drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49
  50 #define PFX "IPMI message handler: "
  51
  52 #define IPMI_DRIVER_VERSION "39.2"
  53
  54 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  55 static int ipmi_init_msghandler(void);
  56 static void smi_recv_tasklet(unsigned long);
  57 static void handle_new_recv_msgs(ipmi_smi_t intf);
  58 static void need_waiter(ipmi_smi_t intf);
  59
  60 static int initialized;
  61
  62 #ifdef CONFIG_PROC_FS
  63 static struct proc_dir_entry *proc_ipmi_root;
  64 #endif /* CONFIG_PROC_FS */
  65
  66 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  67 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  68
  69 #define MAX_EVENTS_IN_QUEUE     25
  70
  71 /*
  72  * Don't let a message sit in a queue forever, always time it with at lest
  73  * the max message timer.  This is in milliseconds.
  74  */
  75 #define MAX_MSG_TIMEOUT         60000
  76
  77 /* Call every ~1000 ms. */
  78 #define IPMI_TIMEOUT_TIME       1000
  79
  80 /* How many jiffies does it take to get to the timeout time. */
  81 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
  82
  83 /*
  84  * Request events from the queue every second (this is the number of
  85  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
  86  * future, IPMI will add a way to know immediately if an event is in
  87  * the queue and this silliness can go away.
  88  */
  89 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
  90
  91 /*
  92  * The main "user" data structure.
  93  */
  94 struct ipmi_user {
  95         struct list_head link;
  96
  97         /* Set to false when the user is destroyed. */
  98         bool valid;
  99
 100         struct kref refcount;
 101
 102         /* The upper layer that handles receive messages. */
 103         struct ipmi_user_hndl *handler;
 104         void             *handler_data;
 105
 106         /* The interface this user is bound to. */
 107         ipmi_smi_t intf;
 108
 109         /* Does this interface receive IPMI events? */
 110         bool gets_events;
 111 };
 112
 113 struct cmd_rcvr {
 114         struct list_head link;
 115
 116         ipmi_user_t   user;
 117         unsigned char netfn;
 118         unsigned char cmd;
 119         unsigned int  chans;
 120
 121         /*
 122          * This is used to form a linked lised during mass deletion.
 123          * Since this is in an RCU list, we cannot use the link above
 124          * or change any data until the RCU period completes.  So we
 125          * use this next variable during mass deletion so we can have
 126          * a list and don't have to wait and restart the search on
 127          * every individual deletion of a command.
 128          */
 129         struct cmd_rcvr *next;
 130 };
 131
 132 struct seq_table {
 133         unsigned int         inuse : 1;
 134         unsigned int         broadcast : 1;
 135
 136         unsigned long        timeout;
 137         unsigned long        orig_timeout;
 138         unsigned int         retries_left;
 139
 140         /*
 141          * To verify on an incoming send message response that this is
 142          * the message that the response is for, we keep a sequence id
 143          * and increment it every time we send a message.
 144          */
 145         long                 seqid;
 146
 147         /*
 148          * This is held so we can properly respond to the message on a
 149          * timeout, and it is used to hold the temporary data for
 150          * retransmission, too.
 151          */
 152         struct ipmi_recv_msg *recv_msg;
 153 };
 154
 155 /*
 156  * Store the information in a msgid (long) to allow us to find a
 157  * sequence table entry from the msgid.
 158  */
 159 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 160
 161 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 162         do {                                                            \
 163                 seq = ((msgid >> 26) & 0x3f);                           \
 164                 seqid = (msgid & 0x3fffff);                             \
 165         } while (0)
 166
 167 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 168
 169 struct ipmi_channel {
 170         unsigned char medium;
 171         unsigned char protocol;
 172
 173         /*
 174          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 175          * but may be changed by the user.
 176          */
 177         unsigned char address;
 178
 179         /*
 180          * My LUN.  This should generally stay the SMS LUN, but just in
 181          * case...
 182          */
 183         unsigned char lun;
 184 };
 185
 186 #ifdef CONFIG_PROC_FS
 187 struct ipmi_proc_entry {
 188         char                   *name;
 189         struct ipmi_proc_entry *next;
 190 };
 191 #endif
 192
 193 struct bmc_device {
 194         struct platform_device pdev;
 195         struct ipmi_device_id  id;
 196         unsigned char          guid[16];
 197         int                    guid_set;
 198         char                   name[16];
 199         struct kref            usecount;
 200
 201         /* bmc device attributes */
 202         struct device_attribute device_id_attr;
 203         struct device_attribute provides_dev_sdrs_attr;
 204         struct device_attribute revision_attr;
 205         struct device_attribute firmware_rev_attr;
 206         struct device_attribute version_attr;
 207         struct device_attribute add_dev_support_attr;
 208         struct device_attribute manufacturer_id_attr;
 209         struct device_attribute product_id_attr;
 210         struct device_attribute guid_attr;
 211         struct device_attribute aux_firmware_rev_attr;
 212 };
 213 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 214
 215 /*
 216  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 217  * structure.
 218  */
 219 enum ipmi_stat_indexes {
 220         /* Commands we got from the user that were invalid. */
 221         IPMI_STAT_sent_invalid_commands = 0,
 222
 223         /* Commands we sent to the MC. */
 224         IPMI_STAT_sent_local_commands,
 225
 226         /* Responses from the MC that were delivered to a user. */
 227         IPMI_STAT_handled_local_responses,
 228
 229         /* Responses from the MC that were not delivered to a user. */
 230         IPMI_STAT_unhandled_local_responses,
 231
 232         /* Commands we sent out to the IPMB bus. */
 233         IPMI_STAT_sent_ipmb_commands,
 234
 235         /* Commands sent on the IPMB that had errors on the SEND CMD */
 236         IPMI_STAT_sent_ipmb_command_errs,
 237
 238         /* Each retransmit increments this count. */
 239         IPMI_STAT_retransmitted_ipmb_commands,
 240
 241         /*
 242          * When a message times out (runs out of retransmits) this is
 243          * incremented.
 244          */
 245         IPMI_STAT_timed_out_ipmb_commands,
 246
 247         /*
 248          * This is like above, but for broadcasts.  Broadcasts are
 249          * *not* included in the above count (they are expected to
 250          * time out).
 251          */
 252         IPMI_STAT_timed_out_ipmb_broadcasts,
 253
 254         /* Responses I have sent to the IPMB bus. */
 255         IPMI_STAT_sent_ipmb_responses,
 256
 257         /* The response was delivered to the user. */
 258         IPMI_STAT_handled_ipmb_responses,
 259
 260         /* The response had invalid data in it. */
 261         IPMI_STAT_invalid_ipmb_responses,
 262
 263         /* The response didn't have anyone waiting for it. */
 264         IPMI_STAT_unhandled_ipmb_responses,
 265
 266         /* Commands we sent out to the IPMB bus. */
 267         IPMI_STAT_sent_lan_commands,
 268
 269         /* Commands sent on the IPMB that had errors on the SEND CMD */
 270         IPMI_STAT_sent_lan_command_errs,
 271
 272         /* Each retransmit increments this count. */
 273         IPMI_STAT_retransmitted_lan_commands,
 274
 275         /*
 276          * When a message times out (runs out of retransmits) this is
 277          * incremented.
 278          */
 279         IPMI_STAT_timed_out_lan_commands,
 280
 281         /* Responses I have sent to the IPMB bus. */
 282         IPMI_STAT_sent_lan_responses,
 283
 284         /* The response was delivered to the user. */
 285         IPMI_STAT_handled_lan_responses,
 286
 287         /* The response had invalid data in it. */
 288         IPMI_STAT_invalid_lan_responses,
 289
 290         /* The response didn't have anyone waiting for it. */
 291         IPMI_STAT_unhandled_lan_responses,
 292
 293         /* The command was delivered to the user. */
 294         IPMI_STAT_handled_commands,
 295
 296         /* The command had invalid data in it. */
 297         IPMI_STAT_invalid_commands,
 298
 299         /* The command didn't have anyone waiting for it. */
 300         IPMI_STAT_unhandled_commands,
 301
 302         /* Invalid data in an event. */
 303         IPMI_STAT_invalid_events,
 304
 305         /* Events that were received with the proper format. */
 306         IPMI_STAT_events,
 307
 308         /* Retransmissions on IPMB that failed. */
 309         IPMI_STAT_dropped_rexmit_ipmb_commands,
 310
 311         /* Retransmissions on LAN that failed. */
 312         IPMI_STAT_dropped_rexmit_lan_commands,
 313
 314         /* This *must* remain last, add new values above this. */
 315         IPMI_NUM_STATS
 316 };
 317
 318
 319 #define IPMI_IPMB_NUM_SEQ       64
 320 #define IPMI_MAX_CHANNELS       16
 321 struct ipmi_smi {
 322         /* What interface number are we? */
 323         int intf_num;
 324
 325         struct kref refcount;
 326
 327         /* Used for a list of interfaces. */
 328         struct list_head link;
 329
 330         /*
 331          * The list of upper layers that are using me.  seq_lock
 332          * protects this.
 333          */
 334         struct list_head users;
 335
 336         /* Information to supply to users. */
 337         unsigned char ipmi_version_major;
 338         unsigned char ipmi_version_minor;
 339
 340         /* Used for wake ups at startup. */
 341         wait_queue_head_t waitq;
 342
 343         struct bmc_device *bmc;
 344         char *my_dev_name;
 345
 346         /*
 347          * This is the lower-layer's sender routine.  Note that you
 348          * must either be holding the ipmi_interfaces_mutex or be in
 349          * an umpreemptible region to use this.  You must fetch the
 350          * value into a local variable and make sure it is not NULL.
 351          */
 352         struct ipmi_smi_handlers *handlers;
 353         void                     *send_info;
 354
 355 #ifdef CONFIG_PROC_FS
 356         /* A list of proc entries for this interface. */
 357         struct mutex           proc_entry_lock;
 358         struct ipmi_proc_entry *proc_entries;
 359 #endif
 360
 361         /* Driver-model device for the system interface. */
 362         struct device          *si_dev;
 363
 364         /*
 365          * A table of sequence numbers for this interface.  We use the
 366          * sequence numbers for IPMB messages that go out of the
 367          * interface to match them up with their responses.  A routine
 368          * is called periodically to time the items in this list.
 369          */
 370         spinlock_t       seq_lock;
 371         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 372         int curr_seq;
 373
 374         /*
 375          * Messages queued for delivery.  If delivery fails (out of memory
 376          * for instance), They will stay in here to be processed later in a
 377          * periodic timer interrupt.  The tasklet is for handling received
 378          * messages directly from the handler.
 379          */
 380         spinlock_t       waiting_rcv_msgs_lock;
 381         struct list_head waiting_rcv_msgs;
 382         atomic_t         watchdog_pretimeouts_to_deliver;
 383         struct tasklet_struct recv_tasklet;
 384
 385         /*
 386          * The list of command receivers that are registered for commands
 387          * on this interface.
 388          */
 389         struct mutex     cmd_rcvrs_mutex;
 390         struct list_head cmd_rcvrs;
 391
 392         /*
 393          * Events that were queues because no one was there to receive
 394          * them.
 395          */
 396         spinlock_t       events_lock; /* For dealing with event stuff. */
 397         struct list_head waiting_events;
 398         unsigned int     waiting_events_count; /* How many events in queue? */
 399         char             delivering_events;
 400         char             event_msg_printed;
 401         atomic_t         event_waiters;
 402         unsigned int     ticks_to_req_ev;
 403         int              last_needs_timer;
 404
 405         /*
 406          * The event receiver for my BMC, only really used at panic
 407          * shutdown as a place to store this.
 408          */
 409         unsigned char event_receiver;
 410         unsigned char event_receiver_lun;
 411         unsigned char local_sel_device;
 412         unsigned char local_event_generator;
 413
 414         /* For handling of maintenance mode. */
 415         int maintenance_mode;
 416         bool maintenance_mode_enable;
 417         int auto_maintenance_timeout;
 418         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 419
 420         /*
 421          * A cheap hack, if this is non-null and a message to an
 422          * interface comes in with a NULL user, call this routine with
 423          * it.  Note that the message will still be freed by the
 424          * caller.  This only works on the system interface.
 425          */
 426         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 427
 428         /*
 429          * When we are scanning the channels for an SMI, this will
 430          * tell which channel we are scanning.
 431          */
 432         int curr_channel;
 433
 434         /* Channel information */
 435         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 436
 437         /* Proc FS stuff. */
 438         struct proc_dir_entry *proc_dir;
 439         char                  proc_dir_name[10];
 440
 441         atomic_t stats[IPMI_NUM_STATS];
 442
 443         /*
 444          * run_to_completion duplicate of smb_info, smi_info
 445          * and ipmi_serial_info structures. Used to decrease numbers of
 446          * parameters passed by "low" level IPMI code.
 447          */
 448         int run_to_completion;
 449 };
 450 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 451
 452 /**
 453  * The driver model view of the IPMI messaging driver.
 454  */
 455 static struct platform_driver ipmidriver = {
 456         .driver = {
 457                 .name = "ipmi",
 458                 .bus = &platform_bus_type
 459         }
 460 };
 461 static DEFINE_MUTEX(ipmidriver_mutex);
 462
 463 static LIST_HEAD(ipmi_interfaces);
 464 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 465
 466 /*
 467  * List of watchers that want to know when smi's are added and deleted.
 468  */
 469 static LIST_HEAD(smi_watchers);
 470 static DEFINE_MUTEX(smi_watchers_mutex);
 471
 472 #define ipmi_inc_stat(intf, stat) \
 473         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 474 #define ipmi_get_stat(intf, stat) \
 475         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 476
 477 static char *addr_src_to_str[] = { "invalid", "hotmod", "hardcoded", "SPMI",
 478                                    "ACPI", "SMBIOS", "PCI",
 479                                    "device-tree", "default" };
 480
 481 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 482 {
 483         if (src > SI_DEFAULT)
 484                 src = 0; /* Invalid */
 485         return addr_src_to_str[src];
 486 }
 487 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 488
 489 static int is_lan_addr(struct ipmi_addr *addr)
 490 {
 491         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 492 }
 493
 494 static int is_ipmb_addr(struct ipmi_addr *addr)
 495 {
 496         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 497 }
 498
 499 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 500 {
 501         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 502 }
 503
 504 static void free_recv_msg_list(struct list_head *q)
 505 {
 506         struct ipmi_recv_msg *msg, *msg2;
 507
 508         list_for_each_entry_safe(msg, msg2, q, link) {
 509                 list_del(&msg->link);
 510                 ipmi_free_recv_msg(msg);
 511         }
 512 }
 513
 514 static void free_smi_msg_list(struct list_head *q)
 515 {
 516         struct ipmi_smi_msg *msg, *msg2;
 517
 518         list_for_each_entry_safe(msg, msg2, q, link) {
 519                 list_del(&msg->link);
 520                 ipmi_free_smi_msg(msg);
 521         }
 522 }
 523
 524 static void clean_up_interface_data(ipmi_smi_t intf)
 525 {
 526         int              i;
 527         struct cmd_rcvr  *rcvr, *rcvr2;
 528         struct list_head list;
 529
 530         tasklet_kill(&intf->recv_tasklet);
 531
 532         free_smi_msg_list(&intf->waiting_rcv_msgs);
 533         free_recv_msg_list(&intf->waiting_events);
 534
 535         /*
 536          * Wholesale remove all the entries from the list in the
 537          * interface and wait for RCU to know that none are in use.
 538          */
 539         mutex_lock(&intf->cmd_rcvrs_mutex);
 540         INIT_LIST_HEAD(&list);
 541         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 542         mutex_unlock(&intf->cmd_rcvrs_mutex);
 543
 544         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 545                 kfree(rcvr);
 546
 547         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 548                 if ((intf->seq_table[i].inuse)
 549                                         && (intf->seq_table[i].recv_msg))
 550                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 551         }
 552 }
 553
 554 static void intf_free(struct kref *ref)
 555 {
 556         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 557
 558         clean_up_interface_data(intf);
 559         kfree(intf);
 560 }
 561
 562 struct watcher_entry {
 563         int              intf_num;
 564         ipmi_smi_t       intf;
 565         struct list_head link;
 566 };
 567
 568 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 569 {
 570         ipmi_smi_t intf;
 571         LIST_HEAD(to_deliver);
 572         struct watcher_entry *e, *e2;
 573
 574         mutex_lock(&smi_watchers_mutex);
 575
 576         mutex_lock(&ipmi_interfaces_mutex);
 577
 578         /* Build a list of things to deliver. */
 579         list_for_each_entry(intf, &ipmi_interfaces, link) {
 580                 if (intf->intf_num == -1)
 581                         continue;
 582                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 583                 if (!e)
 584                         goto out_err;
 585                 kref_get(&intf->refcount);
 586                 e->intf = intf;
 587                 e->intf_num = intf->intf_num;
 588                 list_add_tail(&e->link, &to_deliver);
 589         }
 590
 591         /* We will succeed, so add it to the list. */
 592         list_add(&watcher->link, &smi_watchers);
 593
 594         mutex_unlock(&ipmi_interfaces_mutex);
 595
 596         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 597                 list_del(&e->link);
 598                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 599                 kref_put(&e->intf->refcount, intf_free);
 600                 kfree(e);
 601         }
 602
 603         mutex_unlock(&smi_watchers_mutex);
 604
 605         return 0;
 606
 607  out_err:
 608         mutex_unlock(&ipmi_interfaces_mutex);
 609         mutex_unlock(&smi_watchers_mutex);
 610         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 611                 list_del(&e->link);
 612                 kref_put(&e->intf->refcount, intf_free);
 613                 kfree(e);
 614         }
 615         return -ENOMEM;
 616 }
 617 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 618
 619 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 620 {
 621         mutex_lock(&smi_watchers_mutex);
 622         list_del(&(watcher->link));
 623         mutex_unlock(&smi_watchers_mutex);
 624         return 0;
 625 }
 626 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 627
 628 /*
 629  * Must be called with smi_watchers_mutex held.
