drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49 #include <linux/moduleparam.h>
  50 #include <linux/workqueue.h>
  51 #include <linux/uuid.h>
  52
  53 #define PFX "IPMI message handler: "
  54
  55 #define IPMI_DRIVER_VERSION "39.2"
  56
  57 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  58 static int ipmi_init_msghandler(void);
  59 static void smi_recv_tasklet(unsigned long);
  60 static void handle_new_recv_msgs(ipmi_smi_t intf);
  61 static void need_waiter(ipmi_smi_t intf);
  62 static int handle_one_recv_msg(ipmi_smi_t          intf,
  63                                struct ipmi_smi_msg *msg);
  64
  65 static int initialized;
  66
  67 enum ipmi_panic_event_op {
  68         IPMI_SEND_PANIC_EVENT_NONE,
  69         IPMI_SEND_PANIC_EVENT,
  70         IPMI_SEND_PANIC_EVENT_STRING
  71 };
  72 #ifdef CONFIG_IPMI_PANIC_STRING
  73 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_STRING
  74 #elif defined(CONFIG_IPMI_PANIC_EVENT)
  75 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT
  76 #else
  77 #define IPMI_PANIC_DEFAULT IPMI_SEND_PANIC_EVENT_NONE
  78 #endif
  79 static enum ipmi_panic_event_op ipmi_send_panic_event = IPMI_PANIC_DEFAULT;
  80
  81 static int panic_op_write_handler(const char *val,
  82                                   const struct kernel_param *kp)
  83 {
  84         char valcp[16];
  85         char *s;
  86
  87         strncpy(valcp, val, 15);
  88         valcp[15] = '\0';
  89
  90         s = strstrip(valcp);
  91
  92         if (strcmp(s, "none") == 0)
  93                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_NONE;
  94         else if (strcmp(s, "event") == 0)
  95                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT;
  96         else if (strcmp(s, "string") == 0)
  97                 ipmi_send_panic_event = IPMI_SEND_PANIC_EVENT_STRING;
  98         else
  99                 return -EINVAL;
 100
 101         return 0;
 102 }
 103
 104 static int panic_op_read_handler(char *buffer, const struct kernel_param *kp)
 105 {
 106         switch (ipmi_send_panic_event) {
 107         case IPMI_SEND_PANIC_EVENT_NONE:
 108                 strcpy(buffer, "none");
 109                 break;
 110
 111         case IPMI_SEND_PANIC_EVENT:
 112                 strcpy(buffer, "event");
 113                 break;
 114
 115         case IPMI_SEND_PANIC_EVENT_STRING:
 116                 strcpy(buffer, "string");
 117                 break;
 118
 119         default:
 120                 strcpy(buffer, "???");
 121                 break;
 122         }
 123
 124         return strlen(buffer);
 125 }
 126
 127 static const struct kernel_param_ops panic_op_ops = {
 128         .set = panic_op_write_handler,
 129         .get = panic_op_read_handler
 130 };
 131 module_param_cb(panic_op, &panic_op_ops, NULL, 0600);
 132 MODULE_PARM_DESC(panic_op, "Sets if the IPMI driver will attempt to store panic information in the event log in the event of a panic.  Set to 'none' for no, 'event' for a single event, or 'string' for a generic event and the panic string in IPMI OEM events.");
 133
 134
 135 #ifdef CONFIG_IPMI_PROC_INTERFACE
 136 static struct proc_dir_entry *proc_ipmi_root;
 137 #endif /* CONFIG_IPMI_PROC_INTERFACE */
 138
 139 /* Remain in auto-maintenance mode for this amount of time (in ms). */
 140 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
 141
 142 #define MAX_EVENTS_IN_QUEUE     25
 143
 144 /*
 145  * Don't let a message sit in a queue forever, always time it with at lest
 146  * the max message timer.  This is in milliseconds.
 147  */
 148 #define MAX_MSG_TIMEOUT         60000
 149
 150 /* Call every ~1000 ms. */
 151 #define IPMI_TIMEOUT_TIME       1000
 152
 153 /* How many jiffies does it take to get to the timeout time. */
 154 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
 155
 156 /*
 157  * Request events from the queue every second (this is the number of
 158  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
 159  * future, IPMI will add a way to know immediately if an event is in
 160  * the queue and this silliness can go away.
 161  */
 162 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
 163
 164 /* How long should we cache dynamic device IDs? */
 165 #define IPMI_DYN_DEV_ID_EXPIRY  (10 * HZ)
 166
 167 /*
 168  * The main "user" data structure.
 169  */
 170 struct ipmi_user {
 171         struct list_head link;
 172
 173         /* Set to false when the user is destroyed. */
 174         bool valid;
 175
 176         struct kref refcount;
 177
 178         /* The upper layer that handles receive messages. */
 179         const struct ipmi_user_hndl *handler;
 180         void             *handler_data;
 181
 182         /* The interface this user is bound to. */
 183         ipmi_smi_t intf;
 184
 185         /* Does this interface receive IPMI events? */
 186         bool gets_events;
 187 };
 188
 189 struct cmd_rcvr {
 190         struct list_head link;
 191
 192         ipmi_user_t   user;
 193         unsigned char netfn;
 194         unsigned char cmd;
 195         unsigned int  chans;
 196
 197         /*
 198          * This is used to form a linked lised during mass deletion.
 199          * Since this is in an RCU list, we cannot use the link above
 200          * or change any data until the RCU period completes.  So we
 201          * use this next variable during mass deletion so we can have
 202          * a list and don't have to wait and restart the search on
 203          * every individual deletion of a command.
 204          */
 205         struct cmd_rcvr *next;
 206 };
 207
 208 struct seq_table {
 209         unsigned int         inuse : 1;
 210         unsigned int         broadcast : 1;
 211
 212         unsigned long        timeout;
 213         unsigned long        orig_timeout;
 214         unsigned int         retries_left;
 215
 216         /*
 217          * To verify on an incoming send message response that this is
 218          * the message that the response is for, we keep a sequence id
 219          * and increment it every time we send a message.
 220          */
 221         long                 seqid;
 222
 223         /*
 224          * This is held so we can properly respond to the message on a
 225          * timeout, and it is used to hold the temporary data for
 226          * retransmission, too.
 227          */
 228         struct ipmi_recv_msg *recv_msg;
 229 };
 230
 231 /*
 232  * Store the information in a msgid (long) to allow us to find a
 233  * sequence table entry from the msgid.
 234  */
 235 #define STORE_SEQ_IN_MSGID(seq, seqid) \
 236         ((((seq) & 0x3f) << 26) | ((seqid) & 0x3ffffff))
 237
 238 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 239         do {                                                            \
 240                 seq = (((msgid) >> 26) & 0x3f);                         \
 241                 seqid = ((msgid) & 0x3ffffff);                          \
 242         } while (0)
 243
 244 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3ffffff)
 245
 246 #define IPMI_MAX_CHANNELS       16
 247 struct ipmi_channel {
 248         unsigned char medium;
 249         unsigned char protocol;
 250 };
 251
 252 struct ipmi_channel_set {
 253         struct ipmi_channel c[IPMI_MAX_CHANNELS];
 254 };
 255
 256 struct ipmi_my_addrinfo {
 257         /*
 258          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 259          * but may be changed by the user.
 260          */
 261         unsigned char address;
 262
 263         /*
 264          * My LUN.  This should generally stay the SMS LUN, but just in
 265          * case...
 266          */
 267         unsigned char lun;
 268 };
 269
 270 #ifdef CONFIG_IPMI_PROC_INTERFACE
 271 struct ipmi_proc_entry {
 272         char                   *name;
 273         struct ipmi_proc_entry *next;
 274 };
 275 #endif
 276
 277 /*
 278  * Note that the product id, manufacturer id, guid, and device id are
 279  * immutable in this structure, so dyn_mutex is not required for
 280  * accessing those.  If those change on a BMC, a new BMC is allocated.
 281  */
 282 struct bmc_device {
 283         struct platform_device pdev;
 284         struct list_head       intfs; /* Interfaces on this BMC. */
 285         struct ipmi_device_id  id;
 286         struct ipmi_device_id  fetch_id;
 287         int                    dyn_id_set;
 288         unsigned long          dyn_id_expiry;
 289         struct mutex           dyn_mutex; /* Protects id, intfs, & dyn* */
 290         guid_t                 guid;
 291         guid_t                 fetch_guid;
 292         int                    dyn_guid_set;
 293         struct kref            usecount;
 294         struct work_struct     remove_work;
 295 };
 296 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 297
 298 static int bmc_get_device_id(ipmi_smi_t intf, struct bmc_device *bmc,
 299                              struct ipmi_device_id *id,
 300                              bool *guid_set, guid_t *guid);
 301
 302 /*
 303  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 304  * structure.
 305  */
 306 enum ipmi_stat_indexes {
 307         /* Commands we got from the user that were invalid. */
 308         IPMI_STAT_sent_invalid_commands = 0,
 309
 310         /* Commands we sent to the MC. */
 311         IPMI_STAT_sent_local_commands,
 312
 313         /* Responses from the MC that were delivered to a user. */
 314         IPMI_STAT_handled_local_responses,
 315
 316         /* Responses from the MC that were not delivered to a user. */
 317         IPMI_STAT_unhandled_local_responses,
 318
 319         /* Commands we sent out to the IPMB bus. */
 320         IPMI_STAT_sent_ipmb_commands,
 321
 322         /* Commands sent on the IPMB that had errors on the SEND CMD */
 323         IPMI_STAT_sent_ipmb_command_errs,
 324
 325         /* Each retransmit increments this count. */
 326         IPMI_STAT_retransmitted_ipmb_commands,
 327
 328         /*
 329          * When a message times out (runs out of retransmits) this is
 330          * incremented.
 331          */
 332         IPMI_STAT_timed_out_ipmb_commands,
 333
 334         /*
 335          * This is like above, but for broadcasts.  Broadcasts are
 336          * *not* included in the above count (they are expected to
 337          * time out).
 338          */
 339         IPMI_STAT_timed_out_ipmb_broadcasts,
 340
 341         /* Responses I have sent to the IPMB bus. */
 342         IPMI_STAT_sent_ipmb_responses,
 343
 344         /* The response was delivered to the user. */
 345         IPMI_STAT_handled_ipmb_responses,
 346
 347         /* The response had invalid data in it. */
 348         IPMI_STAT_invalid_ipmb_responses,
 349
 350         /* The response didn't have anyone waiting for it. */
 351         IPMI_STAT_unhandled_ipmb_responses,
 352
 353         /* Commands we sent out to the IPMB bus. */
 354         IPMI_STAT_sent_lan_commands,
 355
 356         /* Commands sent on the IPMB that had errors on the SEND CMD */
 357         IPMI_STAT_sent_lan_command_errs,
 358
 359         /* Each retransmit increments this count. */
 360         IPMI_STAT_retransmitted_lan_commands,
 361
 362         /*
 363          * When a message times out (runs out of retransmits) this is
 364          * incremented.
 365          */
 366         IPMI_STAT_timed_out_lan_commands,
 367
 368         /* Responses I have sent to the IPMB bus. */
 369         IPMI_STAT_sent_lan_responses,
 370
 371         /* The response was delivered to the user. */
 372         IPMI_STAT_handled_lan_responses,
 373
 374         /* The response had invalid data in it. */
 375         IPMI_STAT_invalid_lan_responses,
 376
 377         /* The response didn't have anyone waiting for it. */
 378         IPMI_STAT_unhandled_lan_responses,
 379
 380         /* The command was delivered to the user. */
 381         IPMI_STAT_handled_commands,
 382
 383         /* The command had invalid data in it. */
 384         IPMI_STAT_invalid_commands,
 385
 386         /* The command didn't have anyone waiting for it. */
 387         IPMI_STAT_unhandled_commands,
 388
 389         /* Invalid data in an event. */
 390         IPMI_STAT_invalid_events,
 391
 392         /* Events that were received with the proper format. */
 393         IPMI_STAT_events,
 394
 395         /* Retransmissions on IPMB that failed. */
 396         IPMI_STAT_dropped_rexmit_ipmb_commands,
 397
 398         /* Retransmissions on LAN that failed. */
 399         IPMI_STAT_dropped_rexmit_lan_commands,
 400
 401         /* This *must* remain last, add new values above this. */
 402         IPMI_NUM_STATS
 403 };
 404
 405
 406 #define IPMI_IPMB_NUM_SEQ       64
 407 struct ipmi_smi {
 408         /* What interface number are we? */
 409         int intf_num;
 410
 411         struct kref refcount;
 412
 413         /* Set when the interface is being unregistered. */
 414         bool in_shutdown;
 415
 416         /* Used for a list of interfaces. */
 417         struct list_head link;
 418
 419         /*
 420          * The list of upper layers that are using me.  seq_lock
 421          * protects this.
 422          */
 423         struct list_head users;
 424
 425         /* Used for wake ups at startup. */
 426         wait_queue_head_t waitq;
 427
 428         /*
 429          * Prevents the interface from being unregistered when the
 430          * interface is used by being looked up through the BMC
 431          * structure.
 432          */
 433         struct mutex bmc_reg_mutex;
 434
 435         struct bmc_device tmp_bmc;
 436         struct bmc_device *bmc;
 437         bool bmc_registered;
 438         struct list_head bmc_link;
 439         char *my_dev_name;
 440         bool in_bmc_register;  /* Handle recursive situations.  Yuck. */
 441         struct work_struct bmc_reg_work;
 442
 443         /*
 444          * This is the lower-layer's sender routine.  Note that you
 445          * must either be holding the ipmi_interfaces_mutex or be in
 446          * an umpreemptible region to use this.  You must fetch the
 447          * value into a local variable and make sure it is not NULL.
 448          */
 449         const struct ipmi_smi_handlers *handlers;
 450         void                     *send_info;
 451
 452 #ifdef CONFIG_IPMI_PROC_INTERFACE
 453         /* A list of proc entries for this interface. */
 454         struct mutex           proc_entry_lock;
 455         struct ipmi_proc_entry *proc_entries;
 456
 457         struct proc_dir_entry *proc_dir;
 458         char                  proc_dir_name[10];
 459 #endif
 460
 461         /* Driver-model device for the system interface. */
 462         struct device          *si_dev;
 463
 464         /*
 465          * A table of sequence numbers for this interface.  We use the
 466          * sequence numbers for IPMB messages that go out of the
 467          * interface to match them up with their responses.  A routine
 468          * is called periodically to time the items in this list.
 469          */
 470         spinlock_t       seq_lock;
 471         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 472         int curr_seq;
 473
 474         /*
 475          * Messages queued for delivery.  If delivery fails (out of memory
 476          * for instance), They will stay in here to be processed later in a
 477          * periodic timer interrupt.  The tasklet is for handling received
 478          * messages directly from the handler.
 479          */
 480         spinlock_t       waiting_rcv_msgs_lock;
 481         struct list_head waiting_rcv_msgs;
 482         atomic_t         watchdog_pretimeouts_to_deliver;
 483         struct tasklet_struct recv_tasklet;
 484
 485         spinlock_t             xmit_msgs_lock;
 486         struct list_head       xmit_msgs;
 487         struct ipmi_smi_msg    *curr_msg;
 488         struct list_head       hp_xmit_msgs;
 489
 490         /*
 491          * The list of command receivers that are registered for commands
 492          * on this interface.
 493          */
 494         struct mutex     cmd_rcvrs_mutex;
 495         struct list_head cmd_rcvrs;
 496
 497         /*
 498          * Events that were queues because no one was there to receive
 499          * them.
 500          */
 501         spinlock_t       events_lock; /* For dealing with event stuff. */
 502         struct list_head waiting_events;
 503         unsigned int     waiting_events_count; /* How many events in queue? */
 504         char             delivering_events;
 505         char             event_msg_printed;
 506         atomic_t         event_waiters;
 507         unsigned int     ticks_to_req_ev;
 508         int              last_needs_timer;
 509
 510         /*
 511          * The event receiver for my BMC, only really used at panic
 512          * shutdown as a place to store this.
 513          */
 514         unsigned char event_receiver;
 515         unsigned char event_receiver_lun;
 516         unsigned char local_sel_device;
 517         unsigned char local_event_generator;
 518
 519         /* For handling of maintenance mode. */
 520         int maintenance_mode;
 521         bool maintenance_mode_enable;
 522         int auto_maintenance_timeout;
 523         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 524
 525         /*
 526          * A cheap hack, if this is non-null and a message to an
 527          * interface comes in with a NULL user, call this routine with
 528          * it.  Note that the message will still be freed by the
 529          * caller.  This only works on the system interface.
 530          *
 531          * Protected by bmc_reg_mutex.
 532          */
 533         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 534
 535         /*
 536          * When we are scanning the channels for an SMI, this will
 537          * tell which channel we are scanning.
 538          */
 539         int curr_channel;
 540
 541         /* Channel information */
 542         struct ipmi_channel_set *channel_list;
 543         unsigned int curr_working_cset; /* First index into the following. */
 544         struct ipmi_channel_set wchannels[2];
 545         struct ipmi_my_addrinfo addrinfo[IPMI_MAX_CHANNELS];
 546         bool channels_ready;
 547
 548         atomic_t stats[IPMI_NUM_STATS];
 549
 550         /*
 551          * run_to_completion duplicate of smb_info, smi_info
 552          * and ipmi_serial_info structures. Used to decrease numbers of
 553          * parameters passed by "low" level IPMI code.
 554          */
 555         int run_to_completion;
 556 };
 557 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 558
 559 static void __get_guid(ipmi_smi_t intf);
 560 static void __ipmi_bmc_unregister(ipmi_smi_t intf);
 561 static int __ipmi_bmc_register(ipmi_smi_t intf,
 562                                struct ipmi_device_id *id,
 563                                bool guid_set, guid_t *guid, int intf_num);
 564 static int __scan_channels(ipmi_smi_t intf, struct ipmi_device_id *id);
 565
 566
 567 /**
 568  * The driver model view of the IPMI messaging driver.
 569  */
 570 static struct platform_driver ipmidriver = {
 571         .driver = {
 572                 .name = "ipmi",
 573                 .bus = &platform_bus_type
 574         }
 575 };
 576 /*
 577  * This mutex keeps us from adding the same BMC twice.
 578  */
 579 static DEFINE_MUTEX(ipmidriver_mutex);
 580
 581 static LIST_HEAD(ipmi_interfaces);
 582 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 583
 584 /*
 585  * List of watchers that want to know when smi's are added and deleted.
 586  */
 587 static LIST_HEAD(smi_watchers);
 588 static DEFINE_MUTEX(smi_watchers_mutex);
 589
 590 #define ipmi_inc_stat(intf, stat) \
 591         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 592 #define ipmi_get_stat(intf, stat) \
 593         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 594
 595 static const char * const addr_src_to_str[] = {
 596         "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI",
 597         "device-tree", "platform"
 598 };
 599
 600 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 601 {
 602         if (src >= SI_LAST)
 603                 src = 0; /* Invalid */
 604         return addr_src_to_str[src];
 605 }
 606 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 607
 608 static int is_lan_addr(struct ipmi_addr *addr)
 609 {
 610         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 611 }
 612
 613 static int is_ipmb_addr(struct ipmi_addr *addr)
 614 {
 615         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 616 }
 617
 618 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 619 {
 620         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 621 }
 622
 623 static void free_recv_msg_list(struct list_head *q)
 624 {
 625         struct ipmi_recv_msg *msg, *msg2;
 626
 627         list_for_each_entry_safe(msg, msg2, q, link) {
 628                 list_del(&msg->link);
 629                 ipmi_free_recv_msg(msg);
 630         }
 631 }
 632
 633 static void free_smi_msg_list(struct list_head *q)
 634 {
 635         struct ipmi_smi_msg *msg, *msg2;
 636
 637         list_for_each_entry_safe(msg, msg2, q, link) {
 638                 list_del(&msg->link);
 639                 ipmi_free_smi_msg(msg);
 640         }
 641 }
 642
 643 static void clean_up_interface_data(ipmi_smi_t intf)
 644 {
 645         int              i;
 646         struct cmd_rcvr  *rcvr, *rcvr2;
 647         struct list_head list;
 648
 649         tasklet_kill(&intf->recv_tasklet);
 650
 651         free_smi_msg_list(&intf->waiting_rcv_msgs);
 652         free_recv_msg_list(&intf->waiting_events);
 653
 654         /*
 655          * Wholesale remove all the entries from the list in the
 656          * interface and wait for RCU to know that none are in use.
