drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49
  50 #define PFX "IPMI message handler: "
  51
  52 #define IPMI_DRIVER_VERSION "39.2"
  53
  54 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  55 static int ipmi_init_msghandler(void);
  56 static void smi_recv_tasklet(unsigned long);
  57 static void handle_new_recv_msgs(ipmi_smi_t intf);
  58 static void need_waiter(ipmi_smi_t intf);
  59 static int handle_one_recv_msg(ipmi_smi_t          intf,
  60                                struct ipmi_smi_msg *msg);
  61
  62 static int initialized;
  63
  64 #ifdef CONFIG_PROC_FS
  65 static struct proc_dir_entry *proc_ipmi_root;
  66 #endif /* CONFIG_PROC_FS */
  67
  68 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  69 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  70
  71 #define MAX_EVENTS_IN_QUEUE     25
  72
  73 /*
  74  * Don't let a message sit in a queue forever, always time it with at lest
  75  * the max message timer.  This is in milliseconds.
  76  */
  77 #define MAX_MSG_TIMEOUT         60000
  78
  79 /* Call every ~1000 ms. */
  80 #define IPMI_TIMEOUT_TIME       1000
  81
  82 /* How many jiffies does it take to get to the timeout time. */
  83 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
  84
  85 /*
  86  * Request events from the queue every second (this is the number of
  87  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
  88  * future, IPMI will add a way to know immediately if an event is in
  89  * the queue and this silliness can go away.
  90  */
  91 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
  92
  93 /*
  94  * The main "user" data structure.
  95  */
  96 struct ipmi_user {
  97         struct list_head link;
  98
  99         /* Set to false when the user is destroyed. */
 100         bool valid;
 101
 102         struct kref refcount;
 103
 104         /* The upper layer that handles receive messages. */
 105         struct ipmi_user_hndl *handler;
 106         void             *handler_data;
 107
 108         /* The interface this user is bound to. */
 109         ipmi_smi_t intf;
 110
 111         /* Does this interface receive IPMI events? */
 112         bool gets_events;
 113 };
 114
 115 struct cmd_rcvr {
 116         struct list_head link;
 117
 118         ipmi_user_t   user;
 119         unsigned char netfn;
 120         unsigned char cmd;
 121         unsigned int  chans;
 122
 123         /*
 124          * This is used to form a linked lised during mass deletion.
 125          * Since this is in an RCU list, we cannot use the link above
 126          * or change any data until the RCU period completes.  So we
 127          * use this next variable during mass deletion so we can have
 128          * a list and don't have to wait and restart the search on
 129          * every individual deletion of a command.
 130          */
 131         struct cmd_rcvr *next;
 132 };
 133
 134 struct seq_table {
 135         unsigned int         inuse : 1;
 136         unsigned int         broadcast : 1;
 137
 138         unsigned long        timeout;
 139         unsigned long        orig_timeout;
 140         unsigned int         retries_left;
 141
 142         /*
 143          * To verify on an incoming send message response that this is
 144          * the message that the response is for, we keep a sequence id
 145          * and increment it every time we send a message.
 146          */
 147         long                 seqid;
 148
 149         /*
 150          * This is held so we can properly respond to the message on a
 151          * timeout, and it is used to hold the temporary data for
 152          * retransmission, too.
 153          */
 154         struct ipmi_recv_msg *recv_msg;
 155 };
 156
 157 /*
 158  * Store the information in a msgid (long) to allow us to find a
 159  * sequence table entry from the msgid.
 160  */
 161 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 162
 163 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 164         do {                                                            \
 165                 seq = ((msgid >> 26) & 0x3f);                           \
 166                 seqid = (msgid & 0x3fffff);                             \
 167         } while (0)
 168
 169 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 170
 171 struct ipmi_channel {
 172         unsigned char medium;
 173         unsigned char protocol;
 174
 175         /*
 176          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 177          * but may be changed by the user.