 630  */
 631 static void
 632 call_smi_watchers(int i, struct device *dev)
 633 {
 634         struct ipmi_smi_watcher *w;
 635
 636         list_for_each_entry(w, &smi_watchers, link) {
 637                 if (try_module_get(w->owner)) {
 638                         w->new_smi(i, dev);
 639                         module_put(w->owner);
 640                 }
 641         }
 642 }
 643
 644 static int
 645 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 646 {
 647         if (addr1->addr_type != addr2->addr_type)
 648                 return 0;
 649
 650         if (addr1->channel != addr2->channel)
 651                 return 0;
 652
 653         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 654                 struct ipmi_system_interface_addr *smi_addr1
 655                     = (struct ipmi_system_interface_addr *) addr1;
 656                 struct ipmi_system_interface_addr *smi_addr2
 657                     = (struct ipmi_system_interface_addr *) addr2;
 658                 return (smi_addr1->lun == smi_addr2->lun);
 659         }
 660
 661         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 662                 struct ipmi_ipmb_addr *ipmb_addr1
 663                     = (struct ipmi_ipmb_addr *) addr1;
 664                 struct ipmi_ipmb_addr *ipmb_addr2
 665                     = (struct ipmi_ipmb_addr *) addr2;
 666
 667                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 668                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 669         }
 670
 671         if (is_lan_addr(addr1)) {
 672                 struct ipmi_lan_addr *lan_addr1
 673                         = (struct ipmi_lan_addr *) addr1;
 674                 struct ipmi_lan_addr *lan_addr2
 675                     = (struct ipmi_lan_addr *) addr2;
 676
 677                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 678                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 679                         && (lan_addr1->session_handle
 680                             == lan_addr2->session_handle)
 681                         && (lan_addr1->lun == lan_addr2->lun));
 682         }
 683
 684         return 1;
 685 }
 686
 687 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 688 {
 689         if (len < sizeof(struct ipmi_system_interface_addr))
 690                 return -EINVAL;
 691
 692         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 693                 if (addr->channel != IPMI_BMC_CHANNEL)
 694                         return -EINVAL;
 695                 return 0;
 696         }
 697
 698         if ((addr->channel == IPMI_BMC_CHANNEL)
 699             || (addr->channel >= IPMI_MAX_CHANNELS)
 700             || (addr->channel < 0))
 701                 return -EINVAL;
 702
 703         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 704                 if (len < sizeof(struct ipmi_ipmb_addr))
 705                         return -EINVAL;
 706                 return 0;
 707         }
 708
 709         if (is_lan_addr(addr)) {
 710                 if (len < sizeof(struct ipmi_lan_addr))
 711                         return -EINVAL;
 712                 return 0;
 713         }
 714
 715         return -EINVAL;
 716 }
 717 EXPORT_SYMBOL(ipmi_validate_addr);
 718
 719 unsigned int ipmi_addr_length(int addr_type)
 720 {
 721         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 722                 return sizeof(struct ipmi_system_interface_addr);
 723
 724         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 725                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 726                 return sizeof(struct ipmi_ipmb_addr);
 727
 728         if (addr_type == IPMI_LAN_ADDR_TYPE)
 729                 return sizeof(struct ipmi_lan_addr);
 730
 731         return 0;
 732 }
 733 EXPORT_SYMBOL(ipmi_addr_length);
 734
 735 static void deliver_response(struct ipmi_recv_msg *msg)
 736 {
 737         if (!msg->user) {
 738                 ipmi_smi_t    intf = msg->user_msg_data;
 739
 740                 /* Special handling for NULL users. */
 741                 if (intf->null_user_handler) {
 742                         intf->null_user_handler(intf, msg);
 743                         ipmi_inc_stat(intf, handled_local_responses);
 744                 } else {
 745                         /* No handler, so give up. */
 746                         ipmi_inc_stat(intf, unhandled_local_responses);
 747                 }
 748                 ipmi_free_recv_msg(msg);
 749         } else {
 750                 ipmi_user_t user = msg->user;
 751                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 752         }
 753 }
 754
 755 static void
 756 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 757 {
 758         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 759         msg->msg_data[0] = err;
 760         msg->msg.netfn |= 1; /* Convert to a response. */
 761         msg->msg.data_len = 1;
 762         msg->msg.data = msg->msg_data;
 763         deliver_response(msg);
 764 }
 765
 766 /*
 767  * Find the next sequence number not being used and add the given
 768  * message with the given timeout to the sequence table.  This must be
 769  * called with the interface's seq_lock held.
 770  */
 771 static int intf_next_seq(ipmi_smi_t           intf,
 772                          struct ipmi_recv_msg *recv_msg,
 773                          unsigned long        timeout,
 774                          int                  retries,
 775                          int                  broadcast,
 776                          unsigned char        *seq,
 777                          long                 *seqid)
 778 {
 779         int          rv = 0;
 780         unsigned int i;
 781
 782         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 783                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 784                 if (!intf->seq_table[i].inuse)
 785                         break;
 786         }
 787
 788         if (!intf->seq_table[i].inuse) {
 789                 intf->seq_table[i].recv_msg = recv_msg;
 790
 791                 /*
 792                  * Start with the maximum timeout, when the send response
 793                  * comes in we will start the real timer.
 794                  */
 795                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 796                 intf->seq_table[i].orig_timeout = timeout;
 797                 intf->seq_table[i].retries_left = retries;
 798                 intf->seq_table[i].broadcast = broadcast;
 799                 intf->seq_table[i].inuse = 1;
 800                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 801                 *seq = i;
 802                 *seqid = intf->seq_table[i].seqid;
 803                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 804                 need_waiter(intf);
 805         } else {
 806                 rv = -EAGAIN;
 807         }
 808
 809         return rv;
 810 }
 811
 812 /*
 813  * Return the receive message for the given sequence number and
 814  * release the sequence number so it can be reused.  Some other data
 815  * is passed in to be sure the message matches up correctly (to help
 816  * guard against message coming in after their timeout and the
 817  * sequence number being reused).
 818  */
 819 static int intf_find_seq(ipmi_smi_t           intf,
 820                          unsigned char        seq,
 821                          short                channel,
 822                          unsigned char        cmd,
 823                          unsigned char        netfn,
 824                          struct ipmi_addr     *addr,
 825                          struct ipmi_recv_msg **recv_msg)
 826 {
 827         int           rv = -ENODEV;
 828         unsigned long flags;
 829
 830         if (seq >= IPMI_IPMB_NUM_SEQ)
 831                 return -EINVAL;
 832
 833         spin_lock_irqsave(&(intf->seq_lock), flags);
 834         if (intf->seq_table[seq].inuse) {
 835                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 836
 837                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 838                                 && (msg->msg.netfn == netfn)
 839                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 840                         *recv_msg = msg;
 841                         intf->seq_table[seq].inuse = 0;
 842                         rv = 0;
 843                 }
 844         }
 845         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 846
 847         return rv;
 848 }
 849
 850
 851 /* Start the timer for a specific sequence table entry. */
 852 static int intf_start_seq_timer(ipmi_smi_t intf,
 853                                 long       msgid)
 854 {
 855         int           rv = -ENODEV;
 856         unsigned long flags;
 857         unsigned char seq;
 858         unsigned long seqid;
 859
 860
 861         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 862
 863         spin_lock_irqsave(&(intf->seq_lock), flags);
 864         /*
 865          * We do this verification because the user can be deleted
 866          * while a message is outstanding.
 867          */
 868         if ((intf->seq_table[seq].inuse)
 869                                 && (intf->seq_table[seq].seqid == seqid)) {
 870                 struct seq_table *ent = &(intf->seq_table[seq]);
 871                 ent->timeout = ent->orig_timeout;
 872                 rv = 0;
 873         }
 874         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 875
 876         return rv;
 877 }
 878
 879 /* Got an error for the send message for a specific sequence number. */
 880 static int intf_err_seq(ipmi_smi_t   intf,
 881                         long         msgid,
 882                         unsigned int err)
 883 {
 884         int                  rv = -ENODEV;
 885         unsigned long        flags;
 886         unsigned char        seq;
 887         unsigned long        seqid;
 888         struct ipmi_recv_msg *msg = NULL;
 889
 890
 891         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 892
 893         spin_lock_irqsave(&(intf->seq_lock), flags);
 894         /*
 895          * We do this verification because the user can be deleted
 896          * while a message is outstanding.
 897          */
 898         if ((intf->seq_table[seq].inuse)
 899                                 && (intf->seq_table[seq].seqid == seqid)) {
 900                 struct seq_table *ent = &(intf->seq_table[seq]);
 901
 902                 ent->inuse = 0;
 903                 msg = ent->recv_msg;
 904                 rv = 0;
 905         }
 906         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 907
 908         if (msg)
 909                 deliver_err_response(msg, err);
 910
 911         return rv;
 912 }
 913
 914
 915 int ipmi_create_user(unsigned int          if_num,
 916                      struct ipmi_user_hndl *handler,
 917                      void                  *handler_data,
 918                      ipmi_user_t           *user)
 919 {
 920         unsigned long flags;
 921         ipmi_user_t   new_user;
 922         int           rv = 0;
 923         ipmi_smi_t    intf;
 924
 925         /*
 926          * There is no module usecount here, because it's not
 927          * required.  Since this can only be used by and called from
 928          * other modules, they will implicitly use this module, and
 929          * thus this can't be removed unless the other modules are
 930          * removed.
 931          */
 932
 933         if (handler == NULL)
 934                 return -EINVAL;
 935
 936         /*
 937          * Make sure the driver is actually initialized, this handles
 938          * problems with initialization order.
 939          */
 940         if (!initialized) {
 941                 rv = ipmi_init_msghandler();
 942                 if (rv)
 943                         return rv;
 944
 945                 /*
 946                  * The init code doesn't return an error if it was turned
 947                  * off, but it won't initialize.  Check that.
 948                  */
 949                 if (!initialized)
 950                         return -ENODEV;
 951         }
 952
 953         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 954         if (!new_user)
 955                 return -ENOMEM;
 956
 957         mutex_lock(&ipmi_interfaces_mutex);
 958         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 959                 if (intf->intf_num == if_num)
 960                         goto found;
 961         }
 962         /* Not found, return an error */
 963         rv = -EINVAL;
 964         goto out_kfree;
 965
 966  found:
 967         /* Note that each existing user holds a refcount to the interface. */
 968         kref_get(&intf->refcount);
 969
 970         kref_init(&new_user->refcount);
 971         new_user->handler = handler;
 972         new_user->handler_data = handler_data;
 973         new_user->intf = intf;
 974         new_user->gets_events = false;
 975
 976         if (!try_module_get(intf->handlers->owner)) {
 977                 rv = -ENODEV;
 978                 goto out_kref;
 979         }
 980
 981         if (intf->handlers->inc_usecount) {
 982                 rv = intf->handlers->inc_usecount(intf->send_info);
 983                 if (rv) {
 984                         module_put(intf->handlers->owner);
 985                         goto out_kref;
 986                 }
 987         }
 988
 989         /*
 990          * Hold the lock so intf->handlers is guaranteed to be good
 991          * until now
 992          */
 993         mutex_unlock(&ipmi_interfaces_mutex);
 994
 995         new_user->valid = true;
 996         spin_lock_irqsave(&intf->seq_lock, flags);
 997         list_add_rcu(&new_user->link, &intf->users);
 998         spin_unlock_irqrestore(&intf->seq_lock, flags);
 999         if (handler->ipmi_watchdog_pretimeout) {
1000                 /* User wants pretimeouts, so make sure to watch for them. */
1001                 if (atomic_inc_return(&intf->event_waiters) == 1)
1002                         need_waiter(intf);
1003         }
1004         *user = new_user;
1005         return 0;
1006
1007 out_kref:
1008         kref_put(&intf->refcount, intf_free);
1009 out_kfree:
1010         mutex_unlock(&ipmi_interfaces_mutex);
1011         kfree(new_user);
1012         return rv;
1013 }
1014 EXPORT_SYMBOL(ipmi_create_user);
1015
1016 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1017 {
1018         int           rv = 0;
1019         ipmi_smi_t    intf;
1020         struct ipmi_smi_handlers *handlers;
1021
1022         mutex_lock(&ipmi_interfaces_mutex);
1023         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1024                 if (intf->intf_num == if_num)
1025                         goto found;
1026         }
1027         /* Not found, return an error */
1028         rv = -EINVAL;
1029         mutex_unlock(&ipmi_interfaces_mutex);
1030         return rv;
1031
1032 found:
1033         handlers = intf->handlers;
1034         rv = -ENOSYS;
1035         if (handlers->get_smi_info)
1036                 rv = handlers->get_smi_info(intf->send_info, data);
1037         mutex_unlock(&ipmi_interfaces_mutex);
1038
1039         return rv;
1040 }
1041 EXPORT_SYMBOL(ipmi_get_smi_info);
1042
1043 static void free_user(struct kref *ref)
1044 {
1045         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1046         kfree(user);
1047 }
1048
1049 int ipmi_destroy_user(ipmi_user_t user)
1050 {
1051         ipmi_smi_t       intf = user->intf;
1052         int              i;
1053         unsigned long    flags;
1054         struct cmd_rcvr  *rcvr;
1055         struct cmd_rcvr  *rcvrs = NULL;
1056
1057         user->valid = false;
1058
1059         if (user->handler->ipmi_watchdog_pretimeout)
1060                 atomic_dec(&intf->event_waiters);
1061
1062         if (user->gets_events)
1063                 atomic_dec(&intf->event_waiters);
1064
1065         /* Remove the user from the interface's sequence table. */
1066         spin_lock_irqsave(&intf->seq_lock, flags);
1067         list_del_rcu(&user->link);
1068
1069         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1070                 if (intf->seq_table[i].inuse
1071                     && (intf->seq_table[i].recv_msg->user == user)) {
1072                         intf->seq_table[i].inuse = 0;
1073                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1074                 }
1075         }
1076         spin_unlock_irqrestore(&intf->seq_lock, flags);
1077
1078         /*
1079          * Remove the user from the command receiver's table.  First
1080          * we build a list of everything (not using the standard link,
1081          * since other things may be using it till we do
1082          * synchronize_rcu()) then free everything in that list.