 657          */
 658         mutex_lock(&intf->cmd_rcvrs_mutex);
 659         INIT_LIST_HEAD(&list);
 660         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 661         mutex_unlock(&intf->cmd_rcvrs_mutex);
 662
 663         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 664                 kfree(rcvr);
 665
 666         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 667                 if ((intf->seq_table[i].inuse)
 668                                         && (intf->seq_table[i].recv_msg))
 669                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 670         }
 671 }
 672
 673 static void intf_free(struct kref *ref)
 674 {
 675         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 676
 677         clean_up_interface_data(intf);
 678         kfree(intf);
 679 }
 680
 681 struct watcher_entry {
 682         int              intf_num;
 683         ipmi_smi_t       intf;
 684         struct list_head link;
 685 };
 686
 687 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 688 {
 689         ipmi_smi_t intf;
 690         LIST_HEAD(to_deliver);
 691         struct watcher_entry *e, *e2;
 692
 693         mutex_lock(&smi_watchers_mutex);
 694
 695         mutex_lock(&ipmi_interfaces_mutex);
 696
 697         /* Build a list of things to deliver. */
 698         list_for_each_entry(intf, &ipmi_interfaces, link) {
 699                 if (intf->intf_num == -1)
 700                         continue;
 701                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 702                 if (!e)
 703                         goto out_err;
 704                 kref_get(&intf->refcount);
 705                 e->intf = intf;
 706                 e->intf_num = intf->intf_num;
 707                 list_add_tail(&e->link, &to_deliver);
 708         }
 709
 710         /* We will succeed, so add it to the list. */
 711         list_add(&watcher->link, &smi_watchers);
 712
 713         mutex_unlock(&ipmi_interfaces_mutex);
 714
 715         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 716                 list_del(&e->link);
 717                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 718                 kref_put(&e->intf->refcount, intf_free);
 719                 kfree(e);
 720         }
 721
 722         mutex_unlock(&smi_watchers_mutex);
 723
 724         return 0;
 725
 726  out_err:
 727         mutex_unlock(&ipmi_interfaces_mutex);
 728         mutex_unlock(&smi_watchers_mutex);
 729         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 730                 list_del(&e->link);
 731                 kref_put(&e->intf->refcount, intf_free);
 732                 kfree(e);
 733         }
 734         return -ENOMEM;
 735 }
 736 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 737
 738 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 739 {
 740         mutex_lock(&smi_watchers_mutex);
 741         list_del(&(watcher->link));
 742         mutex_unlock(&smi_watchers_mutex);
 743         return 0;
 744 }
 745 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 746
 747 /*
 748  * Must be called with smi_watchers_mutex held.
 749  */
 750 static void
 751 call_smi_watchers(int i, struct device *dev)
 752 {
 753         struct ipmi_smi_watcher *w;
 754
 755         list_for_each_entry(w, &smi_watchers, link) {
 756                 if (try_module_get(w->owner)) {
 757                         w->new_smi(i, dev);
 758                         module_put(w->owner);
 759                 }
 760         }
 761 }
 762
 763 static int
 764 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 765 {
 766         if (addr1->addr_type != addr2->addr_type)
 767                 return 0;
 768
 769         if (addr1->channel != addr2->channel)
 770                 return 0;
 771
 772         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 773                 struct ipmi_system_interface_addr *smi_addr1
 774                     = (struct ipmi_system_interface_addr *) addr1;
 775                 struct ipmi_system_interface_addr *smi_addr2
 776                     = (struct ipmi_system_interface_addr *) addr2;
 777                 return (smi_addr1->lun == smi_addr2->lun);
 778         }
 779
 780         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 781                 struct ipmi_ipmb_addr *ipmb_addr1
 782                     = (struct ipmi_ipmb_addr *) addr1;
 783                 struct ipmi_ipmb_addr *ipmb_addr2
 784                     = (struct ipmi_ipmb_addr *) addr2;
 785
 786                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 787                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 788         }
 789
 790         if (is_lan_addr(addr1)) {
 791                 struct ipmi_lan_addr *lan_addr1
 792                         = (struct ipmi_lan_addr *) addr1;
 793                 struct ipmi_lan_addr *lan_addr2
 794                     = (struct ipmi_lan_addr *) addr2;
 795
 796                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 797                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 798                         && (lan_addr1->session_handle
 799                             == lan_addr2->session_handle)
 800                         && (lan_addr1->lun == lan_addr2->lun));
 801         }
 802
 803         return 1;
 804 }
 805
 806 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 807 {
 808         if (len < sizeof(struct ipmi_system_interface_addr))
 809                 return -EINVAL;
 810
 811         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 812                 if (addr->channel != IPMI_BMC_CHANNEL)
 813                         return -EINVAL;
 814                 return 0;
 815         }
 816
 817         if ((addr->channel == IPMI_BMC_CHANNEL)
 818             || (addr->channel >= IPMI_MAX_CHANNELS)
 819             || (addr->channel < 0))
 820                 return -EINVAL;
 821
 822         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 823                 if (len < sizeof(struct ipmi_ipmb_addr))
 824                         return -EINVAL;
 825                 return 0;
 826         }
 827
 828         if (is_lan_addr(addr)) {
 829                 if (len < sizeof(struct ipmi_lan_addr))
 830                         return -EINVAL;
 831                 return 0;
 832         }
 833
 834         return -EINVAL;
 835 }
 836 EXPORT_SYMBOL(ipmi_validate_addr);
 837
 838 unsigned int ipmi_addr_length(int addr_type)
 839 {
 840         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 841                 return sizeof(struct ipmi_system_interface_addr);
 842
 843         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 844                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 845                 return sizeof(struct ipmi_ipmb_addr);
 846
 847         if (addr_type == IPMI_LAN_ADDR_TYPE)
 848                 return sizeof(struct ipmi_lan_addr);
 849
 850         return 0;
 851 }
 852 EXPORT_SYMBOL(ipmi_addr_length);
 853
 854 static void deliver_response(struct ipmi_recv_msg *msg)
 855 {
 856         if (!msg->user) {
 857                 ipmi_smi_t    intf = msg->user_msg_data;
 858
 859                 /* Special handling for NULL users. */
 860                 if (intf->null_user_handler) {
 861                         intf->null_user_handler(intf, msg);
 862                         ipmi_inc_stat(intf, handled_local_responses);
 863                 } else {
 864                         /* No handler, so give up. */
 865                         ipmi_inc_stat(intf, unhandled_local_responses);
 866                 }
 867                 ipmi_free_recv_msg(msg);
 868         } else if (!oops_in_progress) {
 869                 /*
 870                  * If we are running in the panic context, calling the
 871                  * receive handler doesn't much meaning and has a deadlock
 872                  * risk.  At this moment, simply skip it in that case.
 873                  */
 874
 875                 ipmi_user_t user = msg->user;
 876                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 877         }
 878 }
 879
 880 static void
 881 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 882 {
 883         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 884         msg->msg_data[0] = err;
 885         msg->msg.netfn |= 1; /* Convert to a response. */
 886         msg->msg.data_len = 1;
 887         msg->msg.data = msg->msg_data;
 888         deliver_response(msg);
 889 }
 890
 891 /*
 892  * Find the next sequence number not being used and add the given
 893  * message with the given timeout to the sequence table.  This must be
 894  * called with the interface's seq_lock held.
 895  */
 896 static int intf_next_seq(ipmi_smi_t           intf,
 897                          struct ipmi_recv_msg *recv_msg,
 898                          unsigned long        timeout,
 899                          int                  retries,
 900                          int                  broadcast,
 901                          unsigned char        *seq,
 902                          long                 *seqid)
 903 {
 904         int          rv = 0;
 905         unsigned int i;
 906
 907         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 908                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 909                 if (!intf->seq_table[i].inuse)
 910                         break;
 911         }
 912
 913         if (!intf->seq_table[i].inuse) {
 914                 intf->seq_table[i].recv_msg = recv_msg;
 915
 916                 /*
 917                  * Start with the maximum timeout, when the send response
 918                  * comes in we will start the real timer.
 919                  */
 920                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 921                 intf->seq_table[i].orig_timeout = timeout;
 922                 intf->seq_table[i].retries_left = retries;
 923                 intf->seq_table[i].broadcast = broadcast;
 924                 intf->seq_table[i].inuse = 1;
 925                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 926                 *seq = i;
 927                 *seqid = intf->seq_table[i].seqid;
 928                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 929                 need_waiter(intf);
 930         } else {
 931                 rv = -EAGAIN;
 932         }
 933
 934         return rv;
 935 }
 936
 937 /*
 938  * Return the receive message for the given sequence number and
 939  * release the sequence number so it can be reused.  Some other data
 940  * is passed in to be sure the message matches up correctly (to help
 941  * guard against message coming in after their timeout and the
 942  * sequence number being reused).
 943  */
 944 static int intf_find_seq(ipmi_smi_t           intf,
 945                          unsigned char        seq,
 946                          short                channel,
 947                          unsigned char        cmd,
 948                          unsigned char        netfn,
 949                          struct ipmi_addr     *addr,
 950                          struct ipmi_recv_msg **recv_msg)
 951 {
 952         int           rv = -ENODEV;
 953         unsigned long flags;
 954
 955         if (seq >= IPMI_IPMB_NUM_SEQ)
 956                 return -EINVAL;
 957
 958         spin_lock_irqsave(&(intf->seq_lock), flags);
 959         if (intf->seq_table[seq].inuse) {
 960                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 961
 962                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 963                                 && (msg->msg.netfn == netfn)
 964                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 965                         *recv_msg = msg;
 966                         intf->seq_table[seq].inuse = 0;
 967                         rv = 0;
 968                 }
 969         }
 970         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 971
 972         return rv;
 973 }
 974
 975
 976 /* Start the timer for a specific sequence table entry. */
 977 static int intf_start_seq_timer(ipmi_smi_t intf,
 978                                 long       msgid)
 979 {
 980         int           rv = -ENODEV;
 981         unsigned long flags;
 982         unsigned char seq;
 983         unsigned long seqid;
 984
 985
 986         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 987
 988         spin_lock_irqsave(&(intf->seq_lock), flags);
 989         /*
 990          * We do this verification because the user can be deleted
 991          * while a message is outstanding.
 992          */
 993         if ((intf->seq_table[seq].inuse)
 994                                 && (intf->seq_table[seq].seqid == seqid)) {
 995                 struct seq_table *ent = &(intf->seq_table[seq]);
 996                 ent->timeout = ent->orig_timeout;
 997                 rv = 0;
 998         }
 999         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1000
1001         return rv;
1002 }
1003
1004 /* Got an error for the send message for a specific sequence number. */
1005 static int intf_err_seq(ipmi_smi_t   intf,
1006                         long         msgid,
1007                         unsigned int err)
1008 {
1009         int                  rv = -ENODEV;
1010         unsigned long        flags;
1011         unsigned char        seq;
1012         unsigned long        seqid;
1013         struct ipmi_recv_msg *msg = NULL;
1014
1015
1016         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
1017
1018         spin_lock_irqsave(&(intf->seq_lock), flags);
1019         /*
1020          * We do this verification because the user can be deleted
1021          * while a message is outstanding.
1022          */
1023         if ((intf->seq_table[seq].inuse)
1024                                 && (intf->seq_table[seq].seqid == seqid)) {
1025                 struct seq_table *ent = &(intf->seq_table[seq]);
1026
1027                 ent->inuse = 0;
1028                 msg = ent->recv_msg;
1029                 rv = 0;
1030         }
1031         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1032
1033         if (msg)
1034                 deliver_err_response(msg, err);
1035
1036         return rv;
1037 }
1038
1039
1040 int ipmi_create_user(unsigned int          if_num,
1041                      const struct ipmi_user_hndl *handler,
1042                      void                  *handler_data,
1043                      ipmi_user_t           *user)
1044 {
1045         unsigned long flags;
1046         ipmi_user_t   new_user;
1047         int           rv = 0;
1048         ipmi_smi_t    intf;
1049
1050         /*
1051          * There is no module usecount here, because it's not
1052          * required.  Since this can only be used by and called from
1053          * other modules, they will implicitly use this module, and
1054          * thus this can't be removed unless the other modules are
1055          * removed.
1056          */
1057
1058         if (handler == NULL)
1059                 return -EINVAL;
1060
1061         /*
1062          * Make sure the driver is actually initialized, this handles
1063          * problems with initialization order.
1064          */
1065         if (!initialized) {
1066                 rv = ipmi_init_msghandler();
1067                 if (rv)
1068                         return rv;
1069
1070                 /*
1071                  * The init code doesn't return an error if it was turned
1072                  * off, but it won't initialize.  Check that.
1073                  */
1074                 if (!initialized)
1075                         return -ENODEV;
1076         }
1077
1078         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
1079         if (!new_user)
1080                 return -ENOMEM;
1081
1082         mutex_lock(&ipmi_interfaces_mutex);
1083         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1084                 if (intf->intf_num == if_num)
1085                         goto found;
1086         }
1087         /* Not found, return an error */
1088         rv = -EINVAL;
1089         goto out_kfree;
1090
1091  found:
1092         /* Note that each existing user holds a refcount to the interface. */
1093         kref_get(&intf->refcount);
1094
1095         kref_init(&new_user->refcount);
1096         new_user->handler = handler;
1097         new_user->handler_data = handler_data;
1098         new_user->intf = intf;
1099         new_user->gets_events = false;
1100
1101         if (!try_module_get(intf->handlers->owner)) {
1102                 rv = -ENODEV;
1103                 goto out_kref;
1104         }
1105
1106         if (intf->handlers->inc_usecount) {
1107                 rv = intf->handlers->inc_usecount(intf->send_info);
1108                 if (rv) {
1109                         module_put(intf->handlers->owner);
1110                         goto out_kref;
1111                 }
1112         }
1113
1114         /*
1115          * Hold the lock so intf->handlers is guaranteed to be good
1116          * until now
1117          */
1118         mutex_unlock(&ipmi_interfaces_mutex);
1119
1120         new_user->valid = true;
1121         spin_lock_irqsave(&intf->seq_lock, flags);
1122         list_add_rcu(&new_user->link, &intf->users);
1123         spin_unlock_irqrestore(&intf->seq_lock, flags);
1124         if (handler->ipmi_watchdog_pretimeout) {
1125                 /* User wants pretimeouts, so make sure to watch for them. */
1126                 if (atomic_inc_return(&intf->event_waiters) == 1)
1127                         need_waiter(intf);
1128         }
1129         *user = new_user;
1130         return 0;
1131
1132 out_kref:
1133         kref_put(&intf->refcount, intf_free);
1134 out_kfree:
1135         mutex_unlock(&ipmi_interfaces_mutex);
1136         kfree(new_user);
1137         return rv;
1138 }
1139 EXPORT_SYMBOL(ipmi_create_user);
1140
1141 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1142 {
1143         int           rv = 0;
1144         ipmi_smi_t    intf;
1145         const struct ipmi_smi_handlers *handlers;
1146
1147         mutex_lock(&ipmi_interfaces_mutex);
1148         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1149                 if (intf->intf_num == if_num)
1150                         goto found;
1151         }
1152         /* Not found, return an error */
1153         rv = -EINVAL;
1154         mutex_unlock(&ipmi_interfaces_mutex);
1155         return rv;
1156
1157 found:
1158         handlers = intf->handlers;
1159         rv = -ENOSYS;
1160         if (handlers->get_smi_info)
1161                 rv = handlers->get_smi_info(intf->send_info, data);
1162         mutex_unlock(&ipmi_interfaces_mutex);
1163
1164         return rv;
1165 }
1166 EXPORT_SYMBOL(ipmi_get_smi_info);
1167
1168 static void free_user(struct kref *ref)
1169 {
1170         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1171         kfree(user);
1172 }
1173
1174 int ipmi_destroy_user(ipmi_user_t user)
1175 {
1176         ipmi_smi_t       intf = user->intf;
1177         int              i;
1178         unsigned long    flags;
1179         struct cmd_rcvr  *rcvr;
1180         struct cmd_rcvr  *rcvrs = NULL;
1181
1182         user->valid = false;
1183
1184         if (user->handler->ipmi_watchdog_pretimeout)
1185                 atomic_dec(&intf->event_waiters);
1186
1187         if (user->gets_events)
1188                 atomic_dec(&intf->event_waiters);
1189
1190         /* Remove the user from the interface's sequence table. */
1191         spin_lock_irqsave(&intf->seq_lock, flags);
1192         list_del_rcu(&user->link);
1193
1194         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1195                 if (intf->seq_table[i].inuse
1196                     && (intf->seq_table[i].recv_msg->user == user)) {
1197                         intf->seq_table[i].inuse = 0;
1198                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1199                 }
1200         }
1201         spin_unlock_irqrestore(&intf->seq_lock, flags);
1202
1203         /*
1204          * Remove the user from the command receiver's table.  First
1205          * we build a list of everything (not using the standard link,
1206          * since other things may be using it till we do
1207          * synchronize_rcu()) then free everything in that list.
1208          */
1209         mutex_lock(&intf->cmd_rcvrs_mutex);
1210         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1211                 if (rcvr->user == user) {
1212                         list_del_rcu(&rcvr->link);
1213                         rcvr->next = rcvrs;
1214                         rcvrs = rcvr;
1215                 }
1216         }
1217         mutex_unlock(&intf->cmd_rcvrs_mutex);
1218         synchronize_rcu();
1219         while (rcvrs) {
1220                 rcvr = rcvrs;
1221                 rcvrs = rcvr->next;
1222                 kfree(rcvr);
1223         }
1224
1225         mutex_lock(&ipmi_interfaces_mutex);
1226         if (intf->handlers) {
1227                 module_put(intf->handlers->owner);
1228                 if (intf->handlers->dec_usecount)
1229                         intf->handlers->dec_usecount(intf->send_info);
1230         }
1231         mutex_unlock(&ipmi_interfaces_mutex);
1232
1233         kref_put(&intf->refcount, intf_free);
1234
1235         kref_put(&user->refcount, free_user);
1236
1237         return 0;
1238 }
1239 EXPORT_SYMBOL(ipmi_destroy_user);
1240
1241 int ipmi_get_version(ipmi_user_t   user,
1242                      unsigned char *major,
1243                      unsigned char *minor)
1244 {
1245         struct ipmi_device_id id;
1246         int rv;
1247
1248         rv = bmc_get_device_id(user->intf, NULL, &id, NULL, NULL);
1249         if (rv)
1250                 return rv;
1251
1252         *major = ipmi_version_major(&id);
1253         *minor = ipmi_version_minor(&id);
1254
1255         return 0;
1256 }
1257 EXPORT_SYMBOL(ipmi_get_version);
1258
1259 int ipmi_set_my_address(ipmi_user_t   user,
1260                         unsigned int  channel,
1261                         unsigned char address)
1262 {
1263         if (channel >= IPMI_MAX_CHANNELS)
1264                 return -EINVAL;
1265         user->intf->addrinfo[channel].address = address;
1266         return 0;
1267 }
1268 EXPORT_SYMBOL(ipmi_set_my_address);
1269
1270 int ipmi_get_my_address(ipmi_user_t   user,
1271                         unsigned int  channel,
1272                         unsigned char *address)
1273 {
1274         if (channel >= IPMI_MAX_CHANNELS)
1275                 return -EINVAL;
1276         *address = user->intf->addrinfo[channel].address;
1277         return 0;
1278 }
1279 EXPORT_SYMBOL(ipmi_get_my_address);
1280
1281 int ipmi_set_my_LUN(ipmi_user_t   user,
1282                     unsigned int  channel,
1283                     unsigned char LUN)
1284 {
1285         if (channel >= IPMI_MAX_CHANNELS)
1286                 return -EINVAL;
1287         user->intf->addrinfo[channel].lun = LUN & 0x3;
1288         return 0;
1289 }
1290 EXPORT_SYMBOL(ipmi_set_my_LUN);
1291
1292 int ipmi_get_my_LUN(ipmi_user_t   user,
1293                     unsigned int  channel,
1294                     unsigned char *address)
1295 {
1296         if (channel >= IPMI_MAX_CHANNELS)
1297                 return -EINVAL;
1298         *address = user->intf->addrinfo[channel].lun;
1299         return 0;
1300 }
1301 EXPORT_SYMBOL(ipmi_get_my_LUN);
1302
1303 int ipmi_get_maintenance_mode(ipmi_user_t user)
1304 {
1305         int           mode;
1306         unsigned long flags;
1307
1308         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1309         mode = user->intf->maintenance_mode;
1310         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1311
1312         return mode;
1313 }
1314 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1315
1316 static void maintenance_mode_update(ipmi_smi_t intf)
1317 {
1318         if (intf->handlers->set_maintenance_mode)
1319                 intf->handlers->set_maintenance_mode(
1320                         intf->send_info, intf->maintenance_mode_enable);
1321 }
1322
1323 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1324 {
1325         int           rv = 0;
1326         unsigned long flags;
1327         ipmi_smi_t    intf = user->intf;
1328
1329         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1330         if (intf->maintenance_mode != mode) {
1331                 switch (mode) {
1332                 case IPMI_MAINTENANCE_MODE_AUTO:
1333                         intf->maintenance_mode_enable
1334                                 = (intf->auto_maintenance_timeout > 0);
1335                         break;
1336
1337                 case IPMI_MAINTENANCE_MODE_OFF:
1338                         intf->maintenance_mode_enable = false;
1339                         break;
1340
1341                 case IPMI_MAINTENANCE_MODE_ON:
1342                         intf->maintenance_mode_enable = true;
1343                         break;
1344
1345                 default:
1346                         rv = -EINVAL;
1347                         goto out_unlock;
1348                 }
1349                 intf->maintenance_mode = mode;
1350
1351                 maintenance_mode_update(intf);
1352         }
1353  out_unlock:
1354         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1355
1356         return rv;
1357 }
1358 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1359
1360 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1361 {
1362         unsigned long        flags;
1363         ipmi_smi_t           intf = user->intf;
1364         struct ipmi_recv_msg *msg, *msg2;
1365         struct list_head     msgs;
1366
1367         INIT_LIST_HEAD(&msgs);
1368
1369         spin_lock_irqsave(&intf->events_lock, flags);
1370         if (user->gets_events == val)
1371                 goto out;
1372
1373         user->gets_events = val;
1374
1375         if (val) {
1376                 if (atomic_inc_return(&intf->event_waiters) == 1)
1377                         need_waiter(intf);
1378         } else {
1379                 atomic_dec(&intf->event_waiters);
1380         }
1381
1382         if (intf->delivering_events)
1383                 /*
1384                  * Another thread is delivering events for this, so
1385                  * let it handle any new events.