 178          */
 179         unsigned char address;
 180
 181         /*
 182          * My LUN.  This should generally stay the SMS LUN, but just in
 183          * case...
 184          */
 185         unsigned char lun;
 186 };
 187
 188 #ifdef CONFIG_PROC_FS
 189 struct ipmi_proc_entry {
 190         char                   *name;
 191         struct ipmi_proc_entry *next;
 192 };
 193 #endif
 194
 195 struct bmc_device {
 196         struct platform_device pdev;
 197         struct ipmi_device_id  id;
 198         unsigned char          guid[16];
 199         int                    guid_set;
 200         char                   name[16];
 201         struct kref            usecount;
 202
 203         /* bmc device attributes */
 204         struct device_attribute device_id_attr;
 205         struct device_attribute provides_dev_sdrs_attr;
 206         struct device_attribute revision_attr;
 207         struct device_attribute firmware_rev_attr;
 208         struct device_attribute version_attr;
 209         struct device_attribute add_dev_support_attr;
 210         struct device_attribute manufacturer_id_attr;
 211         struct device_attribute product_id_attr;
 212         struct device_attribute guid_attr;
 213         struct device_attribute aux_firmware_rev_attr;
 214 };
 215 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 216
 217 /*
 218  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 219  * structure.
 220  */
 221 enum ipmi_stat_indexes {
 222         /* Commands we got from the user that were invalid. */
 223         IPMI_STAT_sent_invalid_commands = 0,
 224
 225         /* Commands we sent to the MC. */
 226         IPMI_STAT_sent_local_commands,
 227
 228         /* Responses from the MC that were delivered to a user. */
 229         IPMI_STAT_handled_local_responses,
 230
 231         /* Responses from the MC that were not delivered to a user. */
 232         IPMI_STAT_unhandled_local_responses,
 233
 234         /* Commands we sent out to the IPMB bus. */
 235         IPMI_STAT_sent_ipmb_commands,
 236
 237         /* Commands sent on the IPMB that had errors on the SEND CMD */
 238         IPMI_STAT_sent_ipmb_command_errs,
 239
 240         /* Each retransmit increments this count. */
 241         IPMI_STAT_retransmitted_ipmb_commands,
 242
 243         /*
 244          * When a message times out (runs out of retransmits) this is
 245          * incremented.
 246          */
 247         IPMI_STAT_timed_out_ipmb_commands,
 248
 249         /*
 250          * This is like above, but for broadcasts.  Broadcasts are
 251          * *not* included in the above count (they are expected to
 252          * time out).
 253          */
 254         IPMI_STAT_timed_out_ipmb_broadcasts,
 255
 256         /* Responses I have sent to the IPMB bus. */
 257         IPMI_STAT_sent_ipmb_responses,
 258
 259         /* The response was delivered to the user. */
 260         IPMI_STAT_handled_ipmb_responses,
 261
 262         /* The response had invalid data in it. */
 263         IPMI_STAT_invalid_ipmb_responses,
 264
 265         /* The response didn't have anyone waiting for it. */
 266         IPMI_STAT_unhandled_ipmb_responses,
 267
 268         /* Commands we sent out to the IPMB bus. */
 269         IPMI_STAT_sent_lan_commands,
 270
 271         /* Commands sent on the IPMB that had errors on the SEND CMD */
 272         IPMI_STAT_sent_lan_command_errs,
 273
 274         /* Each retransmit increments this count. */
 275         IPMI_STAT_retransmitted_lan_commands,
 276
 277         /*
 278          * When a message times out (runs out of retransmits) this is
 279          * incremented.