1083          */
1084         mutex_lock(&intf->cmd_rcvrs_mutex);
1085         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1086                 if (rcvr->user == user) {
1087                         list_del_rcu(&rcvr->link);
1088                         rcvr->next = rcvrs;
1089                         rcvrs = rcvr;
1090                 }
1091         }
1092         mutex_unlock(&intf->cmd_rcvrs_mutex);
1093         synchronize_rcu();
1094         while (rcvrs) {
1095                 rcvr = rcvrs;
1096                 rcvrs = rcvr->next;
1097                 kfree(rcvr);
1098         }
1099
1100         mutex_lock(&ipmi_interfaces_mutex);
1101         if (intf->handlers) {
1102                 module_put(intf->handlers->owner);
1103                 if (intf->handlers->dec_usecount)
1104                         intf->handlers->dec_usecount(intf->send_info);
1105         }
1106         mutex_unlock(&ipmi_interfaces_mutex);
1107
1108         kref_put(&intf->refcount, intf_free);
1109
1110         kref_put(&user->refcount, free_user);
1111
1112         return 0;
1113 }
1114 EXPORT_SYMBOL(ipmi_destroy_user);
1115
1116 void ipmi_get_version(ipmi_user_t   user,
1117                       unsigned char *major,
1118                       unsigned char *minor)
1119 {
1120         *major = user->intf->ipmi_version_major;
1121         *minor = user->intf->ipmi_version_minor;
1122 }
1123 EXPORT_SYMBOL(ipmi_get_version);
1124
1125 int ipmi_set_my_address(ipmi_user_t   user,
1126                         unsigned int  channel,
1127                         unsigned char address)
1128 {
1129         if (channel >= IPMI_MAX_CHANNELS)
1130                 return -EINVAL;
1131         user->intf->channels[channel].address = address;
1132         return 0;
1133 }
1134 EXPORT_SYMBOL(ipmi_set_my_address);
1135
1136 int ipmi_get_my_address(ipmi_user_t   user,
1137                         unsigned int  channel,
1138                         unsigned char *address)
1139 {
1140         if (channel >= IPMI_MAX_CHANNELS)
1141                 return -EINVAL;
1142         *address = user->intf->channels[channel].address;
1143         return 0;
1144 }
1145 EXPORT_SYMBOL(ipmi_get_my_address);
1146
1147 int ipmi_set_my_LUN(ipmi_user_t   user,
1148                     unsigned int  channel,
1149                     unsigned char LUN)
1150 {
1151         if (channel >= IPMI_MAX_CHANNELS)
1152                 return -EINVAL;
1153         user->intf->channels[channel].lun = LUN & 0x3;
1154         return 0;
1155 }
1156 EXPORT_SYMBOL(ipmi_set_my_LUN);
1157
1158 int ipmi_get_my_LUN(ipmi_user_t   user,
1159                     unsigned int  channel,
1160                     unsigned char *address)
1161 {
1162         if (channel >= IPMI_MAX_CHANNELS)
1163                 return -EINVAL;
1164         *address = user->intf->channels[channel].lun;
1165         return 0;
1166 }
1167 EXPORT_SYMBOL(ipmi_get_my_LUN);
1168
1169 int ipmi_get_maintenance_mode(ipmi_user_t user)
1170 {
1171         int           mode;
1172         unsigned long flags;
1173
1174         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1175         mode = user->intf->maintenance_mode;
1176         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1177
1178         return mode;
1179 }
1180 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1181
1182 static void maintenance_mode_update(ipmi_smi_t intf)
1183 {
1184         if (intf->handlers->set_maintenance_mode)
1185                 intf->handlers->set_maintenance_mode(
1186                         intf->send_info, intf->maintenance_mode_enable);
1187 }
1188
1189 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1190 {
1191         int           rv = 0;
1192         unsigned long flags;
1193         ipmi_smi_t    intf = user->intf;
1194
1195         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1196         if (intf->maintenance_mode != mode) {
1197                 switch (mode) {
1198                 case IPMI_MAINTENANCE_MODE_AUTO:
1199                         intf->maintenance_mode_enable
1200                                 = (intf->auto_maintenance_timeout > 0);
1201                         break;
1202
1203                 case IPMI_MAINTENANCE_MODE_OFF:
1204                         intf->maintenance_mode_enable = false;
1205                         break;
1206
1207                 case IPMI_MAINTENANCE_MODE_ON:
1208                         intf->maintenance_mode_enable = true;
1209                         break;
1210
1211                 default:
1212                         rv = -EINVAL;
1213                         goto out_unlock;
1214                 }
1215                 intf->maintenance_mode = mode;
1216
1217                 maintenance_mode_update(intf);
1218         }
1219  out_unlock:
1220         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1221
1222         return rv;
1223 }
1224 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1225
1226 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1227 {
1228         unsigned long        flags;
1229         ipmi_smi_t           intf = user->intf;
1230         struct ipmi_recv_msg *msg, *msg2;
1231         struct list_head     msgs;
1232
1233         INIT_LIST_HEAD(&msgs);
1234
1235         spin_lock_irqsave(&intf->events_lock, flags);
1236         if (user->gets_events == val)
1237                 goto out;
1238
1239         user->gets_events = val;
1240
1241         if (val) {
1242                 if (atomic_inc_return(&intf->event_waiters) == 1)
1243                         need_waiter(intf);
1244         } else {
1245                 atomic_dec(&intf->event_waiters);
1246         }
1247
1248         if (intf->delivering_events)
1249                 /*
1250                  * Another thread is delivering events for this, so
1251                  * let it handle any new events.
1252                  */
1253                 goto out;
1254
1255         /* Deliver any queued events. */
1256         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1257                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1258                         list_move_tail(&msg->link, &msgs);
1259                 intf->waiting_events_count = 0;
1260                 if (intf->event_msg_printed) {
1261                         printk(KERN_WARNING PFX "Event queue no longer"
1262                                " full\n");
1263                         intf->event_msg_printed = 0;
1264                 }
1265
1266                 intf->delivering_events = 1;
1267                 spin_unlock_irqrestore(&intf->events_lock, flags);
1268
1269                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1270                         msg->user = user;
1271                         kref_get(&user->refcount);
1272                         deliver_response(msg);
1273                 }
1274
1275                 spin_lock_irqsave(&intf->events_lock, flags);
1276                 intf->delivering_events = 0;
1277         }
1278
1279  out:
1280         spin_unlock_irqrestore(&intf->events_lock, flags);
1281
1282         return 0;
1283 }
1284 EXPORT_SYMBOL(ipmi_set_gets_events);
1285
1286 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1287                                       unsigned char netfn,
1288                                       unsigned char cmd,
1289                                       unsigned char chan)
1290 {
1291         struct cmd_rcvr *rcvr;
1292
1293         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1294                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1295                                         && (rcvr->chans & (1 << chan)))
1296                         return rcvr;
1297         }
1298         return NULL;
1299 }
1300
1301 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1302                                  unsigned char netfn,
1303                                  unsigned char cmd,
1304                                  unsigned int  chans)
1305 {
1306         struct cmd_rcvr *rcvr;
1307
1308         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1309                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1310                                         && (rcvr->chans & chans))
1311                         return 0;
1312         }
1313         return 1;
1314 }
1315
1316 int ipmi_register_for_cmd(ipmi_user_t   user,
1317                           unsigned char netfn,
1318                           unsigned char cmd,
1319                           unsigned int  chans)
1320 {
1321         ipmi_smi_t      intf = user->intf;
1322         struct cmd_rcvr *rcvr;
1323         int             rv = 0;
1324
1325
1326         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1327         if (!rcvr)
1328                 return -ENOMEM;
1329         rcvr->cmd = cmd;
1330         rcvr->netfn = netfn;
1331         rcvr->chans = chans;
1332         rcvr->user = user;
1333
1334         mutex_lock(&intf->cmd_rcvrs_mutex);
1335         /* Make sure the command/netfn is not already registered. */
1336         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1337                 rv = -EBUSY;
1338                 goto out_unlock;
1339         }
1340
1341         if (atomic_inc_return(&intf->event_waiters) == 1)
1342                 need_waiter(intf);
1343
1344         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1345
1346  out_unlock:
1347         mutex_unlock(&intf->cmd_rcvrs_mutex);
1348         if (rv)
1349                 kfree(rcvr);
1350
1351         return rv;
1352 }
1353 EXPORT_SYMBOL(ipmi_register_for_cmd);
1354
1355 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1356                             unsigned char netfn,
1357                             unsigned char cmd,
1358                             unsigned int  chans)
1359 {
1360         ipmi_smi_t      intf = user->intf;
1361         struct cmd_rcvr *rcvr;
1362         struct cmd_rcvr *rcvrs = NULL;
1363         int i, rv = -ENOENT;
1364
1365         mutex_lock(&intf->cmd_rcvrs_mutex);
1366         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1367                 if (((1 << i) & chans) == 0)
1368                         continue;
1369                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1370                 if (rcvr == NULL)
1371                         continue;
1372                 if (rcvr->user == user) {
1373                         rv = 0;
1374                         rcvr->chans &= ~chans;
1375                         if (rcvr->chans == 0) {
1376                                 list_del_rcu(&rcvr->link);
1377                                 rcvr->next = rcvrs;
1378                                 rcvrs = rcvr;
1379                         }
1380                 }
1381         }
1382         mutex_unlock(&intf->cmd_rcvrs_mutex);
1383         synchronize_rcu();
1384         while (rcvrs) {
1385                 atomic_dec(&intf->event_waiters);
1386                 rcvr = rcvrs;
1387                 rcvrs = rcvr->next;
1388                 kfree(rcvr);
1389         }
1390         return rv;
1391 }
1392 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1393
1394 static unsigned char
1395 ipmb_checksum(unsigned char *data, int size)
1396 {
1397         unsigned char csum = 0;
1398
1399         for (; size > 0; size--, data++)
1400                 csum += *data;
1401
1402         return -csum;
1403 }
1404
1405 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1406                                    struct kernel_ipmi_msg *msg,
1407                                    struct ipmi_ipmb_addr *ipmb_addr,
1408                                    long                  msgid,
1409                                    unsigned char         ipmb_seq,
1410                                    int                   broadcast,
1411                                    unsigned char         source_address,
1412                                    unsigned char         source_lun)
1413 {
1414         int i = broadcast;
1415
1416         /* Format the IPMB header data. */
1417         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1418         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1419         smi_msg->data[2] = ipmb_addr->channel;
1420         if (broadcast)
1421                 smi_msg->data[3] = 0;
1422         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1423         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1424         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1425         smi_msg->data[i+6] = source_address;
1426         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1427         smi_msg->data[i+8] = msg->cmd;
1428
1429         /* Now tack on the data to the message. */
1430         if (msg->data_len > 0)
1431                 memcpy(&(smi_msg->data[i+9]), msg->data,
1432                        msg->data_len);
1433         smi_msg->data_size = msg->data_len + 9;
1434
1435         /* Now calculate the checksum and tack it on. */
1436         smi_msg->data[i+smi_msg->data_size]
1437                 = ipmb_checksum(&(smi_msg->data[i+6]),
1438                                 smi_msg->data_size-6);
1439
1440         /*
1441          * Add on the checksum size and the offset from the
1442          * broadcast.
1443          */
1444         smi_msg->data_size += 1 + i;
1445
1446         smi_msg->msgid = msgid;
1447 }
1448
1449 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1450                                   struct kernel_ipmi_msg *msg,
1451                                   struct ipmi_lan_addr  *lan_addr,
1452                                   long                  msgid,
1453                                   unsigned char         ipmb_seq,
1454                                   unsigned char         source_lun)
1455 {
1456         /* Format the IPMB header data. */
1457         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1458         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1459         smi_msg->data[2] = lan_addr->channel;
1460         smi_msg->data[3] = lan_addr->session_handle;
1461         smi_msg->data[4] = lan_addr->remote_SWID;
1462         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1463         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1464         smi_msg->data[7] = lan_addr->local_SWID;
1465         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1466         smi_msg->data[9] = msg->cmd;
1467
1468         /* Now tack on the data to the message. */
1469         if (msg->data_len > 0)
1470                 memcpy(&(smi_msg->data[10]), msg->data,
1471                        msg->data_len);
1472         smi_msg->data_size = msg->data_len + 10;
1473
1474         /* Now calculate the checksum and tack it on. */
1475         smi_msg->data[smi_msg->data_size]
1476                 = ipmb_checksum(&(smi_msg->data[7]),
1477                                 smi_msg->data_size-7);
1478
1479         /*
1480          * Add on the checksum size and the offset from the
1481          * broadcast.
1482          */
1483         smi_msg->data_size += 1;
1484
1485         smi_msg->msgid = msgid;
1486 }
1487
1488 /*
1489  * Separate from ipmi_request so that the user does not have to be
1490  * supplied in certain circumstances (mainly at panic time).  If
1491  * messages are supplied, they will be freed, even if an error
1492  * occurs.
1493  */
1494 static int i_ipmi_request(ipmi_user_t          user,
1495                           ipmi_smi_t           intf,
1496                           struct ipmi_addr     *addr,
1497                           long                 msgid,
1498                           struct kernel_ipmi_msg *msg,
1499                           void                 *user_msg_data,
1500                           void                 *supplied_smi,
1501                           struct ipmi_recv_msg *supplied_recv,
1502                           int                  priority,
1503                           unsigned char        source_address,
1504                           unsigned char        source_lun,
1505                           int                  retries,
1506                           unsigned int         retry_time_ms)
1507 {
1508         int                      rv = 0;
1509         struct ipmi_smi_msg      *smi_msg;
1510         struct ipmi_recv_msg     *recv_msg;
1511         unsigned long            flags;
1512         struct ipmi_smi_handlers *handlers;
1513
1514
1515         if (supplied_recv)
1516                 recv_msg = supplied_recv;
1517         else {
1518                 recv_msg = ipmi_alloc_recv_msg();
1519                 if (recv_msg == NULL)
1520                         return -ENOMEM;
1521         }
1522         recv_msg->user_msg_data = user_msg_data;
1523
1524         if (supplied_smi)
1525                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1526         else {
1527                 smi_msg = ipmi_alloc_smi_msg();
1528                 if (smi_msg == NULL) {
1529                         ipmi_free_recv_msg(recv_msg);
1530                         return -ENOMEM;
1531                 }
1532         }
1533
1534         rcu_read_lock();
1535         handlers = intf->handlers;
1536         if (!handlers) {
1537                 rv = -ENODEV;
1538                 goto out_err;
1539         }
1540
1541         recv_msg->user = user;
1542         if (user)
1543                 kref_get(&user->refcount);
1544         recv_msg->msgid = msgid;
1545         /*
1546          * Store the message to send in the receive message so timeout
1547          * responses can get the proper response data.
1548          */
1549         recv_msg->msg = *msg;
1550
1551         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1552                 struct ipmi_system_interface_addr *smi_addr;
1553
1554                 if (msg->netfn & 1) {
1555                         /* Responses are not allowed to the SMI. */
1556                         rv = -EINVAL;
1557                         goto out_err;
1558                 }
1559
1560                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1561                 if (smi_addr->lun > 3) {
1562                         ipmi_inc_stat(intf, sent_invalid_commands);
1563                         rv = -EINVAL;
1564                         goto out_err;
1565                 }
1566
1567                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1568
1569                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1570                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1571                         || (msg->cmd == IPMI_GET_MSG_CMD)
1572                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1573                         /*
1574                          * We don't let the user do these, since we manage
1575                          * the sequence numbers.
1576                          */
1577                         ipmi_inc_stat(intf, sent_invalid_commands);
1578                         rv = -EINVAL;
1579                         goto out_err;
1580                 }
1581
1582                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1583                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1584                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1585                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1586                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1587                         intf->auto_maintenance_timeout
1588                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1589                         if (!intf->maintenance_mode
1590                             && !intf->maintenance_mode_enable) {
1591                                 intf->maintenance_mode_enable = true;
1592                                 maintenance_mode_update(intf);
1593                         }
1594                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1595                                                flags);
1596                 }
1597
1598                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1599                         ipmi_inc_stat(intf, sent_invalid_commands);
1600                         rv = -EMSGSIZE;
1601                         goto out_err;
1602                 }
1603
1604                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1605                 smi_msg->data[1] = msg->cmd;
1606                 smi_msg->msgid = msgid;
1607                 smi_msg->user_data = recv_msg;
1608                 if (msg->data_len > 0)
1609                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1610                 smi_msg->data_size = msg->data_len + 2;
1611                 ipmi_inc_stat(intf, sent_local_commands);
1612         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1613                 struct ipmi_ipmb_addr *ipmb_addr;
1614                 unsigned char         ipmb_seq;
1615                 long                  seqid;
1616                 int                   broadcast = 0;
1617
1618                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1619                         ipmi_inc_stat(intf, sent_invalid_commands);
1620                         rv = -EINVAL;
1621                         goto out_err;
1622                 }
1623
1624                 if (intf->channels[addr->channel].medium
1625                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1626                         ipmi_inc_stat(intf, sent_invalid_commands);
1627                         rv = -EINVAL;
1628                         goto out_err;
1629                 }
1630
1631                 if (retries < 0) {
1632                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1633                         retries = 0; /* Don't retry broadcasts. */
1634                     else
1635                         retries = 4;
1636                 }
1637                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1638                     /*
1639                      * Broadcasts add a zero at the beginning of the
1640                      * message, but otherwise is the same as an IPMB
1641                      * address.
1642                      */
1643                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1644                     broadcast = 1;
1645                 }
1646
1647
1648                 /* Default to 1 second retries. */
1649                 if (retry_time_ms == 0)
1650                     retry_time_ms = 1000;
1651
1652                 /*
1653                  * 9 for the header and 1 for the checksum, plus
1654                  * possibly one for the broadcast.
1655                  */
1656                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1657                         ipmi_inc_stat(intf, sent_invalid_commands);
1658                         rv = -EMSGSIZE;
1659                         goto out_err;
1660                 }
1661
1662                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1663                 if (ipmb_addr->lun > 3) {
1664                         ipmi_inc_stat(intf, sent_invalid_commands);
1665                         rv = -EINVAL;
1666                         goto out_err;
1667                 }
1668
1669                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1670
1671                 if (recv_msg->msg.netfn & 0x1) {
1672                         /*
1673                          * It's a response, so use the user's sequence
1674                          * from msgid.
1675                          */
1676                         ipmi_inc_stat(intf, sent_ipmb_responses);
1677                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1678                                         msgid, broadcast,
1679                                         source_address, source_lun);
1680
1681                         /*
1682                          * Save the receive message so we can use it
1683                          * to deliver the response.
1684                          */
1685                         smi_msg->user_data = recv_msg;
1686                 } else {
1687                         /* It's a command, so get a sequence for it. */
1688
1689                         spin_lock_irqsave(&(intf->seq_lock), flags);
1690
1691                         /*
1692                          * Create a sequence number with a 1 second
1693                          * timeout and 4 retries.
1694                          */
1695                         rv = intf_next_seq(intf,
1696                                            recv_msg,
1697                                            retry_time_ms,
1698                                            retries,
1699                                            broadcast,
1700                                            &ipmb_seq,
1701                                            &seqid);
1702                         if (rv) {
1703                                 /*
1704                                  * We have used up all the sequence numbers,
1705                                  * probably, so abort.
1706                                  */
1707                                 spin_unlock_irqrestore(&(intf->seq_lock),
1708                                                        flags);
1709                                 goto out_err;
1710                         }
1711
1712                         ipmi_inc_stat(intf, sent_ipmb_commands);
1713
1714                         /*
1715                          * Store the sequence number in the message,
1716                          * so that when the send message response
1717                          * comes back we can start the timer.
1718                          */
1719                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1720                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1721                                         ipmb_seq, broadcast,
1722                                         source_address, source_lun);
1723
1724                         /*
1725                          * Copy the message into the recv message data, so we
1726                          * can retransmit it later if necessary.
