drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49
  50 #define PFX "IPMI message handler: "
  51
  52 #define IPMI_DRIVER_VERSION "39.2"
  53
  54 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  55 static int ipmi_init_msghandler(void);
  56 static void smi_recv_tasklet(unsigned long);
  57 static void handle_new_recv_msgs(ipmi_smi_t intf);
  58 static void need_waiter(ipmi_smi_t intf);
  59 static int handle_one_recv_msg(ipmi_smi_t          intf,
  60                                struct ipmi_smi_msg *msg);
  61
  62 static int initialized;
  63
  64 #ifdef CONFIG_PROC_FS
  65 static struct proc_dir_entry *proc_ipmi_root;
  66 #endif /* CONFIG_PROC_FS */
  67
  68 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  69 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  70
  71 #define MAX_EVENTS_IN_QUEUE     25
  72
  73 /*
  74  * Don't let a message sit in a queue forever, always time it with at lest
  75  * the max message timer.  This is in milliseconds.
  76  */
  77 #define MAX_MSG_TIMEOUT         60000
  78
  79 /* Call every ~1000 ms. */
  80 #define IPMI_TIMEOUT_TIME       1000
  81
  82 /* How many jiffies does it take to get to the timeout time. */
  83 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
  84
  85 /*
  86  * Request events from the queue every second (this is the number of
  87  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
  88  * future, IPMI will add a way to know immediately if an event is in
  89  * the queue and this silliness can go away.
  90  */
  91 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
  92
  93 /*
  94  * The main "user" data structure.
  95  */
  96 struct ipmi_user {
  97         struct list_head link;
  98
  99         /* Set to false when the user is destroyed. */
 100         bool valid;
 101
 102         struct kref refcount;
 103
 104         /* The upper layer that handles receive messages. */
 105         struct ipmi_user_hndl *handler;
 106         void             *handler_data;
 107
 108         /* The interface this user is bound to. */
 109         ipmi_smi_t intf;
 110
 111         /* Does this interface receive IPMI events? */
 112         bool gets_events;
 113 };
 114
 115 struct cmd_rcvr {
 116         struct list_head link;
 117
 118         ipmi_user_t   user;
 119         unsigned char netfn;
 120         unsigned char cmd;
 121         unsigned int  chans;
 122
 123         /*
 124          * This is used to form a linked lised during mass deletion.
 125          * Since this is in an RCU list, we cannot use the link above
 126          * or change any data until the RCU period completes.  So we
 127          * use this next variable during mass deletion so we can have
 128          * a list and don't have to wait and restart the search on
 129          * every individual deletion of a command.
 130          */
 131         struct cmd_rcvr *next;
 132 };
 133
 134 struct seq_table {
 135         unsigned int         inuse : 1;
 136         unsigned int         broadcast : 1;
 137
 138         unsigned long        timeout;
 139         unsigned long        orig_timeout;
 140         unsigned int         retries_left;
 141
 142         /*
 143          * To verify on an incoming send message response that this is
 144          * the message that the response is for, we keep a sequence id
 145          * and increment it every time we send a message.
 146          */
 147         long                 seqid;
 148
 149         /*
 150          * This is held so we can properly respond to the message on a
 151          * timeout, and it is used to hold the temporary data for
 152          * retransmission, too.
 153          */
 154         struct ipmi_recv_msg *recv_msg;
 155 };
 156
 157 /*
 158  * Store the information in a msgid (long) to allow us to find a
 159  * sequence table entry from the msgid.
 160  */
 161 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 162
 163 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 164         do {                                                            \
 165                 seq = ((msgid >> 26) & 0x3f);                           \
 166                 seqid = (msgid & 0x3fffff);                             \
 167         } while (0)
 168
 169 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 170
 171 struct ipmi_channel {
 172         unsigned char medium;
 173         unsigned char protocol;
 174
 175         /*
 176          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 177          * but may be changed by the user.
 178          */
 179         unsigned char address;
 180
 181         /*
 182          * My LUN.  This should generally stay the SMS LUN, but just in
 183          * case...
 184          */
 185         unsigned char lun;
 186 };
 187
 188 #ifdef CONFIG_PROC_FS
 189 struct ipmi_proc_entry {
 190         char                   *name;
 191         struct ipmi_proc_entry *next;
 192 };
 193 #endif
 194
 195 struct bmc_device {
 196         struct platform_device pdev;
 197         struct ipmi_device_id  id;
 198         unsigned char          guid[16];
 199         int                    guid_set;
 200         char                   name[16];
 201         struct kref            usecount;
 202 };
 203 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 204
 205 /*
 206  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 207  * structure.
 208  */
 209 enum ipmi_stat_indexes {
 210         /* Commands we got from the user that were invalid. */
 211         IPMI_STAT_sent_invalid_commands = 0,
 212
 213         /* Commands we sent to the MC. */
 214         IPMI_STAT_sent_local_commands,
 215
 216         /* Responses from the MC that were delivered to a user. */
 217         IPMI_STAT_handled_local_responses,
 218
 219         /* Responses from the MC that were not delivered to a user. */
 220         IPMI_STAT_unhandled_local_responses,
 221
 222         /* Commands we sent out to the IPMB bus. */
 223         IPMI_STAT_sent_ipmb_commands,
 224
 225         /* Commands sent on the IPMB that had errors on the SEND CMD */
 226         IPMI_STAT_sent_ipmb_command_errs,
 227
 228         /* Each retransmit increments this count. */
 229         IPMI_STAT_retransmitted_ipmb_commands,
 230
 231         /*
 232          * When a message times out (runs out of retransmits) this is
 233          * incremented.
 234          */
 235         IPMI_STAT_timed_out_ipmb_commands,
 236
 237         /*
 238          * This is like above, but for broadcasts.  Broadcasts are
 239          * *not* included in the above count (they are expected to
 240          * time out).
 241          */
 242         IPMI_STAT_timed_out_ipmb_broadcasts,
 243
 244         /* Responses I have sent to the IPMB bus. */
 245         IPMI_STAT_sent_ipmb_responses,
 246
 247         /* The response was delivered to the user. */
 248         IPMI_STAT_handled_ipmb_responses,
 249
 250         /* The response had invalid data in it. */
 251         IPMI_STAT_invalid_ipmb_responses,
 252
 253         /* The response didn't have anyone waiting for it. */
 254         IPMI_STAT_unhandled_ipmb_responses,
 255
 256         /* Commands we sent out to the IPMB bus. */
 257         IPMI_STAT_sent_lan_commands,
 258
 259         /* Commands sent on the IPMB that had errors on the SEND CMD */
 260         IPMI_STAT_sent_lan_command_errs,
 261
 262         /* Each retransmit increments this count. */
 263         IPMI_STAT_retransmitted_lan_commands,
 264
 265         /*
 266          * When a message times out (runs out of retransmits) this is
 267          * incremented.
 268          */
 269         IPMI_STAT_timed_out_lan_commands,
 270
 271         /* Responses I have sent to the IPMB bus. */
 272         IPMI_STAT_sent_lan_responses,
 273
 274         /* The response was delivered to the user. */
 275         IPMI_STAT_handled_lan_responses,
 276
 277         /* The response had invalid data in it. */
 278         IPMI_STAT_invalid_lan_responses,
 279
 280         /* The response didn't have anyone waiting for it. */
 281         IPMI_STAT_unhandled_lan_responses,
 282
 283         /* The command was delivered to the user. */
 284         IPMI_STAT_handled_commands,
 285
 286         /* The command had invalid data in it. */
 287         IPMI_STAT_invalid_commands,
 288
 289         /* The command didn't have anyone waiting for it. */
 290         IPMI_STAT_unhandled_commands,
 291
 292         /* Invalid data in an event. */
 293         IPMI_STAT_invalid_events,
 294
 295         /* Events that were received with the proper format. */
 296         IPMI_STAT_events,
 297
 298         /* Retransmissions on IPMB that failed. */
 299         IPMI_STAT_dropped_rexmit_ipmb_commands,
 300
 301         /* Retransmissions on LAN that failed. */
 302         IPMI_STAT_dropped_rexmit_lan_commands,
 303
 304         /* This *must* remain last, add new values above this. */
 305         IPMI_NUM_STATS
 306 };
 307
 308
 309 #define IPMI_IPMB_NUM_SEQ       64
 310 #define IPMI_MAX_CHANNELS       16
 311 struct ipmi_smi {
 312         /* What interface number are we? */
 313         int intf_num;
 314
 315         struct kref refcount;
 316
 317         /* Set when the interface is being unregistered. */
 318         bool in_shutdown;
 319
 320         /* Used for a list of interfaces. */
 321         struct list_head link;
 322
 323         /*
 324          * The list of upper layers that are using me.  seq_lock
 325          * protects this.
 326          */
 327         struct list_head users;
 328
 329         /* Information to supply to users. */
 330         unsigned char ipmi_version_major;
 331         unsigned char ipmi_version_minor;
 332
 333         /* Used for wake ups at startup. */
 334         wait_queue_head_t waitq;
 335
 336         struct bmc_device *bmc;
 337         char *my_dev_name;
 338
 339         /*
 340          * This is the lower-layer's sender routine.  Note that you
 341          * must either be holding the ipmi_interfaces_mutex or be in
 342          * an umpreemptible region to use this.  You must fetch the
 343          * value into a local variable and make sure it is not NULL.
 344          */
 345         const struct ipmi_smi_handlers *handlers;
 346         void                     *send_info;
 347
 348 #ifdef CONFIG_PROC_FS
 349         /* A list of proc entries for this interface. */
 350         struct mutex           proc_entry_lock;
 351         struct ipmi_proc_entry *proc_entries;
 352 #endif
 353
 354         /* Driver-model device for the system interface. */
 355         struct device          *si_dev;
 356
 357         /*
 358          * A table of sequence numbers for this interface.  We use the
 359          * sequence numbers for IPMB messages that go out of the
 360          * interface to match them up with their responses.  A routine
 361          * is called periodically to time the items in this list.
 362          */
 363         spinlock_t       seq_lock;
 364         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 365         int curr_seq;
 366
 367         /*
 368          * Messages queued for delivery.  If delivery fails (out of memory
 369          * for instance), They will stay in here to be processed later in a
 370          * periodic timer interrupt.  The tasklet is for handling received
 371          * messages directly from the handler.
 372          */
 373         spinlock_t       waiting_rcv_msgs_lock;
 374         struct list_head waiting_rcv_msgs;
 375         atomic_t         watchdog_pretimeouts_to_deliver;
 376         struct tasklet_struct recv_tasklet;
 377
 378         spinlock_t             xmit_msgs_lock;
 379         struct list_head       xmit_msgs;
 380         struct ipmi_smi_msg    *curr_msg;
 381         struct list_head       hp_xmit_msgs;
 382
 383         /*
 384          * The list of command receivers that are registered for commands
 385          * on this interface.
 386          */
 387         struct mutex     cmd_rcvrs_mutex;
 388         struct list_head cmd_rcvrs;
 389
 390         /*
 391          * Events that were queues because no one was there to receive
 392          * them.
 393          */
 394         spinlock_t       events_lock; /* For dealing with event stuff. */
 395         struct list_head waiting_events;
 396         unsigned int     waiting_events_count; /* How many events in queue? */
 397         char             delivering_events;
 398         char             event_msg_printed;
 399         atomic_t         event_waiters;
 400         unsigned int     ticks_to_req_ev;
 401         int              last_needs_timer;
 402
 403         /*
 404          * The event receiver for my BMC, only really used at panic
 405          * shutdown as a place to store this.
 406          */
 407         unsigned char event_receiver;
 408         unsigned char event_receiver_lun;
 409         unsigned char local_sel_device;
 410         unsigned char local_event_generator;
 411
 412         /* For handling of maintenance mode. */
 413         int maintenance_mode;
 414         bool maintenance_mode_enable;
 415         int auto_maintenance_timeout;
 416         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 417
 418         /*
 419          * A cheap hack, if this is non-null and a message to an
 420          * interface comes in with a NULL user, call this routine with
 421          * it.  Note that the message will still be freed by the
 422          * caller.  This only works on the system interface.
 423          */
 424         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 425
 426         /*
 427          * When we are scanning the channels for an SMI, this will
 428          * tell which channel we are scanning.
 429          */
 430         int curr_channel;
 431
 432         /* Channel information */
 433         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 434
 435         /* Proc FS stuff. */
 436         struct proc_dir_entry *proc_dir;
 437         char                  proc_dir_name[10];
 438
 439         atomic_t stats[IPMI_NUM_STATS];
 440
 441         /*
 442          * run_to_completion duplicate of smb_info, smi_info
 443          * and ipmi_serial_info structures. Used to decrease numbers of
 444          * parameters passed by "low" level IPMI code.
 445          */
 446         int run_to_completion;
 447 };
 448 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 449
 450 /**
 451  * The driver model view of the IPMI messaging driver.
 452  */
 453 static struct platform_driver ipmidriver = {
 454         .driver = {
 455                 .name = "ipmi",
 456                 .bus = &platform_bus_type
 457         }
 458 };
 459 static DEFINE_MUTEX(ipmidriver_mutex);
 460
 461 static LIST_HEAD(ipmi_interfaces);
 462 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 463
 464 /*
 465  * List of watchers that want to know when smi's are added and deleted.
 466  */
 467 static LIST_HEAD(smi_watchers);
 468 static DEFINE_MUTEX(smi_watchers_mutex);
 469
 470 #define ipmi_inc_stat(intf, stat) \
 471         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 472 #define ipmi_get_stat(intf, stat) \
 473         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 474
 475 static const char * const addr_src_to_str[] = {
 476         "invalid", "hotmod", "hardcoded", "SPMI", "ACPI", "SMBIOS", "PCI",
 477         "device-tree"
 478 };
 479
 480 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 481 {
 482         if (src >= SI_LAST)
 483                 src = 0; /* Invalid */
 484         return addr_src_to_str[src];
 485 }
 486 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 487
 488 static int is_lan_addr(struct ipmi_addr *addr)
 489 {
 490         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 491 }
 492
 493 static int is_ipmb_addr(struct ipmi_addr *addr)
 494 {
 495         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 496 }
 497
 498 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 499 {
 500         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 501 }
 502
 503 static void free_recv_msg_list(struct list_head *q)
 504 {
 505         struct ipmi_recv_msg *msg, *msg2;
 506
 507         list_for_each_entry_safe(msg, msg2, q, link) {
 508                 list_del(&msg->link);
 509                 ipmi_free_recv_msg(msg);
 510         }
 511 }
 512
 513 static void free_smi_msg_list(struct list_head *q)
 514 {
 515         struct ipmi_smi_msg *msg, *msg2;
 516
 517         list_for_each_entry_safe(msg, msg2, q, link) {
 518                 list_del(&msg->link);
 519                 ipmi_free_smi_msg(msg);
 520         }
 521 }
 522
 523 static void clean_up_interface_data(ipmi_smi_t intf)
 524 {
 525         int              i;
 526         struct cmd_rcvr  *rcvr, *rcvr2;
 527         struct list_head list;
 528
 529         tasklet_kill(&intf->recv_tasklet);
 530
 531         free_smi_msg_list(&intf->waiting_rcv_msgs);
 532         free_recv_msg_list(&intf->waiting_events);
 533
 534         /*
 535          * Wholesale remove all the entries from the list in the
 536          * interface and wait for RCU to know that none are in use.
 537          */
 538         mutex_lock(&intf->cmd_rcvrs_mutex);
 539         INIT_LIST_HEAD(&list);
 540         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 541         mutex_unlock(&intf->cmd_rcvrs_mutex);
 542
 543         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 544                 kfree(rcvr);
 545
 546         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 547                 if ((intf->seq_table[i].inuse)
 548                                         && (intf->seq_table[i].recv_msg))
 549                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 550         }
 551 }
 552
 553 static void intf_free(struct kref *ref)
 554 {
 555         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 556
 557         clean_up_interface_data(intf);
 558         kfree(intf);
 559 }
 560
 561 struct watcher_entry {
 562         int              intf_num;
 563         ipmi_smi_t       intf;
 564         struct list_head link;
 565 };
 566
 567 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 568 {
 569         ipmi_smi_t intf;
 570         LIST_HEAD(to_deliver);
 571         struct watcher_entry *e, *e2;
 572
 573         mutex_lock(&smi_watchers_mutex);
 574
 575         mutex_lock(&ipmi_interfaces_mutex);
 576
 577         /* Build a list of things to deliver. */
 578         list_for_each_entry(intf, &ipmi_interfaces, link) {
 579                 if (intf->intf_num == -1)
 580                         continue;
 581                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 582                 if (!e)
 583                         goto out_err;
 584                 kref_get(&intf->refcount);
 585                 e->intf = intf;
 586                 e->intf_num = intf->intf_num;
 587                 list_add_tail(&e->link, &to_deliver);
 588         }
 589
 590         /* We will succeed, so add it to the list. */
 591         list_add(&watcher->link, &smi_watchers);
 592
 593         mutex_unlock(&ipmi_interfaces_mutex);
 594
 595         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 596                 list_del(&e->link);
 597                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 598                 kref_put(&e->intf->refcount, intf_free);
 599                 kfree(e);
 600         }
 601
 602         mutex_unlock(&smi_watchers_mutex);
 603
 604         return 0;
 605
 606  out_err:
 607         mutex_unlock(&ipmi_interfaces_mutex);
 608         mutex_unlock(&smi_watchers_mutex);
 609         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 610                 list_del(&e->link);
 611                 kref_put(&e->intf->refcount, intf_free);
 612                 kfree(e);
 613         }
 614         return -ENOMEM;
 615 }
 616 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 617
 618 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 619 {
 620         mutex_lock(&smi_watchers_mutex);
 621         list_del(&(watcher->link));
 622         mutex_unlock(&smi_watchers_mutex);
 623         return 0;
 624 }
 625 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 626
 627 /*
 628  * Must be called with smi_watchers_mutex held.