1386                  */
1387                 goto out;
1388
1389         /* Deliver any queued events. */
1390         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1391                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1392                         list_move_tail(&msg->link, &msgs);
1393                 intf->waiting_events_count = 0;
1394                 if (intf->event_msg_printed) {
1395                         dev_warn(intf->si_dev,
1396                                  PFX "Event queue no longer full\n");
1397                         intf->event_msg_printed = 0;
1398                 }
1399
1400                 intf->delivering_events = 1;
1401                 spin_unlock_irqrestore(&intf->events_lock, flags);
1402
1403                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1404                         msg->user = user;
1405                         kref_get(&user->refcount);
1406                         deliver_response(msg);
1407                 }
1408
1409                 spin_lock_irqsave(&intf->events_lock, flags);
1410                 intf->delivering_events = 0;
1411         }
1412
1413  out:
1414         spin_unlock_irqrestore(&intf->events_lock, flags);
1415
1416         return 0;
1417 }
1418 EXPORT_SYMBOL(ipmi_set_gets_events);
1419
1420 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1421                                       unsigned char netfn,
1422                                       unsigned char cmd,
1423                                       unsigned char chan)
1424 {
1425         struct cmd_rcvr *rcvr;
1426
1427         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1428                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1429                                         && (rcvr->chans & (1 << chan)))
1430                         return rcvr;
1431         }
1432         return NULL;
1433 }
1434
1435 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1436                                  unsigned char netfn,
1437                                  unsigned char cmd,
1438                                  unsigned int  chans)
1439 {
1440         struct cmd_rcvr *rcvr;
1441
1442         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1443                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1444                                         && (rcvr->chans & chans))
1445                         return 0;
1446         }
1447         return 1;
1448 }
1449
1450 int ipmi_register_for_cmd(ipmi_user_t   user,
1451                           unsigned char netfn,
1452                           unsigned char cmd,
1453                           unsigned int  chans)
1454 {
1455         ipmi_smi_t      intf = user->intf;
1456         struct cmd_rcvr *rcvr;
1457         int             rv = 0;
1458
1459
1460         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1461         if (!rcvr)
1462                 return -ENOMEM;
1463         rcvr->cmd = cmd;
1464         rcvr->netfn = netfn;
1465         rcvr->chans = chans;
1466         rcvr->user = user;
1467
1468         mutex_lock(&intf->cmd_rcvrs_mutex);
1469         /* Make sure the command/netfn is not already registered. */
1470         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1471                 rv = -EBUSY;
1472                 goto out_unlock;
1473         }
1474
1475         if (atomic_inc_return(&intf->event_waiters) == 1)
1476                 need_waiter(intf);
1477
1478         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1479
1480  out_unlock:
1481         mutex_unlock(&intf->cmd_rcvrs_mutex);
1482         if (rv)
1483                 kfree(rcvr);
1484
1485         return rv;
1486 }
1487 EXPORT_SYMBOL(ipmi_register_for_cmd);
1488
1489 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1490                             unsigned char netfn,
1491                             unsigned char cmd,
1492                             unsigned int  chans)
1493 {
1494         ipmi_smi_t      intf = user->intf;
1495         struct cmd_rcvr *rcvr;
1496         struct cmd_rcvr *rcvrs = NULL;
1497         int i, rv = -ENOENT;
1498
1499         mutex_lock(&intf->cmd_rcvrs_mutex);
1500         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1501                 if (((1 << i) & chans) == 0)
1502                         continue;
1503                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1504                 if (rcvr == NULL)
1505                         continue;
1506                 if (rcvr->user == user) {
1507                         rv = 0;
1508                         rcvr->chans &= ~chans;
1509                         if (rcvr->chans == 0) {
1510                                 list_del_rcu(&rcvr->link);
1511                                 rcvr->next = rcvrs;
1512                                 rcvrs = rcvr;
1513                         }
1514                 }
1515         }
1516         mutex_unlock(&intf->cmd_rcvrs_mutex);
1517         synchronize_rcu();
1518         while (rcvrs) {
1519                 atomic_dec(&intf->event_waiters);
1520                 rcvr = rcvrs;
1521                 rcvrs = rcvr->next;
1522                 kfree(rcvr);
1523         }
1524         return rv;
1525 }
1526 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1527
1528 static unsigned char
1529 ipmb_checksum(unsigned char *data, int size)
1530 {
1531         unsigned char csum = 0;
1532
1533         for (; size > 0; size--, data++)
1534                 csum += *data;
1535
1536         return -csum;
1537 }
1538
1539 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1540                                    struct kernel_ipmi_msg *msg,
1541                                    struct ipmi_ipmb_addr *ipmb_addr,
1542                                    long                  msgid,
1543                                    unsigned char         ipmb_seq,
1544                                    int                   broadcast,
1545                                    unsigned char         source_address,
1546                                    unsigned char         source_lun)
1547 {
1548         int i = broadcast;
1549
1550         /* Format the IPMB header data. */
1551         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1552         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1553         smi_msg->data[2] = ipmb_addr->channel;
1554         if (broadcast)
1555                 smi_msg->data[3] = 0;
1556         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1557         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1558         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1559         smi_msg->data[i+6] = source_address;
1560         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1561         smi_msg->data[i+8] = msg->cmd;
1562
1563         /* Now tack on the data to the message. */
1564         if (msg->data_len > 0)
1565                 memcpy(&(smi_msg->data[i+9]), msg->data,
1566                        msg->data_len);
1567         smi_msg->data_size = msg->data_len + 9;
1568
1569         /* Now calculate the checksum and tack it on. */
1570         smi_msg->data[i+smi_msg->data_size]
1571                 = ipmb_checksum(&(smi_msg->data[i+6]),
1572                                 smi_msg->data_size-6);
1573
1574         /*
1575          * Add on the checksum size and the offset from the
1576          * broadcast.
1577          */
1578         smi_msg->data_size += 1 + i;
1579
1580         smi_msg->msgid = msgid;
1581 }
1582
1583 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1584                                   struct kernel_ipmi_msg *msg,
1585                                   struct ipmi_lan_addr  *lan_addr,
1586                                   long                  msgid,
1587                                   unsigned char         ipmb_seq,
1588                                   unsigned char         source_lun)
1589 {
1590         /* Format the IPMB header data. */
1591         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1592         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1593         smi_msg->data[2] = lan_addr->channel;
1594         smi_msg->data[3] = lan_addr->session_handle;
1595         smi_msg->data[4] = lan_addr->remote_SWID;
1596         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1597         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1598         smi_msg->data[7] = lan_addr->local_SWID;
1599         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1600         smi_msg->data[9] = msg->cmd;
1601
1602         /* Now tack on the data to the message. */
1603         if (msg->data_len > 0)
1604                 memcpy(&(smi_msg->data[10]), msg->data,
1605                        msg->data_len);
1606         smi_msg->data_size = msg->data_len + 10;
1607
1608         /* Now calculate the checksum and tack it on. */
1609         smi_msg->data[smi_msg->data_size]
1610                 = ipmb_checksum(&(smi_msg->data[7]),
1611                                 smi_msg->data_size-7);
1612
1613         /*
1614          * Add on the checksum size and the offset from the
1615          * broadcast.
1616          */
1617         smi_msg->data_size += 1;
1618
1619         smi_msg->msgid = msgid;
1620 }
1621
1622 static struct ipmi_smi_msg *smi_add_send_msg(ipmi_smi_t intf,
1623                                              struct ipmi_smi_msg *smi_msg,
1624                                              int priority)
1625 {
1626         if (intf->curr_msg) {
1627                 if (priority > 0)
1628                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1629                 else
1630                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1631                 smi_msg = NULL;
1632         } else {
1633                 intf->curr_msg = smi_msg;
1634         }
1635
1636         return smi_msg;
1637 }
1638
1639
1640 static void smi_send(ipmi_smi_t intf, const struct ipmi_smi_handlers *handlers,
1641                      struct ipmi_smi_msg *smi_msg, int priority)
1642 {
1643         int run_to_completion = intf->run_to_completion;
1644
1645         if (run_to_completion) {
1646                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1647         } else {
1648                 unsigned long flags;
1649
1650                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1651                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1652                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1653         }
1654
1655         if (smi_msg)
1656                 handlers->sender(intf->send_info, smi_msg);
1657 }
1658
1659 /*
1660  * Separate from ipmi_request so that the user does not have to be
1661  * supplied in certain circumstances (mainly at panic time).  If
1662  * messages are supplied, they will be freed, even if an error
1663  * occurs.
1664  */
1665 static int i_ipmi_request(ipmi_user_t          user,
1666                           ipmi_smi_t           intf,
1667                           struct ipmi_addr     *addr,
1668                           long                 msgid,
1669                           struct kernel_ipmi_msg *msg,
1670                           void                 *user_msg_data,
1671                           void                 *supplied_smi,
1672                           struct ipmi_recv_msg *supplied_recv,
1673                           int                  priority,
1674                           unsigned char        source_address,
1675                           unsigned char        source_lun,
1676                           int                  retries,
1677                           unsigned int         retry_time_ms)
1678 {
1679         int                      rv = 0;
1680         struct ipmi_smi_msg      *smi_msg;
1681         struct ipmi_recv_msg     *recv_msg;
1682         unsigned long            flags;
1683
1684
1685         if (supplied_recv)
1686                 recv_msg = supplied_recv;
1687         else {
1688                 recv_msg = ipmi_alloc_recv_msg();
1689                 if (recv_msg == NULL)
1690                         return -ENOMEM;
1691         }
1692         recv_msg->user_msg_data = user_msg_data;
1693
1694         if (supplied_smi)
1695                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1696         else {
1697                 smi_msg = ipmi_alloc_smi_msg();
1698                 if (smi_msg == NULL) {
1699                         ipmi_free_recv_msg(recv_msg);
1700                         return -ENOMEM;
1701                 }
1702         }
1703
1704         rcu_read_lock();
1705         if (intf->in_shutdown) {
1706                 rv = -ENODEV;
1707                 goto out_err;
1708         }
1709
1710         recv_msg->user = user;
1711         if (user)
1712                 kref_get(&user->refcount);
1713         recv_msg->msgid = msgid;
1714         /*
1715          * Store the message to send in the receive message so timeout
1716          * responses can get the proper response data.
1717          */
1718         recv_msg->msg = *msg;
1719
1720         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1721                 struct ipmi_system_interface_addr *smi_addr;
1722
1723                 if (msg->netfn & 1) {
1724                         /* Responses are not allowed to the SMI. */
1725                         rv = -EINVAL;
1726                         goto out_err;
1727                 }
1728
1729                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1730                 if (smi_addr->lun > 3) {
1731                         ipmi_inc_stat(intf, sent_invalid_commands);
1732                         rv = -EINVAL;
1733                         goto out_err;
1734                 }
1735
1736                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1737
1738                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1739                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1740                         || (msg->cmd == IPMI_GET_MSG_CMD)
1741                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1742                         /*
1743                          * We don't let the user do these, since we manage
1744                          * the sequence numbers.
1745                          */
1746                         ipmi_inc_stat(intf, sent_invalid_commands);
1747                         rv = -EINVAL;
1748                         goto out_err;
1749                 }
1750
1751                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1752                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1753                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1754                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1755                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1756                         intf->auto_maintenance_timeout
1757                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1758                         if (!intf->maintenance_mode
1759                             && !intf->maintenance_mode_enable) {
1760                                 intf->maintenance_mode_enable = true;
1761                                 maintenance_mode_update(intf);
1762                         }
1763                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1764                                                flags);
1765                 }
1766
1767                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1768                         ipmi_inc_stat(intf, sent_invalid_commands);
1769                         rv = -EMSGSIZE;
1770                         goto out_err;
1771                 }
1772
1773                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1774                 smi_msg->data[1] = msg->cmd;
1775                 smi_msg->msgid = msgid;
1776                 smi_msg->user_data = recv_msg;
1777                 if (msg->data_len > 0)
1778                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1779                 smi_msg->data_size = msg->data_len + 2;
1780                 ipmi_inc_stat(intf, sent_local_commands);
1781         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1782                 struct ipmi_ipmb_addr *ipmb_addr;
1783                 unsigned char         ipmb_seq;
1784                 long                  seqid;
1785                 int                   broadcast = 0;
1786                 struct ipmi_channel   *chans;
1787
1788                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1789                         ipmi_inc_stat(intf, sent_invalid_commands);
1790                         rv = -EINVAL;
1791                         goto out_err;
1792                 }
1793
1794                 chans = READ_ONCE(intf->channel_list)->c;
1795
1796                 if (chans[addr->channel].medium != IPMI_CHANNEL_MEDIUM_IPMB) {
1797                         ipmi_inc_stat(intf, sent_invalid_commands);
1798                         rv = -EINVAL;
1799                         goto out_err;
1800                 }
1801
1802                 if (retries < 0) {
1803                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1804                         retries = 0; /* Don't retry broadcasts. */
1805                     else
1806                         retries = 4;
1807                 }
1808                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1809                     /*
1810                      * Broadcasts add a zero at the beginning of the
1811                      * message, but otherwise is the same as an IPMB
1812                      * address.
1813                      */
1814                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1815                     broadcast = 1;
1816                 }
1817
1818
1819                 /* Default to 1 second retries. */
1820                 if (retry_time_ms == 0)
1821                     retry_time_ms = 1000;
1822
1823                 /*
1824                  * 9 for the header and 1 for the checksum, plus
1825                  * possibly one for the broadcast.
1826                  */
1827                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1828                         ipmi_inc_stat(intf, sent_invalid_commands);
1829                         rv = -EMSGSIZE;
1830                         goto out_err;
1831                 }
1832
1833                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1834                 if (ipmb_addr->lun > 3) {
1835                         ipmi_inc_stat(intf, sent_invalid_commands);
1836                         rv = -EINVAL;
1837                         goto out_err;
1838                 }
1839
1840                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1841
1842                 if (recv_msg->msg.netfn & 0x1) {
1843                         /*
1844                          * It's a response, so use the user's sequence
1845                          * from msgid.
1846                          */
1847                         ipmi_inc_stat(intf, sent_ipmb_responses);
1848                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1849                                         msgid, broadcast,
1850                                         source_address, source_lun);
1851
1852                         /*
1853                          * Save the receive message so we can use it
1854                          * to deliver the response.
1855                          */
1856                         smi_msg->user_data = recv_msg;
1857                 } else {
1858                         /* It's a command, so get a sequence for it. */
1859
1860                         spin_lock_irqsave(&(intf->seq_lock), flags);
1861
1862                         /*
1863                          * Create a sequence number with a 1 second
1864                          * timeout and 4 retries.
1865                          */
1866                         rv = intf_next_seq(intf,
1867                                            recv_msg,
1868                                            retry_time_ms,
1869                                            retries,
1870                                            broadcast,
1871                                            &ipmb_seq,
1872                                            &seqid);
1873                         if (rv) {
1874                                 /*
1875                                  * We have used up all the sequence numbers,
1876                                  * probably, so abort.
1877                                  */
1878                                 spin_unlock_irqrestore(&(intf->seq_lock),
1879                                                        flags);
1880                                 goto out_err;
1881                         }
1882
1883                         ipmi_inc_stat(intf, sent_ipmb_commands);
1884
1885                         /*
1886                          * Store the sequence number in the message,
1887                          * so that when the send message response
1888                          * comes back we can start the timer.
1889                          */
1890                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1891                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1892                                         ipmb_seq, broadcast,
1893                                         source_address, source_lun);
1894
1895                         /*
1896                          * Copy the message into the recv message data, so we
1897                          * can retransmit it later if necessary.
1898                          */
1899                         memcpy(recv_msg->msg_data, smi_msg->data,
1900                                smi_msg->data_size);
1901                         recv_msg->msg.data = recv_msg->msg_data;
1902                         recv_msg->msg.data_len = smi_msg->data_size;
1903
1904                         /*
1905                          * We don't unlock until here, because we need
1906                          * to copy the completed message into the
1907                          * recv_msg before we release the lock.
1908                          * Otherwise, race conditions may bite us.  I
1909                          * know that's pretty paranoid, but I prefer
1910                          * to be correct.
1911                          */
1912                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1913                 }
1914         } else if (is_lan_addr(addr)) {
1915                 struct ipmi_lan_addr  *lan_addr;
1916                 unsigned char         ipmb_seq;
1917                 long                  seqid;
1918                 struct ipmi_channel   *chans;
1919
1920                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1921                         ipmi_inc_stat(intf, sent_invalid_commands);
1922                         rv = -EINVAL;
1923                         goto out_err;
1924                 }
1925
1926                 chans = READ_ONCE(intf->channel_list)->c;
1927
1928                 if ((chans[addr->channel].medium
1929                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1930                     && (chans[addr->channel].medium
1931                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1932                         ipmi_inc_stat(intf, sent_invalid_commands);
1933                         rv = -EINVAL;
1934                         goto out_err;
1935                 }
1936
1937                 retries = 4;
1938
1939                 /* Default to 1 second retries. */
1940                 if (retry_time_ms == 0)
1941                     retry_time_ms = 1000;
1942
1943                 /* 11 for the header and 1 for the checksum. */
1944                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1945                         ipmi_inc_stat(intf, sent_invalid_commands);
1946                         rv = -EMSGSIZE;
1947                         goto out_err;
1948                 }
1949
1950                 lan_addr = (struct ipmi_lan_addr *) addr;
1951                 if (lan_addr->lun > 3) {
1952                         ipmi_inc_stat(intf, sent_invalid_commands);
1953                         rv = -EINVAL;
1954                         goto out_err;
1955                 }
1956
1957                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1958
1959                 if (recv_msg->msg.netfn & 0x1) {
1960                         /*
1961                          * It's a response, so use the user's sequence
1962                          * from msgid.
1963                          */
1964                         ipmi_inc_stat(intf, sent_lan_responses);
1965                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1966                                        msgid, source_lun);
1967
1968                         /*
1969                          * Save the receive message so we can use it
1970                          * to deliver the response.
1971                          */
1972                         smi_msg->user_data = recv_msg;
1973                 } else {
1974                         /* It's a command, so get a sequence for it. */
1975
1976                         spin_lock_irqsave(&(intf->seq_lock), flags);
1977
1978                         /*
1979                          * Create a sequence number with a 1 second
1980                          * timeout and 4 retries.
1981                          */
1982                         rv = intf_next_seq(intf,
1983                                            recv_msg,
1984                                            retry_time_ms,
1985                                            retries,
1986                                            0,
1987                                            &ipmb_seq,
1988                                            &seqid);
1989                         if (rv) {
1990                                 /*
1991                                  * We have used up all the sequence numbers,
1992                                  * probably, so abort.
1993                                  */
1994                                 spin_unlock_irqrestore(&(intf->seq_lock),
1995                                                        flags);
1996                                 goto out_err;
1997                         }
1998
1999                         ipmi_inc_stat(intf, sent_lan_commands);
2000
2001                         /*
2002                          * Store the sequence number in the message,
2003                          * so that when the send message response
2004                          * comes back we can start the timer.
2005                          */
2006                         format_lan_msg(smi_msg, msg, lan_addr,
2007                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
2008                                        ipmb_seq, source_lun);
2009
2010                         /*
2011                          * Copy the message into the recv message data, so we
2012                          * can retransmit it later if necessary.
2013                          */
2014                         memcpy(recv_msg->msg_data, smi_msg->data,
2015                                smi_msg->data_size);
2016                         recv_msg->msg.data = recv_msg->msg_data;
2017                         recv_msg->msg.data_len = smi_msg->data_size;
2018
2019                         /*
2020                          * We don't unlock until here, because we need
2021                          * to copy the completed message into the
2022                          * recv_msg before we release the lock.
2023                          * Otherwise, race conditions may bite us.  I
2024                          * know that's pretty paranoid, but I prefer
2025                          * to be correct.