 280          */
 281         IPMI_STAT_timed_out_lan_commands,
 282
 283         /* Responses I have sent to the IPMB bus. */
 284         IPMI_STAT_sent_lan_responses,
 285
 286         /* The response was delivered to the user. */
 287         IPMI_STAT_handled_lan_responses,
 288
 289         /* The response had invalid data in it. */
 290         IPMI_STAT_invalid_lan_responses,
 291
 292         /* The response didn't have anyone waiting for it. */
 293         IPMI_STAT_unhandled_lan_responses,
 294
 295         /* The command was delivered to the user. */
 296         IPMI_STAT_handled_commands,
 297
 298         /* The command had invalid data in it. */
 299         IPMI_STAT_invalid_commands,
 300
 301         /* The command didn't have anyone waiting for it. */
 302         IPMI_STAT_unhandled_commands,
 303
 304         /* Invalid data in an event. */
 305         IPMI_STAT_invalid_events,
 306
 307         /* Events that were received with the proper format. */
 308         IPMI_STAT_events,
 309
 310         /* Retransmissions on IPMB that failed. */
 311         IPMI_STAT_dropped_rexmit_ipmb_commands,
 312
 313         /* Retransmissions on LAN that failed. */
 314         IPMI_STAT_dropped_rexmit_lan_commands,
 315
 316         /* This *must* remain last, add new values above this. */
 317         IPMI_NUM_STATS
 318 };
 319
 320
 321 #define IPMI_IPMB_NUM_SEQ       64
 322 #define IPMI_MAX_CHANNELS       16
 323 struct ipmi_smi {
 324         /* What interface number are we? */
 325         int intf_num;
 326
 327         struct kref refcount;
 328
 329         /* Set when the interface is being unregistered. */
 330         bool in_shutdown;
 331
 332         /* Used for a list of interfaces. */
 333         struct list_head link;
 334
 335         /*
 336          * The list of upper layers that are using me.  seq_lock
 337          * protects this.
 338          */
 339         struct list_head users;
 340
 341         /* Information to supply to users. */
 342         unsigned char ipmi_version_major;
 343         unsigned char ipmi_version_minor;
 344
 345         /* Used for wake ups at startup. */
 346         wait_queue_head_t waitq;
 347
 348         struct bmc_device *bmc;
 349         char *my_dev_name;
 350
 351         /*
 352          * This is the lower-layer's sender routine.  Note that you
 353          * must either be holding the ipmi_interfaces_mutex or be in
 354          * an umpreemptible region to use this.  You must fetch the
 355          * value into a local variable and make sure it is not NULL.
 356          */
 357         struct ipmi_smi_handlers *handlers;
 358         void                     *send_info;
 359
 360 #ifdef CONFIG_PROC_FS
 361         /* A list of proc entries for this interface. */
 362         struct mutex           proc_entry_lock;
 363         struct ipmi_proc_entry *proc_entries;
 364 #endif
 365
 366         /* Driver-model device for the system interface. */
 367         struct device          *si_dev;
 368
 369         /*
 370          * A table of sequence numbers for this interface.  We use the
 371          * sequence numbers for IPMB messages that go out of the
 372          * interface to match them up with their responses.  A routine
 373          * is called periodically to time the items in this list.
 374          */
 375         spinlock_t       seq_lock;
 376         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 377         int curr_seq;
 378
 379         /*
 380          * Messages queued for delivery.  If delivery fails (out of memory
 381          * for instance), They will stay in here to be processed later in a
 382          * periodic timer interrupt.  The tasklet is for handling received
 383          * messages directly from the handler.
 384          */
 385         spinlock_t       waiting_rcv_msgs_lock;
 386         struct list_head waiting_rcv_msgs;
 387         atomic_t         watchdog_pretimeouts_to_deliver;
 388         struct tasklet_struct recv_tasklet;
 389
 390         spinlock_t             xmit_msgs_lock;
 391         struct list_head       xmit_msgs;
 392         struct ipmi_smi_msg    *curr_msg;
 393         struct list_head       hp_xmit_msgs;
 394
 395         /*
 396          * The list of command receivers that are registered for commands
 397          * on this interface.
 398          */
 399         struct mutex     cmd_rcvrs_mutex;
 400         struct list_head cmd_rcvrs;
 401
 402         /*
 403          * Events that were queues because no one was there to receive
 404          * them.