 629  */
 630 static void
 631 call_smi_watchers(int i, struct device *dev)
 632 {
 633         struct ipmi_smi_watcher *w;
 634
 635         list_for_each_entry(w, &smi_watchers, link) {
 636                 if (try_module_get(w->owner)) {
 637                         w->new_smi(i, dev);
 638                         module_put(w->owner);
 639                 }
 640         }
 641 }
 642
 643 static int
 644 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 645 {
 646         if (addr1->addr_type != addr2->addr_type)
 647                 return 0;
 648
 649         if (addr1->channel != addr2->channel)
 650                 return 0;
 651
 652         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 653                 struct ipmi_system_interface_addr *smi_addr1
 654                     = (struct ipmi_system_interface_addr *) addr1;
 655                 struct ipmi_system_interface_addr *smi_addr2
 656                     = (struct ipmi_system_interface_addr *) addr2;
 657                 return (smi_addr1->lun == smi_addr2->lun);
 658         }
 659
 660         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 661                 struct ipmi_ipmb_addr *ipmb_addr1
 662                     = (struct ipmi_ipmb_addr *) addr1;
 663                 struct ipmi_ipmb_addr *ipmb_addr2
 664                     = (struct ipmi_ipmb_addr *) addr2;
 665
 666                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 667                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 668         }
 669
 670         if (is_lan_addr(addr1)) {
 671                 struct ipmi_lan_addr *lan_addr1
 672                         = (struct ipmi_lan_addr *) addr1;
 673                 struct ipmi_lan_addr *lan_addr2
 674                     = (struct ipmi_lan_addr *) addr2;
 675
 676                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 677                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 678                         && (lan_addr1->session_handle
 679                             == lan_addr2->session_handle)
 680                         && (lan_addr1->lun == lan_addr2->lun));
 681         }
 682
 683         return 1;
 684 }
 685
 686 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 687 {
 688         if (len < sizeof(struct ipmi_system_interface_addr))
 689                 return -EINVAL;
 690
 691         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 692                 if (addr->channel != IPMI_BMC_CHANNEL)
 693                         return -EINVAL;
 694                 return 0;
 695         }
 696
 697         if ((addr->channel == IPMI_BMC_CHANNEL)
 698             || (addr->channel >= IPMI_MAX_CHANNELS)
 699             || (addr->channel < 0))
 700                 return -EINVAL;
 701
 702         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 703                 if (len < sizeof(struct ipmi_ipmb_addr))
 704                         return -EINVAL;
 705                 return 0;
 706         }
 707
 708         if (is_lan_addr(addr)) {
 709                 if (len < sizeof(struct ipmi_lan_addr))
 710                         return -EINVAL;
 711                 return 0;
 712         }
 713
 714         return -EINVAL;
 715 }
 716 EXPORT_SYMBOL(ipmi_validate_addr);
 717
 718 unsigned int ipmi_addr_length(int addr_type)
 719 {
 720         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 721                 return sizeof(struct ipmi_system_interface_addr);
 722
 723         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 724                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 725                 return sizeof(struct ipmi_ipmb_addr);
 726
 727         if (addr_type == IPMI_LAN_ADDR_TYPE)
 728                 return sizeof(struct ipmi_lan_addr);
 729
 730         return 0;
 731 }
 732 EXPORT_SYMBOL(ipmi_addr_length);
 733
 734 static void deliver_response(struct ipmi_recv_msg *msg)
 735 {
 736         if (!msg->user) {
 737                 ipmi_smi_t    intf = msg->user_msg_data;
 738
 739                 /* Special handling for NULL users. */
 740                 if (intf->null_user_handler) {
 741                         intf->null_user_handler(intf, msg);
 742                         ipmi_inc_stat(intf, handled_local_responses);
 743                 } else {
 744                         /* No handler, so give up. */
 745                         ipmi_inc_stat(intf, unhandled_local_responses);
 746                 }
 747                 ipmi_free_recv_msg(msg);
 748         } else if (!oops_in_progress) {
 749                 /*
 750                  * If we are running in the panic context, calling the
 751                  * receive handler doesn't much meaning and has a deadlock
 752                  * risk.  At this moment, simply skip it in that case.
 753                  */
 754
 755                 ipmi_user_t user = msg->user;
 756                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 757         }
 758 }
 759
 760 static void
 761 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 762 {
 763         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 764         msg->msg_data[0] = err;
 765         msg->msg.netfn |= 1; /* Convert to a response. */
 766         msg->msg.data_len = 1;
 767         msg->msg.data = msg->msg_data;
 768         deliver_response(msg);
 769 }
 770
 771 /*
 772  * Find the next sequence number not being used and add the given
 773  * message with the given timeout to the sequence table.  This must be
 774  * called with the interface's seq_lock held.
 775  */
 776 static int intf_next_seq(ipmi_smi_t           intf,
 777                          struct ipmi_recv_msg *recv_msg,
 778                          unsigned long        timeout,
 779                          int                  retries,
 780                          int                  broadcast,
 781                          unsigned char        *seq,
 782                          long                 *seqid)
 783 {
 784         int          rv = 0;
 785         unsigned int i;
 786
 787         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 788                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 789                 if (!intf->seq_table[i].inuse)
 790                         break;
 791         }
 792
 793         if (!intf->seq_table[i].inuse) {
 794                 intf->seq_table[i].recv_msg = recv_msg;
 795
 796                 /*
 797                  * Start with the maximum timeout, when the send response
 798                  * comes in we will start the real timer.
 799                  */
 800                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 801                 intf->seq_table[i].orig_timeout = timeout;
 802                 intf->seq_table[i].retries_left = retries;
 803                 intf->seq_table[i].broadcast = broadcast;
 804                 intf->seq_table[i].inuse = 1;
 805                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 806                 *seq = i;
 807                 *seqid = intf->seq_table[i].seqid;
 808                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 809                 need_waiter(intf);
 810         } else {
 811                 rv = -EAGAIN;
 812         }
 813
 814         return rv;
 815 }
 816
 817 /*
 818  * Return the receive message for the given sequence number and
 819  * release the sequence number so it can be reused.  Some other data
 820  * is passed in to be sure the message matches up correctly (to help
 821  * guard against message coming in after their timeout and the
 822  * sequence number being reused).
 823  */
 824 static int intf_find_seq(ipmi_smi_t           intf,
 825                          unsigned char        seq,
 826                          short                channel,
 827                          unsigned char        cmd,
 828                          unsigned char        netfn,
 829                          struct ipmi_addr     *addr,
 830                          struct ipmi_recv_msg **recv_msg)
 831 {
 832         int           rv = -ENODEV;
 833         unsigned long flags;
 834
 835         if (seq >= IPMI_IPMB_NUM_SEQ)
 836                 return -EINVAL;
 837
 838         spin_lock_irqsave(&(intf->seq_lock), flags);
 839         if (intf->seq_table[seq].inuse) {
 840                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 841
 842                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 843                                 && (msg->msg.netfn == netfn)
 844                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 845                         *recv_msg = msg;
 846                         intf->seq_table[seq].inuse = 0;
 847                         rv = 0;
 848                 }
 849         }
 850         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 851
 852         return rv;
 853 }
 854
 855
 856 /* Start the timer for a specific sequence table entry. */
 857 static int intf_start_seq_timer(ipmi_smi_t intf,
 858                                 long       msgid)
 859 {
 860         int           rv = -ENODEV;
 861         unsigned long flags;
 862         unsigned char seq;
 863         unsigned long seqid;
 864
 865
 866         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 867
 868         spin_lock_irqsave(&(intf->seq_lock), flags);
 869         /*
 870          * We do this verification because the user can be deleted
 871          * while a message is outstanding.
 872          */
 873         if ((intf->seq_table[seq].inuse)
 874                                 && (intf->seq_table[seq].seqid == seqid)) {
 875                 struct seq_table *ent = &(intf->seq_table[seq]);
 876                 ent->timeout = ent->orig_timeout;
 877                 rv = 0;
 878         }
 879         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 880
 881         return rv;
 882 }
 883
 884 /* Got an error for the send message for a specific sequence number. */
 885 static int intf_err_seq(ipmi_smi_t   intf,
 886                         long         msgid,
 887                         unsigned int err)
 888 {
 889         int                  rv = -ENODEV;
 890         unsigned long        flags;
 891         unsigned char        seq;
 892         unsigned long        seqid;
 893         struct ipmi_recv_msg *msg = NULL;
 894
 895
 896         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 897
 898         spin_lock_irqsave(&(intf->seq_lock), flags);
 899         /*
 900          * We do this verification because the user can be deleted
 901          * while a message is outstanding.
 902          */
 903         if ((intf->seq_table[seq].inuse)
 904                                 && (intf->seq_table[seq].seqid == seqid)) {
 905                 struct seq_table *ent = &(intf->seq_table[seq]);
 906
 907                 ent->inuse = 0;
 908                 msg = ent->recv_msg;
 909                 rv = 0;
 910         }
 911         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 912
 913         if (msg)
 914                 deliver_err_response(msg, err);
 915
 916         return rv;
 917 }
 918
 919
 920 int ipmi_create_user(unsigned int          if_num,
 921                      struct ipmi_user_hndl *handler,
 922                      void                  *handler_data,
 923                      ipmi_user_t           *user)
 924 {
 925         unsigned long flags;
 926         ipmi_user_t   new_user;
 927         int           rv = 0;
 928         ipmi_smi_t    intf;
 929
 930         /*
 931          * There is no module usecount here, because it's not
 932          * required.  Since this can only be used by and called from
 933          * other modules, they will implicitly use this module, and
 934          * thus this can't be removed unless the other modules are
 935          * removed.
 936          */
 937
 938         if (handler == NULL)
 939                 return -EINVAL;
 940
 941         /*
 942          * Make sure the driver is actually initialized, this handles
 943          * problems with initialization order.
 944          */
 945         if (!initialized) {
 946                 rv = ipmi_init_msghandler();
 947                 if (rv)
 948                         return rv;
 949
 950                 /*
 951                  * The init code doesn't return an error if it was turned
 952                  * off, but it won't initialize.  Check that.
 953                  */
 954                 if (!initialized)
 955                         return -ENODEV;
 956         }
 957
 958         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 959         if (!new_user)
 960                 return -ENOMEM;
 961
 962         mutex_lock(&ipmi_interfaces_mutex);
 963         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 964                 if (intf->intf_num == if_num)
 965                         goto found;
 966         }
 967         /* Not found, return an error */
 968         rv = -EINVAL;
 969         goto out_kfree;
 970
 971  found:
 972         /* Note that each existing user holds a refcount to the interface. */
 973         kref_get(&intf->refcount);
 974
 975         kref_init(&new_user->refcount);
 976         new_user->handler = handler;
 977         new_user->handler_data = handler_data;
 978         new_user->intf = intf;
 979         new_user->gets_events = false;
 980
 981         if (!try_module_get(intf->handlers->owner)) {
 982                 rv = -ENODEV;
 983                 goto out_kref;
 984         }
 985
 986         if (intf->handlers->inc_usecount) {
 987                 rv = intf->handlers->inc_usecount(intf->send_info);
 988                 if (rv) {
 989                         module_put(intf->handlers->owner);
 990                         goto out_kref;
 991                 }
 992         }
 993
 994         /*
 995          * Hold the lock so intf->handlers is guaranteed to be good
 996          * until now
 997          */
 998         mutex_unlock(&ipmi_interfaces_mutex);
 999
1000         new_user->valid = true;
1001         spin_lock_irqsave(&intf->seq_lock, flags);
1002         list_add_rcu(&new_user->link, &intf->users);
1003         spin_unlock_irqrestore(&intf->seq_lock, flags);
1004         if (handler->ipmi_watchdog_pretimeout) {
1005                 /* User wants pretimeouts, so make sure to watch for them. */
1006                 if (atomic_inc_return(&intf->event_waiters) == 1)
1007                         need_waiter(intf);
1008         }
1009         *user = new_user;
1010         return 0;
1011
1012 out_kref:
1013         kref_put(&intf->refcount, intf_free);
1014 out_kfree:
1015         mutex_unlock(&ipmi_interfaces_mutex);
1016         kfree(new_user);
1017         return rv;
1018 }
1019 EXPORT_SYMBOL(ipmi_create_user);
1020
1021 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1022 {
1023         int           rv = 0;
1024         ipmi_smi_t    intf;
1025         const struct ipmi_smi_handlers *handlers;
1026
1027         mutex_lock(&ipmi_interfaces_mutex);
1028         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1029                 if (intf->intf_num == if_num)
1030                         goto found;
1031         }
1032         /* Not found, return an error */
1033         rv = -EINVAL;
1034         mutex_unlock(&ipmi_interfaces_mutex);
1035         return rv;
1036
1037 found:
1038         handlers = intf->handlers;
1039         rv = -ENOSYS;
1040         if (handlers->get_smi_info)
1041                 rv = handlers->get_smi_info(intf->send_info, data);
1042         mutex_unlock(&ipmi_interfaces_mutex);
1043
1044         return rv;
1045 }
1046 EXPORT_SYMBOL(ipmi_get_smi_info);
1047
1048 static void free_user(struct kref *ref)
1049 {
1050         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1051         kfree(user);
1052 }
1053
1054 int ipmi_destroy_user(ipmi_user_t user)
1055 {
1056         ipmi_smi_t       intf = user->intf;
1057         int              i;
1058         unsigned long    flags;
1059         struct cmd_rcvr  *rcvr;
1060         struct cmd_rcvr  *rcvrs = NULL;
1061
1062         user->valid = false;
1063
1064         if (user->handler->ipmi_watchdog_pretimeout)
1065                 atomic_dec(&intf->event_waiters);
1066
1067         if (user->gets_events)
1068                 atomic_dec(&intf->event_waiters);
1069
1070         /* Remove the user from the interface's sequence table. */
1071         spin_lock_irqsave(&intf->seq_lock, flags);
1072         list_del_rcu(&user->link);
1073
1074         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1075                 if (intf->seq_table[i].inuse
1076                     && (intf->seq_table[i].recv_msg->user == user)) {
1077                         intf->seq_table[i].inuse = 0;
1078                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1079                 }
1080         }
1081         spin_unlock_irqrestore(&intf->seq_lock, flags);
1082
1083         /*
1084          * Remove the user from the command receiver's table.  First
1085          * we build a list of everything (not using the standard link,
1086          * since other things may be using it till we do
1087          * synchronize_rcu()) then free everything in that list.
1088          */
1089         mutex_lock(&intf->cmd_rcvrs_mutex);
1090         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1091                 if (rcvr->user == user) {
1092                         list_del_rcu(&rcvr->link);
1093                         rcvr->next = rcvrs;
1094                         rcvrs = rcvr;
1095                 }
1096         }
1097         mutex_unlock(&intf->cmd_rcvrs_mutex);
1098         synchronize_rcu();
1099         while (rcvrs) {
1100                 rcvr = rcvrs;
1101                 rcvrs = rcvr->next;
1102                 kfree(rcvr);
1103         }
1104
1105         mutex_lock(&ipmi_interfaces_mutex);
1106         if (intf->handlers) {
1107                 module_put(intf->handlers->owner);
1108                 if (intf->handlers->dec_usecount)
1109                         intf->handlers->dec_usecount(intf->send_info);
1110         }
1111         mutex_unlock(&ipmi_interfaces_mutex);
1112
1113         kref_put(&intf->refcount, intf_free);
1114
1115         kref_put(&user->refcount, free_user);
1116
1117         return 0;
1118 }
1119 EXPORT_SYMBOL(ipmi_destroy_user);
1120
1121 void ipmi_get_version(ipmi_user_t   user,
1122                       unsigned char *major,
1123                       unsigned char *minor)
1124 {
1125         *major = user->intf->ipmi_version_major;
1126         *minor = user->intf->ipmi_version_minor;
1127 }
1128 EXPORT_SYMBOL(ipmi_get_version);
1129
1130 int ipmi_set_my_address(ipmi_user_t   user,
1131                         unsigned int  channel,
1132                         unsigned char address)
1133 {
1134         if (channel >= IPMI_MAX_CHANNELS)
1135                 return -EINVAL;
1136         user->intf->channels[channel].address = address;
1137         return 0;
1138 }
1139 EXPORT_SYMBOL(ipmi_set_my_address);
1140
1141 int ipmi_get_my_address(ipmi_user_t   user,
1142                         unsigned int  channel,
1143                         unsigned char *address)
1144 {
1145         if (channel >= IPMI_MAX_CHANNELS)
1146                 return -EINVAL;
1147         *address = user->intf->channels[channel].address;
1148         return 0;
1149 }
1150 EXPORT_SYMBOL(ipmi_get_my_address);
1151
1152 int ipmi_set_my_LUN(ipmi_user_t   user,
1153                     unsigned int  channel,
1154                     unsigned char LUN)
1155 {
1156         if (channel >= IPMI_MAX_CHANNELS)
1157                 return -EINVAL;
1158         user->intf->channels[channel].lun = LUN & 0x3;
1159         return 0;
1160 }
1161 EXPORT_SYMBOL(ipmi_set_my_LUN);
1162
1163 int ipmi_get_my_LUN(ipmi_user_t   user,
1164                     unsigned int  channel,
1165                     unsigned char *address)
1166 {
1167         if (channel >= IPMI_MAX_CHANNELS)
1168                 return -EINVAL;
1169         *address = user->intf->channels[channel].lun;
1170         return 0;
1171 }
1172 EXPORT_SYMBOL(ipmi_get_my_LUN);
1173
1174 int ipmi_get_maintenance_mode(ipmi_user_t user)
1175 {
1176         int           mode;
1177         unsigned long flags;
1178
1179         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1180         mode = user->intf->maintenance_mode;
1181         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1182
1183         return mode;
1184 }
1185 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1186
1187 static void maintenance_mode_update(ipmi_smi_t intf)
1188 {
1189         if (intf->handlers->set_maintenance_mode)
1190                 intf->handlers->set_maintenance_mode(
1191                         intf->send_info, intf->maintenance_mode_enable);
1192 }
1193
1194 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1195 {
1196         int           rv = 0;
1197         unsigned long flags;
1198         ipmi_smi_t    intf = user->intf;
1199
1200         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1201         if (intf->maintenance_mode != mode) {
1202                 switch (mode) {
1203                 case IPMI_MAINTENANCE_MODE_AUTO:
1204                         intf->maintenance_mode_enable
1205                                 = (intf->auto_maintenance_timeout > 0);
1206                         break;
1207
1208                 case IPMI_MAINTENANCE_MODE_OFF:
1209                         intf->maintenance_mode_enable = false;
1210                         break;
1211
1212                 case IPMI_MAINTENANCE_MODE_ON:
1213                         intf->maintenance_mode_enable = true;
1214                         break;
1215
1216                 default:
1217                         rv = -EINVAL;
1218                         goto out_unlock;
1219                 }
1220                 intf->maintenance_mode = mode;
1221
1222                 maintenance_mode_update(intf);
1223         }
1224  out_unlock:
1225         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1226
1227         return rv;
1228 }
1229 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1230
1231 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1232 {
1233         unsigned long        flags;
1234         ipmi_smi_t           intf = user->intf;
1235         struct ipmi_recv_msg *msg, *msg2;
1236         struct list_head     msgs;
1237
1238         INIT_LIST_HEAD(&msgs);
1239
1240         spin_lock_irqsave(&intf->events_lock, flags);
1241         if (user->gets_events == val)
1242                 goto out;
1243
1244         user->gets_events = val;
1245
1246         if (val) {
1247                 if (atomic_inc_return(&intf->event_waiters) == 1)
1248                         need_waiter(intf);
1249         } else {
1250                 atomic_dec(&intf->event_waiters);
1251         }
1252
1253         if (intf->delivering_events)
1254                 /*
1255                  * Another thread is delivering events for this, so
1256                  * let it handle any new events.
