_read,
+       .write          = smu_write,
+       .poll           = smu_fpoll,
+       .open           = smu_open,
+       .release        = smu_release,
+};
+
+static struct miscdevice pmu_device __pmacdata = {
+       MISC_DYNAMIC_MINOR, "smu", &smu_device_fops
+};
+
+static int smu_device_init(void)
+{
+       if (!smu)
+               return -ENODEV;
+       if (misc_register(&pmu_device) < 0)
+               printk(KERN_ERR "via-pmu: cannot register misc device.\n");
+       return 0;
+}
+device_initcall(smu_device_init);
 
+#ifndef _SMU_H
+#define _SMU_H
+
 /*
  * Definitions for talking to the SMU chip in newer G5 PowerMacs
  */
 
 #include <linux/config.h>
+#include <linux/list.h>
+
+/*
+ * Known SMU commands
+ *
+ * Most of what is below comes from looking at the Open Firmware driver,
+ * though this is still incomplete and could use better documentation here
+ * or there...
+ */
+
+
+/*
+ * Partition info commands
+ *
+ * I do not know what those are for at this point
+ */
+#define SMU_CMD_PARTITION_COMMAND              0x3e
+
+
+/*
+ * Fan control
+ *
+ * This is a "mux" for fan control commands, first byte is the
+ * "sub" command.
+ */
+#define SMU_CMD_FAN_COMMAND                    0x4a
+
+
+/*
+ * Battery access
+ *
+ * Same command number as the PMU, could it be same syntax ?
+ */
+#define SMU_CMD_BATTERY_COMMAND                        0x6f
+#define   SMU_CMD_GET_BATTERY_INFO             0x00
+
+/*
+ * Real time clock control
+ *
+ * This is a "mux", first data byte contains the "sub" command.
+ * The "RTC" part of the SMU controls the date, time, powerup
+ * timer, but also a PRAM
+ *
+ * Dates are in BCD format on 7 bytes:
+ * [sec] [min] [hour] [weekday] [month day] [month] [year]
+ * with month being 1 based and year minus 100
+ */
+#define SMU_CMD_RTC_COMMAND                    0x8e
+#define   SMU_CMD_RTC_SET_PWRUP_TIMER          0x00 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_PWRUP_TIMER          0x01 /* o: 7 bytes date */
+#define   SMU_CMD_RTC_STOP_PWRUP_TIMER         0x02
+#define   SMU_CMD_RTC_SET_PRAM_BYTE_ACC                0x20 /* i: 1 byte (address?) */
+#define   SMU_CMD_RTC_SET_PRAM_AUTOINC         0x21 /* i: 1 byte (data?) */
+#define   SMU_CMD_RTC_SET_PRAM_LO_BYTES        0x22 /* i: 10 bytes */
+#define   SMU_CMD_RTC_SET_PRAM_HI_BYTES        0x23 /* i: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_BYTE            0x28 /* i: 1 bytes (address?) */
+#define   SMU_CMD_RTC_GET_PRAM_LO_BYTES        0x29 /* o: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_HI_BYTES        0x2a /* o: 10 bytes */
+#define          SMU_CMD_RTC_SET_DATETIME              0x80 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_DATETIME             0x81 /* o: 7 bytes date */
+
+ /*
+  * i2c commands
+  *
+  * To issue an i2c command, first is to send a parameter block to the
+  * the SMU. This is a command of type 0x9a with 9 bytes of header
+  * eventually followed by data for a write:
+  *
+  * 0: bus number (from device-tree usually, SMU has lots of busses !)
+  * 1: transfer type/format (see below)
+  * 2: device address. For combined and combined4 type transfers, this
+  *    is the "write" version of the address (bit 0x01 cleared)
+  * 3: subaddress length (0..3)
+  * 4: subaddress byte 0 (or only byte for subaddress length 1)
+  * 5: subaddress byte 1
+  * 6: subaddress byte 2
+  * 7: combined address (device address for combined mode data phase)
+  * 8: data length
+  *
+  * The transfer types are the same good old Apple ones it seems,
+  * that is:
+  *   - 0x00: Simple transfer
+  *   - 0x01: Subaddress transfer (addr write + data tx, no restart)
+  *   - 0x02: Combined transfer (addr write + restart + data tx)
+  *
+  * This is then followed by actual data for a write.
+  *
+  * At this point, the OF driver seems to have a limitation on transfer
+  * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know
+  * wether this is just an OF limit due to some temporary buffer size
+  * or if this is an SMU imposed limit. This driver has the same limitation
+  * for now as I use a 0x10 bytes temporary buffer as well
+  *
+  * Once that is completed, a response is expected from the SMU. This is
+  * obtained via a command of type 0x9a with a length of 1 byte containing
+  * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's
+  * though I can't tell yet if this is actually necessary. Once this command
+  * is complete, at this point, all I can tell is what OF does. OF tests
+  * byte 0 of the reply:
+  *   - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ?