1727                          */
1728                         memcpy(recv_msg->msg_data, smi_msg->data,
1729                                smi_msg->data_size);
1730                         recv_msg->msg.data = recv_msg->msg_data;
1731                         recv_msg->msg.data_len = smi_msg->data_size;
1732
1733                         /*
1734                          * We don't unlock until here, because we need
1735                          * to copy the completed message into the
1736                          * recv_msg before we release the lock.
1737                          * Otherwise, race conditions may bite us.  I
1738                          * know that's pretty paranoid, but I prefer
1739                          * to be correct.
1740                          */
1741                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1742                 }
1743         } else if (is_lan_addr(addr)) {
1744                 struct ipmi_lan_addr  *lan_addr;
1745                 unsigned char         ipmb_seq;
1746                 long                  seqid;
1747
1748                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1749                         ipmi_inc_stat(intf, sent_invalid_commands);
1750                         rv = -EINVAL;
1751                         goto out_err;
1752                 }
1753
1754                 if ((intf->channels[addr->channel].medium
1755                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1756                     && (intf->channels[addr->channel].medium
1757                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1758                         ipmi_inc_stat(intf, sent_invalid_commands);
1759                         rv = -EINVAL;
1760                         goto out_err;
1761                 }
1762
1763                 retries = 4;
1764
1765                 /* Default to 1 second retries. */
1766                 if (retry_time_ms == 0)
1767                     retry_time_ms = 1000;
1768
1769                 /* 11 for the header and 1 for the checksum. */
1770                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1771                         ipmi_inc_stat(intf, sent_invalid_commands);
1772                         rv = -EMSGSIZE;
1773                         goto out_err;
1774                 }
1775
1776                 lan_addr = (struct ipmi_lan_addr *) addr;
1777                 if (lan_addr->lun > 3) {
1778                         ipmi_inc_stat(intf, sent_invalid_commands);
1779                         rv = -EINVAL;
1780                         goto out_err;
1781                 }
1782
1783                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1784
1785                 if (recv_msg->msg.netfn & 0x1) {
1786                         /*
1787                          * It's a response, so use the user's sequence
1788                          * from msgid.
1789                          */
1790                         ipmi_inc_stat(intf, sent_lan_responses);
1791                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1792                                        msgid, source_lun);
1793
1794                         /*
1795                          * Save the receive message so we can use it
1796                          * to deliver the response.
1797                          */
1798                         smi_msg->user_data = recv_msg;
1799                 } else {
1800                         /* It's a command, so get a sequence for it. */
1801
1802                         spin_lock_irqsave(&(intf->seq_lock), flags);
1803
1804                         /*
1805                          * Create a sequence number with a 1 second
1806                          * timeout and 4 retries.
1807                          */
1808                         rv = intf_next_seq(intf,
1809                                            recv_msg,
1810                                            retry_time_ms,
1811                                            retries,
1812                                            0,
1813                                            &ipmb_seq,
1814                                            &seqid);
1815                         if (rv) {
1816                                 /*
1817                                  * We have used up all the sequence numbers,
1818                                  * probably, so abort.
1819                                  */
1820                                 spin_unlock_irqrestore(&(intf->seq_lock),
1821                                                        flags);
1822                                 goto out_err;
1823                         }
1824
1825                         ipmi_inc_stat(intf, sent_lan_commands);
1826
1827                         /*
1828                          * Store the sequence number in the message,
1829                          * so that when the send message response
1830                          * comes back we can start the timer.
1831                          */
1832                         format_lan_msg(smi_msg, msg, lan_addr,
1833                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1834                                        ipmb_seq, source_lun);
1835
1836                         /*
1837                          * Copy the message into the recv message data, so we
1838                          * can retransmit it later if necessary.
1839                          */
1840                         memcpy(recv_msg->msg_data, smi_msg->data,
1841                                smi_msg->data_size);
1842                         recv_msg->msg.data = recv_msg->msg_data;
1843                         recv_msg->msg.data_len = smi_msg->data_size;
1844
1845                         /*
1846                          * We don't unlock until here, because we need
1847                          * to copy the completed message into the
1848                          * recv_msg before we release the lock.
1849                          * Otherwise, race conditions may bite us.  I
1850                          * know that's pretty paranoid, but I prefer
1851                          * to be correct.
1852                          */
1853                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1854                 }
1855         } else {
1856             /* Unknown address type. */
1857                 ipmi_inc_stat(intf, sent_invalid_commands);
1858                 rv = -EINVAL;
1859                 goto out_err;
1860         }
1861
1862 #ifdef DEBUG_MSGING
1863         {
1864                 int m;
1865                 for (m = 0; m < smi_msg->data_size; m++)
1866                         printk(" %2.2x", smi_msg->data[m]);
1867                 printk("\n");
1868         }
1869 #endif
1870
1871         handlers->sender(intf->send_info, smi_msg, priority);
1872         rcu_read_unlock();
1873
1874         return 0;
1875
1876  out_err:
1877         rcu_read_unlock();
1878         ipmi_free_smi_msg(smi_msg);
1879         ipmi_free_recv_msg(recv_msg);
1880         return rv;
1881 }
1882
1883 static int check_addr(ipmi_smi_t       intf,
1884                       struct ipmi_addr *addr,
1885                       unsigned char    *saddr,
1886                       unsigned char    *lun)
1887 {
1888         if (addr->channel >= IPMI_MAX_CHANNELS)
1889                 return -EINVAL;
1890         *lun = intf->channels[addr->channel].lun;
1891         *saddr = intf->channels[addr->channel].address;
1892         return 0;
1893 }
1894
1895 int ipmi_request_settime(ipmi_user_t      user,
1896                          struct ipmi_addr *addr,
1897                          long             msgid,
1898                          struct kernel_ipmi_msg  *msg,
1899                          void             *user_msg_data,
1900                          int              priority,
1901                          int              retries,
1902                          unsigned int     retry_time_ms)
1903 {
1904         unsigned char saddr = 0, lun = 0;
1905         int           rv;
1906
1907         if (!user)
1908                 return -EINVAL;
1909         rv = check_addr(user->intf, addr, &saddr, &lun);
1910         if (rv)
1911                 return rv;
1912         return i_ipmi_request(user,
1913                               user->intf,
1914                               addr,
1915                               msgid,
1916                               msg,
1917                               user_msg_data,
1918                               NULL, NULL,
1919                               priority,
1920                               saddr,
1921                               lun,
1922                               retries,
1923                               retry_time_ms);
1924 }
1925 EXPORT_SYMBOL(ipmi_request_settime);
1926
1927 int ipmi_request_supply_msgs(ipmi_user_t          user,
1928                              struct ipmi_addr     *addr,
1929                              long                 msgid,
1930                              struct kernel_ipmi_msg *msg,
1931                              void                 *user_msg_data,
1932                              void                 *supplied_smi,
1933                              struct ipmi_recv_msg *supplied_recv,
1934                              int                  priority)
1935 {
1936         unsigned char saddr = 0, lun = 0;
1937         int           rv;
1938
1939         if (!user)
1940                 return -EINVAL;
1941         rv = check_addr(user->intf, addr, &saddr, &lun);
1942         if (rv)
1943                 return rv;
1944         return i_ipmi_request(user,
1945                               user->intf,
1946                               addr,
1947                               msgid,
1948                               msg,
1949                               user_msg_data,
1950                               supplied_smi,
1951                               supplied_recv,
1952                               priority,
1953                               saddr,
1954                               lun,
1955                               -1, 0);
1956 }
1957 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1958
1959 #ifdef CONFIG_PROC_FS
1960 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
1961 {
1962         ipmi_smi_t intf = m->private;
1963         int        i;
1964
1965         seq_printf(m, "%x", intf->channels[0].address);
1966         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
1967                 seq_printf(m, " %x", intf->channels[i].address);
1968         return seq_putc(m, '\n');
1969 }
1970
1971 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
1972 {
1973         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
1974 }
1975
1976 static const struct file_operations smi_ipmb_proc_ops = {
1977         .open           = smi_ipmb_proc_open,
1978         .read           = seq_read,
1979         .llseek         = seq_lseek,
1980         .release        = single_release,
1981 };
1982
1983 static int smi_version_proc_show(struct seq_file *m, void *v)
1984 {
1985         ipmi_smi_t intf = m->private;
1986
1987         return seq_printf(m, "%u.%u\n",
1988                        ipmi_version_major(&intf->bmc->id),
1989                        ipmi_version_minor(&intf->bmc->id));
1990 }
1991
1992 static int smi_version_proc_open(struct inode *inode, struct file *file)
1993 {
1994         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
1995 }
1996
1997 static const struct file_operations smi_version_proc_ops = {
1998         .open           = smi_version_proc_open,
1999         .read           = seq_read,
2000         .llseek         = seq_lseek,
2001         .release        = single_release,
2002 };
2003
2004 static int smi_stats_proc_show(struct seq_file *m, void *v)
2005 {
2006         ipmi_smi_t intf = m->private;
2007
2008         seq_printf(m, "sent_invalid_commands:       %u\n",
2009                        ipmi_get_stat(intf, sent_invalid_commands));
2010         seq_printf(m, "sent_local_commands:         %u\n",
2011                        ipmi_get_stat(intf, sent_local_commands));
2012         seq_printf(m, "handled_local_responses:     %u\n",
2013                        ipmi_get_stat(intf, handled_local_responses));
2014         seq_printf(m, "unhandled_local_responses:   %u\n",
2015                        ipmi_get_stat(intf, unhandled_local_responses));
2016         seq_printf(m, "sent_ipmb_commands:          %u\n",
2017                        ipmi_get_stat(intf, sent_ipmb_commands));
2018         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2019                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2020         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2021                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2022         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2023                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2024         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2025                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2026         seq_printf(m, "sent_ipmb_responses:         %u\n",
2027                        ipmi_get_stat(intf, sent_ipmb_responses));
2028         seq_printf(m, "handled_ipmb_responses:      %u\n",
2029                        ipmi_get_stat(intf, handled_ipmb_responses));
2030         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2031                        ipmi_get_stat(intf, invalid_ipmb_responses));
2032         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2033                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2034         seq_printf(m, "sent_lan_commands:           %u\n",
2035                        ipmi_get_stat(intf, sent_lan_commands));
2036         seq_printf(m, "sent_lan_command_errs:       %u\n",
2037                        ipmi_get_stat(intf, sent_lan_command_errs));
2038         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2039                        ipmi_get_stat(intf, retransmitted_lan_commands));
2040         seq_printf(m, "timed_out_lan_commands:      %u\n",
2041                        ipmi_get_stat(intf, timed_out_lan_commands));
2042         seq_printf(m, "sent_lan_responses:          %u\n",
2043                        ipmi_get_stat(intf, sent_lan_responses));
2044         seq_printf(m, "handled_lan_responses:       %u\n",
2045                        ipmi_get_stat(intf, handled_lan_responses));
2046         seq_printf(m, "invalid_lan_responses:       %u\n",
2047                        ipmi_get_stat(intf, invalid_lan_responses));
2048         seq_printf(m, "unhandled_lan_responses:     %u\n",
2049                        ipmi_get_stat(intf, unhandled_lan_responses));
2050         seq_printf(m, "handled_commands:            %u\n",
2051                        ipmi_get_stat(intf, handled_commands));
2052         seq_printf(m, "invalid_commands:            %u\n",
2053                        ipmi_get_stat(intf, invalid_commands));
2054         seq_printf(m, "unhandled_commands:          %u\n",
2055                        ipmi_get_stat(intf, unhandled_commands));
2056         seq_printf(m, "invalid_events:              %u\n",
2057                        ipmi_get_stat(intf, invalid_events));
2058         seq_printf(m, "events:                      %u\n",
2059                        ipmi_get_stat(intf, events));
2060         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2061                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2062         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2063                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2064         return 0;
2065 }
2066
2067 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2068 {
2069         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2070 }
2071
2072 static const struct file_operations smi_stats_proc_ops = {
2073         .open           = smi_stats_proc_open,
2074         .read           = seq_read,
2075         .llseek         = seq_lseek,
2076         .release        = single_release,
2077 };
2078 #endif /* CONFIG_PROC_FS */
2079
2080 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2081                             const struct file_operations *proc_ops,
2082                             void *data)
2083 {
2084         int                    rv = 0;
2085 #ifdef CONFIG_PROC_FS
2086         struct proc_dir_entry  *file;
2087         struct ipmi_proc_entry *entry;
2088
2089         /* Create a list element. */
2090         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2091         if (!entry)
2092                 return -ENOMEM;
2093         entry->name = kstrdup(name, GFP_KERNEL);
2094         if (!entry->name) {
2095                 kfree(entry);
2096                 return -ENOMEM;
2097         }
2098
2099         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2100         if (!file) {
2101                 kfree(entry->name);
2102                 kfree(entry);
2103                 rv = -ENOMEM;
2104         } else {
2105                 mutex_lock(&smi->proc_entry_lock);
2106                 /* Stick it on the list. */
2107                 entry->next = smi->proc_entries;
2108                 smi->proc_entries = entry;
2109                 mutex_unlock(&smi->proc_entry_lock);
2110         }
2111 #endif /* CONFIG_PROC_FS */
2112
2113         return rv;
2114 }
2115 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2116
2117 static int add_proc_entries(ipmi_smi_t smi, int num)
2118 {
2119         int rv = 0;
2120
2121 #ifdef CONFIG_PROC_FS
2122         sprintf(smi->proc_dir_name, "%d", num);
2123         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2124         if (!smi->proc_dir)
2125                 rv = -ENOMEM;
2126
2127         if (rv == 0)
2128                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2129                                              &smi_stats_proc_ops,
2130                                              smi);
2131
2132         if (rv == 0)
2133                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2134                                              &smi_ipmb_proc_ops,
2135                                              smi);
2136
2137         if (rv == 0)
2138                 rv = ipmi_smi_add_proc_entry(smi, "version",
2139                                              &smi_version_proc_ops,
2140                                              smi);
2141 #endif /* CONFIG_PROC_FS */
2142
2143         return rv;
2144 }
2145
2146 static void remove_proc_entries(ipmi_smi_t smi)
2147 {
2148 #ifdef CONFIG_PROC_FS
2149         struct ipmi_proc_entry *entry;
2150
2151         mutex_lock(&smi->proc_entry_lock);
2152         while (smi->proc_entries) {
2153                 entry = smi->proc_entries;
2154                 smi->proc_entries = entry->next;
2155
2156                 remove_proc_entry(entry->name, smi->proc_dir);
2157                 kfree(entry->name);
2158                 kfree(entry);
2159         }
2160         mutex_unlock(&smi->proc_entry_lock);
2161         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2162 #endif /* CONFIG_PROC_FS */
2163 }
2164
2165 static int __find_bmc_guid(struct device *dev, void *data)
2166 {
2167         unsigned char *id = data;
2168         struct bmc_device *bmc = to_bmc_device(dev);
2169         return memcmp(bmc->guid, id, 16) == 0;
2170 }
2171
2172 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2173                                              unsigned char *guid)
2174 {
2175         struct device *dev;
2176
2177         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2178         if (dev)
2179                 return to_bmc_device(dev);
2180         else
2181                 return NULL;
2182 }
2183
2184 struct prod_dev_id {
2185         unsigned int  product_id;
2186         unsigned char device_id;
2187 };
2188
2189 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2190 {
2191         struct prod_dev_id *id = data;
2192         struct bmc_device *bmc = to_bmc_device(dev);
2193
2194         return (bmc->id.product_id == id->product_id
2195                 && bmc->id.device_id == id->device_id);
2196 }
2197
2198 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2199         struct device_driver *drv,
2200         unsigned int product_id, unsigned char device_id)
2201 {
2202         struct prod_dev_id id = {
2203                 .product_id = product_id,
2204                 .device_id = device_id,
2205         };
2206         struct device *dev;
2207
2208         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2209         if (dev)
2210                 return to_bmc_device(dev);
2211         else
2212                 return NULL;
2213 }
2214
2215 static ssize_t device_id_show(struct device *dev,
2216                               struct device_attribute *attr,
2217                               char *buf)
2218 {
2219         struct bmc_device *bmc = to_bmc_device(dev);
2220
2221         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2222 }
2223 DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
2224
2225 static ssize_t provides_device_sdrs_show(struct device *dev,
2226                                          struct device_attribute *attr,
2227                                          char *buf)
2228 {
2229         struct bmc_device *bmc = to_bmc_device(dev);
2230
2231         return snprintf(buf, 10, "%u\n",
2232                         (bmc->id.device_revision & 0x80) >> 7);
2233 }
2234 DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show, NULL);
2235
2236 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2237                              char *buf)
2238 {
2239         struct bmc_device *bmc = to_bmc_device(dev);
2240
2241         return snprintf(buf, 20, "%u\n",
2242                         bmc->id.device_revision & 0x0F);
2243 }
2244 DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
2245
2246 static ssize_t firmware_revision_show(struct device *dev,
2247                                       struct device_attribute *attr,
2248                                       char *buf)
2249 {
2250         struct bmc_device *bmc = to_bmc_device(dev);
2251
2252         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2253                         bmc->id.firmware_revision_2);
2254 }
2255 DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
2256
2257 static ssize_t ipmi_version_show(struct device *dev,
2258                                  struct device_attribute *attr,
2259                                  char *buf)
2260 {
2261         struct bmc_device *bmc = to_bmc_device(dev);
2262
2263         return snprintf(buf, 20, "%u.%u\n",
2264                         ipmi_version_major(&bmc->id),
2265                         ipmi_version_minor(&bmc->id));
2266 }
2267 DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
2268
2269 static ssize_t add_dev_support_show(struct device *dev,