1257                  */
1258                 goto out;
1259
1260         /* Deliver any queued events. */
1261         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1262                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1263                         list_move_tail(&msg->link, &msgs);
1264                 intf->waiting_events_count = 0;
1265                 if (intf->event_msg_printed) {
1266                         printk(KERN_WARNING PFX "Event queue no longer"
1267                                " full\n");
1268                         intf->event_msg_printed = 0;
1269                 }
1270
1271                 intf->delivering_events = 1;
1272                 spin_unlock_irqrestore(&intf->events_lock, flags);
1273
1274                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1275                         msg->user = user;
1276                         kref_get(&user->refcount);
1277                         deliver_response(msg);
1278                 }
1279
1280                 spin_lock_irqsave(&intf->events_lock, flags);
1281                 intf->delivering_events = 0;
1282         }
1283
1284  out:
1285         spin_unlock_irqrestore(&intf->events_lock, flags);
1286
1287         return 0;
1288 }
1289 EXPORT_SYMBOL(ipmi_set_gets_events);
1290
1291 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1292                                       unsigned char netfn,
1293                                       unsigned char cmd,
1294                                       unsigned char chan)
1295 {
1296         struct cmd_rcvr *rcvr;
1297
1298         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1299                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1300                                         && (rcvr->chans & (1 << chan)))
1301                         return rcvr;
1302         }
1303         return NULL;
1304 }
1305
1306 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1307                                  unsigned char netfn,
1308                                  unsigned char cmd,
1309                                  unsigned int  chans)
1310 {
1311         struct cmd_rcvr *rcvr;
1312
1313         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1314                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1315                                         && (rcvr->chans & chans))
1316                         return 0;
1317         }
1318         return 1;
1319 }
1320
1321 int ipmi_register_for_cmd(ipmi_user_t   user,
1322                           unsigned char netfn,
1323                           unsigned char cmd,
1324                           unsigned int  chans)
1325 {
1326         ipmi_smi_t      intf = user->intf;
1327         struct cmd_rcvr *rcvr;
1328         int             rv = 0;
1329
1330
1331         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1332         if (!rcvr)
1333                 return -ENOMEM;
1334         rcvr->cmd = cmd;
1335         rcvr->netfn = netfn;
1336         rcvr->chans = chans;
1337         rcvr->user = user;
1338
1339         mutex_lock(&intf->cmd_rcvrs_mutex);
1340         /* Make sure the command/netfn is not already registered. */
1341         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1342                 rv = -EBUSY;
1343                 goto out_unlock;
1344         }
1345
1346         if (atomic_inc_return(&intf->event_waiters) == 1)
1347                 need_waiter(intf);
1348
1349         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1350
1351  out_unlock:
1352         mutex_unlock(&intf->cmd_rcvrs_mutex);
1353         if (rv)
1354                 kfree(rcvr);
1355
1356         return rv;
1357 }
1358 EXPORT_SYMBOL(ipmi_register_for_cmd);
1359
1360 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1361                             unsigned char netfn,
1362                             unsigned char cmd,
1363                             unsigned int  chans)
1364 {
1365         ipmi_smi_t      intf = user->intf;
1366         struct cmd_rcvr *rcvr;
1367         struct cmd_rcvr *rcvrs = NULL;
1368         int i, rv = -ENOENT;
1369
1370         mutex_lock(&intf->cmd_rcvrs_mutex);
1371         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1372                 if (((1 << i) & chans) == 0)
1373                         continue;
1374                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1375                 if (rcvr == NULL)
1376                         continue;
1377                 if (rcvr->user == user) {
1378                         rv = 0;
1379                         rcvr->chans &= ~chans;
1380                         if (rcvr->chans == 0) {
1381                                 list_del_rcu(&rcvr->link);
1382                                 rcvr->next = rcvrs;
1383                                 rcvrs = rcvr;
1384                         }
1385                 }
1386         }
1387         mutex_unlock(&intf->cmd_rcvrs_mutex);
1388         synchronize_rcu();
1389         while (rcvrs) {
1390                 atomic_dec(&intf->event_waiters);
1391                 rcvr = rcvrs;
1392                 rcvrs = rcvr->next;
1393                 kfree(rcvr);
1394         }
1395         return rv;
1396 }
1397 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1398
1399 static unsigned char
1400 ipmb_checksum(unsigned char *data, int size)
1401 {
1402         unsigned char csum = 0;
1403
1404         for (; size > 0; size--, data++)
1405                 csum += *data;
1406
1407         return -csum;
1408 }
1409
1410 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1411                                    struct kernel_ipmi_msg *msg,
1412                                    struct ipmi_ipmb_addr *ipmb_addr,
1413                                    long                  msgid,
1414                                    unsigned char         ipmb_seq,
1415                                    int                   broadcast,
1416                                    unsigned char         source_address,
1417                                    unsigned char         source_lun)
1418 {
1419         int i = broadcast;
1420
1421         /* Format the IPMB header data. */
1422         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1423         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1424         smi_msg->data[2] = ipmb_addr->channel;
1425         if (broadcast)
1426                 smi_msg->data[3] = 0;
1427         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1428         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1429         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1430         smi_msg->data[i+6] = source_address;
1431         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1432         smi_msg->data[i+8] = msg->cmd;
1433
1434         /* Now tack on the data to the message. */
1435         if (msg->data_len > 0)
1436                 memcpy(&(smi_msg->data[i+9]), msg->data,
1437                        msg->data_len);
1438         smi_msg->data_size = msg->data_len + 9;
1439
1440         /* Now calculate the checksum and tack it on. */
1441         smi_msg->data[i+smi_msg->data_size]
1442                 = ipmb_checksum(&(smi_msg->data[i+6]),
1443                                 smi_msg->data_size-6);
1444
1445         /*
1446          * Add on the checksum size and the offset from the
1447          * broadcast.
1448          */
1449         smi_msg->data_size += 1 + i;
1450
1451         smi_msg->msgid = msgid;
1452 }
1453
1454 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1455                                   struct kernel_ipmi_msg *msg,
1456                                   struct ipmi_lan_addr  *lan_addr,
1457                                   long                  msgid,
1458                                   unsigned char         ipmb_seq,
1459                                   unsigned char         source_lun)
1460 {
1461         /* Format the IPMB header data. */
1462         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1463         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1464         smi_msg->data[2] = lan_addr->channel;
1465         smi_msg->data[3] = lan_addr->session_handle;
1466         smi_msg->data[4] = lan_addr->remote_SWID;
1467         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1468         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1469         smi_msg->data[7] = lan_addr->local_SWID;
1470         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1471         smi_msg->data[9] = msg->cmd;
1472
1473         /* Now tack on the data to the message. */
1474         if (msg->data_len > 0)
1475                 memcpy(&(smi_msg->data[10]), msg->data,
1476                        msg->data_len);
1477         smi_msg->data_size = msg->data_len + 10;
1478
1479         /* Now calculate the checksum and tack it on. */
1480         smi_msg->data[smi_msg->data_size]
1481                 = ipmb_checksum(&(smi_msg->data[7]),
1482                                 smi_msg->data_size-7);
1483
1484         /*
1485          * Add on the checksum size and the offset from the
1486          * broadcast.
1487          */
1488         smi_msg->data_size += 1;
1489
1490         smi_msg->msgid = msgid;
1491 }
1492
1493 static struct ipmi_smi_msg *smi_add_send_msg(ipmi_smi_t intf,
1494                                              struct ipmi_smi_msg *smi_msg,
1495                                              int priority)
1496 {
1497         if (intf->curr_msg) {
1498                 if (priority > 0)
1499                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1500                 else
1501                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1502                 smi_msg = NULL;
1503         } else {
1504                 intf->curr_msg = smi_msg;
1505         }
1506
1507         return smi_msg;
1508 }
1509
1510
1511 static void smi_send(ipmi_smi_t intf, const struct ipmi_smi_handlers *handlers,
1512                      struct ipmi_smi_msg *smi_msg, int priority)
1513 {
1514         int run_to_completion = intf->run_to_completion;
1515
1516         if (run_to_completion) {
1517                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1518         } else {
1519                 unsigned long flags;
1520
1521                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1522                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1523                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1524         }
1525
1526         if (smi_msg)
1527                 handlers->sender(intf->send_info, smi_msg);
1528 }
1529
1530 /*
1531  * Separate from ipmi_request so that the user does not have to be
1532  * supplied in certain circumstances (mainly at panic time).  If
1533  * messages are supplied, they will be freed, even if an error
1534  * occurs.
1535  */
1536 static int i_ipmi_request(ipmi_user_t          user,
1537                           ipmi_smi_t           intf,
1538                           struct ipmi_addr     *addr,
1539                           long                 msgid,
1540                           struct kernel_ipmi_msg *msg,
1541                           void                 *user_msg_data,
1542                           void                 *supplied_smi,
1543                           struct ipmi_recv_msg *supplied_recv,
1544                           int                  priority,
1545                           unsigned char        source_address,
1546                           unsigned char        source_lun,
1547                           int                  retries,
1548                           unsigned int         retry_time_ms)
1549 {
1550         int                      rv = 0;
1551         struct ipmi_smi_msg      *smi_msg;
1552         struct ipmi_recv_msg     *recv_msg;
1553         unsigned long            flags;
1554
1555
1556         if (supplied_recv)
1557                 recv_msg = supplied_recv;
1558         else {
1559                 recv_msg = ipmi_alloc_recv_msg();
1560                 if (recv_msg == NULL)
1561                         return -ENOMEM;
1562         }
1563         recv_msg->user_msg_data = user_msg_data;
1564
1565         if (supplied_smi)
1566                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1567         else {
1568                 smi_msg = ipmi_alloc_smi_msg();
1569                 if (smi_msg == NULL) {
1570                         ipmi_free_recv_msg(recv_msg);
1571                         return -ENOMEM;
1572                 }
1573         }
1574
1575         rcu_read_lock();
1576         if (intf->in_shutdown) {
1577                 rv = -ENODEV;
1578                 goto out_err;
1579         }
1580
1581         recv_msg->user = user;
1582         if (user)
1583                 kref_get(&user->refcount);
1584         recv_msg->msgid = msgid;
1585         /*
1586          * Store the message to send in the receive message so timeout
1587          * responses can get the proper response data.
1588          */
1589         recv_msg->msg = *msg;
1590
1591         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1592                 struct ipmi_system_interface_addr *smi_addr;
1593
1594                 if (msg->netfn & 1) {
1595                         /* Responses are not allowed to the SMI. */
1596                         rv = -EINVAL;
1597                         goto out_err;
1598                 }
1599
1600                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1601                 if (smi_addr->lun > 3) {
1602                         ipmi_inc_stat(intf, sent_invalid_commands);
1603                         rv = -EINVAL;
1604                         goto out_err;
1605                 }
1606
1607                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1608
1609                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1610                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1611                         || (msg->cmd == IPMI_GET_MSG_CMD)
1612                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1613                         /*
1614                          * We don't let the user do these, since we manage
1615                          * the sequence numbers.
1616                          */
1617                         ipmi_inc_stat(intf, sent_invalid_commands);
1618                         rv = -EINVAL;
1619                         goto out_err;
1620                 }
1621
1622                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1623                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1624                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1625                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1626                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1627                         intf->auto_maintenance_timeout
1628                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1629                         if (!intf->maintenance_mode
1630                             && !intf->maintenance_mode_enable) {
1631                                 intf->maintenance_mode_enable = true;
1632                                 maintenance_mode_update(intf);
1633                         }
1634                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1635                                                flags);
1636                 }
1637
1638                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1639                         ipmi_inc_stat(intf, sent_invalid_commands);
1640                         rv = -EMSGSIZE;
1641                         goto out_err;
1642                 }
1643
1644                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1645                 smi_msg->data[1] = msg->cmd;
1646                 smi_msg->msgid = msgid;
1647                 smi_msg->user_data = recv_msg;
1648                 if (msg->data_len > 0)
1649                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1650                 smi_msg->data_size = msg->data_len + 2;
1651                 ipmi_inc_stat(intf, sent_local_commands);
1652         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1653                 struct ipmi_ipmb_addr *ipmb_addr;
1654                 unsigned char         ipmb_seq;
1655                 long                  seqid;
1656                 int                   broadcast = 0;
1657
1658                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1659                         ipmi_inc_stat(intf, sent_invalid_commands);
1660                         rv = -EINVAL;
1661                         goto out_err;
1662                 }
1663
1664                 if (intf->channels[addr->channel].medium
1665                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1666                         ipmi_inc_stat(intf, sent_invalid_commands);
1667                         rv = -EINVAL;
1668                         goto out_err;
1669                 }
1670
1671                 if (retries < 0) {
1672                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1673                         retries = 0; /* Don't retry broadcasts. */
1674                     else
1675                         retries = 4;
1676                 }
1677                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1678                     /*
1679                      * Broadcasts add a zero at the beginning of the
1680                      * message, but otherwise is the same as an IPMB
1681                      * address.
1682                      */
1683                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1684                     broadcast = 1;
1685                 }
1686
1687
1688                 /* Default to 1 second retries. */
1689                 if (retry_time_ms == 0)
1690                     retry_time_ms = 1000;
1691
1692                 /*
1693                  * 9 for the header and 1 for the checksum, plus
1694                  * possibly one for the broadcast.
1695                  */
1696                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1697                         ipmi_inc_stat(intf, sent_invalid_commands);
1698                         rv = -EMSGSIZE;
1699                         goto out_err;
1700                 }
1701
1702                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1703                 if (ipmb_addr->lun > 3) {
1704                         ipmi_inc_stat(intf, sent_invalid_commands);
1705                         rv = -EINVAL;
1706                         goto out_err;
1707                 }
1708
1709                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1710
1711                 if (recv_msg->msg.netfn & 0x1) {
1712                         /*
1713                          * It's a response, so use the user's sequence
1714                          * from msgid.
1715                          */
1716                         ipmi_inc_stat(intf, sent_ipmb_responses);
1717                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1718                                         msgid, broadcast,
1719                                         source_address, source_lun);
1720
1721                         /*
1722                          * Save the receive message so we can use it
1723                          * to deliver the response.
1724                          */
1725                         smi_msg->user_data = recv_msg;
1726                 } else {
1727                         /* It's a command, so get a sequence for it. */
1728
1729                         spin_lock_irqsave(&(intf->seq_lock), flags);
1730
1731                         /*
1732                          * Create a sequence number with a 1 second
1733                          * timeout and 4 retries.
1734                          */
1735                         rv = intf_next_seq(intf,
1736                                            recv_msg,
1737                                            retry_time_ms,
1738                                            retries,
1739                                            broadcast,
1740                                            &ipmb_seq,
1741                                            &seqid);
1742                         if (rv) {
1743                                 /*
1744                                  * We have used up all the sequence numbers,
1745                                  * probably, so abort.
1746                                  */
1747                                 spin_unlock_irqrestore(&(intf->seq_lock),
1748                                                        flags);
1749                                 goto out_err;
1750                         }
1751
1752                         ipmi_inc_stat(intf, sent_ipmb_commands);
1753
1754                         /*
1755                          * Store the sequence number in the message,
1756                          * so that when the send message response
1757                          * comes back we can start the timer.
1758                          */
1759                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1760                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1761                                         ipmb_seq, broadcast,
1762                                         source_address, source_lun);
1763
1764                         /*
1765                          * Copy the message into the recv message data, so we
1766                          * can retransmit it later if necessary.
1767                          */
1768                         memcpy(recv_msg->msg_data, smi_msg->data,
1769                                smi_msg->data_size);
1770                         recv_msg->msg.data = recv_msg->msg_data;
1771                         recv_msg->msg.data_len = smi_msg->data_size;
1772
1773                         /*
1774                          * We don't unlock until here, because we need
1775                          * to copy the completed message into the
1776                          * recv_msg before we release the lock.
1777                          * Otherwise, race conditions may bite us.  I
1778                          * know that's pretty paranoid, but I prefer
1779                          * to be correct.