2026                          */
2027                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
2028                 }
2029         } else {
2030             /* Unknown address type. */
2031                 ipmi_inc_stat(intf, sent_invalid_commands);
2032                 rv = -EINVAL;
2033                 goto out_err;
2034         }
2035
2036 #ifdef DEBUG_MSGING
2037         {
2038                 int m;
2039                 for (m = 0; m < smi_msg->data_size; m++)
2040                         printk(" %2.2x", smi_msg->data[m]);
2041                 printk("\n");
2042         }
2043 #endif
2044
2045         smi_send(intf, intf->handlers, smi_msg, priority);
2046         rcu_read_unlock();
2047
2048         return 0;
2049
2050  out_err:
2051         rcu_read_unlock();
2052         ipmi_free_smi_msg(smi_msg);
2053         ipmi_free_recv_msg(recv_msg);
2054         return rv;
2055 }
2056
2057 static int check_addr(ipmi_smi_t       intf,
2058                       struct ipmi_addr *addr,
2059                       unsigned char    *saddr,
2060                       unsigned char    *lun)
2061 {
2062         if (addr->channel >= IPMI_MAX_CHANNELS)
2063                 return -EINVAL;
2064         *lun = intf->addrinfo[addr->channel].lun;
2065         *saddr = intf->addrinfo[addr->channel].address;
2066         return 0;
2067 }
2068
2069 int ipmi_request_settime(ipmi_user_t      user,
2070                          struct ipmi_addr *addr,
2071                          long             msgid,
2072                          struct kernel_ipmi_msg  *msg,
2073                          void             *user_msg_data,
2074                          int              priority,
2075                          int              retries,
2076                          unsigned int     retry_time_ms)
2077 {
2078         unsigned char saddr = 0, lun = 0;
2079         int           rv;
2080
2081         if (!user)
2082                 return -EINVAL;
2083         rv = check_addr(user->intf, addr, &saddr, &lun);
2084         if (rv)
2085                 return rv;
2086         return i_ipmi_request(user,
2087                               user->intf,
2088                               addr,
2089                               msgid,
2090                               msg,
2091                               user_msg_data,
2092                               NULL, NULL,
2093                               priority,
2094                               saddr,
2095                               lun,
2096                               retries,
2097                               retry_time_ms);
2098 }
2099 EXPORT_SYMBOL(ipmi_request_settime);
2100
2101 int ipmi_request_supply_msgs(ipmi_user_t          user,
2102                              struct ipmi_addr     *addr,
2103                              long                 msgid,
2104                              struct kernel_ipmi_msg *msg,
2105                              void                 *user_msg_data,
2106                              void                 *supplied_smi,
2107                              struct ipmi_recv_msg *supplied_recv,
2108                              int                  priority)
2109 {
2110         unsigned char saddr = 0, lun = 0;
2111         int           rv;
2112
2113         if (!user)
2114                 return -EINVAL;
2115         rv = check_addr(user->intf, addr, &saddr, &lun);
2116         if (rv)
2117                 return rv;
2118         return i_ipmi_request(user,
2119                               user->intf,
2120                               addr,
2121                               msgid,
2122                               msg,
2123                               user_msg_data,
2124                               supplied_smi,
2125                               supplied_recv,
2126                               priority,
2127                               saddr,
2128                               lun,
2129                               -1, 0);
2130 }
2131 EXPORT_SYMBOL(ipmi_request_supply_msgs);
2132
2133 static void bmc_device_id_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2134 {
2135         int rv;
2136
2137         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2138                         || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2139                         || (msg->msg.cmd != IPMI_GET_DEVICE_ID_CMD)) {
2140                 dev_warn(intf->si_dev,
2141                          PFX "invalid device_id msg: addr_type=%d netfn=%x cmd=%x\n",
2142                         msg->addr.addr_type, msg->msg.netfn, msg->msg.cmd);
2143                 return;
2144         }
2145
2146         rv = ipmi_demangle_device_id(msg->msg.netfn, msg->msg.cmd,
2147                         msg->msg.data, msg->msg.data_len, &intf->bmc->fetch_id);
2148         if (rv) {
2149                 dev_warn(intf->si_dev,
2150                          PFX "device id demangle failed: %d\n", rv);
2151                 intf->bmc->dyn_id_set = 0;
2152         } else {
2153                 /*
2154                  * Make sure the id data is available before setting
2155                  * dyn_id_set.
2156                  */
2157                 smp_wmb();
2158                 intf->bmc->dyn_id_set = 1;
2159         }
2160
2161         wake_up(&intf->waitq);
2162 }
2163
2164 static int
2165 send_get_device_id_cmd(ipmi_smi_t intf)
2166 {
2167         struct ipmi_system_interface_addr si;
2168         struct kernel_ipmi_msg msg;
2169
2170         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2171         si.channel = IPMI_BMC_CHANNEL;
2172         si.lun = 0;
2173
2174         msg.netfn = IPMI_NETFN_APP_REQUEST;
2175         msg.cmd = IPMI_GET_DEVICE_ID_CMD;
2176         msg.data = NULL;
2177         msg.data_len = 0;
2178
2179         return i_ipmi_request(NULL,
2180                               intf,
2181                               (struct ipmi_addr *) &si,
2182                               0,
2183                               &msg,
2184                               intf,
2185                               NULL,
2186                               NULL,
2187                               0,
2188                               intf->addrinfo[0].address,
2189                               intf->addrinfo[0].lun,
2190                               -1, 0);
2191 }
2192
2193 static int __get_device_id(ipmi_smi_t intf, struct bmc_device *bmc)
2194 {
2195         int rv;
2196
2197         bmc->dyn_id_set = 2;
2198
2199         intf->null_user_handler = bmc_device_id_handler;
2200
2201         rv = send_get_device_id_cmd(intf);
2202         if (rv)
2203                 return rv;
2204
2205         wait_event(intf->waitq, bmc->dyn_id_set != 2);
2206
2207         if (!bmc->dyn_id_set)
2208                 rv = -EIO; /* Something went wrong in the fetch. */
2209
2210         /* dyn_id_set makes the id data available. */
2211         smp_rmb();
2212
2213         intf->null_user_handler = NULL;
2214
2215         return rv;
2216 }
2217
2218 /*
2219  * Fetch the device id for the bmc/interface.  You must pass in either
2220  * bmc or intf, this code will get the other one.  If the data has
2221  * been recently fetched, this will just use the cached data.  Otherwise
2222  * it will run a new fetch.
2223  *
2224  * Except for the first time this is called (in ipmi_register_smi()),
2225  * this will always return good data;
2226  */
2227 static int __bmc_get_device_id(ipmi_smi_t intf, struct bmc_device *bmc,
2228                                struct ipmi_device_id *id,
2229                                bool *guid_set, guid_t *guid, int intf_num)
2230 {
2231         int rv = 0;
2232         int prev_dyn_id_set, prev_guid_set;
2233         bool intf_set = intf != NULL;
2234
2235         if (!intf) {
2236                 mutex_lock(&bmc->dyn_mutex);
2237 retry_bmc_lock:
2238                 if (list_empty(&bmc->intfs)) {
2239                         mutex_unlock(&bmc->dyn_mutex);
2240                         return -ENOENT;
2241                 }
2242                 intf = list_first_entry(&bmc->intfs, struct ipmi_smi,
2243                                         bmc_link);
2244                 kref_get(&intf->refcount);
2245                 mutex_unlock(&bmc->dyn_mutex);
2246                 mutex_lock(&intf->bmc_reg_mutex);
2247                 mutex_lock(&bmc->dyn_mutex);
2248                 if (intf != list_first_entry(&bmc->intfs, struct ipmi_smi,
2249                                              bmc_link)) {
2250                         mutex_unlock(&intf->bmc_reg_mutex);
2251                         kref_put(&intf->refcount, intf_free);
2252                         goto retry_bmc_lock;
2253                 }
2254         } else {
2255                 mutex_lock(&intf->bmc_reg_mutex);
2256                 bmc = intf->bmc;
2257                 mutex_lock(&bmc->dyn_mutex);
2258                 kref_get(&intf->refcount);
2259         }
2260
2261         /* If we have a valid and current ID, just return that. */
2262         if (intf->in_bmc_register ||
2263             (bmc->dyn_id_set && time_is_after_jiffies(bmc->dyn_id_expiry)))
2264                 goto out_noprocessing;
2265
2266         prev_guid_set = bmc->dyn_guid_set;
2267         __get_guid(intf);
2268
2269         prev_dyn_id_set = bmc->dyn_id_set;
2270         rv = __get_device_id(intf, bmc);
2271         if (rv)
2272                 goto out;
2273
2274         /*
2275          * The guid, device id, manufacturer id, and product id should
2276          * not change on a BMC.  If it does we have to do some dancing.
2277          */
2278         if (!intf->bmc_registered
2279             || (!prev_guid_set && bmc->dyn_guid_set)
2280             || (!prev_dyn_id_set && bmc->dyn_id_set)
2281             || (prev_guid_set && bmc->dyn_guid_set
2282                 && !guid_equal(&bmc->guid, &bmc->fetch_guid))
2283             || bmc->id.device_id != bmc->fetch_id.device_id
2284             || bmc->id.manufacturer_id != bmc->fetch_id.manufacturer_id
2285             || bmc->id.product_id != bmc->fetch_id.product_id) {
2286                 struct ipmi_device_id id = bmc->fetch_id;
2287                 int guid_set = bmc->dyn_guid_set;
2288                 guid_t guid;
2289
2290                 guid = bmc->fetch_guid;
2291                 mutex_unlock(&bmc->dyn_mutex);
2292
2293                 __ipmi_bmc_unregister(intf);
2294                 /* Fill in the temporary BMC for good measure. */
2295                 intf->bmc->id = id;
2296                 intf->bmc->dyn_guid_set = guid_set;
2297                 intf->bmc->guid = guid;
2298                 if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
2299                         need_waiter(intf); /* Retry later on an error. */
2300                 else
2301                         __scan_channels(intf, &id);
2302
2303
2304                 if (!intf_set) {
2305                         /*
2306                          * We weren't given the interface on the
2307                          * command line, so restart the operation on
2308                          * the next interface for the BMC.
2309                          */
2310                         mutex_unlock(&intf->bmc_reg_mutex);
2311                         mutex_lock(&bmc->dyn_mutex);
2312                         goto retry_bmc_lock;
2313                 }
2314
2315                 /* We have a new BMC, set it up. */
2316                 bmc = intf->bmc;
2317                 mutex_lock(&bmc->dyn_mutex);
2318                 goto out_noprocessing;
2319         } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
2320                 /* Version info changes, scan the channels again. */
2321                 __scan_channels(intf, &bmc->fetch_id);
2322
2323         bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
2324
2325 out:
2326         if (rv && prev_dyn_id_set) {
2327                 rv = 0; /* Ignore failures if we have previous data. */
2328                 bmc->dyn_id_set = prev_dyn_id_set;
2329         }
2330         if (!rv) {
2331                 bmc->id = bmc->fetch_id;
2332                 if (bmc->dyn_guid_set)
2333                         bmc->guid = bmc->fetch_guid;
2334                 else if (prev_guid_set)
2335                         /*
2336                          * The guid used to be valid and it failed to fetch,
2337                          * just use the cached value.
2338                          */
2339                         bmc->dyn_guid_set = prev_guid_set;
2340         }
2341 out_noprocessing:
2342         if (!rv) {
2343                 if (id)
2344                         *id = bmc->id;
2345
2346                 if (guid_set)
2347                         *guid_set = bmc->dyn_guid_set;
2348
2349                 if (guid && bmc->dyn_guid_set)
2350                         *guid =  bmc->guid;
2351         }
2352
2353         mutex_unlock(&bmc->dyn_mutex);
2354         mutex_unlock(&intf->bmc_reg_mutex);
2355
2356         kref_put(&intf->refcount, intf_free);
2357         return rv;
2358 }
2359
2360 static int bmc_get_device_id(ipmi_smi_t intf, struct bmc_device *bmc,
2361                              struct ipmi_device_id *id,
2362                              bool *guid_set, guid_t *guid)
2363 {
2364         return __bmc_get_device_id(intf, bmc, id, guid_set, guid, -1);
2365 }
2366
2367 #ifdef CONFIG_IPMI_PROC_INTERFACE
2368 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
2369 {
2370         ipmi_smi_t intf = m->private;
2371         int        i;
2372
2373         seq_printf(m, "%x", intf->addrinfo[0].address);
2374         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
2375                 seq_printf(m, " %x", intf->addrinfo[i].address);
2376         seq_putc(m, '\n');
2377
2378         return 0;
2379 }
2380
2381 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
2382 {
2383         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
2384 }
2385
2386 static const struct file_operations smi_ipmb_proc_ops = {
2387         .open           = smi_ipmb_proc_open,
2388         .read           = seq_read,
2389         .llseek         = seq_lseek,
2390         .release        = single_release,
2391 };
2392
2393 static int smi_version_proc_show(struct seq_file *m, void *v)
2394 {
2395         ipmi_smi_t intf = m->private;
2396         struct ipmi_device_id id;
2397         int rv;
2398
2399         rv = bmc_get_device_id(intf, NULL, &id, NULL, NULL);
2400         if (rv)
2401                 return rv;
2402
2403         seq_printf(m, "%u.%u\n",
2404                    ipmi_version_major(&id),
2405                    ipmi_version_minor(&id));
2406
2407         return 0;
2408 }
2409
2410 static int smi_version_proc_open(struct inode *inode, struct file *file)
2411 {
2412         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
2413 }
2414
2415 static const struct file_operations smi_version_proc_ops = {
2416         .open           = smi_version_proc_open,
2417         .read           = seq_read,
2418         .llseek         = seq_lseek,
2419         .release        = single_release,
2420 };
2421
2422 static int smi_stats_proc_show(struct seq_file *m, void *v)
2423 {
2424         ipmi_smi_t intf = m->private;
2425
2426         seq_printf(m, "sent_invalid_commands:       %u\n",
2427                        ipmi_get_stat(intf, sent_invalid_commands));
2428         seq_printf(m, "sent_local_commands:         %u\n",
2429                        ipmi_get_stat(intf, sent_local_commands));
2430         seq_printf(m, "handled_local_responses:     %u\n",
2431                        ipmi_get_stat(intf, handled_local_responses));
2432         seq_printf(m, "unhandled_local_responses:   %u\n",
2433                        ipmi_get_stat(intf, unhandled_local_responses));
2434         seq_printf(m, "sent_ipmb_commands:          %u\n",
2435                        ipmi_get_stat(intf, sent_ipmb_commands));
2436         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2437                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2438         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2439                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2440         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2441                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2442         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2443                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2444         seq_printf(m, "sent_ipmb_responses:         %u\n",
2445                        ipmi_get_stat(intf, sent_ipmb_responses));
2446         seq_printf(m, "handled_ipmb_responses:      %u\n",
2447                        ipmi_get_stat(intf, handled_ipmb_responses));
2448         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2449                        ipmi_get_stat(intf, invalid_ipmb_responses));
2450         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2451                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2452         seq_printf(m, "sent_lan_commands:           %u\n",
2453                        ipmi_get_stat(intf, sent_lan_commands));
2454         seq_printf(m, "sent_lan_command_errs:       %u\n",
2455                        ipmi_get_stat(intf, sent_lan_command_errs));
2456         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2457                        ipmi_get_stat(intf, retransmitted_lan_commands));
2458         seq_printf(m, "timed_out_lan_commands:      %u\n",
2459                        ipmi_get_stat(intf, timed_out_lan_commands));
2460         seq_printf(m, "sent_lan_responses:          %u\n",
2461                        ipmi_get_stat(intf, sent_lan_responses));
2462         seq_printf(m, "handled_lan_responses:       %u\n",
2463                        ipmi_get_stat(intf, handled_lan_responses));
2464         seq_printf(m, "invalid_lan_responses:       %u\n",
2465                        ipmi_get_stat(intf, invalid_lan_responses));
2466         seq_printf(m, "unhandled_lan_responses:     %u\n",
2467                        ipmi_get_stat(intf, unhandled_lan_responses));
2468         seq_printf(m, "handled_commands:            %u\n",
2469                        ipmi_get_stat(intf, handled_commands));
2470         seq_printf(m, "invalid_commands:            %u\n",
2471                        ipmi_get_stat(intf, invalid_commands));
2472         seq_printf(m, "unhandled_commands:          %u\n",
2473                        ipmi_get_stat(intf, unhandled_commands));
2474         seq_printf(m, "invalid_events:              %u\n",
2475                        ipmi_get_stat(intf, invalid_events));
2476         seq_printf(m, "events:                      %u\n",
2477                        ipmi_get_stat(intf, events));
2478         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2479                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2480         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2481                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2482         return 0;
2483 }
2484
2485 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2486 {
2487         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2488 }
2489
2490 static const struct file_operations smi_stats_proc_ops = {
2491         .open           = smi_stats_proc_open,
2492         .read           = seq_read,
2493         .llseek         = seq_lseek,
2494         .release        = single_release,
2495 };
2496
2497 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2498                             const struct file_operations *proc_ops,
2499                             void *data)
2500 {
2501         int                    rv = 0;
2502         struct proc_dir_entry  *file;
2503         struct ipmi_proc_entry *entry;
2504
2505         /* Create a list element. */
2506         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2507         if (!entry)
2508                 return -ENOMEM;
2509         entry->name = kstrdup(name, GFP_KERNEL);
2510         if (!entry->name) {
2511                 kfree(entry);
2512                 return -ENOMEM;
2513         }
2514
2515         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2516         if (!file) {
2517                 kfree(entry->name);
2518                 kfree(entry);
2519                 rv = -ENOMEM;
2520         } else {
2521                 mutex_lock(&smi->proc_entry_lock);
2522                 /* Stick it on the list. */
2523                 entry->next = smi->proc_entries;
2524                 smi->proc_entries = entry;
2525                 mutex_unlock(&smi->proc_entry_lock);
2526         }
2527
2528         return rv;
2529 }
2530 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2531
2532 static int add_proc_entries(ipmi_smi_t smi, int num)
2533 {
2534         int rv = 0;
2535
2536         sprintf(smi->proc_dir_name, "%d", num);
2537         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2538         if (!smi->proc_dir)
2539                 rv = -ENOMEM;
2540
2541         if (rv == 0)
2542                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2543                                              &smi_stats_proc_ops,
2544                                              smi);
2545
2546         if (rv == 0)
2547                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2548                                              &smi_ipmb_proc_ops,
2549                                              smi);
2550
2551         if (rv == 0)
2552                 rv = ipmi_smi_add_proc_entry(smi, "version",
2553                                              &smi_version_proc_ops,
2554                                              smi);
2555
2556         return rv;
2557 }
2558
2559 static void remove_proc_entries(ipmi_smi_t smi)
2560 {
2561         struct ipmi_proc_entry *entry;
2562
2563         mutex_lock(&smi->proc_entry_lock);
2564         while (smi->proc_entries) {
2565                 entry = smi->proc_entries;
2566                 smi->proc_entries = entry->next;
2567
2568                 remove_proc_entry(entry->name, smi->proc_dir);
2569                 kfree(entry->name);
2570                 kfree(entry);
2571         }
2572         mutex_unlock(&smi->proc_entry_lock);
2573         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2574 }
2575 #endif /* CONFIG_IPMI_PROC_INTERFACE */
2576
2577 static ssize_t device_id_show(struct device *dev,
2578                               struct device_attribute *attr,
2579                               char *buf)
2580 {
2581         struct bmc_device *bmc = to_bmc_device(dev);
2582         struct ipmi_device_id id;
2583         int rv;
2584
2585         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2586         if (rv)
2587                 return rv;
2588
2589         return snprintf(buf, 10, "%u\n", id.device_id);
2590 }
2591 static DEVICE_ATTR_RO(device_id);
2592
2593 static ssize_t provides_device_sdrs_show(struct device *dev,
2594                                          struct device_attribute *attr,
2595                                          char *buf)
2596 {
2597         struct bmc_device *bmc = to_bmc_device(dev);
2598         struct ipmi_device_id id;
2599         int rv;
2600
2601         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2602         if (rv)
2603                 return rv;
2604
2605         return snprintf(buf, 10, "%u\n", (id.device_revision & 0x80) >> 7);
2606 }
2607 static DEVICE_ATTR_RO(provides_device_sdrs);
2608
2609 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2610                              char *buf)
2611 {
2612         struct bmc_device *bmc = to_bmc_device(dev);
2613         struct ipmi_device_id id;
2614         int rv;
2615
2616         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2617         if (rv)
2618                 return rv;
2619
2620         return snprintf(buf, 20, "%u\n", id.device_revision & 0x0F);
2621 }
2622 static DEVICE_ATTR_RO(revision);
2623
2624 static ssize_t firmware_revision_show(struct device *dev,
2625                                       struct device_attribute *attr,
2626                                       char *buf)
2627 {
2628         struct bmc_device *bmc = to_bmc_device(dev);
2629         struct ipmi_device_id id;
2630         int rv;
2631
2632         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2633         if (rv)
2634                 return rv;
2635
2636         return snprintf(buf, 20, "%u.%x\n", id.firmware_revision_1,
2637                         id.firmware_revision_2);
2638 }
2639 static DEVICE_ATTR_RO(firmware_revision);
2640
2641 static ssize_t ipmi_version_show(struct device *dev,
2642                                  struct device_attribute *attr,
2643                                  char *buf)
2644 {
2645         struct bmc_device *bmc = to_bmc_device(dev);
2646         struct ipmi_device_id id;
2647         int rv;
2648
2649         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2650         if (rv)
2651                 return rv;
2652
2653         return snprintf(buf, 20, "%u.%u\n",
2654                         ipmi_version_major(&id),
2655                         ipmi_version_minor(&id));
2656 }
2657 static DEVICE_ATTR_RO(ipmi_version);
2658
2659 static ssize_t add_dev_support_show(struct device *dev,
2660                                     struct device_attribute *attr,
2661                                     char *buf)
2662 {
2663         struct bmc_device *bmc = to_bmc_device(dev);
2664         struct ipmi_device_id id;
2665         int rv;
2666
2667         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2668         if (rv)
2669                 return rv;
2670
2671         return snprintf(buf, 10, "0x%02x\n", id.additional_device_support);
2672 }
2673 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
2674                    NULL);
2675
2676 static ssize_t manufacturer_id_show(struct device *dev,
2677                                     struct device_attribute *attr,
2678                                     char *buf)
2679 {
2680         struct bmc_device *bmc = to_bmc_device(dev);
2681         struct ipmi_device_id id;
2682         int rv;
2683
2684         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2685         if (rv)
2686                 return rv;
2687
2688         return snprintf(buf, 20, "0x%6.6x\n", id.manufacturer_id);
2689 }
2690 static DEVICE_ATTR_RO(manufacturer_id);
2691
2692 static ssize_t product_id_show(struct device *dev,
2693                                struct device_attribute *attr,
2694                                char *buf)
2695 {
2696         struct bmc_device *bmc = to_bmc_device(dev);
2697         struct ipmi_device_id id;
2698         int rv;
2699
2700         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2701         if (rv)
2702                 return rv;
2703
2704         return snprintf(buf, 10, "0x%4.4x\n", id.product_id);
2705 }
2706 static DEVICE_ATTR_RO(product_id);
2707
2708 static ssize_t aux_firmware_rev_show(struct device *dev,
2709                                      struct device_attribute *attr,
2710                                      char *buf)
2711 {
2712         struct bmc_device *bmc = to_bmc_device(dev);
2713         struct ipmi_device_id id;
2714         int rv;
2715
2716         rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2717         if (rv)
2718                 return rv;
2719
2720         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2721                         id.aux_firmware_revision[3],
2722                         id.aux_firmware_revision[2],
2723                         id.aux_firmware_revision[1],
2724                         id.aux_firmware_revision[0]);
2725 }
2726 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2727
2728 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2729                          char *buf)
2730 {
2731         struct bmc_device *bmc = to_bmc_device(dev);
2732         bool guid_set;
2733         guid_t guid;
2734         int rv;
2735
2736         rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, &guid);
2737         if (rv)
2738                 return rv;
2739         if (!guid_set)
2740                 return -ENOENT;
2741
2742         return snprintf(buf, 38, "%pUl\n", guid.b);
2743 }
2744 static DEVICE_ATTR_RO(guid);
2745
2746 static struct attribute *bmc_dev_attrs[] = {
2747         &dev_attr_device_id.attr,
2748         &dev_attr_provides_device_sdrs.attr,
2749         &dev_attr_revision.attr,
2750         &dev_attr_firmware_revision.attr,
2751         &dev_attr_ipmi_version.attr,
2752         &dev_attr_additional_device_support.attr,
2753         &dev_attr_manufacturer_id.attr,
2754         &dev_attr_product_id.attr,
2755         &dev_attr_aux_firmware_revision.attr,
2756         &dev_attr_guid.attr,
2757         NULL
2758 };
2759
2760 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,
2761                                        struct attribute *attr, int idx)
2762 {
2763         struct device *dev = kobj_to_dev(kobj);
2764         struct bmc_device *bmc = to_bmc_device(dev);
2765         umode_t mode = attr->mode;
2766         int rv;
2767
2768         if (attr == &dev_attr_aux_firmware_revision.attr) {
2769                 struct ipmi_device_id id;
2770
2771                 rv = bmc_get_device_id(NULL, bmc, &id, NULL, NULL);
2772                 return (!rv && id.aux_firmware_revision_set) ? mode : 0;
2773         }
2774         if (attr == &dev_attr_guid.attr) {
2775                 bool guid_set;
2776
2777                 rv = bmc_get_device_id(NULL, bmc, NULL, &guid_set, NULL);
2778                 return (!rv && guid_set) ? mode : 0;
2779         }
2780         return mode;
2781 }
2782
2783 static const struct attribute_group bmc_dev_attr_group = {
2784         .attrs          = bmc_dev_attrs,
2785         .is_visible     = bmc_dev_attr_is_visible,
2786 };
2787
2788 static const struct attribute_group *bmc_dev_attr_groups[] = {
2789         &bmc_dev_attr_group,
2790         NULL
2791 };
2792
2793 static const struct device_type bmc_device_type = {
2794         .groups         = bmc_dev_attr_groups,
2795 };
2796
2797 static int __find_bmc_guid(struct device *dev, void *data)
2798 {
2799         guid_t *guid = data;
2800         struct bmc_device *bmc;
2801         int rv;
2802
2803         if (dev->type != &bmc_device_type)
2804                 return 0;
2805
2806         bmc = to_bmc_device(dev);
2807         rv = bmc->dyn_guid_set && guid_equal(&bmc->guid, guid);
2808         if (rv)
2809                 rv = kref_get_unless_zero(&bmc->usecount);
2810         return rv;
2811 }
2812
2813 /*
2814  * Returns with the bmc's usecount incremented, if it is non-NULL.