2270                                     struct device_attribute *attr,
2271                                     char *buf)
2272 {
2273         struct bmc_device *bmc = to_bmc_device(dev);
2274
2275         return snprintf(buf, 10, "0x%02x\n",
2276                         bmc->id.additional_device_support);
2277 }
2278 DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, NULL);
2279
2280 static ssize_t manufacturer_id_show(struct device *dev,
2281                                     struct device_attribute *attr,
2282                                     char *buf)
2283 {
2284         struct bmc_device *bmc = to_bmc_device(dev);
2285
2286         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2287 }
2288 DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
2289
2290 static ssize_t product_id_show(struct device *dev,
2291                                struct device_attribute *attr,
2292                                char *buf)
2293 {
2294         struct bmc_device *bmc = to_bmc_device(dev);
2295
2296         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2297 }
2298 DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
2299
2300 static ssize_t aux_firmware_rev_show(struct device *dev,
2301                                      struct device_attribute *attr,
2302                                      char *buf)
2303 {
2304         struct bmc_device *bmc = to_bmc_device(dev);
2305
2306         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2307                         bmc->id.aux_firmware_revision[3],
2308                         bmc->id.aux_firmware_revision[2],
2309                         bmc->id.aux_firmware_revision[1],
2310                         bmc->id.aux_firmware_revision[0]);
2311 }
2312 DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2313
2314 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2315                          char *buf)
2316 {
2317         struct bmc_device *bmc = to_bmc_device(dev);
2318
2319         return snprintf(buf, 100, "%Lx%Lx\n",
2320                         (long long) bmc->guid[0],
2321                         (long long) bmc->guid[8]);
2322 }
2323 DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
2324
2325 static struct attribute *bmc_dev_attrs[] = {
2326         &dev_attr_device_id.attr,
2327         &dev_attr_provides_device_sdrs.attr,
2328         &dev_attr_revision.attr,
2329         &dev_attr_firmware_revision.attr,
2330         &dev_attr_ipmi_version.attr,
2331         &dev_attr_additional_device_support.attr,
2332         &dev_attr_manufacturer_id.attr,
2333         &dev_attr_product_id.attr,
2334         NULL
2335 };
2336
2337 static struct attribute_group bmc_dev_attr_group = {
2338         .attrs          = bmc_dev_attrs,
2339 };
2340
2341 static const struct attribute_group *bmc_dev_attr_groups[] = {
2342         &bmc_dev_attr_group,
2343         NULL
2344 };
2345
2346 static struct device_type bmc_device_type = {
2347         .groups         = bmc_dev_attr_groups,
2348 };
2349
2350 static void
2351 release_bmc_device(struct device *dev)
2352 {
2353         kfree(to_bmc_device(dev));
2354 }
2355
2356 static void
2357 cleanup_bmc_device(struct kref *ref)
2358 {
2359         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2360
2361         if (bmc->id.aux_firmware_revision_set)
2362                 device_remove_file(&bmc->pdev.dev,
2363                                    &bmc->aux_firmware_rev_attr);
2364         if (bmc->guid_set)
2365                 device_remove_file(&bmc->pdev.dev,
2366                                    &bmc->guid_attr);
2367
2368         platform_device_unregister(&bmc->pdev);
2369 }
2370
2371 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2372 {
2373         struct bmc_device *bmc = intf->bmc;
2374
2375         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2376         if (intf->my_dev_name) {
2377                 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2378                 kfree(intf->my_dev_name);
2379                 intf->my_dev_name = NULL;
2380         }
2381
2382         mutex_lock(&ipmidriver_mutex);
2383         kref_put(&bmc->usecount, cleanup_bmc_device);
2384         intf->bmc = NULL;
2385         mutex_unlock(&ipmidriver_mutex);
2386 }
2387
2388 static int create_bmc_files(struct bmc_device *bmc)
2389 {
2390         int err;
2391
2392         if (bmc->id.aux_firmware_revision_set) {
2393                 bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2394                 err = device_create_file(&bmc->pdev.dev,
2395                                    &bmc->aux_firmware_rev_attr);
2396                 if (err)
2397                         goto out;
2398         }
2399         if (bmc->guid_set) {
2400                 bmc->guid_attr.attr.name = "guid";
2401                 err = device_create_file(&bmc->pdev.dev,
2402                                    &bmc->guid_attr);
2403                 if (err)
2404                         goto out_aux_firm;
2405         }
2406
2407         return 0;
2408
2409 out_aux_firm:
2410         if (bmc->id.aux_firmware_revision_set)
2411                 device_remove_file(&bmc->pdev.dev,
2412                                    &bmc->aux_firmware_rev_attr);
2413 out:
2414         return err;
2415 }
2416
2417 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
2418 {
2419         int               rv;
2420         struct bmc_device *bmc = intf->bmc;
2421         struct bmc_device *old_bmc;
2422
2423         mutex_lock(&ipmidriver_mutex);
2424
2425         /*
2426          * Try to find if there is an bmc_device struct
2427          * representing the interfaced BMC already
2428          */
2429         if (bmc->guid_set)
2430                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2431         else
2432                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2433                                                     bmc->id.product_id,
2434                                                     bmc->id.device_id);
2435
2436         /*
2437          * If there is already an bmc_device, free the new one,
2438          * otherwise register the new BMC device
2439          */
2440         if (old_bmc) {
2441                 kfree(bmc);
2442                 intf->bmc = old_bmc;
2443                 bmc = old_bmc;
2444
2445                 kref_get(&bmc->usecount);
2446                 mutex_unlock(&ipmidriver_mutex);
2447
2448                 printk(KERN_INFO
2449                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2450                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2451                        bmc->id.manufacturer_id,
2452                        bmc->id.product_id,
2453                        bmc->id.device_id);
2454         } else {
2455                 unsigned char orig_dev_id = bmc->id.device_id;
2456                 int warn_printed = 0;
2457
2458                 snprintf(bmc->name, sizeof(bmc->name),
2459                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2460                 bmc->pdev.name = bmc->name;
2461
2462                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2463                                                  bmc->id.product_id,
2464                                                  bmc->id.device_id)) {
2465                         if (!warn_printed) {
2466                                 printk(KERN_WARNING PFX
2467                                        "This machine has two different BMCs"
2468                                        " with the same product id and device"
2469                                        " id.  This is an error in the"
2470                                        " firmware, but incrementing the"
2471                                        " device id to work around the problem."
2472                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2473                                        bmc->id.product_id, bmc->id.device_id);
2474                                 warn_printed = 1;
2475                         }
2476                         bmc->id.device_id++; /* Wraps at 255 */
2477                         if (bmc->id.device_id == orig_dev_id) {
2478                                 printk(KERN_ERR PFX
2479                                        "Out of device ids!\n");
2480                                 break;
2481                         }
2482                 }
2483
2484                 bmc->pdev.dev.driver = &ipmidriver.driver;
2485                 bmc->pdev.id = bmc->id.device_id;
2486                 bmc->pdev.dev.release = release_bmc_device;
2487                 bmc->pdev.dev.type = &bmc_device_type;
2488                 kref_init(&bmc->usecount);
2489
2490                 rv = platform_device_register(&bmc->pdev);
2491                 mutex_unlock(&ipmidriver_mutex);
2492                 if (rv) {
2493                         put_device(&bmc->pdev.dev);
2494                         printk(KERN_ERR
2495                                "ipmi_msghandler:"
2496                                " Unable to register bmc device: %d\n",
2497                                rv);
2498                         /*
2499                          * Don't go to out_err, you can only do that if
2500                          * the device is registered already.
2501                          */
2502                         return rv;
2503                 }
2504
2505                 rv = create_bmc_files(bmc);
2506                 if (rv) {
2507                         mutex_lock(&ipmidriver_mutex);
2508                         platform_device_unregister(&bmc->pdev);
2509                         mutex_unlock(&ipmidriver_mutex);
2510
2511                         return rv;
2512                 }
2513
2514                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2515                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2516                          bmc->id.manufacturer_id,
2517                          bmc->id.product_id,
2518                          bmc->id.device_id);
2519         }
2520
2521         /*
2522          * create symlink from system interface device to bmc device
2523          * and back.
2524          */
2525         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
2526         if (rv) {
2527                 printk(KERN_ERR
2528                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2529                        rv);
2530                 goto out_err;
2531         }
2532
2533         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
2534         if (!intf->my_dev_name) {
2535                 rv = -ENOMEM;
2536                 printk(KERN_ERR
2537                        "ipmi_msghandler: allocate link from BMC: %d\n",
2538                        rv);
2539                 goto out_err;
2540         }
2541
2542         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
2543                                intf->my_dev_name);
2544         if (rv) {
2545                 kfree(intf->my_dev_name);
2546                 intf->my_dev_name = NULL;
2547                 printk(KERN_ERR
2548                        "ipmi_msghandler:"
2549                        " Unable to create symlink to bmc: %d\n",
2550                        rv);
2551                 goto out_err;
2552         }
2553
2554         return 0;
2555
2556 out_err:
2557         ipmi_bmc_unregister(intf);
2558         return rv;
2559 }
2560
2561 static int
2562 send_guid_cmd(ipmi_smi_t intf, int chan)
2563 {
2564         struct kernel_ipmi_msg            msg;
2565         struct ipmi_system_interface_addr si;
2566
2567         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2568         si.channel = IPMI_BMC_CHANNEL;
2569         si.lun = 0;
2570
2571         msg.netfn = IPMI_NETFN_APP_REQUEST;
2572         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2573         msg.data = NULL;
2574         msg.data_len = 0;
2575         return i_ipmi_request(NULL,
2576                               intf,
2577                               (struct ipmi_addr *) &si,
2578                               0,
2579                               &msg,
2580                               intf,
2581                               NULL,
2582                               NULL,
2583                               0,
2584                               intf->channels[0].address,
2585                               intf->channels[0].lun,
2586                               -1, 0);
2587 }
2588
2589 static void
2590 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2591 {
2592         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2593             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2594             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2595                 /* Not for me */
2596                 return;
2597
2598         if (msg->msg.data[0] != 0) {
2599                 /* Error from getting the GUID, the BMC doesn't have one. */
2600                 intf->bmc->guid_set = 0;
2601                 goto out;
2602         }
2603
2604         if (msg->msg.data_len < 17) {
2605                 intf->bmc->guid_set = 0;
2606                 printk(KERN_WARNING PFX
2607                        "guid_handler: The GUID response from the BMC was too"
2608                        " short, it was %d but should have been 17.  Assuming"
2609                        " GUID is not available.\n",
2610                        msg->msg.data_len);
2611                 goto out;
2612         }
2613
2614         memcpy(intf->bmc->guid, msg->msg.data, 16);
2615         intf->bmc->guid_set = 1;
2616  out:
2617         wake_up(&intf->waitq);
2618 }
2619
2620 static void
2621 get_guid(ipmi_smi_t intf)
2622 {
2623         int rv;
2624
2625         intf->bmc->guid_set = 0x2;
2626         intf->null_user_handler = guid_handler;
2627         rv = send_guid_cmd(intf, 0);
2628         if (rv)
2629                 /* Send failed, no GUID available. */
2630                 intf->bmc->guid_set = 0;
2631         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2632         intf->null_user_handler = NULL;
2633 }
2634
2635 static int
2636 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2637 {
2638         struct kernel_ipmi_msg            msg;
2639         unsigned char                     data[1];
2640         struct ipmi_system_interface_addr si;
2641
2642         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2643         si.channel = IPMI_BMC_CHANNEL;
2644         si.lun = 0;
2645
2646         msg.netfn = IPMI_NETFN_APP_REQUEST;
2647         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2648         msg.data = data;
2649         msg.data_len = 1;
2650         data[0] = chan;
2651         return i_ipmi_request(NULL,
2652                               intf,
2653                               (struct ipmi_addr *) &si,
2654                               0,
2655                               &msg,
2656                               intf,
2657                               NULL,
2658                               NULL,
2659                               0,
2660                               intf->channels[0].address,
2661                               intf->channels[0].lun,
2662                               -1, 0);
2663 }
2664
2665 static void
2666 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2667 {
2668         int rv = 0;
2669         int chan;
2670
2671         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2672             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2673             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2674                 /* It's the one we want */
2675                 if (msg->msg.data[0] != 0) {
2676                         /* Got an error from the channel, just go on. */
2677
2678                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2679                                 /*
2680                                  * If the MC does not support this
2681                                  * command, that is legal.  We just
2682                                  * assume it has one IPMB at channel
2683                                  * zero.
2684                                  */
2685                                 intf->channels[0].medium
2686                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2687                                 intf->channels[0].protocol
2688                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2689
2690                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2691                                 wake_up(&intf->waitq);
2692                                 goto out;
2693                         }
2694                         goto next_channel;
2695                 }
2696                 if (msg->msg.data_len < 4) {
2697                         /* Message not big enough, just go on. */
2698                         goto next_channel;
2699                 }
2700                 chan = intf->curr_channel;
2701                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2702                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2703
2704  next_channel:
2705                 intf->curr_channel++;
2706                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2707                         wake_up(&intf->waitq);
2708                 else
2709                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2710
2711                 if (rv) {
2712                         /* Got an error somehow, just give up. */
2713                         printk(KERN_WARNING PFX
2714                                "Error sending channel information for channel"
2715                                " %d: %d\n", intf->curr_channel, rv);
2716
2717                         intf->curr_channel = IPMI_MAX_CHANNELS;
2718                         wake_up(&intf->waitq);
2719                 }
2720         }
2721  out:
2722         return;
2723 }
2724
2725 static void ipmi_poll(ipmi_smi_t intf)
2726 {
2727         if (intf->handlers->poll)
2728                 intf->handlers->poll(intf->send_info);
2729         /* In case something came in */
2730         handle_new_recv_msgs(intf);
2731 }
2732
2733 void ipmi_poll_interface(ipmi_user_t user)
2734 {
2735         ipmi_poll(user->intf);
2736 }
2737 EXPORT_SYMBOL(ipmi_poll_interface);
2738
2739 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2740                       void                     *send_info,
2741                       struct ipmi_device_id    *device_id,
2742                       struct device            *si_dev,
2743                       unsigned char            slave_addr)
2744 {
2745         int              i, j;
2746         int              rv;
2747         ipmi_smi_t       intf;
2748         ipmi_smi_t       tintf;
2749         struct list_head *link;
2750
2751         /*
2752          * Make sure the driver is actually initialized, this handles
2753          * problems with initialization order.
2754          */
2755         if (!initialized) {
2756                 rv = ipmi_init_msghandler();
2757                 if (rv)
2758                         return rv;
2759                 /*
2760                  * The init code doesn't return an error if it was turned
2761                  * off, but it won't initialize.  Check that.
2762                  */
2763                 if (!initialized)
2764                         return -ENODEV;
2765         }
2766
2767         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2768         if (!intf)
2769                 return -ENOMEM;
2770
2771         intf->ipmi_version_major = ipmi_version_major(device_id);
2772         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2773
2774         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2775         if (!intf->bmc) {
2776                 kfree(intf);
2777                 return -ENOMEM;
2778         }
2779         intf->intf_num = -1; /* Mark it invalid for now. */
2780         kref_init(&intf->refcount);
2781         intf->bmc->id = *device_id;
2782         intf->si_dev = si_dev;
2783         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2784                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2785                 intf->channels[j].lun = 2;
2786         }
2787         if (slave_addr != 0)
2788                 intf->channels[0].address = slave_addr;
2789         INIT_LIST_HEAD(&intf->users);
2790         intf->handlers = handlers;
2791         intf->send_info = send_info;
2792         spin_lock_init(&intf->seq_lock);
2793         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2794                 intf->seq_table[j].inuse = 0;
2795                 intf->seq_table[j].seqid = 0;
2796         }
2797         intf->curr_seq = 0;
2798 #ifdef CONFIG_PROC_FS
2799         mutex_init(&intf->proc_entry_lock);
2800 #endif
2801         spin_lock_init(&intf->waiting_rcv_msgs_lock);
2802         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
2803         tasklet_init(&intf->recv_tasklet,
2804                      smi_recv_tasklet,
2805                      (unsigned long) intf);
2806         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2807         spin_lock_init(&intf->events_lock);
2808         atomic_set(&intf->event_waiters, 0);
2809         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2810         INIT_LIST_HEAD(&intf->waiting_events);
2811         intf->waiting_events_count = 0;
2812         mutex_init(&intf->cmd_rcvrs_mutex);
2813         spin_lock_init(&intf->maintenance_mode_lock);
2814         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2815         init_waitqueue_head(&intf->waitq);
2816         for (i = 0; i < IPMI_NUM_STATS; i++)
2817                 atomic_set(&intf->stats[i], 0);
2818
2819         intf->proc_dir = NULL;
2820
2821         mutex_lock(&smi_watchers_mutex);
2822         mutex_lock(&ipmi_interfaces_mutex);
2823         /* Look for a hole in the numbers. */
2824         i = 0;
2825         link = &ipmi_interfaces;
2826         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2827                 if (tintf->intf_num != i) {
2828                         link = &tintf->link;
2829                         break;
2830                 }
2831                 i++;
2832         }
2833         /* Add the new interface in numeric order. */
2834         if (i == 0)
2835                 list_add_rcu(&intf->link, &ipmi_interfaces);
2836         else
2837                 list_add_tail_rcu(&intf->link, link);
2838
2839         rv = handlers->start_processing(send_info, intf);
2840         if (rv)
2841                 goto out;
2842
2843         get_guid(intf);
2844
2845         if ((intf->ipmi_version_major > 1)
2846                         || ((intf->ipmi_version_major == 1)
2847                             && (intf->ipmi_version_minor >= 5))) {
2848                 /*
2849                  * Start scanning the channels to see what is
2850                  * available.