1780                          */
1781                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1782                 }
1783         } else if (is_lan_addr(addr)) {
1784                 struct ipmi_lan_addr  *lan_addr;
1785                 unsigned char         ipmb_seq;
1786                 long                  seqid;
1787
1788                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1789                         ipmi_inc_stat(intf, sent_invalid_commands);
1790                         rv = -EINVAL;
1791                         goto out_err;
1792                 }
1793
1794                 if ((intf->channels[addr->channel].medium
1795                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1796                     && (intf->channels[addr->channel].medium
1797                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1798                         ipmi_inc_stat(intf, sent_invalid_commands);
1799                         rv = -EINVAL;
1800                         goto out_err;
1801                 }
1802
1803                 retries = 4;
1804
1805                 /* Default to 1 second retries. */
1806                 if (retry_time_ms == 0)
1807                     retry_time_ms = 1000;
1808
1809                 /* 11 for the header and 1 for the checksum. */
1810                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1811                         ipmi_inc_stat(intf, sent_invalid_commands);
1812                         rv = -EMSGSIZE;
1813                         goto out_err;
1814                 }
1815
1816                 lan_addr = (struct ipmi_lan_addr *) addr;
1817                 if (lan_addr->lun > 3) {
1818                         ipmi_inc_stat(intf, sent_invalid_commands);
1819                         rv = -EINVAL;
1820                         goto out_err;
1821                 }
1822
1823                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1824
1825                 if (recv_msg->msg.netfn & 0x1) {
1826                         /*
1827                          * It's a response, so use the user's sequence
1828                          * from msgid.
1829                          */
1830                         ipmi_inc_stat(intf, sent_lan_responses);
1831                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1832                                        msgid, source_lun);
1833
1834                         /*
1835                          * Save the receive message so we can use it
1836                          * to deliver the response.
1837                          */
1838                         smi_msg->user_data = recv_msg;
1839                 } else {
1840                         /* It's a command, so get a sequence for it. */
1841
1842                         spin_lock_irqsave(&(intf->seq_lock), flags);
1843
1844                         /*
1845                          * Create a sequence number with a 1 second
1846                          * timeout and 4 retries.
1847                          */
1848                         rv = intf_next_seq(intf,
1849                                            recv_msg,
1850                                            retry_time_ms,
1851                                            retries,
1852                                            0,
1853                                            &ipmb_seq,
1854                                            &seqid);
1855                         if (rv) {
1856                                 /*
1857                                  * We have used up all the sequence numbers,
1858                                  * probably, so abort.
1859                                  */
1860                                 spin_unlock_irqrestore(&(intf->seq_lock),
1861                                                        flags);
1862                                 goto out_err;
1863                         }
1864
1865                         ipmi_inc_stat(intf, sent_lan_commands);
1866
1867                         /*
1868                          * Store the sequence number in the message,
1869                          * so that when the send message response
1870                          * comes back we can start the timer.
1871                          */
1872                         format_lan_msg(smi_msg, msg, lan_addr,
1873                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1874                                        ipmb_seq, source_lun);
1875
1876                         /*
1877                          * Copy the message into the recv message data, so we
1878                          * can retransmit it later if necessary.
1879                          */
1880                         memcpy(recv_msg->msg_data, smi_msg->data,
1881                                smi_msg->data_size);
1882                         recv_msg->msg.data = recv_msg->msg_data;
1883                         recv_msg->msg.data_len = smi_msg->data_size;
1884
1885                         /*
1886                          * We don't unlock until here, because we need
1887                          * to copy the completed message into the
1888                          * recv_msg before we release the lock.
1889                          * Otherwise, race conditions may bite us.  I
1890                          * know that's pretty paranoid, but I prefer
1891                          * to be correct.
1892                          */
1893                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1894                 }
1895         } else {
1896             /* Unknown address type. */
1897                 ipmi_inc_stat(intf, sent_invalid_commands);
1898                 rv = -EINVAL;
1899                 goto out_err;
1900         }
1901
1902 #ifdef DEBUG_MSGING
1903         {
1904                 int m;
1905                 for (m = 0; m < smi_msg->data_size; m++)
1906                         printk(" %2.2x", smi_msg->data[m]);
1907                 printk("\n");
1908         }
1909 #endif
1910
1911         smi_send(intf, intf->handlers, smi_msg, priority);
1912         rcu_read_unlock();
1913
1914         return 0;
1915
1916  out_err:
1917         rcu_read_unlock();
1918         ipmi_free_smi_msg(smi_msg);
1919         ipmi_free_recv_msg(recv_msg);
1920         return rv;
1921 }
1922
1923 static int check_addr(ipmi_smi_t       intf,
1924                       struct ipmi_addr *addr,
1925                       unsigned char    *saddr,
1926                       unsigned char    *lun)
1927 {
1928         if (addr->channel >= IPMI_MAX_CHANNELS)
1929                 return -EINVAL;
1930         *lun = intf->channels[addr->channel].lun;
1931         *saddr = intf->channels[addr->channel].address;
1932         return 0;
1933 }
1934
1935 int ipmi_request_settime(ipmi_user_t      user,
1936                          struct ipmi_addr *addr,
1937                          long             msgid,
1938                          struct kernel_ipmi_msg  *msg,
1939                          void             *user_msg_data,
1940                          int              priority,
1941                          int              retries,
1942                          unsigned int     retry_time_ms)
1943 {
1944         unsigned char saddr = 0, lun = 0;
1945         int           rv;
1946
1947         if (!user)
1948                 return -EINVAL;
1949         rv = check_addr(user->intf, addr, &saddr, &lun);
1950         if (rv)
1951                 return rv;
1952         return i_ipmi_request(user,
1953                               user->intf,
1954                               addr,
1955                               msgid,
1956                               msg,
1957                               user_msg_data,
1958                               NULL, NULL,
1959                               priority,
1960                               saddr,
1961                               lun,
1962                               retries,
1963                               retry_time_ms);
1964 }
1965 EXPORT_SYMBOL(ipmi_request_settime);
1966
1967 int ipmi_request_supply_msgs(ipmi_user_t          user,
1968                              struct ipmi_addr     *addr,
1969                              long                 msgid,
1970                              struct kernel_ipmi_msg *msg,
1971                              void                 *user_msg_data,
1972                              void                 *supplied_smi,
1973                              struct ipmi_recv_msg *supplied_recv,
1974                              int                  priority)
1975 {
1976         unsigned char saddr = 0, lun = 0;
1977         int           rv;
1978
1979         if (!user)
1980                 return -EINVAL;
1981         rv = check_addr(user->intf, addr, &saddr, &lun);
1982         if (rv)
1983                 return rv;
1984         return i_ipmi_request(user,
1985                               user->intf,
1986                               addr,
1987                               msgid,
1988                               msg,
1989                               user_msg_data,
1990                               supplied_smi,
1991                               supplied_recv,
1992                               priority,
1993                               saddr,
1994                               lun,
1995                               -1, 0);
1996 }
1997 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1998
1999 #ifdef CONFIG_PROC_FS
2000 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
2001 {
2002         ipmi_smi_t intf = m->private;
2003         int        i;
2004
2005         seq_printf(m, "%x", intf->channels[0].address);
2006         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
2007                 seq_printf(m, " %x", intf->channels[i].address);
2008         seq_putc(m, '\n');
2009
2010         return 0;
2011 }
2012
2013 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
2014 {
2015         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
2016 }
2017
2018 static const struct file_operations smi_ipmb_proc_ops = {
2019         .open           = smi_ipmb_proc_open,
2020         .read           = seq_read,
2021         .llseek         = seq_lseek,
2022         .release        = single_release,
2023 };
2024
2025 static int smi_version_proc_show(struct seq_file *m, void *v)
2026 {
2027         ipmi_smi_t intf = m->private;
2028
2029         seq_printf(m, "%u.%u\n",
2030                    ipmi_version_major(&intf->bmc->id),
2031                    ipmi_version_minor(&intf->bmc->id));
2032
2033         return 0;
2034 }
2035
2036 static int smi_version_proc_open(struct inode *inode, struct file *file)
2037 {
2038         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
2039 }
2040
2041 static const struct file_operations smi_version_proc_ops = {
2042         .open           = smi_version_proc_open,
2043         .read           = seq_read,
2044         .llseek         = seq_lseek,
2045         .release        = single_release,
2046 };
2047
2048 static int smi_stats_proc_show(struct seq_file *m, void *v)
2049 {
2050         ipmi_smi_t intf = m->private;
2051
2052         seq_printf(m, "sent_invalid_commands:       %u\n",
2053                        ipmi_get_stat(intf, sent_invalid_commands));
2054         seq_printf(m, "sent_local_commands:         %u\n",
2055                        ipmi_get_stat(intf, sent_local_commands));
2056         seq_printf(m, "handled_local_responses:     %u\n",
2057                        ipmi_get_stat(intf, handled_local_responses));
2058         seq_printf(m, "unhandled_local_responses:   %u\n",
2059                        ipmi_get_stat(intf, unhandled_local_responses));
2060         seq_printf(m, "sent_ipmb_commands:          %u\n",
2061                        ipmi_get_stat(intf, sent_ipmb_commands));
2062         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2063                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2064         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2065                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2066         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2067                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2068         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2069                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2070         seq_printf(m, "sent_ipmb_responses:         %u\n",
2071                        ipmi_get_stat(intf, sent_ipmb_responses));
2072         seq_printf(m, "handled_ipmb_responses:      %u\n",
2073                        ipmi_get_stat(intf, handled_ipmb_responses));
2074         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2075                        ipmi_get_stat(intf, invalid_ipmb_responses));
2076         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2077                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2078         seq_printf(m, "sent_lan_commands:           %u\n",
2079                        ipmi_get_stat(intf, sent_lan_commands));
2080         seq_printf(m, "sent_lan_command_errs:       %u\n",
2081                        ipmi_get_stat(intf, sent_lan_command_errs));
2082         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2083                        ipmi_get_stat(intf, retransmitted_lan_commands));
2084         seq_printf(m, "timed_out_lan_commands:      %u\n",
2085                        ipmi_get_stat(intf, timed_out_lan_commands));
2086         seq_printf(m, "sent_lan_responses:          %u\n",
2087                        ipmi_get_stat(intf, sent_lan_responses));
2088         seq_printf(m, "handled_lan_responses:       %u\n",
2089                        ipmi_get_stat(intf, handled_lan_responses));
2090         seq_printf(m, "invalid_lan_responses:       %u\n",
2091                        ipmi_get_stat(intf, invalid_lan_responses));
2092         seq_printf(m, "unhandled_lan_responses:     %u\n",
2093                        ipmi_get_stat(intf, unhandled_lan_responses));
2094         seq_printf(m, "handled_commands:            %u\n",
2095                        ipmi_get_stat(intf, handled_commands));
2096         seq_printf(m, "invalid_commands:            %u\n",
2097                        ipmi_get_stat(intf, invalid_commands));
2098         seq_printf(m, "unhandled_commands:          %u\n",
2099                        ipmi_get_stat(intf, unhandled_commands));
2100         seq_printf(m, "invalid_events:              %u\n",
2101                        ipmi_get_stat(intf, invalid_events));
2102         seq_printf(m, "events:                      %u\n",
2103                        ipmi_get_stat(intf, events));
2104         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2105                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2106         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2107                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2108         return 0;
2109 }
2110
2111 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2112 {
2113         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2114 }
2115
2116 static const struct file_operations smi_stats_proc_ops = {
2117         .open           = smi_stats_proc_open,
2118         .read           = seq_read,
2119         .llseek         = seq_lseek,
2120         .release        = single_release,
2121 };
2122 #endif /* CONFIG_PROC_FS */
2123
2124 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2125                             const struct file_operations *proc_ops,
2126                             void *data)
2127 {
2128         int                    rv = 0;
2129 #ifdef CONFIG_PROC_FS
2130         struct proc_dir_entry  *file;
2131         struct ipmi_proc_entry *entry;
2132
2133         /* Create a list element. */
2134         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2135         if (!entry)
2136                 return -ENOMEM;
2137         entry->name = kstrdup(name, GFP_KERNEL);
2138         if (!entry->name) {
2139                 kfree(entry);
2140                 return -ENOMEM;
2141         }
2142
2143         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2144         if (!file) {
2145                 kfree(entry->name);
2146                 kfree(entry);
2147                 rv = -ENOMEM;
2148         } else {
2149                 mutex_lock(&smi->proc_entry_lock);
2150                 /* Stick it on the list. */
2151                 entry->next = smi->proc_entries;
2152                 smi->proc_entries = entry;
2153                 mutex_unlock(&smi->proc_entry_lock);
2154         }
2155 #endif /* CONFIG_PROC_FS */
2156
2157         return rv;
2158 }
2159 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2160
2161 static int add_proc_entries(ipmi_smi_t smi, int num)
2162 {
2163         int rv = 0;
2164
2165 #ifdef CONFIG_PROC_FS
2166         sprintf(smi->proc_dir_name, "%d", num);
2167         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2168         if (!smi->proc_dir)
2169                 rv = -ENOMEM;
2170
2171         if (rv == 0)
2172                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2173                                              &smi_stats_proc_ops,
2174                                              smi);
2175
2176         if (rv == 0)
2177                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2178                                              &smi_ipmb_proc_ops,
2179                                              smi);
2180
2181         if (rv == 0)
2182                 rv = ipmi_smi_add_proc_entry(smi, "version",
2183                                              &smi_version_proc_ops,
2184                                              smi);
2185 #endif /* CONFIG_PROC_FS */
2186
2187         return rv;
2188 }
2189
2190 static void remove_proc_entries(ipmi_smi_t smi)
2191 {
2192 #ifdef CONFIG_PROC_FS
2193         struct ipmi_proc_entry *entry;
2194
2195         mutex_lock(&smi->proc_entry_lock);
2196         while (smi->proc_entries) {
2197                 entry = smi->proc_entries;
2198                 smi->proc_entries = entry->next;
2199
2200                 remove_proc_entry(entry->name, smi->proc_dir);
2201                 kfree(entry->name);
2202                 kfree(entry);
2203         }
2204         mutex_unlock(&smi->proc_entry_lock);
2205         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2206 #endif /* CONFIG_PROC_FS */
2207 }
2208
2209 static int __find_bmc_guid(struct device *dev, void *data)
2210 {
2211         unsigned char *id = data;
2212         struct bmc_device *bmc = to_bmc_device(dev);
2213         return memcmp(bmc->guid, id, 16) == 0;
2214 }
2215
2216 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2217                                              unsigned char *guid)
2218 {
2219         struct device *dev;
2220
2221         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2222         if (dev)
2223                 return to_bmc_device(dev);
2224         else
2225                 return NULL;
2226 }
2227
2228 struct prod_dev_id {
2229         unsigned int  product_id;
2230         unsigned char device_id;
2231 };
2232
2233 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2234 {
2235         struct prod_dev_id *id = data;
2236         struct bmc_device *bmc = to_bmc_device(dev);
2237
2238         return (bmc->id.product_id == id->product_id
2239                 && bmc->id.device_id == id->device_id);
2240 }
2241
2242 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2243         struct device_driver *drv,
2244         unsigned int product_id, unsigned char device_id)
2245 {
2246         struct prod_dev_id id = {
2247                 .product_id = product_id,
2248                 .device_id = device_id,
2249         };
2250         struct device *dev;
2251
2252         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2253         if (dev)
2254                 return to_bmc_device(dev);
2255         else
2256                 return NULL;
2257 }
2258
2259 static ssize_t device_id_show(struct device *dev,
2260                               struct device_attribute *attr,
2261                               char *buf)
2262 {
2263         struct bmc_device *bmc = to_bmc_device(dev);
2264
2265         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2266 }
2267 static DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
2268
2269 static ssize_t provides_device_sdrs_show(struct device *dev,
2270                                          struct device_attribute *attr,
2271                                          char *buf)
2272 {
2273         struct bmc_device *bmc = to_bmc_device(dev);
2274
2275         return snprintf(buf, 10, "%u\n",
2276                         (bmc->id.device_revision & 0x80) >> 7);
2277 }
2278 static DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show,
2279                    NULL);
2280
2281 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2282                              char *buf)
2283 {
2284         struct bmc_device *bmc = to_bmc_device(dev);
2285
2286         return snprintf(buf, 20, "%u\n",
2287                         bmc->id.device_revision & 0x0F);
2288 }
2289 static DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
2290
2291 static ssize_t firmware_revision_show(struct device *dev,
2292                                       struct device_attribute *attr,
2293                                       char *buf)
2294 {
2295         struct bmc_device *bmc = to_bmc_device(dev);
2296
2297         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2298                         bmc->id.firmware_revision_2);
2299 }
2300 static DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
2301
2302 static ssize_t ipmi_version_show(struct device *dev,
2303                                  struct device_attribute *attr,
2304                                  char *buf)
2305 {
2306         struct bmc_device *bmc = to_bmc_device(dev);
2307
2308         return snprintf(buf, 20, "%u.%u\n",
2309                         ipmi_version_major(&bmc->id),
2310                         ipmi_version_minor(&bmc->id));
2311 }
2312 static DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
2313
2314 static ssize_t add_dev_support_show(struct device *dev,
2315                                     struct device_attribute *attr,
2316                                     char *buf)
2317 {
2318         struct bmc_device *bmc = to_bmc_device(dev);
2319
2320         return snprintf(buf, 10, "0x%02x\n",
2321                         bmc->id.additional_device_support);
2322 }
2323 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
2324                    NULL);
2325
2326 static ssize_t manufacturer_id_show(struct device *dev,
2327                                     struct device_attribute *attr,
2328                                     char *buf)
2329 {
2330         struct bmc_device *bmc = to_bmc_device(dev);
2331
2332         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2333 }
2334 static DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
2335
2336 static ssize_t product_id_show(struct device *dev,
2337                                struct device_attribute *attr,
2338                                char *buf)
2339 {
2340         struct bmc_device *bmc = to_bmc_device(dev);
2341
2342         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2343 }
2344 static DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
2345
2346 static ssize_t aux_firmware_rev_show(struct device *dev,
2347                                      struct device_attribute *attr,
2348                                      char *buf)
2349 {
2350         struct bmc_device *bmc = to_bmc_device(dev);
2351
2352         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2353                         bmc->id.aux_firmware_revision[3],
2354                         bmc->id.aux_firmware_revision[2],
2355                         bmc->id.aux_firmware_revision[1],
2356                         bmc->id.aux_firmware_revision[0]);
2357 }
2358 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2359
2360 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2361                          char *buf)
2362 {
2363         struct bmc_device *bmc = to_bmc_device(dev);
2364
2365         return snprintf(buf, 100, "%Lx%Lx\n",
2366                         (long long) bmc->guid[0],
2367                         (long long) bmc->guid[8]);
2368 }
2369 static DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
2370
2371 static struct attribute *bmc_dev_attrs[] = {
2372         &dev_attr_device_id.attr,
2373         &dev_attr_provides_device_sdrs.attr,
2374         &dev_attr_revision.attr,
2375         &dev_attr_firmware_revision.attr,
2376         &dev_attr_ipmi_version.attr,
2377         &dev_attr_additional_device_support.attr,
2378         &dev_attr_manufacturer_id.attr,
2379         &dev_attr_product_id.attr,
2380         &dev_attr_aux_firmware_revision.attr,
2381         &dev_attr_guid.attr,
2382         NULL
2383 };
2384
2385 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,
2386                                        struct attribute *attr, int idx)
2387 {
2388         struct device *dev = kobj_to_dev(kobj);
2389         struct bmc_device *bmc = to_bmc_device(dev);
2390         umode_t mode = attr->mode;
2391
2392         if (attr == &dev_attr_aux_firmware_revision.attr)
2393                 return bmc->id.aux_firmware_revision_set ? mode : 0;
2394         if (attr == &dev_attr_guid.attr)
2395                 return bmc->guid_set ? mode : 0;
2396         return mode;
2397 }
2398
2399 static struct attribute_group bmc_dev_attr_group = {
2400         .attrs          = bmc_dev_attrs,
2401         .is_visible     = bmc_dev_attr_is_visible,
2402 };
2403
2404 static const struct attribute_group *bmc_dev_attr_groups[] = {
2405         &bmc_dev_attr_group,
2406         NULL
2407 };
2408
2409 static struct device_type bmc_device_type = {
2410         .groups         = bmc_dev_attr_groups,
2411 };
2412
2413 static void
2414 release_bmc_device(struct device *dev)
2415 {
2416         kfree(to_bmc_device(dev));
2417 }
2418
2419 static void
2420 cleanup_bmc_device(struct kref *ref)
2421 {
2422         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2423
2424         platform_device_unregister(&bmc->pdev);
2425 }
2426
2427 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2428 {
2429         struct bmc_device *bmc = intf->bmc;
2430
2431         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2432         if (intf->my_dev_name) {
2433                 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2434                 kfree(intf->my_dev_name);
2435                 intf->my_dev_name = NULL;
2436         }
2437
2438         mutex_lock(&ipmidriver_mutex);
2439         kref_put(&bmc->usecount, cleanup_bmc_device);
2440         intf->bmc = NULL;
2441         mutex_unlock(&ipmidriver_mutex);
2442 }
2443
2444 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
2445 {
2446         int               rv;
2447         struct bmc_device *bmc = intf->bmc;
2448         struct bmc_device *old_bmc;
2449
2450         mutex_lock(&ipmidriver_mutex);
2451
2452         /*
2453          * Try to find if there is an bmc_device struct
2454          * representing the interfaced BMC already
2455          */
2456         if (bmc->guid_set)
2457                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2458         else
2459                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2460                                                     bmc->id.product_id,
2461                                                     bmc->id.device_id);
2462
2463         /*
2464          * If there is already an bmc_device, free the new one,
2465          * otherwise register the new BMC device
2466          */
2467         if (old_bmc) {
2468                 kfree(bmc);
2469                 intf->bmc = old_bmc;
2470                 bmc = old_bmc;
2471
2472                 kref_get(&bmc->usecount);
2473                 mutex_unlock(&ipmidriver_mutex);
2474
2475                 printk(KERN_INFO
2476                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2477                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2478                        bmc->id.manufacturer_id,
2479                        bmc->id.product_id,
2480                        bmc->id.device_id);
2481         } else {
2482                 unsigned char orig_dev_id = bmc->id.device_id;
2483                 int warn_printed = 0;
2484
2485                 snprintf(bmc->name, sizeof(bmc->name),
2486                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2487                 bmc->pdev.name = bmc->name;
2488
2489                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2490                                                  bmc->id.product_id,
2491                                                  bmc->id.device_id)) {
2492                         if (!warn_printed) {
2493                                 printk(KERN_WARNING PFX
2494                                        "This machine has two different BMCs"
2495                                        " with the same product id and device"
2496                                        " id.  This is an error in the"
2497                                        " firmware, but incrementing the"
2498                                        " device id to work around the problem."