+  *   - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0)
+  *   - on write, < 0 -> failure (immediate exit)
+  *   - else, OF just exists (without error, weird)
+  *
+  * So on read, there is this wait-for-busy thing when getting a 0xfc or
+  * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and
+  * doing the above again until either the retries expire or the result
+  * is no longer 0xfe or 0xfc
+  *
+  * The Darwin I2C driver is less subtle though. On any non-success status
+  * from the response command, it waits 5ms and tries again up to 20 times,
+  * it doesn't differenciate between fatal errors or "busy" status.
+  *
+  * This driver provides an asynchronous paramblock based i2c command
+  * interface to be used either directly by low level code or by a higher
+  * level driver interfacing to the linux i2c layer. The current
+  * implementation of this relies on working timers & timer interrupts
+  * though, so be careful of calling context for now. This may be "fixed"
+  * in the future by adding a polling facility.
+  */
+#define SMU_CMD_I2C_COMMAND                    0x9a
+          /* transfer types */
+#define   SMU_I2C_TRANSFER_SIMPLE      0x00
+#define   SMU_I2C_TRANSFER_STDSUB      0x01
+#define   SMU_I2C_TRANSFER_COMBINED    0x02
+
+/*
+ * Power supply control
+ *
+ * The "sub" command is an ASCII string in the data, the
+ * data lenght is that of the string.
+ *
+ * The VSLEW command can be used to get or set the voltage slewing.
+ *  - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of
+ *    reply at data offset 6, 7 and 8.
+ *  - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is
+ *    used to set the voltage slewing point. The SMU replies with "DONE"
+ * I yet have to figure out their exact meaning of those 3 bytes in
+ * both cases.
+ *
+ */
+#define SMU_CMD_POWER_COMMAND                  0xaa
+#define   SMU_CMD_POWER_RESTART                        "RESTART"
+#define   SMU_CMD_POWER_SHUTDOWN               "SHUTDOWN"
+#define   SMU_CMD_POWER_VOLTAGE_SLEW           "VSLEW"
+
+/* Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_df_COMMAND                        0xdf
+#define   SMU_CMD_MISC_df_SET_DISPLAY_LIT      0x02 /* i: 1 byte */
+#define   SMU_CMD_MISC_df_NMI_OPTION           0x04
+
+/*
+ * Version info commands
+ *
+ * I haven't quite tried to figure out how these work
+ */
+#define SMU_CMD_VERSION_COMMAND                        0xea
+
+
+/*
+ * Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_ee_COMMAND                        0xee
+#define   SMU_CMD_MISC_ee_GET_DATABLOCK_REC    0x02
+#define          SMU_CMD_MISC_ee_LEDS_CTRL             0x04 /* i: 00 (00,01) [00] */
+#define   SMU_CMD_MISC_ee_GET_DATA             0x05 /* i: 00 , o: ?? */
+
+
+
+/*
+ * - Kernel side interface -
+ */
+
+#ifdef __KERNEL__
+
+/*
+ * Asynchronous SMU commands
+ *
+ * Fill up this structure and submit it via smu_queue_command(),
+ * and get notified by the optional done() callback, or because
+ * status becomes != 1
+ */
+
+struct smu_cmd;
+
+struct smu_cmd
+{
+       /* public */
+       u8                      cmd;            /* command */
+       int                     data_len;       /* data len */
+       int                     reply_len;      /* reply len */
+       void                    *data_buf;      /* data buffer */
+       void                    *reply_buf;     /* reply buffer */
+       int                     status;         /* command status */
+       void                    (*done)(struct smu_cmd *cmd, void *misc);
+       void                    *misc;
+
+       /* private */
+       struct list_head        link;
+};
+
+/*
+ * Queues an SMU command, all fields have to be initialized
+ */
+extern int smu_queue_cmd(struct smu_cmd *cmd);
+
+/*
+ * Simple command wrapper. This structure embeds a small buffer
+ * to ease sending simple SMU commands from the stack
+ */
+struct smu_simple_cmd
+{
+       struct smu_cmd  cmd;
+       u8              buffer[16];
+};
+
+/*
+ * Queues a simple command. All fields will be initialized by that
+ * function
+ */
+extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
+                           unsigned int data_len,
+                           void (*done)(struct smu_cmd *cmd, void *misc),
+                           void *misc,
+                           ...);
+
+/*
+ * Completion helper. Pass it to smu_queue_simple or as 'done'
+ * member to smu_queue_cmd, it will call complete() on the struct
+ * completion passed in the "misc" argument
+ */
+extern void smu_done_complete(struct smu_cmd *cmd, void *misc);
 
 /*
- * Basic routines for use by architecture. To be extended as
- * we understand more of the chip
+ * Synchronous helpers. Will spin-wait for completion of a command
+ */
+extern void smu_spinwait_cmd(struct smu_cmd *cmd);
+
+static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd)
+{
+       smu_spinwait_cmd(&scmd->cmd);
+}
+
+/*
+ * Poll routine to call if blocked with irqs off
+ */
+extern void smu_poll(void);
+
+
+/*
+ * Init routine, presence check....