2851                  */
2852                 intf->null_user_handler = channel_handler;
2853                 intf->curr_channel = 0;
2854                 rv = send_channel_info_cmd(intf, 0);
2855                 if (rv) {
2856                         printk(KERN_WARNING PFX
2857                                "Error sending channel information for channel"
2858                                " 0, %d\n", rv);
2859                         goto out;
2860                 }
2861
2862                 /* Wait for the channel info to be read. */
2863                 wait_event(intf->waitq,
2864                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2865                 intf->null_user_handler = NULL;
2866         } else {
2867                 /* Assume a single IPMB channel at zero. */
2868                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2869                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2870                 intf->curr_channel = IPMI_MAX_CHANNELS;
2871         }
2872
2873         if (rv == 0)
2874                 rv = add_proc_entries(intf, i);
2875
2876         rv = ipmi_bmc_register(intf, i);
2877
2878  out:
2879         if (rv) {
2880                 if (intf->proc_dir)
2881                         remove_proc_entries(intf);
2882                 intf->handlers = NULL;
2883                 list_del_rcu(&intf->link);
2884                 mutex_unlock(&ipmi_interfaces_mutex);
2885                 mutex_unlock(&smi_watchers_mutex);
2886                 synchronize_rcu();
2887                 kref_put(&intf->refcount, intf_free);
2888         } else {
2889                 /*
2890                  * Keep memory order straight for RCU readers.  Make
2891                  * sure everything else is committed to memory before
2892                  * setting intf_num to mark the interface valid.
2893                  */
2894                 smp_wmb();
2895                 intf->intf_num = i;
2896                 mutex_unlock(&ipmi_interfaces_mutex);
2897                 /* After this point the interface is legal to use. */
2898                 call_smi_watchers(i, intf->si_dev);
2899                 mutex_unlock(&smi_watchers_mutex);
2900         }
2901
2902         return rv;
2903 }
2904 EXPORT_SYMBOL(ipmi_register_smi);
2905
2906 static void cleanup_smi_msgs(ipmi_smi_t intf)
2907 {
2908         int              i;
2909         struct seq_table *ent;
2910
2911         /* No need for locks, the interface is down. */
2912         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2913                 ent = &(intf->seq_table[i]);
2914                 if (!ent->inuse)
2915                         continue;
2916                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2917         }
2918 }
2919
2920 int ipmi_unregister_smi(ipmi_smi_t intf)
2921 {
2922         struct ipmi_smi_watcher *w;
2923         int    intf_num = intf->intf_num;
2924
2925         ipmi_bmc_unregister(intf);
2926
2927         mutex_lock(&smi_watchers_mutex);
2928         mutex_lock(&ipmi_interfaces_mutex);
2929         intf->intf_num = -1;
2930         intf->handlers = NULL;
2931         list_del_rcu(&intf->link);
2932         mutex_unlock(&ipmi_interfaces_mutex);
2933         synchronize_rcu();
2934
2935         cleanup_smi_msgs(intf);
2936
2937         remove_proc_entries(intf);
2938
2939         /*
2940          * Call all the watcher interfaces to tell them that
2941          * an interface is gone.
2942          */
2943         list_for_each_entry(w, &smi_watchers, link)
2944                 w->smi_gone(intf_num);
2945         mutex_unlock(&smi_watchers_mutex);
2946
2947         kref_put(&intf->refcount, intf_free);
2948         return 0;
2949 }
2950 EXPORT_SYMBOL(ipmi_unregister_smi);
2951
2952 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
2953                                    struct ipmi_smi_msg *msg)
2954 {
2955         struct ipmi_ipmb_addr ipmb_addr;
2956         struct ipmi_recv_msg  *recv_msg;
2957
2958         /*
2959          * This is 11, not 10, because the response must contain a
2960          * completion code.
2961          */
2962         if (msg->rsp_size < 11) {
2963                 /* Message not big enough, just ignore it. */
2964                 ipmi_inc_stat(intf, invalid_ipmb_responses);
2965                 return 0;
2966         }
2967
2968         if (msg->rsp[2] != 0) {
2969                 /* An error getting the response, just ignore it. */
2970                 return 0;
2971         }
2972
2973         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
2974         ipmb_addr.slave_addr = msg->rsp[6];
2975         ipmb_addr.channel = msg->rsp[3] & 0x0f;
2976         ipmb_addr.lun = msg->rsp[7] & 3;
2977
2978         /*
2979          * It's a response from a remote entity.  Look up the sequence
2980          * number and handle the response.
2981          */
2982         if (intf_find_seq(intf,
2983                           msg->rsp[7] >> 2,
2984                           msg->rsp[3] & 0x0f,
2985                           msg->rsp[8],
2986                           (msg->rsp[4] >> 2) & (~1),
2987                           (struct ipmi_addr *) &(ipmb_addr),
2988                           &recv_msg)) {
2989                 /*
2990                  * We were unable to find the sequence number,
2991                  * so just nuke the message.
2992                  */
2993                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
2994                 return 0;
2995         }
2996
2997         memcpy(recv_msg->msg_data,
2998                &(msg->rsp[9]),
2999                msg->rsp_size - 9);
3000         /*
3001          * The other fields matched, so no need to set them, except
3002          * for netfn, which needs to be the response that was
3003          * returned, not the request value.
3004          */
3005         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3006         recv_msg->msg.data = recv_msg->msg_data;
3007         recv_msg->msg.data_len = msg->rsp_size - 10;
3008         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3009         ipmi_inc_stat(intf, handled_ipmb_responses);
3010         deliver_response(recv_msg);
3011
3012         return 0;
3013 }
3014
3015 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3016                                    struct ipmi_smi_msg *msg)
3017 {
3018         struct cmd_rcvr          *rcvr;
3019         int                      rv = 0;
3020         unsigned char            netfn;
3021         unsigned char            cmd;
3022         unsigned char            chan;
3023         ipmi_user_t              user = NULL;
3024         struct ipmi_ipmb_addr    *ipmb_addr;
3025         struct ipmi_recv_msg     *recv_msg;
3026         struct ipmi_smi_handlers *handlers;
3027
3028         if (msg->rsp_size < 10) {
3029                 /* Message not big enough, just ignore it. */
3030                 ipmi_inc_stat(intf, invalid_commands);
3031                 return 0;
3032         }
3033
3034         if (msg->rsp[2] != 0) {
3035                 /* An error getting the response, just ignore it. */
3036                 return 0;
3037         }
3038
3039         netfn = msg->rsp[4] >> 2;
3040         cmd = msg->rsp[8];
3041         chan = msg->rsp[3] & 0xf;
3042
3043         rcu_read_lock();
3044         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3045         if (rcvr) {
3046                 user = rcvr->user;
3047                 kref_get(&user->refcount);
3048         } else
3049                 user = NULL;
3050         rcu_read_unlock();
3051
3052         if (user == NULL) {
3053                 /* We didn't find a user, deliver an error response. */
3054                 ipmi_inc_stat(intf, unhandled_commands);
3055
3056                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3057                 msg->data[1] = IPMI_SEND_MSG_CMD;
3058                 msg->data[2] = msg->rsp[3];
3059                 msg->data[3] = msg->rsp[6];
3060                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3061                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3062                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3063                 /* rqseq/lun */
3064                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3065                 msg->data[8] = msg->rsp[8]; /* cmd */
3066                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3067                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3068                 msg->data_size = 11;
3069
3070 #ifdef DEBUG_MSGING
3071         {
3072                 int m;
3073                 printk("Invalid command:");
3074                 for (m = 0; m < msg->data_size; m++)
3075                         printk(" %2.2x", msg->data[m]);
3076                 printk("\n");
3077         }
3078 #endif
3079                 rcu_read_lock();
3080                 handlers = intf->handlers;
3081                 if (handlers) {
3082                         handlers->sender(intf->send_info, msg, 0);
3083                         /*
3084                          * We used the message, so return the value
3085                          * that causes it to not be freed or
3086                          * queued.
3087                          */
3088                         rv = -1;
3089                 }
3090                 rcu_read_unlock();
3091         } else {
3092                 /* Deliver the message to the user. */
3093                 ipmi_inc_stat(intf, handled_commands);
3094
3095                 recv_msg = ipmi_alloc_recv_msg();
3096                 if (!recv_msg) {
3097                         /*
3098                          * We couldn't allocate memory for the
3099                          * message, so requeue it for handling
3100                          * later.
3101                          */
3102                         rv = 1;
3103                         kref_put(&user->refcount, free_user);
3104                 } else {
3105                         /* Extract the source address from the data. */
3106                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3107                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3108                         ipmb_addr->slave_addr = msg->rsp[6];
3109                         ipmb_addr->lun = msg->rsp[7] & 3;
3110                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3111
3112                         /*
3113                          * Extract the rest of the message information
3114                          * from the IPMB header.
3115                          */
3116                         recv_msg->user = user;
3117                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3118                         recv_msg->msgid = msg->rsp[7] >> 2;
3119                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3120                         recv_msg->msg.cmd = msg->rsp[8];
3121                         recv_msg->msg.data = recv_msg->msg_data;
3122
3123                         /*
3124                          * We chop off 10, not 9 bytes because the checksum
3125                          * at the end also needs to be removed.
3126                          */
3127                         recv_msg->msg.data_len = msg->rsp_size - 10;
3128                         memcpy(recv_msg->msg_data,
3129                                &(msg->rsp[9]),
3130                                msg->rsp_size - 10);
3131                         deliver_response(recv_msg);
3132                 }
3133         }
3134
3135         return rv;
3136 }
3137
3138 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3139                                   struct ipmi_smi_msg *msg)
3140 {
3141         struct ipmi_lan_addr  lan_addr;
3142         struct ipmi_recv_msg  *recv_msg;
3143
3144
3145         /*
3146          * This is 13, not 12, because the response must contain a
3147          * completion code.
3148          */
3149         if (msg->rsp_size < 13) {
3150                 /* Message not big enough, just ignore it. */
3151                 ipmi_inc_stat(intf, invalid_lan_responses);
3152                 return 0;
3153         }
3154
3155         if (msg->rsp[2] != 0) {
3156                 /* An error getting the response, just ignore it. */
3157                 return 0;
3158         }
3159
3160         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3161         lan_addr.session_handle = msg->rsp[4];
3162         lan_addr.remote_SWID = msg->rsp[8];
3163         lan_addr.local_SWID = msg->rsp[5];
3164         lan_addr.channel = msg->rsp[3] & 0x0f;
3165         lan_addr.privilege = msg->rsp[3] >> 4;
3166         lan_addr.lun = msg->rsp[9] & 3;
3167
3168         /*
3169          * It's a response from a remote entity.  Look up the sequence
3170          * number and handle the response.
3171          */
3172         if (intf_find_seq(intf,
3173                           msg->rsp[9] >> 2,
3174                           msg->rsp[3] & 0x0f,
3175                           msg->rsp[10],
3176                           (msg->rsp[6] >> 2) & (~1),
3177                           (struct ipmi_addr *) &(lan_addr),
3178                           &recv_msg)) {
3179                 /*
3180                  * We were unable to find the sequence number,
3181                  * so just nuke the message.
3182                  */
3183                 ipmi_inc_stat(intf, unhandled_lan_responses);
3184                 return 0;
3185         }
3186
3187         memcpy(recv_msg->msg_data,
3188                &(msg->rsp[11]),
3189                msg->rsp_size - 11);
3190         /*
3191          * The other fields matched, so no need to set them, except
3192          * for netfn, which needs to be the response that was
3193          * returned, not the request value.
3194          */
3195         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3196         recv_msg->msg.data = recv_msg->msg_data;
3197         recv_msg->msg.data_len = msg->rsp_size - 12;
3198         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3199         ipmi_inc_stat(intf, handled_lan_responses);
3200         deliver_response(recv_msg);
3201
3202         return 0;
3203 }
3204
3205 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3206                                   struct ipmi_smi_msg *msg)
3207 {
3208         struct cmd_rcvr          *rcvr;
3209         int                      rv = 0;
3210         unsigned char            netfn;
3211         unsigned char            cmd;
3212         unsigned char            chan;
3213         ipmi_user_t              user = NULL;
3214         struct ipmi_lan_addr     *lan_addr;
3215         struct ipmi_recv_msg     *recv_msg;
3216
3217         if (msg->rsp_size < 12) {
3218                 /* Message not big enough, just ignore it. */
3219                 ipmi_inc_stat(intf, invalid_commands);
3220                 return 0;
3221         }
3222
3223         if (msg->rsp[2] != 0) {
3224                 /* An error getting the response, just ignore it. */
3225                 return 0;
3226         }
3227
3228         netfn = msg->rsp[6] >> 2;
3229         cmd = msg->rsp[10];
3230         chan = msg->rsp[3] & 0xf;
3231
3232         rcu_read_lock();
3233         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3234         if (rcvr) {
3235                 user = rcvr->user;
3236                 kref_get(&user->refcount);
3237         } else
3238                 user = NULL;
3239         rcu_read_unlock();
3240
3241         if (user == NULL) {
3242                 /* We didn't find a user, just give up. */
3243                 ipmi_inc_stat(intf, unhandled_commands);
3244
3245                 /*
3246                  * Don't do anything with these messages, just allow
3247                  * them to be freed.
3248                  */
3249                 rv = 0;
3250         } else {
3251                 /* Deliver the message to the user. */
3252                 ipmi_inc_stat(intf, handled_commands);
3253
3254                 recv_msg = ipmi_alloc_recv_msg();
3255                 if (!recv_msg) {
3256                         /*
3257                          * We couldn't allocate memory for the
3258                          * message, so requeue it for handling later.
3259                          */
3260                         rv = 1;
3261                         kref_put(&user->refcount, free_user);
3262                 } else {
3263                         /* Extract the source address from the data. */
3264                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3265                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3266                         lan_addr->session_handle = msg->rsp[4];
3267                         lan_addr->remote_SWID = msg->rsp[8];
3268                         lan_addr->local_SWID = msg->rsp[5];
3269                         lan_addr->lun = msg->rsp[9] & 3;
3270                         lan_addr->channel = msg->rsp[3] & 0xf;
3271                         lan_addr->privilege = msg->rsp[3] >> 4;
3272
3273                         /*
3274                          * Extract the rest of the message information
3275                          * from the IPMB header.
3276                          */
3277                         recv_msg->user = user;
3278                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3279                         recv_msg->msgid = msg->rsp[9] >> 2;
3280                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3281                         recv_msg->msg.cmd = msg->rsp[10];
3282                         recv_msg->msg.data = recv_msg->msg_data;
3283
3284                         /*
3285                          * We chop off 12, not 11 bytes because the checksum
3286                          * at the end also needs to be removed.
3287                          */
3288                         recv_msg->msg.data_len = msg->rsp_size - 12;
3289                         memcpy(recv_msg->msg_data,
3290                                &(msg->rsp[11]),
3291                                msg->rsp_size - 12);
3292                         deliver_response(recv_msg);
3293                 }
3294         }
3295
3296         return rv;
3297 }
3298
3299 /*
3300  * This routine will handle "Get Message" command responses with
3301  * channels that use an OEM Medium. The message format belongs to
3302  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3303  * Chapter 22, sections 22.6 and 22.24 for more details.
3304  */
3305 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3306                                   struct ipmi_smi_msg *msg)
3307 {
3308         struct cmd_rcvr       *rcvr;
3309         int                   rv = 0;
3310         unsigned char         netfn;
3311         unsigned char         cmd;
3312         unsigned char         chan;
3313         ipmi_user_t           user = NULL;
3314         struct ipmi_system_interface_addr *smi_addr;
3315         struct ipmi_recv_msg  *recv_msg;
3316
3317         /*
3318          * We expect the OEM SW to perform error checking
3319          * so we just do some basic sanity checks
3320          */
3321         if (msg->rsp_size < 4) {
3322                 /* Message not big enough, just ignore it. */
3323                 ipmi_inc_stat(intf, invalid_commands);
3324                 return 0;
3325         }
3326
3327         if (msg->rsp[2] != 0) {
3328                 /* An error getting the response, just ignore it. */
3329                 return 0;
3330         }
3331
3332         /*
3333          * This is an OEM Message so the OEM needs to know how
3334          * handle the message. We do no interpretation.
3335          */
3336         netfn = msg->rsp[0] >> 2;
3337         cmd = msg->rsp[1];
3338         chan = msg->rsp[3] & 0xf;
3339
3340         rcu_read_lock();
3341         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3342         if (rcvr) {
3343                 user = rcvr->user;
3344                 kref_get(&user->refcount);
3345         } else
3346                 user = NULL;
3347         rcu_read_unlock();
3348
3349         if (user == NULL) {
3350                 /* We didn't find a user, just give up. */
3351                 ipmi_inc_stat(intf, unhandled_commands);
3352
3353                 /*
3354                  * Don't do anything with these messages, just allow
3355                  * them to be freed.