2499                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2500                                        bmc->id.product_id, bmc->id.device_id);
2501                                 warn_printed = 1;
2502                         }
2503                         bmc->id.device_id++; /* Wraps at 255 */
2504                         if (bmc->id.device_id == orig_dev_id) {
2505                                 printk(KERN_ERR PFX
2506                                        "Out of device ids!\n");
2507                                 break;
2508                         }
2509                 }
2510
2511                 bmc->pdev.dev.driver = &ipmidriver.driver;
2512                 bmc->pdev.id = bmc->id.device_id;
2513                 bmc->pdev.dev.release = release_bmc_device;
2514                 bmc->pdev.dev.type = &bmc_device_type;
2515                 kref_init(&bmc->usecount);
2516
2517                 rv = platform_device_register(&bmc->pdev);
2518                 mutex_unlock(&ipmidriver_mutex);
2519                 if (rv) {
2520                         put_device(&bmc->pdev.dev);
2521                         printk(KERN_ERR
2522                                "ipmi_msghandler:"
2523                                " Unable to register bmc device: %d\n",
2524                                rv);
2525                         /*
2526                          * Don't go to out_err, you can only do that if
2527                          * the device is registered already.
2528                          */
2529                         return rv;
2530                 }
2531
2532                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2533                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2534                          bmc->id.manufacturer_id,
2535                          bmc->id.product_id,
2536                          bmc->id.device_id);
2537         }
2538
2539         /*
2540          * create symlink from system interface device to bmc device
2541          * and back.
2542          */
2543         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
2544         if (rv) {
2545                 printk(KERN_ERR
2546                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2547                        rv);
2548                 goto out_err;
2549         }
2550
2551         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
2552         if (!intf->my_dev_name) {
2553                 rv = -ENOMEM;
2554                 printk(KERN_ERR
2555                        "ipmi_msghandler: allocate link from BMC: %d\n",
2556                        rv);
2557                 goto out_err;
2558         }
2559
2560         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
2561                                intf->my_dev_name);
2562         if (rv) {
2563                 kfree(intf->my_dev_name);
2564                 intf->my_dev_name = NULL;
2565                 printk(KERN_ERR
2566                        "ipmi_msghandler:"
2567                        " Unable to create symlink to bmc: %d\n",
2568                        rv);
2569                 goto out_err;
2570         }
2571
2572         return 0;
2573
2574 out_err:
2575         ipmi_bmc_unregister(intf);
2576         return rv;
2577 }
2578
2579 static int
2580 send_guid_cmd(ipmi_smi_t intf, int chan)
2581 {
2582         struct kernel_ipmi_msg            msg;
2583         struct ipmi_system_interface_addr si;
2584
2585         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2586         si.channel = IPMI_BMC_CHANNEL;
2587         si.lun = 0;
2588
2589         msg.netfn = IPMI_NETFN_APP_REQUEST;
2590         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2591         msg.data = NULL;
2592         msg.data_len = 0;
2593         return i_ipmi_request(NULL,
2594                               intf,
2595                               (struct ipmi_addr *) &si,
2596                               0,
2597                               &msg,
2598                               intf,
2599                               NULL,
2600                               NULL,
2601                               0,
2602                               intf->channels[0].address,
2603                               intf->channels[0].lun,
2604                               -1, 0);
2605 }
2606
2607 static void
2608 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2609 {
2610         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2611             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2612             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2613                 /* Not for me */
2614                 return;
2615
2616         if (msg->msg.data[0] != 0) {
2617                 /* Error from getting the GUID, the BMC doesn't have one. */
2618                 intf->bmc->guid_set = 0;
2619                 goto out;
2620         }
2621
2622         if (msg->msg.data_len < 17) {
2623                 intf->bmc->guid_set = 0;
2624                 printk(KERN_WARNING PFX
2625                        "guid_handler: The GUID response from the BMC was too"
2626                        " short, it was %d but should have been 17.  Assuming"
2627                        " GUID is not available.\n",
2628                        msg->msg.data_len);
2629                 goto out;
2630         }
2631
2632         memcpy(intf->bmc->guid, msg->msg.data, 16);
2633         intf->bmc->guid_set = 1;
2634  out:
2635         wake_up(&intf->waitq);
2636 }
2637
2638 static void
2639 get_guid(ipmi_smi_t intf)
2640 {
2641         int rv;
2642
2643         intf->bmc->guid_set = 0x2;
2644         intf->null_user_handler = guid_handler;
2645         rv = send_guid_cmd(intf, 0);
2646         if (rv)
2647                 /* Send failed, no GUID available. */
2648                 intf->bmc->guid_set = 0;
2649         else
2650                 wait_event(intf->waitq, intf->bmc->guid_set != 2);
2651
2652         intf->null_user_handler = NULL;
2653 }
2654
2655 static int
2656 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2657 {
2658         struct kernel_ipmi_msg            msg;
2659         unsigned char                     data[1];
2660         struct ipmi_system_interface_addr si;
2661
2662         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2663         si.channel = IPMI_BMC_CHANNEL;
2664         si.lun = 0;
2665
2666         msg.netfn = IPMI_NETFN_APP_REQUEST;
2667         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2668         msg.data = data;
2669         msg.data_len = 1;
2670         data[0] = chan;
2671         return i_ipmi_request(NULL,
2672                               intf,
2673                               (struct ipmi_addr *) &si,
2674                               0,
2675                               &msg,
2676                               intf,
2677                               NULL,
2678                               NULL,
2679                               0,
2680                               intf->channels[0].address,
2681                               intf->channels[0].lun,
2682                               -1, 0);
2683 }
2684
2685 static void
2686 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2687 {
2688         int rv = 0;
2689         int chan;
2690
2691         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2692             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2693             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2694                 /* It's the one we want */
2695                 if (msg->msg.data[0] != 0) {
2696                         /* Got an error from the channel, just go on. */
2697
2698                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2699                                 /*
2700                                  * If the MC does not support this
2701                                  * command, that is legal.  We just
2702                                  * assume it has one IPMB at channel
2703                                  * zero.
2704                                  */
2705                                 intf->channels[0].medium
2706                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2707                                 intf->channels[0].protocol
2708                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2709
2710                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2711                                 wake_up(&intf->waitq);
2712                                 goto out;
2713                         }
2714                         goto next_channel;
2715                 }
2716                 if (msg->msg.data_len < 4) {
2717                         /* Message not big enough, just go on. */
2718                         goto next_channel;
2719                 }
2720                 chan = intf->curr_channel;
2721                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2722                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2723
2724  next_channel:
2725                 intf->curr_channel++;
2726                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2727                         wake_up(&intf->waitq);
2728                 else
2729                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2730
2731                 if (rv) {
2732                         /* Got an error somehow, just give up. */
2733                         printk(KERN_WARNING PFX
2734                                "Error sending channel information for channel"
2735                                " %d: %d\n", intf->curr_channel, rv);
2736
2737                         intf->curr_channel = IPMI_MAX_CHANNELS;
2738                         wake_up(&intf->waitq);
2739                 }
2740         }
2741  out:
2742         return;
2743 }
2744
2745 static void ipmi_poll(ipmi_smi_t intf)
2746 {
2747         if (intf->handlers->poll)
2748                 intf->handlers->poll(intf->send_info);
2749         /* In case something came in */
2750         handle_new_recv_msgs(intf);
2751 }
2752
2753 void ipmi_poll_interface(ipmi_user_t user)
2754 {
2755         ipmi_poll(user->intf);
2756 }
2757 EXPORT_SYMBOL(ipmi_poll_interface);
2758
2759 int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
2760                       void                     *send_info,
2761                       struct ipmi_device_id    *device_id,
2762                       struct device            *si_dev,
2763                       unsigned char            slave_addr)
2764 {
2765         int              i, j;
2766         int              rv;
2767         ipmi_smi_t       intf;
2768         ipmi_smi_t       tintf;
2769         struct list_head *link;
2770
2771         /*
2772          * Make sure the driver is actually initialized, this handles
2773          * problems with initialization order.
2774          */
2775         if (!initialized) {
2776                 rv = ipmi_init_msghandler();
2777                 if (rv)
2778                         return rv;
2779                 /*
2780                  * The init code doesn't return an error if it was turned
2781                  * off, but it won't initialize.  Check that.
2782                  */
2783                 if (!initialized)
2784                         return -ENODEV;
2785         }
2786
2787         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2788         if (!intf)
2789                 return -ENOMEM;
2790
2791         intf->ipmi_version_major = ipmi_version_major(device_id);
2792         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2793
2794         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2795         if (!intf->bmc) {
2796                 kfree(intf);
2797                 return -ENOMEM;
2798         }
2799         intf->intf_num = -1; /* Mark it invalid for now. */
2800         kref_init(&intf->refcount);
2801         intf->bmc->id = *device_id;
2802         intf->si_dev = si_dev;
2803         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2804                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2805                 intf->channels[j].lun = 2;
2806         }
2807         if (slave_addr != 0)
2808                 intf->channels[0].address = slave_addr;
2809         INIT_LIST_HEAD(&intf->users);
2810         intf->handlers = handlers;
2811         intf->send_info = send_info;
2812         spin_lock_init(&intf->seq_lock);
2813         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2814                 intf->seq_table[j].inuse = 0;
2815                 intf->seq_table[j].seqid = 0;
2816         }
2817         intf->curr_seq = 0;
2818 #ifdef CONFIG_PROC_FS
2819         mutex_init(&intf->proc_entry_lock);
2820 #endif
2821         spin_lock_init(&intf->waiting_rcv_msgs_lock);
2822         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
2823         tasklet_init(&intf->recv_tasklet,
2824                      smi_recv_tasklet,
2825                      (unsigned long) intf);
2826         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2827         spin_lock_init(&intf->xmit_msgs_lock);
2828         INIT_LIST_HEAD(&intf->xmit_msgs);
2829         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
2830         spin_lock_init(&intf->events_lock);
2831         atomic_set(&intf->event_waiters, 0);
2832         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2833         INIT_LIST_HEAD(&intf->waiting_events);
2834         intf->waiting_events_count = 0;
2835         mutex_init(&intf->cmd_rcvrs_mutex);
2836         spin_lock_init(&intf->maintenance_mode_lock);
2837         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2838         init_waitqueue_head(&intf->waitq);
2839         for (i = 0; i < IPMI_NUM_STATS; i++)
2840                 atomic_set(&intf->stats[i], 0);
2841
2842         intf->proc_dir = NULL;
2843
2844         mutex_lock(&smi_watchers_mutex);
2845         mutex_lock(&ipmi_interfaces_mutex);
2846         /* Look for a hole in the numbers. */
2847         i = 0;
2848         link = &ipmi_interfaces;
2849         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2850                 if (tintf->intf_num != i) {
2851                         link = &tintf->link;
2852                         break;
2853                 }
2854                 i++;
2855         }
2856         /* Add the new interface in numeric order. */
2857         if (i == 0)
2858                 list_add_rcu(&intf->link, &ipmi_interfaces);
2859         else
2860                 list_add_tail_rcu(&intf->link, link);
2861
2862         rv = handlers->start_processing(send_info, intf);
2863         if (rv)
2864                 goto out;
2865
2866         get_guid(intf);
2867
2868         if ((intf->ipmi_version_major > 1)
2869                         || ((intf->ipmi_version_major == 1)
2870                             && (intf->ipmi_version_minor >= 5))) {
2871                 /*
2872                  * Start scanning the channels to see what is
2873                  * available.
2874                  */
2875                 intf->null_user_handler = channel_handler;
2876                 intf->curr_channel = 0;
2877                 rv = send_channel_info_cmd(intf, 0);
2878                 if (rv) {
2879                         printk(KERN_WARNING PFX
2880                                "Error sending channel information for channel"
2881                                " 0, %d\n", rv);
2882                         goto out;
2883                 }
2884
2885                 /* Wait for the channel info to be read. */
2886                 wait_event(intf->waitq,
2887                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2888                 intf->null_user_handler = NULL;
2889         } else {
2890                 /* Assume a single IPMB channel at zero. */
2891                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2892                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2893                 intf->curr_channel = IPMI_MAX_CHANNELS;
2894         }
2895
2896         rv = ipmi_bmc_register(intf, i);
2897
2898         if (rv == 0)
2899                 rv = add_proc_entries(intf, i);
2900
2901  out:
2902         if (rv) {
2903                 if (intf->proc_dir)
2904                         remove_proc_entries(intf);
2905                 intf->handlers = NULL;
2906                 list_del_rcu(&intf->link);
2907                 mutex_unlock(&ipmi_interfaces_mutex);
2908                 mutex_unlock(&smi_watchers_mutex);
2909                 synchronize_rcu();
2910                 kref_put(&intf->refcount, intf_free);
2911         } else {
2912                 /*
2913                  * Keep memory order straight for RCU readers.  Make
2914                  * sure everything else is committed to memory before
2915                  * setting intf_num to mark the interface valid.