2815  */
2816 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2817                                              guid_t *guid)
2818 {
2819         struct device *dev;
2820         struct bmc_device *bmc = NULL;
2821
2822         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2823         if (dev) {
2824                 bmc = to_bmc_device(dev);
2825                 put_device(dev);
2826         }
2827         return bmc;
2828 }
2829
2830 struct prod_dev_id {
2831         unsigned int  product_id;
2832         unsigned char device_id;
2833 };
2834
2835 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2836 {
2837         struct prod_dev_id *cid = data;
2838         struct bmc_device *bmc;
2839         int rv;
2840
2841         if (dev->type != &bmc_device_type)
2842                 return 0;
2843
2844         bmc = to_bmc_device(dev);
2845         rv = (bmc->id.product_id == cid->product_id
2846               && bmc->id.device_id == cid->device_id);
2847         if (rv)
2848                 rv = kref_get_unless_zero(&bmc->usecount);
2849         return rv;
2850 }
2851
2852 /*
2853  * Returns with the bmc's usecount incremented, if it is non-NULL.
2854  */
2855 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2856         struct device_driver *drv,
2857         unsigned int product_id, unsigned char device_id)
2858 {
2859         struct prod_dev_id id = {
2860                 .product_id = product_id,
2861                 .device_id = device_id,
2862         };
2863         struct device *dev;
2864         struct bmc_device *bmc = NULL;
2865
2866         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2867         if (dev) {
2868                 bmc = to_bmc_device(dev);
2869                 put_device(dev);
2870         }
2871         return bmc;
2872 }
2873
2874 static DEFINE_IDA(ipmi_bmc_ida);
2875
2876 static void
2877 release_bmc_device(struct device *dev)
2878 {
2879         kfree(to_bmc_device(dev));
2880 }
2881
2882 static void cleanup_bmc_work(struct work_struct *work)
2883 {
2884         struct bmc_device *bmc = container_of(work, struct bmc_device,
2885                                               remove_work);
2886         int id = bmc->pdev.id; /* Unregister overwrites id */
2887
2888         platform_device_unregister(&bmc->pdev);
2889         ida_simple_remove(&ipmi_bmc_ida, id);
2890 }
2891
2892 static void
2893 cleanup_bmc_device(struct kref *ref)
2894 {
2895         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2896
2897         /*
2898          * Remove the platform device in a work queue to avoid issues
2899          * with removing the device attributes while reading a device
2900          * attribute.
2901          */
2902         schedule_work(&bmc->remove_work);
2903 }
2904
2905 /*
2906  * Must be called with intf->bmc_reg_mutex held.
2907  */
2908 static void __ipmi_bmc_unregister(ipmi_smi_t intf)
2909 {
2910         struct bmc_device *bmc = intf->bmc;
2911
2912         if (!intf->bmc_registered)
2913                 return;
2914
2915         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2916         sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2917         kfree(intf->my_dev_name);
2918         intf->my_dev_name = NULL;
2919
2920         mutex_lock(&bmc->dyn_mutex);
2921         list_del(&intf->bmc_link);
2922         mutex_unlock(&bmc->dyn_mutex);
2923         intf->bmc = &intf->tmp_bmc;
2924         kref_put(&bmc->usecount, cleanup_bmc_device);
2925         intf->bmc_registered = false;
2926 }
2927
2928 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2929 {
2930         mutex_lock(&intf->bmc_reg_mutex);
2931         __ipmi_bmc_unregister(intf);
2932         mutex_unlock(&intf->bmc_reg_mutex);
2933 }
2934
2935 /*
2936  * Must be called with intf->bmc_reg_mutex held.
2937  */
2938 static int __ipmi_bmc_register(ipmi_smi_t intf,
2939                                struct ipmi_device_id *id,
2940                                bool guid_set, guid_t *guid, int intf_num)
2941 {
2942         int               rv;
2943         struct bmc_device *bmc;
2944         struct bmc_device *old_bmc;
2945
2946         /*
2947          * platform_device_register() can cause bmc_reg_mutex to
2948          * be claimed because of the is_visible functions of
2949          * the attributes.  Eliminate possible recursion and
2950          * release the lock.
2951          */
2952         intf->in_bmc_register = true;
2953         mutex_unlock(&intf->bmc_reg_mutex);
2954
2955         /*
2956          * Try to find if there is an bmc_device struct
2957          * representing the interfaced BMC already
2958          */
2959         mutex_lock(&ipmidriver_mutex);
2960         if (guid_set)
2961                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, guid);
2962         else
2963                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2964                                                     id->product_id,
2965                                                     id->device_id);
2966
2967         /*
2968          * If there is already an bmc_device, free the new one,
2969          * otherwise register the new BMC device
2970          */
2971         if (old_bmc) {
2972                 bmc = old_bmc;
2973                 /*
2974                  * Note: old_bmc already has usecount incremented by
2975                  * the BMC find functions.
2976                  */
2977                 intf->bmc = old_bmc;
2978                 mutex_lock(&bmc->dyn_mutex);
2979                 list_add_tail(&intf->bmc_link, &bmc->intfs);
2980                 mutex_unlock(&bmc->dyn_mutex);
2981
2982                 dev_info(intf->si_dev,
2983                          "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2984                          " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2985                          bmc->id.manufacturer_id,
2986                          bmc->id.product_id,
2987                          bmc->id.device_id);
2988         } else {
2989                 bmc = kzalloc(sizeof(*bmc), GFP_KERNEL);
2990                 if (!bmc) {
2991                         rv = -ENOMEM;
2992                         goto out;
2993                 }
2994                 INIT_LIST_HEAD(&bmc->intfs);
2995                 mutex_init(&bmc->dyn_mutex);
2996                 INIT_WORK(&bmc->remove_work, cleanup_bmc_work);
2997
2998                 bmc->id = *id;
2999                 bmc->dyn_id_set = 1;
3000                 bmc->dyn_guid_set = guid_set;
3001                 bmc->guid = *guid;
3002                 bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
3003
3004                 bmc->pdev.name = "ipmi_bmc";
3005
3006                 rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL);
3007                 if (rv < 0)
3008                         goto out;
3009                 bmc->pdev.dev.driver = &ipmidriver.driver;
3010                 bmc->pdev.id = rv;
3011                 bmc->pdev.dev.release = release_bmc_device;
3012                 bmc->pdev.dev.type = &bmc_device_type;
3013                 kref_init(&bmc->usecount);
3014
3015                 intf->bmc = bmc;
3016                 mutex_lock(&bmc->dyn_mutex);
3017                 list_add_tail(&intf->bmc_link, &bmc->intfs);
3018                 mutex_unlock(&bmc->dyn_mutex);
3019
3020                 rv = platform_device_register(&bmc->pdev);
3021                 if (rv) {
3022                         dev_err(intf->si_dev,
3023                                 PFX " Unable to register bmc device: %d\n",
3024                                 rv);
3025                         goto out_list_del;
3026                 }
3027
3028                 dev_info(intf->si_dev,
3029                          "Found new BMC (man_id: 0x%6.6x, prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
3030                          bmc->id.manufacturer_id,
3031                          bmc->id.product_id,
3032                          bmc->id.device_id);
3033         }
3034
3035         /*
3036          * create symlink from system interface device to bmc device
3037          * and back.
3038          */
3039         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
3040         if (rv) {
3041                 dev_err(intf->si_dev,
3042                         PFX "Unable to create bmc symlink: %d\n", rv);
3043                 goto out_put_bmc;
3044         }
3045
3046         if (intf_num == -1)
3047                 intf_num = intf->intf_num;
3048         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", intf_num);
3049         if (!intf->my_dev_name) {
3050                 rv = -ENOMEM;
3051                 dev_err(intf->si_dev,
3052                         PFX "Unable to allocate link from BMC: %d\n", rv);
3053                 goto out_unlink1;
3054         }
3055
3056         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
3057                                intf->my_dev_name);
3058         if (rv) {
3059                 kfree(intf->my_dev_name);
3060                 intf->my_dev_name = NULL;
3061                 dev_err(intf->si_dev,
3062                         PFX "Unable to create symlink to bmc: %d\n", rv);
3063                 goto out_free_my_dev_name;
3064         }
3065
3066         intf->bmc_registered = true;
3067
3068 out:
3069         mutex_unlock(&ipmidriver_mutex);
3070         mutex_lock(&intf->bmc_reg_mutex);
3071         intf->in_bmc_register = false;
3072         return rv;
3073
3074
3075 out_free_my_dev_name:
3076         kfree(intf->my_dev_name);
3077         intf->my_dev_name = NULL;
3078
3079 out_unlink1:
3080         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
3081
3082 out_put_bmc:
3083         mutex_lock(&bmc->dyn_mutex);
3084         list_del(&intf->bmc_link);
3085         mutex_unlock(&bmc->dyn_mutex);
3086         intf->bmc = &intf->tmp_bmc;
3087         kref_put(&bmc->usecount, cleanup_bmc_device);
3088         goto out;
3089
3090 out_list_del:
3091         mutex_lock(&bmc->dyn_mutex);
3092         list_del(&intf->bmc_link);
3093         mutex_unlock(&bmc->dyn_mutex);
3094         intf->bmc = &intf->tmp_bmc;
3095         put_device(&bmc->pdev.dev);
3096         goto out;
3097 }
3098
3099 static int
3100 send_guid_cmd(ipmi_smi_t intf, int chan)
3101 {
3102         struct kernel_ipmi_msg            msg;
3103         struct ipmi_system_interface_addr si;
3104
3105         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3106         si.channel = IPMI_BMC_CHANNEL;
3107         si.lun = 0;
3108
3109         msg.netfn = IPMI_NETFN_APP_REQUEST;
3110         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
3111         msg.data = NULL;
3112         msg.data_len = 0;
3113         return i_ipmi_request(NULL,
3114                               intf,
3115                               (struct ipmi_addr *) &si,
3116                               0,
3117                               &msg,
3118                               intf,
3119                               NULL,
3120                               NULL,
3121                               0,
3122                               intf->addrinfo[0].address,
3123                               intf->addrinfo[0].lun,
3124                               -1, 0);
3125 }
3126
3127 static void guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3128 {
3129         struct bmc_device *bmc = intf->bmc;
3130
3131         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3132             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
3133             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
3134                 /* Not for me */
3135                 return;
3136
3137         if (msg->msg.data[0] != 0) {
3138                 /* Error from getting the GUID, the BMC doesn't have one. */
3139                 bmc->dyn_guid_set = 0;
3140                 goto out;
3141         }
3142
3143         if (msg->msg.data_len < 17) {
3144                 bmc->dyn_guid_set = 0;
3145                 dev_warn(intf->si_dev,
3146                          PFX "The GUID response from the BMC was too short, it was %d but should have been 17.  Assuming GUID is not available.\n",
3147                          msg->msg.data_len);
3148                 goto out;
3149         }
3150
3151         memcpy(bmc->fetch_guid.b, msg->msg.data + 1, 16);
3152         /*
3153          * Make sure the guid data is available before setting
3154          * dyn_guid_set.
3155          */
3156         smp_wmb();
3157         bmc->dyn_guid_set = 1;
3158  out:
3159         wake_up(&intf->waitq);
3160 }
3161
3162 static void __get_guid(ipmi_smi_t intf)
3163 {
3164         int rv;
3165         struct bmc_device *bmc = intf->bmc;
3166
3167         bmc->dyn_guid_set = 2;
3168         intf->null_user_handler = guid_handler;
3169         rv = send_guid_cmd(intf, 0);
3170         if (rv)
3171                 /* Send failed, no GUID available. */
3172                 bmc->dyn_guid_set = 0;
3173
3174         wait_event(intf->waitq, bmc->dyn_guid_set != 2);
3175
3176         /* dyn_guid_set makes the guid data available. */
3177         smp_rmb();
3178
3179         intf->null_user_handler = NULL;
3180 }
3181
3182 static int
3183 send_channel_info_cmd(ipmi_smi_t intf, int chan)
3184 {
3185         struct kernel_ipmi_msg            msg;
3186         unsigned char                     data[1];
3187         struct ipmi_system_interface_addr si;
3188
3189         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3190         si.channel = IPMI_BMC_CHANNEL;
3191         si.lun = 0;
3192
3193         msg.netfn = IPMI_NETFN_APP_REQUEST;
3194         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
3195         msg.data = data;
3196         msg.data_len = 1;
3197         data[0] = chan;
3198         return i_ipmi_request(NULL,
3199                               intf,
3200                               (struct ipmi_addr *) &si,
3201                               0,
3202                               &msg,
3203                               intf,
3204                               NULL,
3205                               NULL,
3206                               0,
3207                               intf->addrinfo[0].address,
3208                               intf->addrinfo[0].lun,
3209                               -1, 0);
3210 }
3211
3212 static void
3213 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3214 {
3215         int rv = 0;
3216         int ch;
3217         unsigned int set = intf->curr_working_cset;
3218         struct ipmi_channel *chans;
3219
3220         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3221             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3222             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
3223                 /* It's the one we want */
3224                 if (msg->msg.data[0] != 0) {
3225                         /* Got an error from the channel, just go on. */
3226
3227                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
3228                                 /*
3229                                  * If the MC does not support this
3230                                  * command, that is legal.  We just
3231                                  * assume it has one IPMB at channel
3232                                  * zero.
3233                                  */
3234                                 intf->wchannels[set].c[0].medium
3235                                         = IPMI_CHANNEL_MEDIUM_IPMB;
3236                                 intf->wchannels[set].c[0].protocol
3237                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
3238
3239                                 intf->channel_list = intf->wchannels + set;
3240                                 intf->channels_ready = true;
3241                                 wake_up(&intf->waitq);
3242                                 goto out;
3243                         }
3244                         goto next_channel;
3245                 }
3246                 if (msg->msg.data_len < 4) {
3247                         /* Message not big enough, just go on. */
3248                         goto next_channel;
3249                 }
3250                 ch = intf->curr_channel;
3251                 chans = intf->wchannels[set].c;
3252                 chans[ch].medium = msg->msg.data[2] & 0x7f;
3253                 chans[ch].protocol = msg->msg.data[3] & 0x1f;
3254
3255  next_channel:
3256                 intf->curr_channel++;
3257                 if (intf->curr_channel >= IPMI_MAX_CHANNELS) {
3258                         intf->channel_list = intf->wchannels + set;
3259                         intf->channels_ready = true;
3260                         wake_up(&intf->waitq);
3261                 } else {
3262                         intf->channel_list = intf->wchannels + set;
3263                         intf->channels_ready = true;
3264                         rv = send_channel_info_cmd(intf, intf->curr_channel);
3265                 }
3266
3267                 if (rv) {
3268                         /* Got an error somehow, just give up. */
3269                         dev_warn(intf->si_dev,
3270                                  PFX "Error sending channel information for channel %d: %d\n",
3271                                  intf->curr_channel, rv);
3272
3273                         intf->channel_list = intf->wchannels + set;
3274                         intf->channels_ready = true;
3275                         wake_up(&intf->waitq);
3276                 }
3277         }
3278  out:
3279         return;
3280 }
3281
3282 /*
3283  * Must be holding intf->bmc_reg_mutex to call this.
3284  */
3285 static int __scan_channels(ipmi_smi_t intf, struct ipmi_device_id *id)
3286 {
3287         int rv;
3288
3289         if (ipmi_version_major(id) > 1
3290                         || (ipmi_version_major(id) == 1
3291                             && ipmi_version_minor(id) >= 5)) {
3292                 unsigned int set;
3293
3294                 /*
3295                  * Start scanning the channels to see what is
3296                  * available.