3356                  */
3357
3358                 rv = 0;
3359         } else {
3360                 /* Deliver the message to the user. */
3361                 ipmi_inc_stat(intf, handled_commands);
3362
3363                 recv_msg = ipmi_alloc_recv_msg();
3364                 if (!recv_msg) {
3365                         /*
3366                          * We couldn't allocate memory for the
3367                          * message, so requeue it for handling
3368                          * later.
3369                          */
3370                         rv = 1;
3371                         kref_put(&user->refcount, free_user);
3372                 } else {
3373                         /*
3374                          * OEM Messages are expected to be delivered via
3375                          * the system interface to SMS software.  We might
3376                          * need to visit this again depending on OEM
3377                          * requirements
3378                          */
3379                         smi_addr = ((struct ipmi_system_interface_addr *)
3380                                     &(recv_msg->addr));
3381                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3382                         smi_addr->channel = IPMI_BMC_CHANNEL;
3383                         smi_addr->lun = msg->rsp[0] & 3;
3384
3385                         recv_msg->user = user;
3386                         recv_msg->user_msg_data = NULL;
3387                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3388                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3389                         recv_msg->msg.cmd = msg->rsp[1];
3390                         recv_msg->msg.data = recv_msg->msg_data;
3391
3392                         /*
3393                          * The message starts at byte 4 which follows the
3394                          * the Channel Byte in the "GET MESSAGE" command
3395                          */
3396                         recv_msg->msg.data_len = msg->rsp_size - 4;
3397                         memcpy(recv_msg->msg_data,
3398                                &(msg->rsp[4]),
3399                                msg->rsp_size - 4);
3400                         deliver_response(recv_msg);
3401                 }
3402         }
3403
3404         return rv;
3405 }
3406
3407 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3408                                      struct ipmi_smi_msg  *msg)
3409 {
3410         struct ipmi_system_interface_addr *smi_addr;
3411
3412         recv_msg->msgid = 0;
3413         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3414         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3415         smi_addr->channel = IPMI_BMC_CHANNEL;
3416         smi_addr->lun = msg->rsp[0] & 3;
3417         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3418         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3419         recv_msg->msg.cmd = msg->rsp[1];
3420         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3421         recv_msg->msg.data = recv_msg->msg_data;
3422         recv_msg->msg.data_len = msg->rsp_size - 3;
3423 }
3424
3425 static int handle_read_event_rsp(ipmi_smi_t          intf,
3426                                  struct ipmi_smi_msg *msg)
3427 {
3428         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3429         struct list_head     msgs;
3430         ipmi_user_t          user;
3431         int                  rv = 0;
3432         int                  deliver_count = 0;
3433         unsigned long        flags;
3434
3435         if (msg->rsp_size < 19) {
3436                 /* Message is too small to be an IPMB event. */
3437                 ipmi_inc_stat(intf, invalid_events);
3438                 return 0;
3439         }
3440
3441         if (msg->rsp[2] != 0) {
3442                 /* An error getting the event, just ignore it. */
3443                 return 0;
3444         }
3445
3446         INIT_LIST_HEAD(&msgs);
3447
3448         spin_lock_irqsave(&intf->events_lock, flags);
3449
3450         ipmi_inc_stat(intf, events);
3451
3452         /*
3453          * Allocate and fill in one message for every user that is
3454          * getting events.
3455          */
3456         rcu_read_lock();
3457         list_for_each_entry_rcu(user, &intf->users, link) {
3458                 if (!user->gets_events)
3459                         continue;
3460
3461                 recv_msg = ipmi_alloc_recv_msg();
3462                 if (!recv_msg) {
3463                         rcu_read_unlock();
3464                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3465                                                  link) {
3466                                 list_del(&recv_msg->link);
3467                                 ipmi_free_recv_msg(recv_msg);
3468                         }
3469                         /*
3470                          * We couldn't allocate memory for the
3471                          * message, so requeue it for handling
3472                          * later.
3473                          */
3474                         rv = 1;
3475                         goto out;
3476                 }
3477
3478                 deliver_count++;
3479
3480                 copy_event_into_recv_msg(recv_msg, msg);
3481                 recv_msg->user = user;
3482                 kref_get(&user->refcount);
3483                 list_add_tail(&(recv_msg->link), &msgs);
3484         }
3485         rcu_read_unlock();
3486
3487         if (deliver_count) {
3488                 /* Now deliver all the messages. */
3489                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3490                         list_del(&recv_msg->link);
3491                         deliver_response(recv_msg);
3492                 }
3493         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3494                 /*
3495                  * No one to receive the message, put it in queue if there's
3496                  * not already too many things in the queue.
3497                  */
3498                 recv_msg = ipmi_alloc_recv_msg();
3499                 if (!recv_msg) {
3500                         /*
3501                          * We couldn't allocate memory for the
3502                          * message, so requeue it for handling
3503                          * later.
3504                          */
3505                         rv = 1;
3506                         goto out;
3507                 }
3508
3509                 copy_event_into_recv_msg(recv_msg, msg);
3510                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3511                 intf->waiting_events_count++;
3512         } else if (!intf->event_msg_printed) {
3513                 /*
3514                  * There's too many things in the queue, discard this
3515                  * message.
3516                  */
3517                 printk(KERN_WARNING PFX "Event queue full, discarding"
3518                        " incoming events\n");
3519                 intf->event_msg_printed = 1;
3520         }
3521
3522  out:
3523         spin_unlock_irqrestore(&(intf->events_lock), flags);
3524
3525         return rv;
3526 }
3527
3528 static int handle_bmc_rsp(ipmi_smi_t          intf,
3529                           struct ipmi_smi_msg *msg)
3530 {
3531         struct ipmi_recv_msg *recv_msg;
3532         struct ipmi_user     *user;
3533
3534         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3535         if (recv_msg == NULL) {
3536                 printk(KERN_WARNING
3537                        "IPMI message received with no owner. This\n"
3538                        "could be because of a malformed message, or\n"
3539                        "because of a hardware error.  Contact your\n"
3540                        "hardware vender for assistance\n");
3541                 return 0;
3542         }
3543
3544         user = recv_msg->user;
3545         /* Make sure the user still exists. */
3546         if (user && !user->valid) {
3547                 /* The user for the message went away, so give up. */
3548                 ipmi_inc_stat(intf, unhandled_local_responses);
3549                 ipmi_free_recv_msg(recv_msg);
3550         } else {
3551                 struct ipmi_system_interface_addr *smi_addr;
3552
3553                 ipmi_inc_stat(intf, handled_local_responses);
3554                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3555                 recv_msg->msgid = msg->msgid;
3556                 smi_addr = ((struct ipmi_system_interface_addr *)
3557                             &(recv_msg->addr));
3558                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3559                 smi_addr->channel = IPMI_BMC_CHANNEL;
3560                 smi_addr->lun = msg->rsp[0] & 3;
3561                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3562                 recv_msg->msg.cmd = msg->rsp[1];
3563                 memcpy(recv_msg->msg_data,
3564                        &(msg->rsp[2]),
3565                        msg->rsp_size - 2);
3566                 recv_msg->msg.data = recv_msg->msg_data;
3567                 recv_msg->msg.data_len = msg->rsp_size - 2;
3568                 deliver_response(recv_msg);
3569         }
3570
3571         return 0;
3572 }
3573
3574 /*
3575  * Handle a received message.  Return 1 if the message should be requeued,
3576  * 0 if the message should be freed, or -1 if the message should not
3577  * be freed or requeued.
3578  */
3579 static int handle_one_recv_msg(ipmi_smi_t          intf,
3580                                struct ipmi_smi_msg *msg)
3581 {
3582         int requeue;
3583         int chan;
3584
3585 #ifdef DEBUG_MSGING
3586         int m;
3587         printk("Recv:");
3588         for (m = 0; m < msg->rsp_size; m++)
3589                 printk(" %2.2x", msg->rsp[m]);
3590         printk("\n");
3591 #endif
3592         if (msg->rsp_size < 2) {
3593                 /* Message is too small to be correct. */
3594                 printk(KERN_WARNING PFX "BMC returned to small a message"
3595                        " for netfn %x cmd %x, got %d bytes\n",
3596                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3597
3598                 /* Generate an error response for the message. */
3599                 msg->rsp[0] = msg->data[0] | (1 << 2);
3600                 msg->rsp[1] = msg->data[1];
3601                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3602                 msg->rsp_size = 3;
3603         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3604                    || (msg->rsp[1] != msg->data[1])) {
3605                 /*
3606                  * The NetFN and Command in the response is not even
3607                  * marginally correct.
3608                  */
3609                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3610                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3611                        (msg->data[0] >> 2) | 1, msg->data[1],
3612                        msg->rsp[0] >> 2, msg->rsp[1]);
3613
3614                 /* Generate an error response for the message. */
3615                 msg->rsp[0] = msg->data[0] | (1 << 2);
3616                 msg->rsp[1] = msg->data[1];
3617                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3618                 msg->rsp_size = 3;
3619         }
3620
3621         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3622             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3623             && (msg->user_data != NULL)) {
3624                 /*
3625                  * It's a response to a response we sent.  For this we
3626                  * deliver a send message response to the user.
3627                  */
3628                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3629
3630                 requeue = 0;
3631                 if (msg->rsp_size < 2)
3632                         /* Message is too small to be correct. */
3633                         goto out;
3634
3635                 chan = msg->data[2] & 0x0f;
3636                 if (chan >= IPMI_MAX_CHANNELS)
3637                         /* Invalid channel number */
3638                         goto out;
3639
3640                 if (!recv_msg)
3641                         goto out;
3642
3643                 /* Make sure the user still exists. */
3644                 if (!recv_msg->user || !recv_msg->user->valid)
3645                         goto out;
3646
3647                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3648                 recv_msg->msg.data = recv_msg->msg_data;
3649                 recv_msg->msg.data_len = 1;
3650                 recv_msg->msg_data[0] = msg->rsp[2];
3651                 deliver_response(recv_msg);
3652         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3653                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3654                 /* It's from the receive queue. */
3655                 chan = msg->rsp[3] & 0xf;
3656                 if (chan >= IPMI_MAX_CHANNELS) {
3657                         /* Invalid channel number */
3658                         requeue = 0;
3659                         goto out;
3660                 }
3661
3662                 /*
3663                  * We need to make sure the channels have been initialized.
3664                  * The channel_handler routine will set the "curr_channel"
3665                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3666                  * channels for this interface have been initialized.
3667                  */
3668                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3669                         requeue = 0; /* Throw the message away */
3670                         goto out;
3671                 }
3672
3673                 switch (intf->channels[chan].medium) {
3674                 case IPMI_CHANNEL_MEDIUM_IPMB:
3675                         if (msg->rsp[4] & 0x04) {
3676                                 /*
3677                                  * It's a response, so find the
3678                                  * requesting message and send it up.
3679                                  */
3680                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3681                         } else {
3682                                 /*
3683                                  * It's a command to the SMS from some other
3684                                  * entity.  Handle that.
3685                                  */
3686                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3687                         }
3688                         break;
3689
3690                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3691                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3692                         if (msg->rsp[6] & 0x04) {
3693                                 /*
3694                                  * It's a response, so find the
3695                                  * requesting message and send it up.
3696                                  */
3697                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3698                         } else {
3699                                 /*
3700                                  * It's a command to the SMS from some other
3701                                  * entity.  Handle that.
3702                                  */
3703                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3704                         }
3705                         break;
3706
3707                 default:
3708                         /* Check for OEM Channels.  Clients had better
3709                            register for these commands. */
3710                         if ((intf->channels[chan].medium
3711                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3712                             && (intf->channels[chan].medium
3713                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3714                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3715                         } else {
3716                                 /*
3717                                  * We don't handle the channel type, so just
3718                                  * free the message.
3719                                  */
3720                                 requeue = 0;
3721                         }
3722                 }
3723
3724         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3725                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3726                 /* It's an asynchronous event. */
3727                 requeue = handle_read_event_rsp(intf, msg);
3728         } else {
3729                 /* It's a response from the local BMC. */
3730                 requeue = handle_bmc_rsp(intf, msg);
3731         }
3732
3733  out:
3734         return requeue;
3735 }
3736
3737 /*
3738  * If there are messages in the queue or pretimeouts, handle them.
3739  */
3740 static void handle_new_recv_msgs(ipmi_smi_t intf)
3741 {
3742         struct ipmi_smi_msg  *smi_msg;
3743         unsigned long        flags = 0;
3744         int                  rv;
3745         int                  run_to_completion = intf->run_to_completion;
3746
3747         /* See if any waiting messages need to be processed. */
3748         if (!run_to_completion)
3749                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3750         while (!list_empty(&intf->waiting_rcv_msgs)) {
3751                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
3752                                      struct ipmi_smi_msg, link);
3753                 list_del(&smi_msg->link);
3754                 if (!run_to_completion)
3755                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3756                                                flags);
3757                 rv = handle_one_recv_msg(intf, smi_msg);
3758                 if (!run_to_completion)
3759                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3760                 if (rv == 0) {
3761                         /* Message handled */
3762                         ipmi_free_smi_msg(smi_msg);
3763                 } else if (rv < 0) {
3764                         /* Fatal error on the message, del but don't free. */
3765                 } else {
3766                         /*
3767                          * To preserve message order, quit if we
3768                          * can't handle a message.
3769                          */
3770                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
3771                         break;
3772                 }
3773         }
3774         if (!run_to_completion)
3775                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3776
3777         /*
3778          * If the pretimout count is non-zero, decrement one from it and
3779          * deliver pretimeouts to all the users.
3780          */
3781         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3782                 ipmi_user_t user;
3783
3784                 rcu_read_lock();
3785                 list_for_each_entry_rcu(user, &intf->users, link) {
3786                         if (user->handler->ipmi_watchdog_pretimeout)
3787                                 user->handler->ipmi_watchdog_pretimeout(
3788                                         user->handler_data);
3789                 }
3790                 rcu_read_unlock();
3791         }
3792 }
3793
3794 static void smi_recv_tasklet(unsigned long val)
3795 {
3796         handle_new_recv_msgs((ipmi_smi_t) val);
3797 }
3798
3799 /* Handle a new message from the lower layer. */
3800 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3801                            struct ipmi_smi_msg *msg)
3802 {
3803         unsigned long flags = 0; /* keep us warning-free. */
3804         int           run_to_completion;
3805
3806
3807         if ((msg->data_size >= 2)
3808             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3809             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3810             && (msg->user_data == NULL)) {
3811                 /*
3812                  * This is the local response to a command send, start
3813                  * the timer for these.  The user_data will not be
3814                  * NULL if this is a response send, and we will let
3815                  * response sends just go through.
3816                  */
3817
3818                 /*
3819                  * Check for errors, if we get certain errors (ones
3820                  * that mean basically we can try again later), we
3821                  * ignore them and start the timer.  Otherwise we
3822                  * report the error immediately.
3823                  */
3824                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3825                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3826                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3827                     && (msg->rsp[2] != IPMI_BUS_ERR)
3828                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3829                         int chan = msg->rsp[3] & 0xf;
3830
3831                         /* Got an error sending the message, handle it. */
3832                         if (chan >= IPMI_MAX_CHANNELS)
3833                                 ; /* This shouldn't happen */
3834                         else if ((intf->channels[chan].medium
3835                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3836                                  || (intf->channels[chan].medium
3837                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3838                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3839                         else
3840                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3841                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3842                 } else
3843                         /* The message was sent, start the timer. */
3844                         intf_start_seq_timer(intf, msg->msgid);
3845
3846                 ipmi_free_smi_msg(msg);
3847                 goto out;
3848         }
3849
3850         /*
3851          * To preserve message order, if the list is not empty, we
3852          * tack this message onto the end of the list.
3853          */
3854         run_to_completion = intf->run_to_completion;
3855         if (!run_to_completion)
3856                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3857         list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
3858         if (!run_to_completion)
3859                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3860
3861         tasklet_schedule(&intf->recv_tasklet);
3862  out:
3863         return;
3864 }
3865 EXPORT_SYMBOL(ipmi_smi_msg_received);
3866
3867 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3868 {
3869         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
3870         tasklet_schedule(&intf->recv_tasklet);
3871 }
3872 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3873
3874 static struct ipmi_smi_msg *
3875 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3876                   unsigned char seq, long seqid)
3877 {
3878         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3879         if (!smi_msg)
3880                 /*
3881                  * If we can't allocate the message, then just return, we
3882                  * get 4 retries, so this should be ok.