2916                  */
2917                 smp_wmb();
2918                 intf->intf_num = i;
2919                 mutex_unlock(&ipmi_interfaces_mutex);
2920                 /* After this point the interface is legal to use. */
2921                 call_smi_watchers(i, intf->si_dev);
2922                 mutex_unlock(&smi_watchers_mutex);
2923         }
2924
2925         return rv;
2926 }
2927 EXPORT_SYMBOL(ipmi_register_smi);
2928
2929 static void deliver_smi_err_response(ipmi_smi_t intf,
2930                                      struct ipmi_smi_msg *msg,
2931                                      unsigned char err)
2932 {
2933         int rv;
2934         msg->rsp[0] = msg->data[0] | 4;
2935         msg->rsp[1] = msg->data[1];
2936         msg->rsp[2] = err;
2937         msg->rsp_size = 3;
2938
2939         /* This will never requeue, but it may ask us to free the message. */
2940         rv = handle_one_recv_msg(intf, msg);
2941         if (rv == 0)
2942                 ipmi_free_smi_msg(msg);
2943 }
2944
2945 static void cleanup_smi_msgs(ipmi_smi_t intf)
2946 {
2947         int              i;
2948         struct seq_table *ent;
2949         struct ipmi_smi_msg *msg;
2950         struct list_head *entry;
2951         struct list_head tmplist;
2952
2953         /* Clear out our transmit queues and hold the messages. */
2954         INIT_LIST_HEAD(&tmplist);
2955         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
2956         list_splice_tail(&intf->xmit_msgs, &tmplist);
2957
2958         /* Current message first, to preserve order */
2959         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
2960                 /* Wait for the message to clear out. */
2961                 schedule_timeout(1);
2962         }
2963
2964         /* No need for locks, the interface is down. */
2965
2966         /*
2967          * Return errors for all pending messages in queue and in the
2968          * tables waiting for remote responses.
2969          */
2970         while (!list_empty(&tmplist)) {
2971                 entry = tmplist.next;
2972                 list_del(entry);
2973                 msg = list_entry(entry, struct ipmi_smi_msg, link);
2974                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
2975         }
2976
2977         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2978                 ent = &(intf->seq_table[i]);
2979                 if (!ent->inuse)
2980                         continue;
2981                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2982         }
2983 }
2984
2985 int ipmi_unregister_smi(ipmi_smi_t intf)
2986 {
2987         struct ipmi_smi_watcher *w;
2988         int intf_num = intf->intf_num;
2989         ipmi_user_t user;
2990
2991         mutex_lock(&smi_watchers_mutex);
2992         mutex_lock(&ipmi_interfaces_mutex);
2993         intf->intf_num = -1;
2994         intf->in_shutdown = true;
2995         list_del_rcu(&intf->link);
2996         mutex_unlock(&ipmi_interfaces_mutex);
2997         synchronize_rcu();
2998
2999         cleanup_smi_msgs(intf);
3000
3001         /* Clean up the effects of users on the lower-level software. */
3002         mutex_lock(&ipmi_interfaces_mutex);
3003         rcu_read_lock();
3004         list_for_each_entry_rcu(user, &intf->users, link) {
3005                 module_put(intf->handlers->owner);
3006                 if (intf->handlers->dec_usecount)
3007                         intf->handlers->dec_usecount(intf->send_info);
3008         }
3009         rcu_read_unlock();
3010         intf->handlers = NULL;
3011         mutex_unlock(&ipmi_interfaces_mutex);
3012
3013         remove_proc_entries(intf);
3014         ipmi_bmc_unregister(intf);
3015
3016         /*
3017          * Call all the watcher interfaces to tell them that
3018          * an interface is gone.
3019          */
3020         list_for_each_entry(w, &smi_watchers, link)
3021                 w->smi_gone(intf_num);
3022         mutex_unlock(&smi_watchers_mutex);
3023
3024         kref_put(&intf->refcount, intf_free);
3025         return 0;
3026 }
3027 EXPORT_SYMBOL(ipmi_unregister_smi);
3028
3029 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3030                                    struct ipmi_smi_msg *msg)
3031 {
3032         struct ipmi_ipmb_addr ipmb_addr;
3033         struct ipmi_recv_msg  *recv_msg;
3034
3035         /*
3036          * This is 11, not 10, because the response must contain a
3037          * completion code.
3038          */
3039         if (msg->rsp_size < 11) {
3040                 /* Message not big enough, just ignore it. */
3041                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3042                 return 0;
3043         }
3044
3045         if (msg->rsp[2] != 0) {
3046                 /* An error getting the response, just ignore it. */
3047                 return 0;
3048         }
3049
3050         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3051         ipmb_addr.slave_addr = msg->rsp[6];
3052         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3053         ipmb_addr.lun = msg->rsp[7] & 3;
3054
3055         /*
3056          * It's a response from a remote entity.  Look up the sequence
3057          * number and handle the response.
3058          */
3059         if (intf_find_seq(intf,
3060                           msg->rsp[7] >> 2,
3061                           msg->rsp[3] & 0x0f,
3062                           msg->rsp[8],
3063                           (msg->rsp[4] >> 2) & (~1),
3064                           (struct ipmi_addr *) &(ipmb_addr),
3065                           &recv_msg)) {
3066                 /*
3067                  * We were unable to find the sequence number,
3068                  * so just nuke the message.
3069                  */
3070                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3071                 return 0;
3072         }
3073
3074         memcpy(recv_msg->msg_data,
3075                &(msg->rsp[9]),
3076                msg->rsp_size - 9);
3077         /*
3078          * The other fields matched, so no need to set them, except
3079          * for netfn, which needs to be the response that was
3080          * returned, not the request value.
3081          */
3082         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3083         recv_msg->msg.data = recv_msg->msg_data;
3084         recv_msg->msg.data_len = msg->rsp_size - 10;
3085         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3086         ipmi_inc_stat(intf, handled_ipmb_responses);
3087         deliver_response(recv_msg);
3088
3089         return 0;
3090 }
3091
3092 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3093                                    struct ipmi_smi_msg *msg)
3094 {
3095         struct cmd_rcvr          *rcvr;
3096         int                      rv = 0;
3097         unsigned char            netfn;
3098         unsigned char            cmd;
3099         unsigned char            chan;
3100         ipmi_user_t              user = NULL;
3101         struct ipmi_ipmb_addr    *ipmb_addr;
3102         struct ipmi_recv_msg     *recv_msg;
3103
3104         if (msg->rsp_size < 10) {
3105                 /* Message not big enough, just ignore it. */
3106                 ipmi_inc_stat(intf, invalid_commands);
3107                 return 0;
3108         }
3109
3110         if (msg->rsp[2] != 0) {
3111                 /* An error getting the response, just ignore it. */
3112                 return 0;
3113         }
3114
3115         netfn = msg->rsp[4] >> 2;
3116         cmd = msg->rsp[8];
3117         chan = msg->rsp[3] & 0xf;
3118
3119         rcu_read_lock();
3120         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3121         if (rcvr) {
3122                 user = rcvr->user;
3123                 kref_get(&user->refcount);
3124         } else
3125                 user = NULL;
3126         rcu_read_unlock();
3127
3128         if (user == NULL) {
3129                 /* We didn't find a user, deliver an error response. */
3130                 ipmi_inc_stat(intf, unhandled_commands);
3131
3132                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3133                 msg->data[1] = IPMI_SEND_MSG_CMD;
3134                 msg->data[2] = msg->rsp[3];
3135                 msg->data[3] = msg->rsp[6];
3136                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3137                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3138                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3139                 /* rqseq/lun */
3140                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3141                 msg->data[8] = msg->rsp[8]; /* cmd */
3142                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3143                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3144                 msg->data_size = 11;
3145
3146 #ifdef DEBUG_MSGING
3147         {
3148                 int m;
3149                 printk("Invalid command:");
3150                 for (m = 0; m < msg->data_size; m++)
3151                         printk(" %2.2x", msg->data[m]);
3152                 printk("\n");
3153         }
3154 #endif
3155                 rcu_read_lock();
3156                 if (!intf->in_shutdown) {
3157                         smi_send(intf, intf->handlers, msg, 0);
3158                         /*
3159                          * We used the message, so return the value
3160                          * that causes it to not be freed or
3161                          * queued.
3162                          */
3163                         rv = -1;
3164                 }
3165                 rcu_read_unlock();
3166         } else {
3167                 /* Deliver the message to the user. */
3168                 ipmi_inc_stat(intf, handled_commands);
3169
3170                 recv_msg = ipmi_alloc_recv_msg();
3171                 if (!recv_msg) {
3172                         /*
3173                          * We couldn't allocate memory for the
3174                          * message, so requeue it for handling
3175                          * later.
3176                          */
3177                         rv = 1;
3178                         kref_put(&user->refcount, free_user);
3179                 } else {
3180                         /* Extract the source address from the data. */
3181                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3182                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3183                         ipmb_addr->slave_addr = msg->rsp[6];
3184                         ipmb_addr->lun = msg->rsp[7] & 3;
3185                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3186
3187                         /*
3188                          * Extract the rest of the message information
3189                          * from the IPMB header.
3190                          */
3191                         recv_msg->user = user;
3192                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3193                         recv_msg->msgid = msg->rsp[7] >> 2;
3194                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3195                         recv_msg->msg.cmd = msg->rsp[8];
3196                         recv_msg->msg.data = recv_msg->msg_data;
3197
3198                         /*
3199                          * We chop off 10, not 9 bytes because the checksum
3200                          * at the end also needs to be removed.
3201                          */
3202                         recv_msg->msg.data_len = msg->rsp_size - 10;
3203                         memcpy(recv_msg->msg_data,
3204                                &(msg->rsp[9]),
3205                                msg->rsp_size - 10);
3206                         deliver_response(recv_msg);
3207                 }
3208         }
3209
3210         return rv;
3211 }
3212
3213 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3214                                   struct ipmi_smi_msg *msg)
3215 {
3216         struct ipmi_lan_addr  lan_addr;
3217         struct ipmi_recv_msg  *recv_msg;
3218
3219
3220         /*
3221          * This is 13, not 12, because the response must contain a
3222          * completion code.
3223          */
3224         if (msg->rsp_size < 13) {
3225                 /* Message not big enough, just ignore it. */
3226                 ipmi_inc_stat(intf, invalid_lan_responses);
3227                 return 0;
3228         }
3229
3230         if (msg->rsp[2] != 0) {
3231                 /* An error getting the response, just ignore it. */
3232                 return 0;
3233         }
3234
3235         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3236         lan_addr.session_handle = msg->rsp[4];
3237         lan_addr.remote_SWID = msg->rsp[8];
3238         lan_addr.local_SWID = msg->rsp[5];
3239         lan_addr.channel = msg->rsp[3] & 0x0f;
3240         lan_addr.privilege = msg->rsp[3] >> 4;
3241         lan_addr.lun = msg->rsp[9] & 3;
3242
3243         /*
3244          * It's a response from a remote entity.  Look up the sequence
3245          * number and handle the response.
3246          */
3247         if (intf_find_seq(intf,
3248                           msg->rsp[9] >> 2,
3249                           msg->rsp[3] & 0x0f,
3250                           msg->rsp[10],
3251                           (msg->rsp[6] >> 2) & (~1),
3252                           (struct ipmi_addr *) &(lan_addr),
3253                           &recv_msg)) {
3254                 /*
3255                  * We were unable to find the sequence number,
3256                  * so just nuke the message.
3257                  */
3258                 ipmi_inc_stat(intf, unhandled_lan_responses);
3259                 return 0;
3260         }
3261
3262         memcpy(recv_msg->msg_data,
3263                &(msg->rsp[11]),
3264                msg->rsp_size - 11);
3265         /*
3266          * The other fields matched, so no need to set them, except
3267          * for netfn, which needs to be the response that was
3268          * returned, not the request value.
3269          */
3270         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3271         recv_msg->msg.data = recv_msg->msg_data;
3272         recv_msg->msg.data_len = msg->rsp_size - 12;
3273         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3274         ipmi_inc_stat(intf, handled_lan_responses);
3275         deliver_response(recv_msg);
3276
3277         return 0;
3278 }
3279
3280 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3281                                   struct ipmi_smi_msg *msg)
3282 {
3283         struct cmd_rcvr          *rcvr;
3284         int                      rv = 0;
3285         unsigned char            netfn;
3286         unsigned char            cmd;
3287         unsigned char            chan;
3288         ipmi_user_t              user = NULL;
3289         struct ipmi_lan_addr     *lan_addr;
3290         struct ipmi_recv_msg     *recv_msg;
3291
3292         if (msg->rsp_size < 12) {
3293                 /* Message not big enough, just ignore it. */
3294                 ipmi_inc_stat(intf, invalid_commands);
3295                 return 0;
3296         }
3297
3298         if (msg->rsp[2] != 0) {
3299                 /* An error getting the response, just ignore it. */
3300                 return 0;
3301         }
3302
3303         netfn = msg->rsp[6] >> 2;
3304         cmd = msg->rsp[10];
3305         chan = msg->rsp[3] & 0xf;
3306
3307         rcu_read_lock();
3308         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3309         if (rcvr) {
3310                 user = rcvr->user;
3311                 kref_get(&user->refcount);
3312         } else
3313                 user = NULL;
3314         rcu_read_unlock();
3315
3316         if (user == NULL) {
3317                 /* We didn't find a user, just give up. */
3318                 ipmi_inc_stat(intf, unhandled_commands);
3319
3320                 /*
3321                  * Don't do anything with these messages, just allow
3322                  * them to be freed.
3323                  */
3324                 rv = 0;
3325         } else {
3326                 /* Deliver the message to the user. */
3327                 ipmi_inc_stat(intf, handled_commands);
3328
3329                 recv_msg = ipmi_alloc_recv_msg();
3330                 if (!recv_msg) {
3331                         /*
3332                          * We couldn't allocate memory for the
3333                          * message, so requeue it for handling later.
3334                          */
3335                         rv = 1;
3336                         kref_put(&user->refcount, free_user);
3337                 } else {
3338                         /* Extract the source address from the data. */
3339                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3340                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3341                         lan_addr->session_handle = msg->rsp[4];
3342                         lan_addr->remote_SWID = msg->rsp[8];
3343                         lan_addr->local_SWID = msg->rsp[5];
3344                         lan_addr->lun = msg->rsp[9] & 3;
3345                         lan_addr->channel = msg->rsp[3] & 0xf;
3346                         lan_addr->privilege = msg->rsp[3] >> 4;
3347
3348                         /*
3349                          * Extract the rest of the message information
3350                          * from the IPMB header.
3351                          */
3352                         recv_msg->user = user;
3353                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3354                         recv_msg->msgid = msg->rsp[9] >> 2;
3355                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3356                         recv_msg->msg.cmd = msg->rsp[10];
3357                         recv_msg->msg.data = recv_msg->msg_data;
3358
3359                         /*
3360                          * We chop off 12, not 11 bytes because the checksum
3361                          * at the end also needs to be removed.
3362                          */
3363                         recv_msg->msg.data_len = msg->rsp_size - 12;
3364                         memcpy(recv_msg->msg_data,
3365                                &(msg->rsp[11]),
3366                                msg->rsp_size - 12);
3367                         deliver_response(recv_msg);
3368                 }
3369         }
3370
3371         return rv;
3372 }
3373
3374 /*
3375  * This routine will handle "Get Message" command responses with
3376  * channels that use an OEM Medium. The message format belongs to
3377  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3378  * Chapter 22, sections 22.6 and 22.24 for more details.
3379  */
3380 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3381                                   struct ipmi_smi_msg *msg)
3382 {
3383         struct cmd_rcvr       *rcvr;
3384         int                   rv = 0;
3385         unsigned char         netfn;
3386         unsigned char         cmd;
3387         unsigned char         chan;
3388         ipmi_user_t           user = NULL;
3389         struct ipmi_system_interface_addr *smi_addr;
3390         struct ipmi_recv_msg  *recv_msg;
3391
3392         /*
3393          * We expect the OEM SW to perform error checking
3394          * so we just do some basic sanity checks
3395          */
3396         if (msg->rsp_size < 4) {
3397                 /* Message not big enough, just ignore it. */
3398                 ipmi_inc_stat(intf, invalid_commands);
3399                 return 0;
3400         }
3401
3402         if (msg->rsp[2] != 0) {
3403                 /* An error getting the response, just ignore it. */
3404                 return 0;
3405         }
3406
3407         /*
3408          * This is an OEM Message so the OEM needs to know how
3409          * handle the message. We do no interpretation.
3410          */
3411         netfn = msg->rsp[0] >> 2;
3412         cmd = msg->rsp[1];
3413         chan = msg->rsp[3] & 0xf;
3414
3415         rcu_read_lock();
3416         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3417         if (rcvr) {
3418                 user = rcvr->user;
3419                 kref_get(&user->refcount);
3420         } else
3421                 user = NULL;
3422         rcu_read_unlock();
3423
3424         if (user == NULL) {
3425                 /* We didn't find a user, just give up. */
3426                 ipmi_inc_stat(intf, unhandled_commands);
3427
3428                 /*
3429                  * Don't do anything with these messages, just allow
3430                  * them to be freed.
3431                  */
3432
3433                 rv = 0;
3434         } else {
3435                 /* Deliver the message to the user. */
3436                 ipmi_inc_stat(intf, handled_commands);
3437
3438                 recv_msg = ipmi_alloc_recv_msg();
3439                 if (!recv_msg) {
3440                         /*
3441                          * We couldn't allocate memory for the
3442                          * message, so requeue it for handling
3443                          * later.