3297                  */
3298                 set = !intf->curr_working_cset;
3299                 intf->curr_working_cset = set;
3300                 memset(&intf->wchannels[set], 0,
3301                        sizeof(struct ipmi_channel_set));
3302
3303                 intf->null_user_handler = channel_handler;
3304                 intf->curr_channel = 0;
3305                 rv = send_channel_info_cmd(intf, 0);
3306                 if (rv) {
3307                         dev_warn(intf->si_dev,
3308                                  "Error sending channel information for channel 0, %d\n",
3309                                  rv);
3310                         return -EIO;
3311                 }
3312
3313                 /* Wait for the channel info to be read. */
3314                 wait_event(intf->waitq, intf->channels_ready);
3315                 intf->null_user_handler = NULL;
3316         } else {
3317                 unsigned int set = intf->curr_working_cset;
3318
3319                 /* Assume a single IPMB channel at zero. */
3320                 intf->wchannels[set].c[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
3321                 intf->wchannels[set].c[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
3322                 intf->channel_list = intf->wchannels + set;
3323                 intf->channels_ready = true;
3324         }
3325
3326         return 0;
3327 }
3328
3329 static void ipmi_poll(ipmi_smi_t intf)
3330 {
3331         if (intf->handlers->poll)
3332                 intf->handlers->poll(intf->send_info);
3333         /* In case something came in */
3334         handle_new_recv_msgs(intf);
3335 }
3336
3337 void ipmi_poll_interface(ipmi_user_t user)
3338 {
3339         ipmi_poll(user->intf);
3340 }
3341 EXPORT_SYMBOL(ipmi_poll_interface);
3342
3343 static void redo_bmc_reg(struct work_struct *work)
3344 {
3345         ipmi_smi_t intf = container_of(work, struct ipmi_smi, bmc_reg_work);
3346
3347         if (!intf->in_shutdown)
3348                 bmc_get_device_id(intf, NULL, NULL, NULL, NULL);
3349
3350         kref_put(&intf->refcount, intf_free);
3351 }
3352
3353 int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
3354                       void                     *send_info,
3355                       struct device            *si_dev,
3356                       unsigned char            slave_addr)
3357 {
3358         int              i, j;
3359         int              rv;
3360         ipmi_smi_t       intf;
3361         ipmi_smi_t       tintf;
3362         struct list_head *link;
3363         struct ipmi_device_id id;
3364
3365         /*
3366          * Make sure the driver is actually initialized, this handles
3367          * problems with initialization order.
3368          */
3369         if (!initialized) {
3370                 rv = ipmi_init_msghandler();
3371                 if (rv)
3372                         return rv;
3373                 /*
3374                  * The init code doesn't return an error if it was turned
3375                  * off, but it won't initialize.  Check that.
3376                  */
3377                 if (!initialized)
3378                         return -ENODEV;
3379         }
3380
3381         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
3382         if (!intf)
3383                 return -ENOMEM;
3384
3385         intf->bmc = &intf->tmp_bmc;
3386         INIT_LIST_HEAD(&intf->bmc->intfs);
3387         mutex_init(&intf->bmc->dyn_mutex);
3388         INIT_LIST_HEAD(&intf->bmc_link);
3389         mutex_init(&intf->bmc_reg_mutex);
3390         intf->intf_num = -1; /* Mark it invalid for now. */
3391         kref_init(&intf->refcount);
3392         INIT_WORK(&intf->bmc_reg_work, redo_bmc_reg);
3393         intf->si_dev = si_dev;
3394         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
3395                 intf->addrinfo[j].address = IPMI_BMC_SLAVE_ADDR;
3396                 intf->addrinfo[j].lun = 2;
3397         }
3398         if (slave_addr != 0)
3399                 intf->addrinfo[0].address = slave_addr;
3400         INIT_LIST_HEAD(&intf->users);
3401         intf->handlers = handlers;
3402         intf->send_info = send_info;
3403         spin_lock_init(&intf->seq_lock);
3404         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
3405                 intf->seq_table[j].inuse = 0;
3406                 intf->seq_table[j].seqid = 0;
3407         }
3408         intf->curr_seq = 0;
3409 #ifdef CONFIG_IPMI_PROC_INTERFACE
3410         mutex_init(&intf->proc_entry_lock);
3411 #endif
3412         spin_lock_init(&intf->waiting_rcv_msgs_lock);
3413         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
3414         tasklet_init(&intf->recv_tasklet,
3415                      smi_recv_tasklet,
3416                      (unsigned long) intf);
3417         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
3418         spin_lock_init(&intf->xmit_msgs_lock);
3419         INIT_LIST_HEAD(&intf->xmit_msgs);
3420         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
3421         spin_lock_init(&intf->events_lock);
3422         atomic_set(&intf->event_waiters, 0);
3423         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3424         INIT_LIST_HEAD(&intf->waiting_events);
3425         intf->waiting_events_count = 0;
3426         mutex_init(&intf->cmd_rcvrs_mutex);
3427         spin_lock_init(&intf->maintenance_mode_lock);
3428         INIT_LIST_HEAD(&intf->cmd_rcvrs);
3429         init_waitqueue_head(&intf->waitq);
3430         for (i = 0; i < IPMI_NUM_STATS; i++)
3431                 atomic_set(&intf->stats[i], 0);
3432
3433 #ifdef CONFIG_IPMI_PROC_INTERFACE
3434         intf->proc_dir = NULL;
3435 #endif
3436
3437         mutex_lock(&smi_watchers_mutex);
3438         mutex_lock(&ipmi_interfaces_mutex);
3439         /* Look for a hole in the numbers. */
3440         i = 0;
3441         link = &ipmi_interfaces;
3442         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
3443                 if (tintf->intf_num != i) {
3444                         link = &tintf->link;
3445                         break;
3446                 }
3447                 i++;
3448         }
3449         /* Add the new interface in numeric order. */
3450         if (i == 0)
3451                 list_add_rcu(&intf->link, &ipmi_interfaces);
3452         else
3453                 list_add_tail_rcu(&intf->link, link);
3454
3455         rv = handlers->start_processing(send_info, intf);
3456         if (rv)
3457                 goto out;
3458
3459         rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);
3460         if (rv) {
3461                 dev_err(si_dev, "Unable to get the device id: %d\n", rv);
3462                 goto out;
3463         }
3464
3465         mutex_lock(&intf->bmc_reg_mutex);
3466         rv = __scan_channels(intf, &id);
3467         mutex_unlock(&intf->bmc_reg_mutex);
3468         if (rv)
3469                 goto out;
3470
3471 #ifdef CONFIG_IPMI_PROC_INTERFACE
3472         rv = add_proc_entries(intf, i);
3473 #endif
3474
3475  out:
3476         if (rv) {
3477                 ipmi_bmc_unregister(intf);
3478 #ifdef CONFIG_IPMI_PROC_INTERFACE
3479                 if (intf->proc_dir)
3480                         remove_proc_entries(intf);
3481 #endif
3482                 intf->handlers = NULL;
3483                 list_del_rcu(&intf->link);
3484                 mutex_unlock(&ipmi_interfaces_mutex);
3485                 mutex_unlock(&smi_watchers_mutex);
3486                 synchronize_rcu();
3487                 kref_put(&intf->refcount, intf_free);
3488         } else {
3489                 /*
3490                  * Keep memory order straight for RCU readers.  Make
3491                  * sure everything else is committed to memory before
3492                  * setting intf_num to mark the interface valid.
3493                  */
3494                 smp_wmb();
3495                 intf->intf_num = i;
3496                 mutex_unlock(&ipmi_interfaces_mutex);
3497                 /* After this point the interface is legal to use. */
3498                 call_smi_watchers(i, intf->si_dev);
3499                 mutex_unlock(&smi_watchers_mutex);
3500         }
3501
3502         return rv;
3503 }
3504 EXPORT_SYMBOL(ipmi_register_smi);
3505
3506 static void deliver_smi_err_response(ipmi_smi_t intf,
3507                                      struct ipmi_smi_msg *msg,
3508                                      unsigned char err)
3509 {
3510         msg->rsp[0] = msg->data[0] | 4;
3511         msg->rsp[1] = msg->data[1];
3512         msg->rsp[2] = err;
3513         msg->rsp_size = 3;
3514         /* It's an error, so it will never requeue, no need to check return. */
3515         handle_one_recv_msg(intf, msg);
3516 }
3517
3518 static void cleanup_smi_msgs(ipmi_smi_t intf)
3519 {
3520         int              i;
3521         struct seq_table *ent;
3522         struct ipmi_smi_msg *msg;
3523         struct list_head *entry;
3524         struct list_head tmplist;
3525
3526         /* Clear out our transmit queues and hold the messages. */
3527         INIT_LIST_HEAD(&tmplist);
3528         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
3529         list_splice_tail(&intf->xmit_msgs, &tmplist);
3530
3531         /* Current message first, to preserve order */
3532         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
3533                 /* Wait for the message to clear out. */
3534                 schedule_timeout(1);
3535         }
3536
3537         /* No need for locks, the interface is down. */
3538
3539         /*
3540          * Return errors for all pending messages in queue and in the
3541          * tables waiting for remote responses.
3542          */
3543         while (!list_empty(&tmplist)) {
3544                 entry = tmplist.next;
3545                 list_del(entry);
3546                 msg = list_entry(entry, struct ipmi_smi_msg, link);
3547                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
3548         }
3549
3550         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
3551                 ent = &(intf->seq_table[i]);
3552                 if (!ent->inuse)
3553                         continue;
3554                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
3555         }
3556 }
3557
3558 int ipmi_unregister_smi(ipmi_smi_t intf)
3559 {
3560         struct ipmi_smi_watcher *w;
3561         int intf_num = intf->intf_num;
3562         ipmi_user_t user;
3563
3564         mutex_lock(&smi_watchers_mutex);
3565         mutex_lock(&ipmi_interfaces_mutex);
3566         intf->intf_num = -1;
3567         intf->in_shutdown = true;
3568         list_del_rcu(&intf->link);
3569         mutex_unlock(&ipmi_interfaces_mutex);
3570         synchronize_rcu();
3571
3572         cleanup_smi_msgs(intf);
3573
3574         /* Clean up the effects of users on the lower-level software. */
3575         mutex_lock(&ipmi_interfaces_mutex);
3576         rcu_read_lock();
3577         list_for_each_entry_rcu(user, &intf->users, link) {
3578                 module_put(intf->handlers->owner);
3579                 if (intf->handlers->dec_usecount)
3580                         intf->handlers->dec_usecount(intf->send_info);
3581         }
3582         rcu_read_unlock();
3583         intf->handlers = NULL;
3584         mutex_unlock(&ipmi_interfaces_mutex);
3585
3586 #ifdef CONFIG_IPMI_PROC_INTERFACE
3587         remove_proc_entries(intf);
3588 #endif
3589         ipmi_bmc_unregister(intf);
3590
3591         /*
3592          * Call all the watcher interfaces to tell them that
3593          * an interface is gone.
3594          */
3595         list_for_each_entry(w, &smi_watchers, link)
3596                 w->smi_gone(intf_num);
3597         mutex_unlock(&smi_watchers_mutex);
3598
3599         kref_put(&intf->refcount, intf_free);
3600         return 0;
3601 }
3602 EXPORT_SYMBOL(ipmi_unregister_smi);
3603
3604 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3605                                    struct ipmi_smi_msg *msg)
3606 {
3607         struct ipmi_ipmb_addr ipmb_addr;
3608         struct ipmi_recv_msg  *recv_msg;
3609
3610         /*
3611          * This is 11, not 10, because the response must contain a
3612          * completion code.
3613          */
3614         if (msg->rsp_size < 11) {
3615                 /* Message not big enough, just ignore it. */
3616                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3617                 return 0;
3618         }
3619
3620         if (msg->rsp[2] != 0) {
3621                 /* An error getting the response, just ignore it. */
3622                 return 0;
3623         }
3624
3625         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3626         ipmb_addr.slave_addr = msg->rsp[6];
3627         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3628         ipmb_addr.lun = msg->rsp[7] & 3;
3629
3630         /*
3631          * It's a response from a remote entity.  Look up the sequence
3632          * number and handle the response.
3633          */
3634         if (intf_find_seq(intf,
3635                           msg->rsp[7] >> 2,
3636                           msg->rsp[3] & 0x0f,
3637                           msg->rsp[8],
3638                           (msg->rsp[4] >> 2) & (~1),
3639                           (struct ipmi_addr *) &(ipmb_addr),
3640                           &recv_msg)) {
3641                 /*
3642                  * We were unable to find the sequence number,
3643                  * so just nuke the message.
3644                  */
3645                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3646                 return 0;
3647         }
3648
3649         memcpy(recv_msg->msg_data,
3650                &(msg->rsp[9]),
3651                msg->rsp_size - 9);
3652         /*
3653          * The other fields matched, so no need to set them, except
3654          * for netfn, which needs to be the response that was
3655          * returned, not the request value.
3656          */
3657         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3658         recv_msg->msg.data = recv_msg->msg_data;
3659         recv_msg->msg.data_len = msg->rsp_size - 10;
3660         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3661         ipmi_inc_stat(intf, handled_ipmb_responses);
3662         deliver_response(recv_msg);
3663
3664         return 0;
3665 }
3666
3667 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3668                                    struct ipmi_smi_msg *msg)
3669 {
3670         struct cmd_rcvr          *rcvr;
3671         int                      rv = 0;
3672         unsigned char            netfn;
3673         unsigned char            cmd;
3674         unsigned char            chan;
3675         ipmi_user_t              user = NULL;
3676         struct ipmi_ipmb_addr    *ipmb_addr;
3677         struct ipmi_recv_msg     *recv_msg;
3678
3679         if (msg->rsp_size < 10) {
3680                 /* Message not big enough, just ignore it. */
3681                 ipmi_inc_stat(intf, invalid_commands);
3682                 return 0;
3683         }
3684
3685         if (msg->rsp[2] != 0) {
3686                 /* An error getting the response, just ignore it. */
3687                 return 0;
3688         }
3689
3690         netfn = msg->rsp[4] >> 2;
3691         cmd = msg->rsp[8];
3692         chan = msg->rsp[3] & 0xf;
3693
3694         rcu_read_lock();
3695         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3696         if (rcvr) {
3697                 user = rcvr->user;
3698                 kref_get(&user->refcount);
3699         } else
3700                 user = NULL;
3701         rcu_read_unlock();
3702
3703         if (user == NULL) {
3704                 /* We didn't find a user, deliver an error response. */
3705                 ipmi_inc_stat(intf, unhandled_commands);
3706
3707                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3708                 msg->data[1] = IPMI_SEND_MSG_CMD;
3709                 msg->data[2] = msg->rsp[3];
3710                 msg->data[3] = msg->rsp[6];
3711                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3712                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3713                 msg->data[6] = intf->addrinfo[msg->rsp[3] & 0xf].address;
3714                 /* rqseq/lun */
3715                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3716                 msg->data[8] = msg->rsp[8]; /* cmd */
3717                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3718                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3719                 msg->data_size = 11;
3720
3721 #ifdef DEBUG_MSGING
3722         {
3723                 int m;
3724                 printk("Invalid command:");
3725                 for (m = 0; m < msg->data_size; m++)
3726                         printk(" %2.2x", msg->data[m]);
3727                 printk("\n");
3728         }
3729 #endif
3730                 rcu_read_lock();
3731                 if (!intf->in_shutdown) {
3732                         smi_send(intf, intf->handlers, msg, 0);
3733                         /*
3734                          * We used the message, so return the value
3735                          * that causes it to not be freed or
3736                          * queued.
3737                          */
3738                         rv = -1;
3739                 }
3740                 rcu_read_unlock();
3741         } else {
3742                 /* Deliver the message to the user. */
3743                 ipmi_inc_stat(intf, handled_commands);
3744
3745                 recv_msg = ipmi_alloc_recv_msg();
3746                 if (!recv_msg) {
3747                         /*
3748                          * We couldn't allocate memory for the
3749                          * message, so requeue it for handling
3750                          * later.
3751                          */
3752                         rv = 1;
3753                         kref_put(&user->refcount, free_user);
3754                 } else {
3755                         /* Extract the source address from the data. */
3756                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3757                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3758                         ipmb_addr->slave_addr = msg->rsp[6];
3759                         ipmb_addr->lun = msg->rsp[7] & 3;
3760                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3761
3762                         /*
3763                          * Extract the rest of the message information
3764                          * from the IPMB header.
3765                          */
3766                         recv_msg->user = user;
3767                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3768                         recv_msg->msgid = msg->rsp[7] >> 2;
3769                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3770                         recv_msg->msg.cmd = msg->rsp[8];
3771                         recv_msg->msg.data = recv_msg->msg_data;
3772
3773                         /*
3774                          * We chop off 10, not 9 bytes because the checksum
3775                          * at the end also needs to be removed.
3776                          */
3777                         recv_msg->msg.data_len = msg->rsp_size - 10;
3778                         memcpy(recv_msg->msg_data,
3779                                &(msg->rsp[9]),
3780                                msg->rsp_size - 10);
3781                         deliver_response(recv_msg);
3782                 }
3783         }
3784
3785         return rv;
3786 }
3787
3788 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3789                                   struct ipmi_smi_msg *msg)
3790 {
3791         struct ipmi_lan_addr  lan_addr;
3792         struct ipmi_recv_msg  *recv_msg;
3793
3794
3795         /*
3796          * This is 13, not 12, because the response must contain a
3797          * completion code.
3798          */
3799         if (msg->rsp_size < 13) {
3800                 /* Message not big enough, just ignore it. */
3801                 ipmi_inc_stat(intf, invalid_lan_responses);
3802                 return 0;
3803         }
3804
3805         if (msg->rsp[2] != 0) {
3806                 /* An error getting the response, just ignore it. */
3807                 return 0;
3808         }
3809
3810         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3811         lan_addr.session_handle = msg->rsp[4];
3812         lan_addr.remote_SWID = msg->rsp[8];
3813         lan_addr.local_SWID = msg->rsp[5];
3814         lan_addr.channel = msg->rsp[3] & 0x0f;
3815         lan_addr.privilege = msg->rsp[3] >> 4;
3816         lan_addr.lun = msg->rsp[9] & 3;
3817
3818         /*
3819          * It's a response from a remote entity.  Look up the sequence
3820          * number and handle the response.
3821          */
3822         if (intf_find_seq(intf,
3823                           msg->rsp[9] >> 2,
3824                           msg->rsp[3] & 0x0f,
3825                           msg->rsp[10],
3826                           (msg->rsp[6] >> 2) & (~1),
3827                           (struct ipmi_addr *) &(lan_addr),
3828                           &recv_msg)) {
3829                 /*
3830                  * We were unable to find the sequence number,
3831                  * so just nuke the message.
3832                  */
3833                 ipmi_inc_stat(intf, unhandled_lan_responses);
3834                 return 0;
3835         }
3836
3837         memcpy(recv_msg->msg_data,
3838                &(msg->rsp[11]),
3839                msg->rsp_size - 11);
3840         /*
3841          * The other fields matched, so no need to set them, except
3842          * for netfn, which needs to be the response that was
3843          * returned, not the request value.
3844          */
3845         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3846         recv_msg->msg.data = recv_msg->msg_data;
3847         recv_msg->msg.data_len = msg->rsp_size - 12;
3848         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3849         ipmi_inc_stat(intf, handled_lan_responses);
3850         deliver_response(recv_msg);
3851
3852         return 0;
3853 }
3854
3855 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3856                                   struct ipmi_smi_msg *msg)
3857 {
3858         struct cmd_rcvr          *rcvr;
3859         int                      rv = 0;
3860         unsigned char            netfn;
3861         unsigned char            cmd;
3862         unsigned char            chan;
3863         ipmi_user_t              user = NULL;
3864         struct ipmi_lan_addr     *lan_addr;
3865         struct ipmi_recv_msg     *recv_msg;
3866
3867         if (msg->rsp_size < 12) {
3868                 /* Message not big enough, just ignore it. */
3869                 ipmi_inc_stat(intf, invalid_commands);
3870                 return 0;
3871         }
3872
3873         if (msg->rsp[2] != 0) {
3874                 /* An error getting the response, just ignore it. */
3875                 return 0;
3876         }
3877
3878         netfn = msg->rsp[6] >> 2;
3879         cmd = msg->rsp[10];
3880         chan = msg->rsp[3] & 0xf;
3881
3882         rcu_read_lock();
3883         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3884         if (rcvr) {
3885                 user = rcvr->user;
3886                 kref_get(&user->refcount);
3887         } else
3888                 user = NULL;
3889         rcu_read_unlock();
3890
3891         if (user == NULL) {
3892                 /* We didn't find a user, just give up. */
3893                 ipmi_inc_stat(intf, unhandled_commands);
3894
3895                 /*
3896                  * Don't do anything with these messages, just allow
3897                  * them to be freed.
3898                  */
3899                 rv = 0;
3900         } else {
3901                 /* Deliver the message to the user. */
3902                 ipmi_inc_stat(intf, handled_commands);
3903
3904                 recv_msg = ipmi_alloc_recv_msg();
3905                 if (!recv_msg) {
3906                         /*
3907                          * We couldn't allocate memory for the
3908                          * message, so requeue it for handling later.