3883                  */
3884                 return NULL;
3885
3886         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3887         smi_msg->data_size = recv_msg->msg.data_len;
3888         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3889
3890 #ifdef DEBUG_MSGING
3891         {
3892                 int m;
3893                 printk("Resend: ");
3894                 for (m = 0; m < smi_msg->data_size; m++)
3895                         printk(" %2.2x", smi_msg->data[m]);
3896                 printk("\n");
3897         }
3898 #endif
3899         return smi_msg;
3900 }
3901
3902 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3903                               struct list_head *timeouts, long timeout_period,
3904                               int slot, unsigned long *flags,
3905                               unsigned int *waiting_msgs)
3906 {
3907         struct ipmi_recv_msg     *msg;
3908         struct ipmi_smi_handlers *handlers;
3909
3910         if (intf->intf_num == -1)
3911                 return;
3912
3913         if (!ent->inuse)
3914                 return;
3915
3916         ent->timeout -= timeout_period;
3917         if (ent->timeout > 0) {
3918                 (*waiting_msgs)++;
3919                 return;
3920         }
3921
3922         if (ent->retries_left == 0) {
3923                 /* The message has used all its retries. */
3924                 ent->inuse = 0;
3925                 msg = ent->recv_msg;
3926                 list_add_tail(&msg->link, timeouts);
3927                 if (ent->broadcast)
3928                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
3929                 else if (is_lan_addr(&ent->recv_msg->addr))
3930                         ipmi_inc_stat(intf, timed_out_lan_commands);
3931                 else
3932                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
3933         } else {
3934                 struct ipmi_smi_msg *smi_msg;
3935                 /* More retries, send again. */
3936
3937                 (*waiting_msgs)++;
3938
3939                 /*
3940                  * Start with the max timer, set to normal timer after
3941                  * the message is sent.
3942                  */
3943                 ent->timeout = MAX_MSG_TIMEOUT;
3944                 ent->retries_left--;
3945                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
3946                                             ent->seqid);
3947                 if (!smi_msg) {
3948                         if (is_lan_addr(&ent->recv_msg->addr))
3949                                 ipmi_inc_stat(intf,
3950                                               dropped_rexmit_lan_commands);
3951                         else
3952                                 ipmi_inc_stat(intf,
3953                                               dropped_rexmit_ipmb_commands);
3954                         return;
3955                 }
3956
3957                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
3958
3959                 /*
3960                  * Send the new message.  We send with a zero
3961                  * priority.  It timed out, I doubt time is that
3962                  * critical now, and high priority messages are really
3963                  * only for messages to the local MC, which don't get
3964                  * resent.
3965                  */
3966                 handlers = intf->handlers;
3967                 if (handlers) {
3968                         if (is_lan_addr(&ent->recv_msg->addr))
3969                                 ipmi_inc_stat(intf,
3970                                               retransmitted_lan_commands);
3971                         else
3972                                 ipmi_inc_stat(intf,
3973                                               retransmitted_ipmb_commands);
3974
3975                         intf->handlers->sender(intf->send_info,
3976                                                smi_msg, 0);
3977                 } else
3978                         ipmi_free_smi_msg(smi_msg);
3979
3980                 spin_lock_irqsave(&intf->seq_lock, *flags);
3981         }
3982 }
3983
3984 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
3985 {
3986         struct list_head     timeouts;
3987         struct ipmi_recv_msg *msg, *msg2;
3988         unsigned long        flags;
3989         int                  i;
3990         unsigned int         waiting_msgs = 0;
3991
3992         /*
3993          * Go through the seq table and find any messages that
3994          * have timed out, putting them in the timeouts
3995          * list.
3996          */
3997         INIT_LIST_HEAD(&timeouts);
3998         spin_lock_irqsave(&intf->seq_lock, flags);
3999         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4000                 check_msg_timeout(intf, &(intf->seq_table[i]),
4001                                   &timeouts, timeout_period, i,
4002                                   &flags, &waiting_msgs);
4003         spin_unlock_irqrestore(&intf->seq_lock, flags);
4004
4005         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4006                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4007
4008         /*
4009          * Maintenance mode handling.  Check the timeout
4010          * optimistically before we claim the lock.  It may
4011          * mean a timeout gets missed occasionally, but that
4012          * only means the timeout gets extended by one period
4013          * in that case.  No big deal, and it avoids the lock
4014          * most of the time.
4015          */
4016         if (intf->auto_maintenance_timeout > 0) {
4017                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4018                 if (intf->auto_maintenance_timeout > 0) {
4019                         intf->auto_maintenance_timeout
4020                                 -= timeout_period;
4021                         if (!intf->maintenance_mode
4022                             && (intf->auto_maintenance_timeout <= 0)) {
4023                                 intf->maintenance_mode_enable = false;
4024                                 maintenance_mode_update(intf);
4025                         }
4026                 }
4027                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4028                                        flags);
4029         }
4030
4031         tasklet_schedule(&intf->recv_tasklet);
4032
4033         return waiting_msgs;
4034 }
4035
4036 static void ipmi_request_event(ipmi_smi_t intf)
4037 {
4038         struct ipmi_smi_handlers *handlers;
4039
4040         /* No event requests when in maintenance mode. */
4041         if (intf->maintenance_mode_enable)
4042                 return;
4043
4044         handlers = intf->handlers;
4045         if (handlers)
4046                 handlers->request_events(intf->send_info);
4047 }
4048
4049 static struct timer_list ipmi_timer;
4050
4051 static atomic_t stop_operation;
4052
4053 static void ipmi_timeout(unsigned long data)
4054 {
4055         ipmi_smi_t intf;
4056         int nt = 0;
4057
4058         if (atomic_read(&stop_operation))
4059                 return;
4060
4061         rcu_read_lock();
4062         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4063                 int lnt = 0;
4064
4065                 if (atomic_read(&intf->event_waiters)) {
4066                         intf->ticks_to_req_ev--;
4067                         if (intf->ticks_to_req_ev == 0) {
4068                                 ipmi_request_event(intf);
4069                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4070                         }
4071                         lnt++;
4072                 }
4073
4074                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4075
4076                 lnt = !!lnt;
4077                 if (lnt != intf->last_needs_timer &&
4078                                         intf->handlers->set_need_watch)
4079                         intf->handlers->set_need_watch(intf->send_info, lnt);
4080                 intf->last_needs_timer = lnt;
4081
4082                 nt += lnt;
4083         }
4084         rcu_read_unlock();
4085
4086         if (nt)
4087                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4088 }
4089
4090 static void need_waiter(ipmi_smi_t intf)
4091 {
4092         /* Racy, but worst case we start the timer twice. */
4093         if (!timer_pending(&ipmi_timer))
4094                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4095 }
4096
4097 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4098 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4099
4100 /* FIXME - convert these to slabs. */
4101 static void free_smi_msg(struct ipmi_smi_msg *msg)
4102 {
4103         atomic_dec(&smi_msg_inuse_count);
4104         kfree(msg);
4105 }
4106
4107 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4108 {
4109         struct ipmi_smi_msg *rv;
4110         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4111         if (rv) {
4112                 rv->done = free_smi_msg;
4113                 rv->user_data = NULL;
4114                 atomic_inc(&smi_msg_inuse_count);
4115         }
4116         return rv;
4117 }
4118 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4119
4120 static void free_recv_msg(struct ipmi_recv_msg *msg)
4121 {
4122         atomic_dec(&recv_msg_inuse_count);
4123         kfree(msg);
4124 }
4125
4126 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4127 {
4128         struct ipmi_recv_msg *rv;
4129
4130         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4131         if (rv) {
4132                 rv->user = NULL;
4133                 rv->done = free_recv_msg;
4134                 atomic_inc(&recv_msg_inuse_count);
4135         }
4136         return rv;
4137 }
4138
4139 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4140 {
4141         if (msg->user)
4142                 kref_put(&msg->user->refcount, free_user);
4143         msg->done(msg);
4144 }
4145 EXPORT_SYMBOL(ipmi_free_recv_msg);
4146
4147 #ifdef CONFIG_IPMI_PANIC_EVENT
4148
4149 static atomic_t panic_done_count = ATOMIC_INIT(0);
4150
4151 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4152 {
4153         atomic_dec(&panic_done_count);
4154 }
4155
4156 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4157 {
4158         atomic_dec(&panic_done_count);
4159 }
4160
4161 /*
4162  * Inside a panic, send a message and wait for a response.
4163  */
4164 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4165                                         struct ipmi_addr     *addr,
4166                                         struct kernel_ipmi_msg *msg)
4167 {
4168         struct ipmi_smi_msg  smi_msg;
4169         struct ipmi_recv_msg recv_msg;
4170         int rv;
4171
4172         smi_msg.done = dummy_smi_done_handler;
4173         recv_msg.done = dummy_recv_done_handler;
4174         atomic_add(2, &panic_done_count);
4175         rv = i_ipmi_request(NULL,
4176                             intf,
4177                             addr,
4178                             0,
4179                             msg,
4180                             intf,
4181                             &smi_msg,
4182                             &recv_msg,
4183                             0,
4184                             intf->channels[0].address,
4185                             intf->channels[0].lun,
4186                             0, 1); /* Don't retry, and don't wait. */
4187         if (rv)
4188                 atomic_sub(2, &panic_done_count);
4189         while (atomic_read(&panic_done_count) != 0)
4190                 ipmi_poll(intf);
4191 }
4192
4193 #ifdef CONFIG_IPMI_PANIC_STRING
4194 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4195 {
4196         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4197             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4198             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4199             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4200                 /* A get event receiver command, save it. */
4201                 intf->event_receiver = msg->msg.data[1];
4202                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4203         }
4204 }
4205
4206 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4207 {
4208         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4209             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4210             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4211             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4212                 /*
4213                  * A get device id command, save if we are an event
4214                  * receiver or generator.
4215                  */
4216                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4217                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4218         }
4219 }
4220 #endif
4221
4222 static void send_panic_events(char *str)
4223 {
4224         struct kernel_ipmi_msg            msg;
4225         ipmi_smi_t                        intf;
4226         unsigned char                     data[16];
4227         struct ipmi_system_interface_addr *si;
4228         struct ipmi_addr                  addr;
4229
4230         si = (struct ipmi_system_interface_addr *) &addr;
4231         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4232         si->channel = IPMI_BMC_CHANNEL;
4233         si->lun = 0;
4234
4235         /* Fill in an event telling that we have failed. */
4236         msg.netfn = 0x04; /* Sensor or Event. */
4237         msg.cmd = 2; /* Platform event command. */
4238         msg.data = data;
4239         msg.data_len = 8;
4240         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4241         data[1] = 0x03; /* This is for IPMI 1.0. */
4242         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4243         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4244         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4245
4246         /*
4247          * Put a few breadcrumbs in.  Hopefully later we can add more things
4248          * to make the panic events more useful.
4249          */
4250         if (str) {
4251                 data[3] = str[0];
4252                 data[6] = str[1];
4253                 data[7] = str[2];
4254         }
4255
4256         /* For every registered interface, send the event. */
4257         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4258                 if (!intf->handlers)
4259                         /* Interface is not ready. */
4260                         continue;
4261
4262                 intf->run_to_completion = 1;
4263                 /* Send the event announcing the panic. */
4264                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4265                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4266         }
4267
4268 #ifdef CONFIG_IPMI_PANIC_STRING
4269         /*
4270          * On every interface, dump a bunch of OEM event holding the
4271          * string.
4272          */
4273         if (!str)
4274                 return;
4275
4276         /* For every registered interface, send the event. */
4277         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4278                 char                  *p = str;
4279                 struct ipmi_ipmb_addr *ipmb;
4280                 int                   j;
4281
4282                 if (intf->intf_num == -1)
4283                         /* Interface was not ready yet. */
4284                         continue;
4285
4286                 /*
4287                  * intf_num is used as an marker to tell if the
4288                  * interface is valid.  Thus we need a read barrier to
4289                  * make sure data fetched before checking intf_num
4290                  * won't be used.
4291                  */
4292                 smp_rmb();
4293
4294                 /*
4295                  * First job here is to figure out where to send the
4296                  * OEM events.  There's no way in IPMI to send OEM
4297                  * events using an event send command, so we have to
4298                  * find the SEL to put them in and stick them in
4299                  * there.
4300                  */
4301
4302                 /* Get capabilities from the get device id. */
4303                 intf->local_sel_device = 0;
4304                 intf->local_event_generator = 0;
4305                 intf->event_receiver = 0;
4306
4307                 /* Request the device info from the local MC. */
4308                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4309                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4310                 msg.data = NULL;
4311                 msg.data_len = 0;
4312                 intf->null_user_handler = device_id_fetcher;
4313                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4314
4315                 if (intf->local_event_generator) {
4316                         /* Request the event receiver from the local MC. */
4317                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4318                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4319                         msg.data = NULL;
4320                         msg.data_len = 0;
4321                         intf->null_user_handler = event_receiver_fetcher;
4322                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4323                 }
4324                 intf->null_user_handler = NULL;
4325
4326                 /*
4327                  * Validate the event receiver.  The low bit must not
4328                  * be 1 (it must be a valid IPMB address), it cannot
4329                  * be zero, and it must not be my address.
4330                  */
4331                 if (((intf->event_receiver & 1) == 0)
4332                     && (intf->event_receiver != 0)
4333                     && (intf->event_receiver != intf->channels[0].address)) {
4334                         /*
4335                          * The event receiver is valid, send an IPMB
4336                          * message.
4337                          */
4338                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4339                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4340                         ipmb->channel = 0; /* FIXME - is this right? */
4341                         ipmb->lun = intf->event_receiver_lun;
4342                         ipmb->slave_addr = intf->event_receiver;
4343                 } else if (intf->local_sel_device) {
4344                         /*
4345                          * The event receiver was not valid (or was
4346                          * me), but I am an SEL device, just dump it
4347                          * in my SEL.
4348                          */
4349                         si = (struct ipmi_system_interface_addr *) &addr;
4350                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4351                         si->channel = IPMI_BMC_CHANNEL;
4352                         si->lun = 0;
4353                 } else
4354                         continue; /* No where to send the event. */
4355
4356                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4357                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4358                 msg.data = data;
4359                 msg.data_len = 16;
4360
4361                 j = 0;
4362                 while (*p) {
4363                         int size = strlen(p);
4364
4365                         if (size > 11)
4366                                 size = 11;
4367                         data[0] = 0;
4368                         data[1] = 0;
4369                         data[2] = 0xf0; /* OEM event without timestamp. */
4370                         data[3] = intf->channels[0].address;
4371                         data[4] = j++; /* sequence # */
4372                         /*
4373                          * Always give 11 bytes, so strncpy will fill
4374                          * it with zeroes for me.
4375                          */
4376                         strncpy(data+5, p, 11);
4377                         p += size;
4378
4379                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4380                 }
4381         }
4382 #endif /* CONFIG_IPMI_PANIC_STRING */
4383 }
4384 #endif /* CONFIG_IPMI_PANIC_EVENT */
4385
4386 static int has_panicked;
4387
4388 static int panic_event(struct notifier_block *this,
4389                        unsigned long         event,
4390                        void                  *ptr)
4391 {
4392         ipmi_smi_t intf;
4393
4394         if (has_panicked)
4395                 return NOTIFY_DONE;
4396         has_panicked = 1;
4397
4398         /* For every registered interface, set it to run to completion. */
4399         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4400                 if (!intf->handlers)
4401                         /* Interface is not ready. */
4402                         continue;
4403
4404                 intf->run_to_completion = 1;
4405                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4406         }
4407
4408 #ifdef CONFIG_IPMI_PANIC_EVENT
4409         send_panic_events(ptr);
4410 #endif
4411
4412         return NOTIFY_DONE;
4413 }
4414
4415 static struct notifier_block panic_block = {
4416         .notifier_call  = panic_event,
4417         .next           = NULL,
4418         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4419 };
4420
4421 static int ipmi_init_msghandler(void)
4422 {
4423         int rv;
4424
4425         if (initialized)
4426                 return 0;
4427
4428         rv = driver_register(&ipmidriver.driver);
4429         if (rv) {
4430                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4431                 return rv;
4432         }
4433
4434         printk(KERN_INFO "ipmi message handler version "
4435                IPMI_DRIVER_VERSION "\n");
4436
4437 #ifdef CONFIG_PROC_FS
4438         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4439         if (!proc_ipmi_root) {
4440             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4441             driver_unregister(&ipmidriver.driver);
4442             return -ENOMEM;
4443         }
4444
4445 #endif /* CONFIG_PROC_FS */
4446
4447         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4448         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4449
4450         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4451
4452         initialized = 1;
4453
4454         return 0;
4455 }
4456
4457 static int __init ipmi_init_msghandler_mod(void)
4458 {
4459         ipmi_init_msghandler();
4460         return 0;
4461 }
4462
4463 static void __exit cleanup_ipmi(void)
4464 {
4465         int count;
4466
4467         if (!initialized)
4468                 return;
4469
4470         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4471
4472         /*
4473          * This can't be called if any interfaces exist, so no worry
4474          * about shutting down the interfaces.
4475          */
4476
4477         /*
4478          * Tell the timer to stop, then wait for it to stop.  This
4479          * avoids problems with race conditions removing the timer
4480          * here.
4481          */
4482         atomic_inc(&stop_operation);
4483         del_timer_sync(&ipmi_timer);
4484
4485 #ifdef CONFIG_PROC_FS
4486         proc_remove(proc_ipmi_root);
4487 #endif /* CONFIG_PROC_FS */
4488
4489         driver_unregister(&ipmidriver.driver);
4490
4491         initialized = 0;
4492
4493         /* Check for buffer leaks. */
4494         count = atomic_read(&smi_msg_inuse_count);
4495         if (count != 0)
4496                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4497                        count);
4498         count = atomic_read(&recv_msg_inuse_count);
4499         if (count != 0)
4500                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4501                        count);
4502 }
4503 module_exit(cleanup_ipmi);
4504
4505 module_init(ipmi_init_msghandler_mod);
4506 MODULE_LICENSE("GPL");
4507 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4508 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4509                    " interface.");
4510 MODULE_VERSION(IPMI_DRIVER_VERSION);