3444                          */
3445                         rv = 1;
3446                         kref_put(&user->refcount, free_user);
3447                 } else {
3448                         /*
3449                          * OEM Messages are expected to be delivered via
3450                          * the system interface to SMS software.  We might
3451                          * need to visit this again depending on OEM
3452                          * requirements
3453                          */
3454                         smi_addr = ((struct ipmi_system_interface_addr *)
3455                                     &(recv_msg->addr));
3456                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3457                         smi_addr->channel = IPMI_BMC_CHANNEL;
3458                         smi_addr->lun = msg->rsp[0] & 3;
3459
3460                         recv_msg->user = user;
3461                         recv_msg->user_msg_data = NULL;
3462                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3463                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3464                         recv_msg->msg.cmd = msg->rsp[1];
3465                         recv_msg->msg.data = recv_msg->msg_data;
3466
3467                         /*
3468                          * The message starts at byte 4 which follows the
3469                          * the Channel Byte in the "GET MESSAGE" command
3470                          */
3471                         recv_msg->msg.data_len = msg->rsp_size - 4;
3472                         memcpy(recv_msg->msg_data,
3473                                &(msg->rsp[4]),
3474                                msg->rsp_size - 4);
3475                         deliver_response(recv_msg);
3476                 }
3477         }
3478
3479         return rv;
3480 }
3481
3482 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3483                                      struct ipmi_smi_msg  *msg)
3484 {
3485         struct ipmi_system_interface_addr *smi_addr;
3486
3487         recv_msg->msgid = 0;
3488         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3489         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3490         smi_addr->channel = IPMI_BMC_CHANNEL;
3491         smi_addr->lun = msg->rsp[0] & 3;
3492         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3493         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3494         recv_msg->msg.cmd = msg->rsp[1];
3495         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3496         recv_msg->msg.data = recv_msg->msg_data;
3497         recv_msg->msg.data_len = msg->rsp_size - 3;
3498 }
3499
3500 static int handle_read_event_rsp(ipmi_smi_t          intf,
3501                                  struct ipmi_smi_msg *msg)
3502 {
3503         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3504         struct list_head     msgs;
3505         ipmi_user_t          user;
3506         int                  rv = 0;
3507         int                  deliver_count = 0;
3508         unsigned long        flags;
3509
3510         if (msg->rsp_size < 19) {
3511                 /* Message is too small to be an IPMB event. */
3512                 ipmi_inc_stat(intf, invalid_events);
3513                 return 0;
3514         }
3515
3516         if (msg->rsp[2] != 0) {
3517                 /* An error getting the event, just ignore it. */
3518                 return 0;
3519         }
3520
3521         INIT_LIST_HEAD(&msgs);
3522
3523         spin_lock_irqsave(&intf->events_lock, flags);
3524
3525         ipmi_inc_stat(intf, events);
3526
3527         /*
3528          * Allocate and fill in one message for every user that is
3529          * getting events.
3530          */
3531         rcu_read_lock();
3532         list_for_each_entry_rcu(user, &intf->users, link) {
3533                 if (!user->gets_events)
3534                         continue;
3535
3536                 recv_msg = ipmi_alloc_recv_msg();
3537                 if (!recv_msg) {
3538                         rcu_read_unlock();
3539                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3540                                                  link) {
3541                                 list_del(&recv_msg->link);
3542                                 ipmi_free_recv_msg(recv_msg);
3543                         }
3544                         /*
3545                          * We couldn't allocate memory for the
3546                          * message, so requeue it for handling
3547                          * later.
3548                          */
3549                         rv = 1;
3550                         goto out;
3551                 }
3552
3553                 deliver_count++;
3554
3555                 copy_event_into_recv_msg(recv_msg, msg);
3556                 recv_msg->user = user;
3557                 kref_get(&user->refcount);
3558                 list_add_tail(&(recv_msg->link), &msgs);
3559         }
3560         rcu_read_unlock();
3561
3562         if (deliver_count) {
3563                 /* Now deliver all the messages. */
3564                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3565                         list_del(&recv_msg->link);
3566                         deliver_response(recv_msg);
3567                 }
3568         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3569                 /*
3570                  * No one to receive the message, put it in queue if there's
3571                  * not already too many things in the queue.
3572                  */
3573                 recv_msg = ipmi_alloc_recv_msg();
3574                 if (!recv_msg) {
3575                         /*
3576                          * We couldn't allocate memory for the
3577                          * message, so requeue it for handling
3578                          * later.
3579                          */
3580                         rv = 1;
3581                         goto out;
3582                 }
3583
3584                 copy_event_into_recv_msg(recv_msg, msg);
3585                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3586                 intf->waiting_events_count++;
3587         } else if (!intf->event_msg_printed) {
3588                 /*
3589                  * There's too many things in the queue, discard this
3590                  * message.
3591                  */
3592                 printk(KERN_WARNING PFX "Event queue full, discarding"
3593                        " incoming events\n");
3594                 intf->event_msg_printed = 1;
3595         }
3596
3597  out:
3598         spin_unlock_irqrestore(&(intf->events_lock), flags);
3599
3600         return rv;
3601 }
3602
3603 static int handle_bmc_rsp(ipmi_smi_t          intf,
3604                           struct ipmi_smi_msg *msg)
3605 {
3606         struct ipmi_recv_msg *recv_msg;
3607         struct ipmi_user     *user;
3608
3609         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3610         if (recv_msg == NULL) {
3611                 printk(KERN_WARNING
3612                        "IPMI message received with no owner. This\n"
3613                        "could be because of a malformed message, or\n"
3614                        "because of a hardware error.  Contact your\n"
3615                        "hardware vender for assistance\n");
3616                 return 0;
3617         }
3618
3619         user = recv_msg->user;
3620         /* Make sure the user still exists. */
3621         if (user && !user->valid) {
3622                 /* The user for the message went away, so give up. */
3623                 ipmi_inc_stat(intf, unhandled_local_responses);
3624                 ipmi_free_recv_msg(recv_msg);
3625         } else {
3626                 struct ipmi_system_interface_addr *smi_addr;
3627
3628                 ipmi_inc_stat(intf, handled_local_responses);
3629                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3630                 recv_msg->msgid = msg->msgid;
3631                 smi_addr = ((struct ipmi_system_interface_addr *)
3632                             &(recv_msg->addr));
3633                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3634                 smi_addr->channel = IPMI_BMC_CHANNEL;
3635                 smi_addr->lun = msg->rsp[0] & 3;
3636                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3637                 recv_msg->msg.cmd = msg->rsp[1];
3638                 memcpy(recv_msg->msg_data,
3639                        &(msg->rsp[2]),
3640                        msg->rsp_size - 2);
3641                 recv_msg->msg.data = recv_msg->msg_data;
3642                 recv_msg->msg.data_len = msg->rsp_size - 2;
3643                 deliver_response(recv_msg);
3644         }
3645
3646         return 0;
3647 }
3648
3649 /*
3650  * Handle a received message.  Return 1 if the message should be requeued,
3651  * 0 if the message should be freed, or -1 if the message should not
3652  * be freed or requeued.
3653  */
3654 static int handle_one_recv_msg(ipmi_smi_t          intf,
3655                                struct ipmi_smi_msg *msg)
3656 {
3657         int requeue;
3658         int chan;
3659
3660 #ifdef DEBUG_MSGING
3661         int m;
3662         printk("Recv:");
3663         for (m = 0; m < msg->rsp_size; m++)
3664                 printk(" %2.2x", msg->rsp[m]);
3665         printk("\n");
3666 #endif
3667         if (msg->rsp_size < 2) {
3668                 /* Message is too small to be correct. */
3669                 printk(KERN_WARNING PFX "BMC returned to small a message"
3670                        " for netfn %x cmd %x, got %d bytes\n",
3671                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3672
3673                 /* Generate an error response for the message. */
3674                 msg->rsp[0] = msg->data[0] | (1 << 2);
3675                 msg->rsp[1] = msg->data[1];
3676                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3677                 msg->rsp_size = 3;
3678         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3679                    || (msg->rsp[1] != msg->data[1])) {
3680                 /*
3681                  * The NetFN and Command in the response is not even
3682                  * marginally correct.
3683                  */
3684                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3685                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3686                        (msg->data[0] >> 2) | 1, msg->data[1],
3687                        msg->rsp[0] >> 2, msg->rsp[1]);
3688
3689                 /* Generate an error response for the message. */
3690                 msg->rsp[0] = msg->data[0] | (1 << 2);
3691                 msg->rsp[1] = msg->data[1];
3692                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3693                 msg->rsp_size = 3;
3694         }
3695
3696         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3697             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3698             && (msg->user_data != NULL)) {
3699                 /*
3700                  * It's a response to a response we sent.  For this we
3701                  * deliver a send message response to the user.
3702                  */
3703                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3704
3705                 requeue = 0;
3706                 if (msg->rsp_size < 2)
3707                         /* Message is too small to be correct. */
3708                         goto out;
3709
3710                 chan = msg->data[2] & 0x0f;
3711                 if (chan >= IPMI_MAX_CHANNELS)
3712                         /* Invalid channel number */
3713                         goto out;
3714
3715                 if (!recv_msg)
3716                         goto out;
3717
3718                 /* Make sure the user still exists. */
3719                 if (!recv_msg->user || !recv_msg->user->valid)
3720                         goto out;
3721
3722                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3723                 recv_msg->msg.data = recv_msg->msg_data;
3724                 recv_msg->msg.data_len = 1;
3725                 recv_msg->msg_data[0] = msg->rsp[2];
3726                 deliver_response(recv_msg);
3727         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3728                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3729                 /* It's from the receive queue. */
3730                 chan = msg->rsp[3] & 0xf;
3731                 if (chan >= IPMI_MAX_CHANNELS) {
3732                         /* Invalid channel number */
3733                         requeue = 0;
3734                         goto out;
3735                 }
3736
3737                 /*
3738                  * We need to make sure the channels have been initialized.
3739                  * The channel_handler routine will set the "curr_channel"
3740                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3741                  * channels for this interface have been initialized.
3742                  */
3743                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3744                         requeue = 0; /* Throw the message away */
3745                         goto out;
3746                 }
3747
3748                 switch (intf->channels[chan].medium) {
3749                 case IPMI_CHANNEL_MEDIUM_IPMB:
3750                         if (msg->rsp[4] & 0x04) {
3751                                 /*
3752                                  * It's a response, so find the
3753                                  * requesting message and send it up.
3754                                  */
3755                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3756                         } else {
3757                                 /*
3758                                  * It's a command to the SMS from some other
3759                                  * entity.  Handle that.
3760                                  */
3761                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3762                         }
3763                         break;
3764
3765                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3766                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3767                         if (msg->rsp[6] & 0x04) {
3768                                 /*
3769                                  * It's a response, so find the
3770                                  * requesting message and send it up.
3771                                  */
3772                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3773                         } else {
3774                                 /*
3775                                  * It's a command to the SMS from some other
3776                                  * entity.  Handle that.
3777                                  */
3778                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3779                         }
3780                         break;
3781
3782                 default:
3783                         /* Check for OEM Channels.  Clients had better
3784                            register for these commands. */
3785                         if ((intf->channels[chan].medium
3786                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3787                             && (intf->channels[chan].medium
3788                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3789                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3790                         } else {
3791                                 /*
3792                                  * We don't handle the channel type, so just
3793                                  * free the message.
3794                                  */
3795                                 requeue = 0;
3796                         }
3797                 }
3798
3799         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3800                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3801                 /* It's an asynchronous event. */
3802                 requeue = handle_read_event_rsp(intf, msg);
3803         } else {
3804                 /* It's a response from the local BMC. */
3805                 requeue = handle_bmc_rsp(intf, msg);
3806         }
3807
3808  out:
3809         return requeue;
3810 }
3811
3812 /*
3813  * If there are messages in the queue or pretimeouts, handle them.
3814  */
3815 static void handle_new_recv_msgs(ipmi_smi_t intf)
3816 {
3817         struct ipmi_smi_msg  *smi_msg;
3818         unsigned long        flags = 0;
3819         int                  rv;
3820         int                  run_to_completion = intf->run_to_completion;
3821
3822         /* See if any waiting messages need to be processed. */
3823         if (!run_to_completion)
3824                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3825         while (!list_empty(&intf->waiting_rcv_msgs)) {
3826                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
3827                                      struct ipmi_smi_msg, link);
3828                 list_del(&smi_msg->link);
3829                 if (!run_to_completion)
3830                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3831                                                flags);
3832                 rv = handle_one_recv_msg(intf, smi_msg);
3833                 if (!run_to_completion)
3834                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3835                 if (rv > 0) {
3836                         /*
3837                          * To preserve message order, quit if we
3838                          * can't handle a message.  Add the message
3839                          * back at the head, this is safe because this
3840                          * tasklet is the only thing that pulls the
3841                          * messages.
3842                          */
3843                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
3844                         break;
3845                 } else {
3846                         if (rv == 0)
3847                                 /* Message handled */
3848                                 ipmi_free_smi_msg(smi_msg);
3849                         /* If rv < 0, fatal error, del but don't free. */
3850                 }
3851         }
3852         if (!run_to_completion)
3853                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3854
3855         /*
3856          * If the pretimout count is non-zero, decrement one from it and
3857          * deliver pretimeouts to all the users.
3858          */
3859         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3860                 ipmi_user_t user;
3861
3862                 rcu_read_lock();
3863                 list_for_each_entry_rcu(user, &intf->users, link) {
3864                         if (user->handler->ipmi_watchdog_pretimeout)
3865                                 user->handler->ipmi_watchdog_pretimeout(
3866                                         user->handler_data);
3867                 }
3868                 rcu_read_unlock();
3869         }
3870 }
3871
3872 static void smi_recv_tasklet(unsigned long val)
3873 {
3874         unsigned long flags = 0; /* keep us warning-free. */
3875         ipmi_smi_t intf = (ipmi_smi_t) val;
3876         int run_to_completion = intf->run_to_completion;
3877         struct ipmi_smi_msg *newmsg = NULL;
3878
3879         /*
3880          * Start the next message if available.
3881          *
3882          * Do this here, not in the actual receiver, because we may deadlock
3883          * because the lower layer is allowed to hold locks while calling
3884          * message delivery.
3885          */
3886
3887         rcu_read_lock();
3888
3889         if (!run_to_completion)
3890                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3891         if (intf->curr_msg == NULL && !intf->in_shutdown) {
3892                 struct list_head *entry = NULL;
3893
3894                 /* Pick the high priority queue first. */
3895                 if (!list_empty(&intf->hp_xmit_msgs))
3896                         entry = intf->hp_xmit_msgs.next;
3897                 else if (!list_empty(&intf->xmit_msgs))
3898                         entry = intf->xmit_msgs.next;
3899
3900                 if (entry) {
3901                         list_del(entry);
3902                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
3903                         intf->curr_msg = newmsg;
3904                 }
3905         }
3906         if (!run_to_completion)
3907                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3908         if (newmsg)
3909                 intf->handlers->sender(intf->send_info, newmsg);
3910
3911         rcu_read_unlock();
3912
3913         handle_new_recv_msgs(intf);
3914 }
3915
3916 /* Handle a new message from the lower layer. */
3917 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3918                            struct ipmi_smi_msg *msg)
3919 {
3920         unsigned long flags = 0; /* keep us warning-free. */
3921         int run_to_completion = intf->run_to_completion;
3922
3923         if ((msg->data_size >= 2)
3924             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3925             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3926             && (msg->user_data == NULL)) {
3927
3928                 if (intf->in_shutdown)
3929                         goto free_msg;
3930
3931                 /*
3932                  * This is the local response to a command send, start
3933                  * the timer for these.  The user_data will not be
3934                  * NULL if this is a response send, and we will let
3935                  * response sends just go through.
3936                  */
3937
3938                 /*
3939                  * Check for errors, if we get certain errors (ones
3940                  * that mean basically we can try again later), we
3941                  * ignore them and start the timer.  Otherwise we
3942                  * report the error immediately.
3943                  */
3944                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3945                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3946                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3947                     && (msg->rsp[2] != IPMI_BUS_ERR)
3948                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3949                         int chan = msg->rsp[3] & 0xf;
3950
3951                         /* Got an error sending the message, handle it. */
3952                         if (chan >= IPMI_MAX_CHANNELS)
3953                                 ; /* This shouldn't happen */
3954                         else if ((intf->channels[chan].medium
3955                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3956                                  || (intf->channels[chan].medium
3957                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3958                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3959                         else
3960                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3961                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3962                 } else
3963                         /* The message was sent, start the timer. */
3964                         intf_start_seq_timer(intf, msg->msgid);
3965
3966 free_msg:
3967                 ipmi_free_smi_msg(msg);
3968         } else {
3969                 /*
3970                  * To preserve message order, we keep a queue and deliver from
3971                  * a tasklet.
3972                  */
3973                 if (!run_to_completion)
3974                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3975                 list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
3976                 if (!run_to_completion)
3977                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3978                                                flags);
3979         }
3980
3981         if (!run_to_completion)
3982                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3983         /*
3984          * We can get an asynchronous event or receive message in addition
3985          * to commands we send.
3986          */
3987         if (msg == intf->curr_msg)
3988                 intf->curr_msg = NULL;
3989         if (!run_to_completion)
3990                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3991
3992         if (run_to_completion)
3993                 smi_recv_tasklet((unsigned long) intf);
3994         else
3995                 tasklet_schedule(&intf->recv_tasklet);
3996 }
3997 EXPORT_SYMBOL(ipmi_smi_msg_received);
3998
3999 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
4000 {
4001         if (intf->in_shutdown)
4002                 return;
4003
4004         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
4005         tasklet_schedule(&intf->recv_tasklet);
4006 }
4007 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4008
4009 static struct ipmi_smi_msg *
4010 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
4011                   unsigned char seq, long seqid)
4012 {
4013         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4014         if (!smi_msg)
4015                 /*
4016                  * If we can't allocate the message, then just return, we
4017                  * get 4 retries, so this should be ok.