3909                          */
3910                         rv = 1;
3911                         kref_put(&user->refcount, free_user);
3912                 } else {
3913                         /* Extract the source address from the data. */
3914                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3915                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3916                         lan_addr->session_handle = msg->rsp[4];
3917                         lan_addr->remote_SWID = msg->rsp[8];
3918                         lan_addr->local_SWID = msg->rsp[5];
3919                         lan_addr->lun = msg->rsp[9] & 3;
3920                         lan_addr->channel = msg->rsp[3] & 0xf;
3921                         lan_addr->privilege = msg->rsp[3] >> 4;
3922
3923                         /*
3924                          * Extract the rest of the message information
3925                          * from the IPMB header.
3926                          */
3927                         recv_msg->user = user;
3928                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3929                         recv_msg->msgid = msg->rsp[9] >> 2;
3930                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3931                         recv_msg->msg.cmd = msg->rsp[10];
3932                         recv_msg->msg.data = recv_msg->msg_data;
3933
3934                         /*
3935                          * We chop off 12, not 11 bytes because the checksum
3936                          * at the end also needs to be removed.
3937                          */
3938                         recv_msg->msg.data_len = msg->rsp_size - 12;
3939                         memcpy(recv_msg->msg_data,
3940                                &(msg->rsp[11]),
3941                                msg->rsp_size - 12);
3942                         deliver_response(recv_msg);
3943                 }
3944         }
3945
3946         return rv;
3947 }
3948
3949 /*
3950  * This routine will handle "Get Message" command responses with
3951  * channels that use an OEM Medium. The message format belongs to
3952  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3953  * Chapter 22, sections 22.6 and 22.24 for more details.
3954  */
3955 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3956                                   struct ipmi_smi_msg *msg)
3957 {
3958         struct cmd_rcvr       *rcvr;
3959         int                   rv = 0;
3960         unsigned char         netfn;
3961         unsigned char         cmd;
3962         unsigned char         chan;
3963         ipmi_user_t           user = NULL;
3964         struct ipmi_system_interface_addr *smi_addr;
3965         struct ipmi_recv_msg  *recv_msg;
3966
3967         /*
3968          * We expect the OEM SW to perform error checking
3969          * so we just do some basic sanity checks
3970          */
3971         if (msg->rsp_size < 4) {
3972                 /* Message not big enough, just ignore it. */
3973                 ipmi_inc_stat(intf, invalid_commands);
3974                 return 0;
3975         }
3976
3977         if (msg->rsp[2] != 0) {
3978                 /* An error getting the response, just ignore it. */
3979                 return 0;
3980         }
3981
3982         /*
3983          * This is an OEM Message so the OEM needs to know how
3984          * handle the message. We do no interpretation.
3985          */
3986         netfn = msg->rsp[0] >> 2;
3987         cmd = msg->rsp[1];
3988         chan = msg->rsp[3] & 0xf;
3989
3990         rcu_read_lock();
3991         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3992         if (rcvr) {
3993                 user = rcvr->user;
3994                 kref_get(&user->refcount);
3995         } else
3996                 user = NULL;
3997         rcu_read_unlock();
3998
3999         if (user == NULL) {
4000                 /* We didn't find a user, just give up. */
4001                 ipmi_inc_stat(intf, unhandled_commands);
4002
4003                 /*
4004                  * Don't do anything with these messages, just allow
4005                  * them to be freed.
4006                  */
4007
4008                 rv = 0;
4009         } else {
4010                 /* Deliver the message to the user. */
4011                 ipmi_inc_stat(intf, handled_commands);
4012
4013                 recv_msg = ipmi_alloc_recv_msg();
4014                 if (!recv_msg) {
4015                         /*
4016                          * We couldn't allocate memory for the
4017                          * message, so requeue it for handling
4018                          * later.
4019                          */
4020                         rv = 1;
4021                         kref_put(&user->refcount, free_user);
4022                 } else {
4023                         /*
4024                          * OEM Messages are expected to be delivered via
4025                          * the system interface to SMS software.  We might
4026                          * need to visit this again depending on OEM
4027                          * requirements
4028                          */
4029                         smi_addr = ((struct ipmi_system_interface_addr *)
4030                                     &(recv_msg->addr));
4031                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4032                         smi_addr->channel = IPMI_BMC_CHANNEL;
4033                         smi_addr->lun = msg->rsp[0] & 3;
4034
4035                         recv_msg->user = user;
4036                         recv_msg->user_msg_data = NULL;
4037                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
4038                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
4039                         recv_msg->msg.cmd = msg->rsp[1];
4040                         recv_msg->msg.data = recv_msg->msg_data;
4041
4042                         /*
4043                          * The message starts at byte 4 which follows the
4044                          * the Channel Byte in the "GET MESSAGE" command
4045                          */
4046                         recv_msg->msg.data_len = msg->rsp_size - 4;
4047                         memcpy(recv_msg->msg_data,
4048                                &(msg->rsp[4]),
4049                                msg->rsp_size - 4);
4050                         deliver_response(recv_msg);
4051                 }
4052         }
4053
4054         return rv;
4055 }
4056
4057 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
4058                                      struct ipmi_smi_msg  *msg)
4059 {
4060         struct ipmi_system_interface_addr *smi_addr;
4061
4062         recv_msg->msgid = 0;
4063         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
4064         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4065         smi_addr->channel = IPMI_BMC_CHANNEL;
4066         smi_addr->lun = msg->rsp[0] & 3;
4067         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
4068         recv_msg->msg.netfn = msg->rsp[0] >> 2;
4069         recv_msg->msg.cmd = msg->rsp[1];
4070         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
4071         recv_msg->msg.data = recv_msg->msg_data;
4072         recv_msg->msg.data_len = msg->rsp_size - 3;
4073 }
4074
4075 static int handle_read_event_rsp(ipmi_smi_t          intf,
4076                                  struct ipmi_smi_msg *msg)
4077 {
4078         struct ipmi_recv_msg *recv_msg, *recv_msg2;
4079         struct list_head     msgs;
4080         ipmi_user_t          user;
4081         int                  rv = 0;
4082         int                  deliver_count = 0;
4083         unsigned long        flags;
4084
4085         if (msg->rsp_size < 19) {
4086                 /* Message is too small to be an IPMB event. */
4087                 ipmi_inc_stat(intf, invalid_events);
4088                 return 0;
4089         }
4090
4091         if (msg->rsp[2] != 0) {
4092                 /* An error getting the event, just ignore it. */
4093                 return 0;
4094         }
4095
4096         INIT_LIST_HEAD(&msgs);
4097
4098         spin_lock_irqsave(&intf->events_lock, flags);
4099
4100         ipmi_inc_stat(intf, events);
4101
4102         /*
4103          * Allocate and fill in one message for every user that is
4104          * getting events.
4105          */
4106         rcu_read_lock();
4107         list_for_each_entry_rcu(user, &intf->users, link) {
4108                 if (!user->gets_events)
4109                         continue;
4110
4111                 recv_msg = ipmi_alloc_recv_msg();
4112                 if (!recv_msg) {
4113                         rcu_read_unlock();
4114                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
4115                                                  link) {
4116                                 list_del(&recv_msg->link);
4117                                 ipmi_free_recv_msg(recv_msg);
4118                         }
4119                         /*
4120                          * We couldn't allocate memory for the
4121                          * message, so requeue it for handling
4122                          * later.
4123                          */
4124                         rv = 1;
4125                         goto out;
4126                 }
4127
4128                 deliver_count++;
4129
4130                 copy_event_into_recv_msg(recv_msg, msg);
4131                 recv_msg->user = user;
4132                 kref_get(&user->refcount);
4133                 list_add_tail(&(recv_msg->link), &msgs);
4134         }
4135         rcu_read_unlock();
4136
4137         if (deliver_count) {
4138                 /* Now deliver all the messages. */
4139                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
4140                         list_del(&recv_msg->link);
4141                         deliver_response(recv_msg);
4142                 }
4143         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
4144                 /*
4145                  * No one to receive the message, put it in queue if there's
4146                  * not already too many things in the queue.
4147                  */
4148                 recv_msg = ipmi_alloc_recv_msg();
4149                 if (!recv_msg) {
4150                         /*
4151                          * We couldn't allocate memory for the
4152                          * message, so requeue it for handling
4153                          * later.
4154                          */
4155                         rv = 1;
4156                         goto out;
4157                 }
4158
4159                 copy_event_into_recv_msg(recv_msg, msg);
4160                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
4161                 intf->waiting_events_count++;
4162         } else if (!intf->event_msg_printed) {
4163                 /*
4164                  * There's too many things in the queue, discard this
4165                  * message.
4166                  */
4167                 dev_warn(intf->si_dev,
4168                          PFX "Event queue full, discarding incoming events\n");
4169                 intf->event_msg_printed = 1;
4170         }
4171
4172  out:
4173         spin_unlock_irqrestore(&(intf->events_lock), flags);
4174
4175         return rv;
4176 }
4177
4178 static int handle_bmc_rsp(ipmi_smi_t          intf,
4179                           struct ipmi_smi_msg *msg)
4180 {
4181         struct ipmi_recv_msg *recv_msg;
4182         struct ipmi_user     *user;
4183
4184         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
4185         if (recv_msg == NULL) {
4186                 dev_warn(intf->si_dev,
4187                          "IPMI message received with no owner. This could be because of a malformed message, or because of a hardware error.  Contact your hardware vender for assistance\n");
4188                 return 0;
4189         }
4190
4191         user = recv_msg->user;
4192         /* Make sure the user still exists. */
4193         if (user && !user->valid) {
4194                 /* The user for the message went away, so give up. */
4195                 ipmi_inc_stat(intf, unhandled_local_responses);
4196                 ipmi_free_recv_msg(recv_msg);
4197         } else {
4198                 struct ipmi_system_interface_addr *smi_addr;
4199
4200                 ipmi_inc_stat(intf, handled_local_responses);
4201                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
4202                 recv_msg->msgid = msg->msgid;
4203                 smi_addr = ((struct ipmi_system_interface_addr *)
4204                             &(recv_msg->addr));
4205                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4206                 smi_addr->channel = IPMI_BMC_CHANNEL;
4207                 smi_addr->lun = msg->rsp[0] & 3;
4208                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
4209                 recv_msg->msg.cmd = msg->rsp[1];
4210                 memcpy(recv_msg->msg_data,
4211                        &(msg->rsp[2]),
4212                        msg->rsp_size - 2);
4213                 recv_msg->msg.data = recv_msg->msg_data;
4214                 recv_msg->msg.data_len = msg->rsp_size - 2;
4215                 deliver_response(recv_msg);
4216         }
4217
4218         return 0;
4219 }
4220
4221 /*
4222  * Handle a received message.  Return 1 if the message should be requeued,
4223  * 0 if the message should be freed, or -1 if the message should not
4224  * be freed or requeued.
4225  */
4226 static int handle_one_recv_msg(ipmi_smi_t          intf,
4227                                struct ipmi_smi_msg *msg)
4228 {
4229         int requeue;
4230         int chan;
4231
4232 #ifdef DEBUG_MSGING
4233         int m;
4234         printk("Recv:");
4235         for (m = 0; m < msg->rsp_size; m++)
4236                 printk(" %2.2x", msg->rsp[m]);
4237         printk("\n");
4238 #endif
4239         if (msg->rsp_size < 2) {
4240                 /* Message is too small to be correct. */
4241                 dev_warn(intf->si_dev,
4242                          PFX "BMC returned to small a message for netfn %x cmd %x, got %d bytes\n",
4243                          (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
4244
4245                 /* Generate an error response for the message. */
4246                 msg->rsp[0] = msg->data[0] | (1 << 2);
4247                 msg->rsp[1] = msg->data[1];
4248                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
4249                 msg->rsp_size = 3;
4250         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
4251                    || (msg->rsp[1] != msg->data[1])) {
4252                 /*
4253                  * The NetFN and Command in the response is not even
4254                  * marginally correct.
4255                  */
4256                 dev_warn(intf->si_dev,
4257                          PFX "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
4258                          (msg->data[0] >> 2) | 1, msg->data[1],
4259                          msg->rsp[0] >> 2, msg->rsp[1]);
4260
4261                 /* Generate an error response for the message. */
4262                 msg->rsp[0] = msg->data[0] | (1 << 2);
4263                 msg->rsp[1] = msg->data[1];
4264                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
4265                 msg->rsp_size = 3;
4266         }
4267
4268         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4269             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
4270             && (msg->user_data != NULL)) {
4271                 /*
4272                  * It's a response to a response we sent.  For this we
4273                  * deliver a send message response to the user.
4274                  */
4275                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
4276
4277                 requeue = 0;
4278                 if (msg->rsp_size < 2)
4279                         /* Message is too small to be correct. */
4280                         goto out;
4281
4282                 chan = msg->data[2] & 0x0f;
4283                 if (chan >= IPMI_MAX_CHANNELS)
4284                         /* Invalid channel number */
4285                         goto out;
4286
4287                 if (!recv_msg)
4288                         goto out;
4289
4290                 /* Make sure the user still exists. */
4291                 if (!recv_msg->user || !recv_msg->user->valid)
4292                         goto out;
4293
4294                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
4295                 recv_msg->msg.data = recv_msg->msg_data;
4296                 recv_msg->msg.data_len = 1;
4297                 recv_msg->msg_data[0] = msg->rsp[2];
4298                 deliver_response(recv_msg);
4299         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4300                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
4301                 struct ipmi_channel   *chans;
4302
4303                 /* It's from the receive queue. */
4304                 chan = msg->rsp[3] & 0xf;
4305                 if (chan >= IPMI_MAX_CHANNELS) {
4306                         /* Invalid channel number */
4307                         requeue = 0;
4308                         goto out;
4309                 }
4310
4311                 /*
4312                  * We need to make sure the channels have been initialized.
4313                  * The channel_handler routine will set the "curr_channel"
4314                  * equal to or greater than IPMI_MAX_CHANNELS when all the
4315                  * channels for this interface have been initialized.
4316                  */
4317                 if (!intf->channels_ready) {
4318                         requeue = 0; /* Throw the message away */
4319                         goto out;
4320                 }
4321
4322                 chans = READ_ONCE(intf->channel_list)->c;
4323
4324                 switch (chans[chan].medium) {
4325                 case IPMI_CHANNEL_MEDIUM_IPMB:
4326                         if (msg->rsp[4] & 0x04) {
4327                                 /*
4328                                  * It's a response, so find the
4329                                  * requesting message and send it up.
4330                                  */
4331                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
4332                         } else {
4333                                 /*
4334                                  * It's a command to the SMS from some other
4335                                  * entity.  Handle that.
4336                                  */
4337                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
4338                         }
4339                         break;
4340
4341                 case IPMI_CHANNEL_MEDIUM_8023LAN:
4342                 case IPMI_CHANNEL_MEDIUM_ASYNC:
4343                         if (msg->rsp[6] & 0x04) {
4344                                 /*
4345                                  * It's a response, so find the
4346                                  * requesting message and send it up.
4347                                  */
4348                                 requeue = handle_lan_get_msg_rsp(intf, msg);
4349                         } else {
4350                                 /*
4351                                  * It's a command to the SMS from some other
4352                                  * entity.  Handle that.
4353                                  */
4354                                 requeue = handle_lan_get_msg_cmd(intf, msg);
4355                         }
4356                         break;
4357
4358                 default:
4359                         /* Check for OEM Channels.  Clients had better
4360                            register for these commands. */
4361                         if ((chans[chan].medium >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
4362                             && (chans[chan].medium
4363                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
4364                                 requeue = handle_oem_get_msg_cmd(intf, msg);
4365                         } else {
4366                                 /*
4367                                  * We don't handle the channel type, so just
4368                                  * free the message.
4369                                  */
4370                                 requeue = 0;
4371                         }
4372                 }
4373
4374         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
4375                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
4376                 /* It's an asynchronous event. */
4377                 requeue = handle_read_event_rsp(intf, msg);
4378         } else {
4379                 /* It's a response from the local BMC. */
4380                 requeue = handle_bmc_rsp(intf, msg);
4381         }
4382
4383  out:
4384         return requeue;
4385 }
4386
4387 /*
4388  * If there are messages in the queue or pretimeouts, handle them.
4389  */
4390 static void handle_new_recv_msgs(ipmi_smi_t intf)
4391 {
4392         struct ipmi_smi_msg  *smi_msg;
4393         unsigned long        flags = 0;
4394         int                  rv;
4395         int                  run_to_completion = intf->run_to_completion;
4396
4397         /* See if any waiting messages need to be processed. */
4398         if (!run_to_completion)
4399                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4400         while (!list_empty(&intf->waiting_rcv_msgs)) {
4401                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
4402                                      struct ipmi_smi_msg, link);
4403                 list_del(&smi_msg->link);
4404                 if (!run_to_completion)
4405                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4406                                                flags);
4407                 rv = handle_one_recv_msg(intf, smi_msg);
4408                 if (!run_to_completion)
4409                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4410                 if (rv > 0) {
4411                         /*
4412                          * To preserve message order, quit if we
4413                          * can't handle a message.  Add the message
4414                          * back at the head, this is safe because this
4415                          * tasklet is the only thing that pulls the
4416                          * messages.
4417                          */
4418                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
4419                         break;
4420                 } else {
4421                         if (rv == 0)
4422                                 /* Message handled */
4423                                 ipmi_free_smi_msg(smi_msg);
4424                         /* If rv < 0, fatal error, del but don't free. */
4425                 }
4426         }
4427         if (!run_to_completion)
4428                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
4429
4430         /*
4431          * If the pretimout count is non-zero, decrement one from it and
4432          * deliver pretimeouts to all the users.
4433          */
4434         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
4435                 ipmi_user_t user;
4436
4437                 rcu_read_lock();
4438                 list_for_each_entry_rcu(user, &intf->users, link) {
4439                         if (user->handler->ipmi_watchdog_pretimeout)
4440                                 user->handler->ipmi_watchdog_pretimeout(
4441                                         user->handler_data);
4442                 }
4443                 rcu_read_unlock();
4444         }
4445 }
4446
4447 static void smi_recv_tasklet(unsigned long val)
4448 {
4449         unsigned long flags = 0; /* keep us warning-free. */
4450         ipmi_smi_t intf = (ipmi_smi_t) val;
4451         int run_to_completion = intf->run_to_completion;
4452         struct ipmi_smi_msg *newmsg = NULL;
4453
4454         /*
4455          * Start the next message if available.
4456          *
4457          * Do this here, not in the actual receiver, because we may deadlock
4458          * because the lower layer is allowed to hold locks while calling
4459          * message delivery.
4460          */
4461
4462         rcu_read_lock();
4463
4464         if (!run_to_completion)
4465                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4466         if (intf->curr_msg == NULL && !intf->in_shutdown) {
4467                 struct list_head *entry = NULL;
4468
4469                 /* Pick the high priority queue first. */
4470                 if (!list_empty(&intf->hp_xmit_msgs))
4471                         entry = intf->hp_xmit_msgs.next;
4472                 else if (!list_empty(&intf->xmit_msgs))
4473                         entry = intf->xmit_msgs.next;
4474
4475                 if (entry) {
4476                         list_del(entry);
4477                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
4478                         intf->curr_msg = newmsg;
4479                 }
4480         }
4481         if (!run_to_completion)
4482                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4483         if (newmsg)
4484                 intf->handlers->sender(intf->send_info, newmsg);
4485
4486         rcu_read_unlock();
4487
4488         handle_new_recv_msgs(intf);
4489 }
4490
4491 /* Handle a new message from the lower layer. */
4492 void ipmi_smi_msg_received(ipmi_smi_t          intf,
4493                            struct ipmi_smi_msg *msg)
4494 {
4495         unsigned long flags = 0; /* keep us warning-free. */
4496         int run_to_completion = intf->run_to_completion;
4497
4498         if ((msg->data_size >= 2)
4499             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
4500             && (msg->data[1] == IPMI_SEND_MSG_CMD)
4501             && (msg->user_data == NULL)) {
4502
4503                 if (intf->in_shutdown)
4504                         goto free_msg;
4505
4506                 /*
4507                  * This is the local response to a command send, start
4508                  * the timer for these.  The user_data will not be
4509                  * NULL if this is a response send, and we will let
4510                  * response sends just go through.
4511                  */
4512
4513                 /*
4514                  * Check for errors, if we get certain errors (ones
4515                  * that mean basically we can try again later), we
4516                  * ignore them and start the timer.  Otherwise we
4517                  * report the error immediately.
4518                  */
4519                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
4520                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
4521                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
4522                     && (msg->rsp[2] != IPMI_BUS_ERR)
4523                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
4524                         int ch = msg->rsp[3] & 0xf;
4525                         struct ipmi_channel *chans;
4526
4527                         /* Got an error sending the message, handle it. */
4528
4529                         chans = READ_ONCE(intf->channel_list)->c;
4530                         if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
4531                             || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
4532                                 ipmi_inc_stat(intf, sent_lan_command_errs);
4533                         else
4534                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
4535                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
4536                 } else
4537                         /* The message was sent, start the timer. */
4538                         intf_start_seq_timer(intf, msg->msgid);
4539
4540 free_msg:
4541                 ipmi_free_smi_msg(msg);
4542         } else {
4543                 /*
4544                  * To preserve message order, we keep a queue and deliver from
4545                  * a tasklet.