  */
 extern int smu_init(void);
 extern int smu_present(void);
+struct of_device;
+extern struct of_device *smu_get_ofdev(void);
+
+
+/*
+ * Common command wrappers
+ */
 extern void smu_shutdown(void);
 extern void smu_restart(void);
-extern int smu_get_rtc_time(struct rtc_time *time);
-extern int smu_set_rtc_time(struct rtc_time *time);
+struct rtc_time;
+extern int smu_get_rtc_time(struct rtc_time *time, int spinwait);
+extern int smu_set_rtc_time(struct rtc_time *time, int spinwait);
 
 /*
  * SMU command buffer absolute address, exported by pmac_setup,
  * this is allocated very early during boot.
  */
 extern unsigned long smu_cmdbuf_abs;
+
+
+/*
+ * Kenrel asynchronous i2c interface
+ */
+
+/* SMU i2c header, exactly matches i2c header on wire */
+struct smu_i2c_param
+{
+       u8      bus;            /* SMU bus ID (from device tree) */
+       u8      type;           /* i2c transfer type */
+       u8      devaddr;        /* device address (includes direction) */
+       u8      sublen;         /* subaddress length */
+       u8      subaddr[3];     /* subaddress */
+       u8      caddr;          /* combined address, filled by SMU driver */
+       u8      datalen;        /* length of transfer */
+       u8      data[7];        /* data */
+};
+
+#define SMU_I2C_READ_MAX       0x0d
+#define SMU_I2C_WRITE_MAX      0x05
+
+struct smu_i2c_cmd
+{
+       /* public */
+       struct smu_i2c_param    info;
+       void                    (*done)(struct smu_i2c_cmd *cmd, void *misc);
+       void                    *misc;
+       int                     status; /* 1 = pending, 0 = ok, <0 = fail */
+
+       /* private */
+       struct smu_cmd          scmd;
+       int                     read;
+       int                     stage;
+       int                     retries;
+       u8                      pdata[0x10];
+       struct list_head        link;
+};
+
+/*
+ * Call this to queue an i2c command to the SMU. You must fill info,
+ * including info.data for a write, done and misc.
+ * For now, no polling interface is provided so you have to use completion
+ * callback.
+ */
+extern int smu_queue_i2c(struct smu_i2c_cmd *cmd);
+
+
+#endif /* __KERNEL__ */
+
+/*
+ * - Userland interface -
+ */
+
+/*
+ * A given instance of the device can be configured for 2 different
+ * things at the moment:
+ *
+ *  - sending SMU commands (default at open() time)
+ *  - receiving SMU events (not yet implemented)
+ *
+ * Commands are written with write() of a command block. They can be
+ * "driver" commands (for example to switch to event reception mode)
+ * or real SMU commands. They are made of a header followed by command
+ * data if any.
+ *
+ * For SMU commands (not for driver commands), you can then read() back
+ * a reply. The reader will be blocked or not depending on how the device
+ * file is opened. poll() isn't implemented yet. The reply will consist
+ * of a header as well, followed by the reply data if any. You should
+ * always provide a buffer large enough for the maximum reply data, I
+ * recommand one page.
+ *
+ * It is illegal to send SMU commands through a file descriptor configured
+ * for events reception
+ *
+ */
+struct smu_user_cmd_hdr
+{
+       __u32           cmdtype;
+#define SMU_CMDTYPE_SMU                        0       /* SMU command */
+#define SMU_CMDTYPE_WANTS_EVENTS       1       /* switch fd to events mode */
+
+       __u8            cmd;                    /* SMU command byte */
+       __u32           data_len;               /* Lenght of data following */
+};
+
+struct smu_user_reply_hdr
+{
+       __u32           status;                 /* Command status */
+       __u32           reply_len;              /* Lenght of data follwing */
+};
+
+#endif /*  _SMU_H */