4018                  */
4019                 return NULL;
4020
4021         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4022         smi_msg->data_size = recv_msg->msg.data_len;
4023         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4024
4025 #ifdef DEBUG_MSGING
4026         {
4027                 int m;
4028                 printk("Resend: ");
4029                 for (m = 0; m < smi_msg->data_size; m++)
4030                         printk(" %2.2x", smi_msg->data[m]);
4031                 printk("\n");
4032         }
4033 #endif
4034         return smi_msg;
4035 }
4036
4037 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
4038                               struct list_head *timeouts,
4039                               unsigned long timeout_period,
4040                               int slot, unsigned long *flags,
4041                               unsigned int *waiting_msgs)
4042 {
4043         struct ipmi_recv_msg     *msg;
4044         const struct ipmi_smi_handlers *handlers;
4045
4046         if (intf->in_shutdown)
4047                 return;
4048
4049         if (!ent->inuse)
4050                 return;
4051
4052         if (timeout_period < ent->timeout) {
4053                 ent->timeout -= timeout_period;
4054                 (*waiting_msgs)++;
4055                 return;
4056         }
4057
4058         if (ent->retries_left == 0) {
4059                 /* The message has used all its retries. */
4060                 ent->inuse = 0;
4061                 msg = ent->recv_msg;
4062                 list_add_tail(&msg->link, timeouts);
4063                 if (ent->broadcast)
4064                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4065                 else if (is_lan_addr(&ent->recv_msg->addr))
4066                         ipmi_inc_stat(intf, timed_out_lan_commands);
4067                 else
4068                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4069         } else {
4070                 struct ipmi_smi_msg *smi_msg;
4071                 /* More retries, send again. */
4072
4073                 (*waiting_msgs)++;
4074
4075                 /*
4076                  * Start with the max timer, set to normal timer after
4077                  * the message is sent.
4078                  */
4079                 ent->timeout = MAX_MSG_TIMEOUT;
4080                 ent->retries_left--;
4081                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4082                                             ent->seqid);
4083                 if (!smi_msg) {
4084                         if (is_lan_addr(&ent->recv_msg->addr))
4085                                 ipmi_inc_stat(intf,
4086                                               dropped_rexmit_lan_commands);
4087                         else
4088                                 ipmi_inc_stat(intf,
4089                                               dropped_rexmit_ipmb_commands);
4090                         return;
4091                 }
4092
4093                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4094
4095                 /*
4096                  * Send the new message.  We send with a zero
4097                  * priority.  It timed out, I doubt time is that
4098                  * critical now, and high priority messages are really
4099                  * only for messages to the local MC, which don't get
4100                  * resent.
4101                  */
4102                 handlers = intf->handlers;
4103                 if (handlers) {
4104                         if (is_lan_addr(&ent->recv_msg->addr))
4105                                 ipmi_inc_stat(intf,
4106                                               retransmitted_lan_commands);
4107                         else
4108                                 ipmi_inc_stat(intf,
4109                                               retransmitted_ipmb_commands);
4110
4111                         smi_send(intf, handlers, smi_msg, 0);
4112                 } else
4113                         ipmi_free_smi_msg(smi_msg);
4114
4115                 spin_lock_irqsave(&intf->seq_lock, *flags);
4116         }
4117 }
4118
4119 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf,
4120                                          unsigned long timeout_period)
4121 {
4122         struct list_head     timeouts;
4123         struct ipmi_recv_msg *msg, *msg2;
4124         unsigned long        flags;
4125         int                  i;
4126         unsigned int         waiting_msgs = 0;
4127
4128         /*
4129          * Go through the seq table and find any messages that
4130          * have timed out, putting them in the timeouts
4131          * list.
4132          */
4133         INIT_LIST_HEAD(&timeouts);
4134         spin_lock_irqsave(&intf->seq_lock, flags);
4135         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4136                 check_msg_timeout(intf, &(intf->seq_table[i]),
4137                                   &timeouts, timeout_period, i,
4138                                   &flags, &waiting_msgs);
4139         spin_unlock_irqrestore(&intf->seq_lock, flags);
4140
4141         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4142                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4143
4144         /*
4145          * Maintenance mode handling.  Check the timeout
4146          * optimistically before we claim the lock.  It may
4147          * mean a timeout gets missed occasionally, but that
4148          * only means the timeout gets extended by one period
4149          * in that case.  No big deal, and it avoids the lock
4150          * most of the time.
4151          */
4152         if (intf->auto_maintenance_timeout > 0) {
4153                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4154                 if (intf->auto_maintenance_timeout > 0) {
4155                         intf->auto_maintenance_timeout
4156                                 -= timeout_period;
4157                         if (!intf->maintenance_mode
4158                             && (intf->auto_maintenance_timeout <= 0)) {
4159                                 intf->maintenance_mode_enable = false;
4160                                 maintenance_mode_update(intf);
4161                         }
4162                 }
4163                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4164                                        flags);
4165         }
4166
4167         tasklet_schedule(&intf->recv_tasklet);
4168
4169         return waiting_msgs;
4170 }
4171
4172 static void ipmi_request_event(ipmi_smi_t intf)
4173 {
4174         /* No event requests when in maintenance mode. */
4175         if (intf->maintenance_mode_enable)
4176                 return;
4177
4178         if (!intf->in_shutdown)
4179                 intf->handlers->request_events(intf->send_info);
4180 }
4181
4182 static struct timer_list ipmi_timer;
4183
4184 static atomic_t stop_operation;
4185
4186 static void ipmi_timeout(unsigned long data)
4187 {
4188         ipmi_smi_t intf;
4189         int nt = 0;
4190
4191         if (atomic_read(&stop_operation))
4192                 return;
4193
4194         rcu_read_lock();
4195         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4196                 int lnt = 0;
4197
4198                 if (atomic_read(&intf->event_waiters)) {
4199                         intf->ticks_to_req_ev--;
4200                         if (intf->ticks_to_req_ev == 0) {
4201                                 ipmi_request_event(intf);
4202                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4203                         }
4204                         lnt++;
4205                 }
4206
4207                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4208
4209                 lnt = !!lnt;
4210                 if (lnt != intf->last_needs_timer &&
4211                                         intf->handlers->set_need_watch)
4212                         intf->handlers->set_need_watch(intf->send_info, lnt);
4213                 intf->last_needs_timer = lnt;
4214
4215                 nt += lnt;
4216         }
4217         rcu_read_unlock();
4218
4219         if (nt)
4220                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4221 }
4222
4223 static void need_waiter(ipmi_smi_t intf)
4224 {
4225         /* Racy, but worst case we start the timer twice. */
4226         if (!timer_pending(&ipmi_timer))
4227                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4228 }
4229
4230 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4231 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4232
4233 static void free_smi_msg(struct ipmi_smi_msg *msg)
4234 {
4235         atomic_dec(&smi_msg_inuse_count);
4236         kfree(msg);
4237 }
4238
4239 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4240 {
4241         struct ipmi_smi_msg *rv;
4242         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4243         if (rv) {
4244                 rv->done = free_smi_msg;
4245                 rv->user_data = NULL;
4246                 atomic_inc(&smi_msg_inuse_count);
4247         }
4248         return rv;
4249 }
4250 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4251
4252 static void free_recv_msg(struct ipmi_recv_msg *msg)
4253 {
4254         atomic_dec(&recv_msg_inuse_count);
4255         kfree(msg);
4256 }
4257
4258 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4259 {
4260         struct ipmi_recv_msg *rv;
4261
4262         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4263         if (rv) {
4264                 rv->user = NULL;
4265                 rv->done = free_recv_msg;
4266                 atomic_inc(&recv_msg_inuse_count);
4267         }
4268         return rv;
4269 }
4270
4271 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4272 {
4273         if (msg->user)
4274                 kref_put(&msg->user->refcount, free_user);
4275         msg->done(msg);
4276 }
4277 EXPORT_SYMBOL(ipmi_free_recv_msg);
4278
4279 #ifdef CONFIG_IPMI_PANIC_EVENT
4280
4281 static atomic_t panic_done_count = ATOMIC_INIT(0);
4282
4283 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4284 {
4285         atomic_dec(&panic_done_count);
4286 }
4287
4288 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4289 {
4290         atomic_dec(&panic_done_count);
4291 }
4292
4293 /*
4294  * Inside a panic, send a message and wait for a response.
4295  */
4296 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4297                                         struct ipmi_addr     *addr,
4298                                         struct kernel_ipmi_msg *msg)
4299 {
4300         struct ipmi_smi_msg  smi_msg;
4301         struct ipmi_recv_msg recv_msg;
4302         int rv;
4303
4304         smi_msg.done = dummy_smi_done_handler;
4305         recv_msg.done = dummy_recv_done_handler;
4306         atomic_add(2, &panic_done_count);
4307         rv = i_ipmi_request(NULL,
4308                             intf,
4309                             addr,
4310                             0,
4311                             msg,
4312                             intf,
4313                             &smi_msg,
4314                             &recv_msg,
4315                             0,
4316                             intf->channels[0].address,
4317                             intf->channels[0].lun,
4318                             0, 1); /* Don't retry, and don't wait. */
4319         if (rv)
4320                 atomic_sub(2, &panic_done_count);
4321         else if (intf->handlers->flush_messages)
4322                 intf->handlers->flush_messages(intf->send_info);
4323
4324         while (atomic_read(&panic_done_count) != 0)
4325                 ipmi_poll(intf);
4326 }
4327
4328 #ifdef CONFIG_IPMI_PANIC_STRING
4329 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4330 {
4331         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4332             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4333             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4334             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4335                 /* A get event receiver command, save it. */
4336                 intf->event_receiver = msg->msg.data[1];
4337                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4338         }
4339 }
4340
4341 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4342 {
4343         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4344             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4345             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4346             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4347                 /*
4348                  * A get device id command, save if we are an event
4349                  * receiver or generator.
4350                  */
4351                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4352                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4353         }
4354 }
4355 #endif
4356
4357 static void send_panic_events(char *str)
4358 {
4359         struct kernel_ipmi_msg            msg;
4360         ipmi_smi_t                        intf;
4361         unsigned char                     data[16];
4362         struct ipmi_system_interface_addr *si;
4363         struct ipmi_addr                  addr;
4364
4365         si = (struct ipmi_system_interface_addr *) &addr;
4366         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4367         si->channel = IPMI_BMC_CHANNEL;
4368         si->lun = 0;
4369
4370         /* Fill in an event telling that we have failed. */
4371         msg.netfn = 0x04; /* Sensor or Event. */
4372         msg.cmd = 2; /* Platform event command. */
4373         msg.data = data;
4374         msg.data_len = 8;
4375         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4376         data[1] = 0x03; /* This is for IPMI 1.0. */
4377         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4378         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4379         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4380
4381         /*
4382          * Put a few breadcrumbs in.  Hopefully later we can add more things
4383          * to make the panic events more useful.
4384          */
4385         if (str) {
4386                 data[3] = str[0];
4387                 data[6] = str[1];
4388                 data[7] = str[2];
4389         }
4390
4391         /* For every registered interface, send the event. */
4392         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4393                 if (!intf->handlers)
4394                         /* Interface is not ready. */
4395                         continue;
4396
4397                 /* Send the event announcing the panic. */
4398                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4399         }
4400
4401 #ifdef CONFIG_IPMI_PANIC_STRING
4402         /*
4403          * On every interface, dump a bunch of OEM event holding the
4404          * string.
4405          */
4406         if (!str)
4407                 return;
4408
4409         /* For every registered interface, send the event. */
4410         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4411                 char                  *p = str;
4412                 struct ipmi_ipmb_addr *ipmb;
4413                 int                   j;
4414
4415                 if (intf->intf_num == -1)
4416                         /* Interface was not ready yet. */
4417                         continue;
4418
4419                 /*
4420                  * intf_num is used as an marker to tell if the
4421                  * interface is valid.  Thus we need a read barrier to
4422                  * make sure data fetched before checking intf_num
4423                  * won't be used.
4424                  */
4425                 smp_rmb();
4426
4427                 /*
4428                  * First job here is to figure out where to send the
4429                  * OEM events.  There's no way in IPMI to send OEM
4430                  * events using an event send command, so we have to
4431                  * find the SEL to put them in and stick them in
4432                  * there.
4433                  */
4434
4435                 /* Get capabilities from the get device id. */
4436                 intf->local_sel_device = 0;
4437                 intf->local_event_generator = 0;
4438                 intf->event_receiver = 0;
4439
4440                 /* Request the device info from the local MC. */
4441                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4442                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4443                 msg.data = NULL;
4444                 msg.data_len = 0;
4445                 intf->null_user_handler = device_id_fetcher;
4446                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4447
4448                 if (intf->local_event_generator) {
4449                         /* Request the event receiver from the local MC. */
4450                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4451                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4452                         msg.data = NULL;
4453                         msg.data_len = 0;
4454                         intf->null_user_handler = event_receiver_fetcher;
4455                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4456                 }
4457                 intf->null_user_handler = NULL;
4458
4459                 /*
4460                  * Validate the event receiver.  The low bit must not
4461                  * be 1 (it must be a valid IPMB address), it cannot
4462                  * be zero, and it must not be my address.
4463                  */
4464                 if (((intf->event_receiver & 1) == 0)
4465                     && (intf->event_receiver != 0)
4466                     && (intf->event_receiver != intf->channels[0].address)) {
4467                         /*
4468                          * The event receiver is valid, send an IPMB
4469                          * message.
4470                          */
4471                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4472                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4473                         ipmb->channel = 0; /* FIXME - is this right? */
4474                         ipmb->lun = intf->event_receiver_lun;
4475                         ipmb->slave_addr = intf->event_receiver;
4476                 } else if (intf->local_sel_device) {
4477                         /*
4478                          * The event receiver was not valid (or was
4479                          * me), but I am an SEL device, just dump it
4480                          * in my SEL.
4481                          */
4482                         si = (struct ipmi_system_interface_addr *) &addr;
4483                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4484                         si->channel = IPMI_BMC_CHANNEL;
4485                         si->lun = 0;
4486                 } else
4487                         continue; /* No where to send the event. */
4488
4489                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4490                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4491                 msg.data = data;
4492                 msg.data_len = 16;
4493
4494                 j = 0;
4495                 while (*p) {
4496                         int size = strlen(p);
4497
4498                         if (size > 11)
4499                                 size = 11;
4500                         data[0] = 0;
4501                         data[1] = 0;
4502                         data[2] = 0xf0; /* OEM event without timestamp. */
4503                         data[3] = intf->channels[0].address;
4504                         data[4] = j++; /* sequence # */
4505                         /*
4506                          * Always give 11 bytes, so strncpy will fill
4507                          * it with zeroes for me.
4508                          */
4509                         strncpy(data+5, p, 11);
4510                         p += size;
4511
4512                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4513                 }
4514         }
4515 #endif /* CONFIG_IPMI_PANIC_STRING */
4516 }
4517 #endif /* CONFIG_IPMI_PANIC_EVENT */
4518
4519 static int has_panicked;
4520
4521 static int panic_event(struct notifier_block *this,
4522                        unsigned long         event,
4523                        void                  *ptr)
4524 {
4525         ipmi_smi_t intf;
4526
4527         if (has_panicked)
4528                 return NOTIFY_DONE;
4529         has_panicked = 1;
4530
4531         /* For every registered interface, set it to run to completion. */
4532         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4533                 if (!intf->handlers)
4534                         /* Interface is not ready. */
4535                         continue;
4536
4537                 /*
4538                  * If we were interrupted while locking xmit_msgs_lock or
4539                  * waiting_rcv_msgs_lock, the corresponding list may be
4540                  * corrupted.  In this case, drop items on the list for
4541                  * the safety.
4542                  */
4543                 if (!spin_trylock(&intf->xmit_msgs_lock)) {
4544                         INIT_LIST_HEAD(&intf->xmit_msgs);
4545                         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
4546                 } else
4547                         spin_unlock(&intf->xmit_msgs_lock);
4548
4549                 if (!spin_trylock(&intf->waiting_rcv_msgs_lock))
4550                         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
4551                 else
4552                         spin_unlock(&intf->waiting_rcv_msgs_lock);
4553
4554                 intf->run_to_completion = 1;
4555                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4556         }
4557
4558 #ifdef CONFIG_IPMI_PANIC_EVENT
4559         send_panic_events(ptr);
4560 #endif
4561
4562         return NOTIFY_DONE;
4563 }
4564
4565 static struct notifier_block panic_block = {
4566         .notifier_call  = panic_event,
4567         .next           = NULL,
4568         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4569 };
4570
4571 static int ipmi_init_msghandler(void)
4572 {
4573         int rv;
4574
4575         if (initialized)
4576                 return 0;
4577
4578         rv = driver_register(&ipmidriver.driver);
4579         if (rv) {
4580                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4581                 return rv;
4582         }
4583
4584         printk(KERN_INFO "ipmi message handler version "
4585                IPMI_DRIVER_VERSION "\n");
4586
4587 #ifdef CONFIG_PROC_FS
4588         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4589         if (!proc_ipmi_root) {
4590             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4591             driver_unregister(&ipmidriver.driver);
4592             return -ENOMEM;
4593         }
4594
4595 #endif /* CONFIG_PROC_FS */
4596
4597         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4598         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4599
4600         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4601
4602         initialized = 1;
4603
4604         return 0;
4605 }
4606
4607 static int __init ipmi_init_msghandler_mod(void)
4608 {
4609         ipmi_init_msghandler();
4610         return 0;
4611 }
4612
4613 static void __exit cleanup_ipmi(void)
4614 {
4615         int count;
4616
4617         if (!initialized)
4618                 return;
4619
4620         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4621
4622         /*
4623          * This can't be called if any interfaces exist, so no worry
4624          * about shutting down the interfaces.
4625          */
4626
4627         /*
4628          * Tell the timer to stop, then wait for it to stop.  This
4629          * avoids problems with race conditions removing the timer
4630          * here.
4631          */
4632         atomic_inc(&stop_operation);
4633         del_timer_sync(&ipmi_timer);
4634
4635 #ifdef CONFIG_PROC_FS
4636         proc_remove(proc_ipmi_root);
4637 #endif /* CONFIG_PROC_FS */
4638
4639         driver_unregister(&ipmidriver.driver);
4640
4641         initialized = 0;
4642
4643         /* Check for buffer leaks. */
4644         count = atomic_read(&smi_msg_inuse_count);
4645         if (count != 0)
4646                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4647                        count);
4648         count = atomic_read(&recv_msg_inuse_count);
4649         if (count != 0)
4650                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4651                        count);
4652 }
4653 module_exit(cleanup_ipmi);
4654
4655 module_init(ipmi_init_msghandler_mod);
4656 MODULE_LICENSE("GPL");
4657 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4658 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4659                    " interface.");
4660 MODULE_VERSION(IPMI_DRIVER_VERSION);