4546                  */
4547                 if (!run_to_completion)
4548                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
4549                 list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
4550                 if (!run_to_completion)
4551                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4552                                                flags);
4553         }
4554
4555         if (!run_to_completion)
4556                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4557         /*
4558          * We can get an asynchronous event or receive message in addition
4559          * to commands we send.
4560          */
4561         if (msg == intf->curr_msg)
4562                 intf->curr_msg = NULL;
4563         if (!run_to_completion)
4564                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4565
4566         if (run_to_completion)
4567                 smi_recv_tasklet((unsigned long) intf);
4568         else
4569                 tasklet_schedule(&intf->recv_tasklet);
4570 }
4571 EXPORT_SYMBOL(ipmi_smi_msg_received);
4572
4573 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
4574 {
4575         if (intf->in_shutdown)
4576                 return;
4577
4578         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
4579         tasklet_schedule(&intf->recv_tasklet);
4580 }
4581 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4582
4583 static struct ipmi_smi_msg *
4584 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
4585                   unsigned char seq, long seqid)
4586 {
4587         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4588         if (!smi_msg)
4589                 /*
4590                  * If we can't allocate the message, then just return, we
4591                  * get 4 retries, so this should be ok.
4592                  */
4593                 return NULL;
4594
4595         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4596         smi_msg->data_size = recv_msg->msg.data_len;
4597         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4598
4599 #ifdef DEBUG_MSGING
4600         {
4601                 int m;
4602                 printk("Resend: ");
4603                 for (m = 0; m < smi_msg->data_size; m++)
4604                         printk(" %2.2x", smi_msg->data[m]);
4605                 printk("\n");
4606         }
4607 #endif
4608         return smi_msg;
4609 }
4610
4611 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
4612                               struct list_head *timeouts,
4613                               unsigned long timeout_period,
4614                               int slot, unsigned long *flags,
4615                               unsigned int *waiting_msgs)
4616 {
4617         struct ipmi_recv_msg     *msg;
4618         const struct ipmi_smi_handlers *handlers;
4619
4620         if (intf->in_shutdown)
4621                 return;
4622
4623         if (!ent->inuse)
4624                 return;
4625
4626         if (timeout_period < ent->timeout) {
4627                 ent->timeout -= timeout_period;
4628                 (*waiting_msgs)++;
4629                 return;
4630         }
4631
4632         if (ent->retries_left == 0) {
4633                 /* The message has used all its retries. */
4634                 ent->inuse = 0;
4635                 msg = ent->recv_msg;
4636                 list_add_tail(&msg->link, timeouts);
4637                 if (ent->broadcast)
4638                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4639                 else if (is_lan_addr(&ent->recv_msg->addr))
4640                         ipmi_inc_stat(intf, timed_out_lan_commands);
4641                 else
4642                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4643         } else {
4644                 struct ipmi_smi_msg *smi_msg;
4645                 /* More retries, send again. */
4646
4647                 (*waiting_msgs)++;
4648
4649                 /*
4650                  * Start with the max timer, set to normal timer after
4651                  * the message is sent.
4652                  */
4653                 ent->timeout = MAX_MSG_TIMEOUT;
4654                 ent->retries_left--;
4655                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4656                                             ent->seqid);
4657                 if (!smi_msg) {
4658                         if (is_lan_addr(&ent->recv_msg->addr))
4659                                 ipmi_inc_stat(intf,
4660                                               dropped_rexmit_lan_commands);
4661                         else
4662                                 ipmi_inc_stat(intf,
4663                                               dropped_rexmit_ipmb_commands);
4664                         return;
4665                 }
4666
4667                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4668
4669                 /*
4670                  * Send the new message.  We send with a zero
4671                  * priority.  It timed out, I doubt time is that
4672                  * critical now, and high priority messages are really
4673                  * only for messages to the local MC, which don't get
4674                  * resent.
4675                  */
4676                 handlers = intf->handlers;
4677                 if (handlers) {
4678                         if (is_lan_addr(&ent->recv_msg->addr))
4679                                 ipmi_inc_stat(intf,
4680                                               retransmitted_lan_commands);
4681                         else
4682                                 ipmi_inc_stat(intf,
4683                                               retransmitted_ipmb_commands);
4684
4685                         smi_send(intf, handlers, smi_msg, 0);
4686                 } else
4687                         ipmi_free_smi_msg(smi_msg);
4688
4689                 spin_lock_irqsave(&intf->seq_lock, *flags);
4690         }
4691 }
4692
4693 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf,
4694                                          unsigned long timeout_period)
4695 {
4696         struct list_head     timeouts;
4697         struct ipmi_recv_msg *msg, *msg2;
4698         unsigned long        flags;
4699         int                  i;
4700         unsigned int         waiting_msgs = 0;
4701
4702         if (!intf->bmc_registered) {
4703                 kref_get(&intf->refcount);
4704                 if (!schedule_work(&intf->bmc_reg_work)) {
4705                         kref_put(&intf->refcount, intf_free);
4706                         waiting_msgs++;
4707                 }
4708         }
4709
4710         /*
4711          * Go through the seq table and find any messages that
4712          * have timed out, putting them in the timeouts
4713          * list.
4714          */
4715         INIT_LIST_HEAD(&timeouts);
4716         spin_lock_irqsave(&intf->seq_lock, flags);
4717         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4718                 check_msg_timeout(intf, &(intf->seq_table[i]),
4719                                   &timeouts, timeout_period, i,
4720                                   &flags, &waiting_msgs);
4721         spin_unlock_irqrestore(&intf->seq_lock, flags);
4722
4723         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4724                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4725
4726         /*
4727          * Maintenance mode handling.  Check the timeout
4728          * optimistically before we claim the lock.  It may
4729          * mean a timeout gets missed occasionally, but that
4730          * only means the timeout gets extended by one period
4731          * in that case.  No big deal, and it avoids the lock
4732          * most of the time.
4733          */
4734         if (intf->auto_maintenance_timeout > 0) {
4735                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4736                 if (intf->auto_maintenance_timeout > 0) {
4737                         intf->auto_maintenance_timeout
4738                                 -= timeout_period;
4739                         if (!intf->maintenance_mode
4740                             && (intf->auto_maintenance_timeout <= 0)) {
4741                                 intf->maintenance_mode_enable = false;
4742                                 maintenance_mode_update(intf);
4743                         }
4744                 }
4745                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4746                                        flags);
4747         }
4748
4749         tasklet_schedule(&intf->recv_tasklet);
4750
4751         return waiting_msgs;
4752 }
4753
4754 static void ipmi_request_event(ipmi_smi_t intf)
4755 {
4756         /* No event requests when in maintenance mode. */
4757         if (intf->maintenance_mode_enable)
4758                 return;
4759
4760         if (!intf->in_shutdown)
4761                 intf->handlers->request_events(intf->send_info);
4762 }
4763
4764 static struct timer_list ipmi_timer;
4765
4766 static atomic_t stop_operation;
4767
4768 static void ipmi_timeout(struct timer_list *unused)
4769 {
4770         ipmi_smi_t intf;
4771         int nt = 0;
4772
4773         if (atomic_read(&stop_operation))
4774                 return;
4775
4776         rcu_read_lock();
4777         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4778                 int lnt = 0;
4779
4780                 if (atomic_read(&intf->event_waiters)) {
4781                         intf->ticks_to_req_ev--;
4782                         if (intf->ticks_to_req_ev == 0) {
4783                                 ipmi_request_event(intf);
4784                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4785                         }
4786                         lnt++;
4787                 }
4788
4789                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4790
4791                 lnt = !!lnt;
4792                 if (lnt != intf->last_needs_timer &&
4793                                         intf->handlers->set_need_watch)
4794                         intf->handlers->set_need_watch(intf->send_info, lnt);
4795                 intf->last_needs_timer = lnt;
4796
4797                 nt += lnt;
4798         }
4799         rcu_read_unlock();
4800
4801         if (nt)
4802                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4803 }
4804
4805 static void need_waiter(ipmi_smi_t intf)
4806 {
4807         /* Racy, but worst case we start the timer twice. */
4808         if (!timer_pending(&ipmi_timer))
4809                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4810 }
4811
4812 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4813 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4814
4815 static void free_smi_msg(struct ipmi_smi_msg *msg)
4816 {
4817         atomic_dec(&smi_msg_inuse_count);
4818         kfree(msg);
4819 }
4820
4821 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4822 {
4823         struct ipmi_smi_msg *rv;
4824         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4825         if (rv) {
4826                 rv->done = free_smi_msg;
4827                 rv->user_data = NULL;
4828                 atomic_inc(&smi_msg_inuse_count);
4829         }
4830         return rv;
4831 }
4832 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4833
4834 static void free_recv_msg(struct ipmi_recv_msg *msg)
4835 {
4836         atomic_dec(&recv_msg_inuse_count);
4837         kfree(msg);
4838 }
4839
4840 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4841 {
4842         struct ipmi_recv_msg *rv;
4843
4844         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4845         if (rv) {
4846                 rv->user = NULL;
4847                 rv->done = free_recv_msg;
4848                 atomic_inc(&recv_msg_inuse_count);
4849         }
4850         return rv;
4851 }
4852
4853 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4854 {
4855         if (msg->user)
4856                 kref_put(&msg->user->refcount, free_user);
4857         msg->done(msg);
4858 }
4859 EXPORT_SYMBOL(ipmi_free_recv_msg);
4860
4861 static atomic_t panic_done_count = ATOMIC_INIT(0);
4862
4863 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4864 {
4865         atomic_dec(&panic_done_count);
4866 }
4867
4868 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4869 {
4870         atomic_dec(&panic_done_count);
4871 }
4872
4873 /*
4874  * Inside a panic, send a message and wait for a response.
4875  */
4876 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4877                                         struct ipmi_addr     *addr,
4878                                         struct kernel_ipmi_msg *msg)
4879 {
4880         struct ipmi_smi_msg  smi_msg;
4881         struct ipmi_recv_msg recv_msg;
4882         int rv;
4883
4884         smi_msg.done = dummy_smi_done_handler;
4885         recv_msg.done = dummy_recv_done_handler;
4886         atomic_add(2, &panic_done_count);
4887         rv = i_ipmi_request(NULL,
4888                             intf,
4889                             addr,
4890                             0,
4891                             msg,
4892                             intf,
4893                             &smi_msg,
4894                             &recv_msg,
4895                             0,
4896                             intf->addrinfo[0].address,
4897                             intf->addrinfo[0].lun,
4898                             0, 1); /* Don't retry, and don't wait. */
4899         if (rv)
4900                 atomic_sub(2, &panic_done_count);
4901         else if (intf->handlers->flush_messages)
4902                 intf->handlers->flush_messages(intf->send_info);
4903
4904         while (atomic_read(&panic_done_count) != 0)
4905                 ipmi_poll(intf);
4906 }
4907
4908 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4909 {
4910         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4911             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4912             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4913             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4914                 /* A get event receiver command, save it. */
4915                 intf->event_receiver = msg->msg.data[1];
4916                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4917         }
4918 }
4919
4920 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4921 {
4922         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4923             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4924             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4925             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4926                 /*
4927                  * A get device id command, save if we are an event
4928                  * receiver or generator.
4929                  */
4930                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4931                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4932         }
4933 }
4934
4935 static void send_panic_events(char *str)
4936 {
4937         struct kernel_ipmi_msg            msg;
4938         ipmi_smi_t                        intf;
4939         unsigned char                     data[16];
4940         struct ipmi_system_interface_addr *si;
4941         struct ipmi_addr                  addr;
4942
4943         if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE)
4944                 return;
4945
4946         si = (struct ipmi_system_interface_addr *) &addr;
4947         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4948         si->channel = IPMI_BMC_CHANNEL;
4949         si->lun = 0;
4950
4951         /* Fill in an event telling that we have failed. */
4952         msg.netfn = 0x04; /* Sensor or Event. */
4953         msg.cmd = 2; /* Platform event command. */
4954         msg.data = data;
4955         msg.data_len = 8;
4956         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4957         data[1] = 0x03; /* This is for IPMI 1.0. */
4958         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4959         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4960         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4961
4962         /*
4963          * Put a few breadcrumbs in.  Hopefully later we can add more things
4964          * to make the panic events more useful.
4965          */
4966         if (str) {
4967                 data[3] = str[0];
4968                 data[6] = str[1];
4969                 data[7] = str[2];
4970         }
4971
4972         /* For every registered interface, send the event. */
4973         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4974                 if (!intf->handlers || !intf->handlers->poll)
4975                         /* Interface is not ready or can't run at panic time. */
4976                         continue;
4977
4978                 /* Send the event announcing the panic. */
4979                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4980         }
4981
4982         /*
4983          * On every interface, dump a bunch of OEM event holding the
4984          * string.
4985          */
4986         if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str)
4987                 return;
4988
4989         /* For every registered interface, send the event. */
4990         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4991                 char                  *p = str;
4992                 struct ipmi_ipmb_addr *ipmb;
4993                 int                   j;
4994
4995                 if (intf->intf_num == -1)
4996                         /* Interface was not ready yet. */
4997                         continue;
4998
4999                 /*
5000                  * intf_num is used as an marker to tell if the
5001                  * interface is valid.  Thus we need a read barrier to
5002                  * make sure data fetched before checking intf_num
5003                  * won't be used.
5004                  */
5005                 smp_rmb();
5006
5007                 /*
5008                  * First job here is to figure out where to send the
5009                  * OEM events.  There's no way in IPMI to send OEM
5010                  * events using an event send command, so we have to
5011                  * find the SEL to put them in and stick them in
5012                  * there.
5013                  */
5014
5015                 /* Get capabilities from the get device id. */
5016                 intf->local_sel_device = 0;
5017                 intf->local_event_generator = 0;
5018                 intf->event_receiver = 0;
5019
5020                 /* Request the device info from the local MC. */
5021                 msg.netfn = IPMI_NETFN_APP_REQUEST;
5022                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
5023                 msg.data = NULL;
5024                 msg.data_len = 0;
5025                 intf->null_user_handler = device_id_fetcher;
5026                 ipmi_panic_request_and_wait(intf, &addr, &msg);
5027
5028                 if (intf->local_event_generator) {
5029                         /* Request the event receiver from the local MC. */
5030                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
5031                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
5032                         msg.data = NULL;
5033                         msg.data_len = 0;
5034                         intf->null_user_handler = event_receiver_fetcher;
5035                         ipmi_panic_request_and_wait(intf, &addr, &msg);
5036                 }
5037                 intf->null_user_handler = NULL;
5038
5039                 /*
5040                  * Validate the event receiver.  The low bit must not
5041                  * be 1 (it must be a valid IPMB address), it cannot
5042                  * be zero, and it must not be my address.
5043                  */
5044                 if (((intf->event_receiver & 1) == 0)
5045                     && (intf->event_receiver != 0)
5046                     && (intf->event_receiver != intf->addrinfo[0].address)) {
5047                         /*
5048                          * The event receiver is valid, send an IPMB
5049                          * message.
5050                          */
5051                         ipmb = (struct ipmi_ipmb_addr *) &addr;
5052                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
5053                         ipmb->channel = 0; /* FIXME - is this right? */
5054                         ipmb->lun = intf->event_receiver_lun;
5055                         ipmb->slave_addr = intf->event_receiver;
5056                 } else if (intf->local_sel_device) {
5057                         /*
5058                          * The event receiver was not valid (or was
5059                          * me), but I am an SEL device, just dump it
5060                          * in my SEL.
5061                          */
5062                         si = (struct ipmi_system_interface_addr *) &addr;
5063                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
5064                         si->channel = IPMI_BMC_CHANNEL;
5065                         si->lun = 0;
5066                 } else
5067                         continue; /* No where to send the event. */
5068
5069                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
5070                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
5071                 msg.data = data;
5072                 msg.data_len = 16;
5073
5074                 j = 0;
5075                 while (*p) {
5076                         int size = strlen(p);
5077
5078                         if (size > 11)
5079                                 size = 11;
5080                         data[0] = 0;
5081                         data[1] = 0;
5082                         data[2] = 0xf0; /* OEM event without timestamp. */
5083                         data[3] = intf->addrinfo[0].address;
5084                         data[4] = j++; /* sequence # */
5085                         /*
5086                          * Always give 11 bytes, so strncpy will fill
5087                          * it with zeroes for me.
5088                          */
5089                         strncpy(data+5, p, 11);
5090                         p += size;
5091
5092                         ipmi_panic_request_and_wait(intf, &addr, &msg);
5093                 }
5094         }
5095 }
5096
5097 static int has_panicked;
5098
5099 static int panic_event(struct notifier_block *this,
5100                        unsigned long         event,
5101                        void                  *ptr)
5102 {
5103         ipmi_smi_t intf;
5104
5105         if (has_panicked)
5106                 return NOTIFY_DONE;
5107         has_panicked = 1;
5108
5109         /* For every registered interface, set it to run to completion. */
5110         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
5111                 if (!intf->handlers)
5112                         /* Interface is not ready. */
5113                         continue;
5114
5115                 /*
5116                  * If we were interrupted while locking xmit_msgs_lock or
5117                  * waiting_rcv_msgs_lock, the corresponding list may be
5118                  * corrupted.  In this case, drop items on the list for
5119                  * the safety.
5120                  */
5121                 if (!spin_trylock(&intf->xmit_msgs_lock)) {
5122                         INIT_LIST_HEAD(&intf->xmit_msgs);
5123                         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
5124                 } else
5125                         spin_unlock(&intf->xmit_msgs_lock);
5126
5127                 if (!spin_trylock(&intf->waiting_rcv_msgs_lock))
5128                         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
5129                 else
5130                         spin_unlock(&intf->waiting_rcv_msgs_lock);
5131
5132                 intf->run_to_completion = 1;
5133                 if (intf->handlers->set_run_to_completion)
5134                         intf->handlers->set_run_to_completion(intf->send_info,
5135                                                               1);
5136         }
5137
5138         send_panic_events(ptr);
5139
5140         return NOTIFY_DONE;
5141 }
5142
5143 static struct notifier_block panic_block = {
5144         .notifier_call  = panic_event,
5145         .next           = NULL,
5146         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
5147 };
5148
5149 static int ipmi_init_msghandler(void)
5150 {
5151         int rv;
5152
5153         if (initialized)
5154                 return 0;
5155
5156         rv = driver_register(&ipmidriver.driver);
5157         if (rv) {
5158                 pr_err(PFX "Could not register IPMI driver\n");
5159                 return rv;
5160         }
5161
5162         pr_info("ipmi message handler version " IPMI_DRIVER_VERSION "\n");
5163
5164 #ifdef CONFIG_IPMI_PROC_INTERFACE
5165         proc_ipmi_root = proc_mkdir("ipmi", NULL);
5166         if (!proc_ipmi_root) {
5167             pr_err(PFX "Unable to create IPMI proc dir");
5168             driver_unregister(&ipmidriver.driver);
5169             return -ENOMEM;
5170         }
5171
5172 #endif /* CONFIG_IPMI_PROC_INTERFACE */
5173
5174         timer_setup(&ipmi_timer, ipmi_timeout, 0);
5175         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
5176
5177         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
5178
5179         initialized = 1;
5180
5181         return 0;
5182 }
5183
5184 static int __init ipmi_init_msghandler_mod(void)
5185 {
5186         ipmi_init_msghandler();
5187         return 0;
5188 }
5189
5190 static void __exit cleanup_ipmi(void)
5191 {
5192         int count;
5193
5194         if (!initialized)
5195                 return;
5196
5197         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
5198
5199         /*
5200          * This can't be called if any interfaces exist, so no worry
5201          * about shutting down the interfaces.
5202          */
5203
5204         /*
5205          * Tell the timer to stop, then wait for it to stop.  This
5206          * avoids problems with race conditions removing the timer
5207          * here.
5208          */
5209         atomic_inc(&stop_operation);
5210         del_timer_sync(&ipmi_timer);
5211
5212 #ifdef CONFIG_IPMI_PROC_INTERFACE
5213         proc_remove(proc_ipmi_root);
5214 #endif /* CONFIG_IPMI_PROC_INTERFACE */
5215
5216         driver_unregister(&ipmidriver.driver);
5217
5218         initialized = 0;
5219
5220         /* Check for buffer leaks. */
5221         count = atomic_read(&smi_msg_inuse_count);
5222         if (count != 0)
5223                 pr_warn(PFX "SMI message count %d at exit\n", count);
5224         count = atomic_read(&recv_msg_inuse_count);
5225         if (count != 0)
5226                 pr_warn(PFX "recv message count %d at exit\n", count);
5227 }
5228 module_exit(cleanup_ipmi);
5229
5230 module_init(ipmi_init_msghandler_mod);
5231 MODULE_LICENSE("GPL");
5232 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
5233 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
5234                    " interface.");
5235 MODULE_VERSION(IPMI_DRIVER_VERSION);
5236 MODULE_SOFTDEP("post: ipmi_devintf");