 405          */
 406         spinlock_t       events_lock; /* For dealing with event stuff. */
 407         struct list_head waiting_events;
 408         unsigned int     waiting_events_count; /* How many events in queue? */
 409         char             delivering_events;
 410         char             event_msg_printed;
 411         atomic_t         event_waiters;
 412         unsigned int     ticks_to_req_ev;
 413         int              last_needs_timer;
 414
 415         /*
 416          * The event receiver for my BMC, only really used at panic
 417          * shutdown as a place to store this.
 418          */
 419         unsigned char event_receiver;
 420         unsigned char event_receiver_lun;
 421         unsigned char local_sel_device;
 422         unsigned char local_event_generator;
 423
 424         /* For handling of maintenance mode. */
 425         int maintenance_mode;
 426         bool maintenance_mode_enable;
 427         int auto_maintenance_timeout;
 428         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 429
 430         /*
 431          * A cheap hack, if this is non-null and a message to an
 432          * interface comes in with a NULL user, call this routine with
 433          * it.  Note that the message will still be freed by the
 434          * caller.  This only works on the system interface.
 435          */
 436         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 437
 438         /*
 439          * When we are scanning the channels for an SMI, this will
 440          * tell which channel we are scanning.
 441          */
 442         int curr_channel;
 443
 444         /* Channel information */
 445         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 446
 447         /* Proc FS stuff. */
 448         struct proc_dir_entry *proc_dir;
 449         char                  proc_dir_name[10];
 450
 451         atomic_t stats[IPMI_NUM_STATS];
 452
 453         /*
 454          * run_to_completion duplicate of smb_info, smi_info
 455          * and ipmi_serial_info structures. Used to decrease numbers of
 456          * parameters passed by "low" level IPMI code.
 457          */
 458         int run_to_completion;
 459 };
 460 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 461
 462 /**
 463  * The driver model view of the IPMI messaging driver.
 464  */
 465 static struct platform_driver ipmidriver = {
 466         .driver = {
 467                 .name = "ipmi",
 468                 .bus = &platform_bus_type
 469         }
 470 };
 471 static DEFINE_MUTEX(ipmidriver_mutex);
 472
 473 static LIST_HEAD(ipmi_interfaces);
 474 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 475
 476 /*
 477  * List of watchers that want to know when smi's are added and deleted.
 478  */
 479 static LIST_HEAD(smi_watchers);
 480 static DEFINE_MUTEX(smi_watchers_mutex);
 481
 482 #define ipmi_inc_stat(intf, stat) \
 483         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 484 #define ipmi_get_stat(intf, stat) \
 485         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 486
 487 static char *addr_src_to_str[] = { "invalid", "hotmod", "hardcoded", "SPMI",
 488                                    "ACPI", "SMBIOS", "PCI",
 489                                    "device-tree", "default" };
 490
 491 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 492 {
 493         if (src > SI_DEFAULT)
 494                 src = 0; /* Invalid */
 495         return addr_src_to_str[src];
 496 }
 497 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 498
 499 static int is_lan_addr(struct ipmi_addr *addr)
 500 {
 501         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 502 }
 503
 504 static int is_ipmb_addr(struct ipmi_addr *addr)
 505 {
 506         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 507 }
 508
 509 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 510 {
 511         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 512 }
 513
 514 static void free_recv_msg_list(struct list_head *q)
 515 {
 516         struct ipmi_recv_msg *msg, *msg2;
 517
 518         list_for_each_entry_safe(msg, msg2, q, link) {
 519                 list_del(&msg->link);
 520                 ipmi_free_recv_msg(msg);
 521         }
 522 }
 523
 524 static void free_smi_msg_list(struct list_head *q)
 525 {
 526         struct ipmi_smi_msg *msg, *msg2;
 527
 528         list_for_each_entry_safe(msg, msg2, q, link) {
 529                 list_del(&msg->link);
 530                 ipmi_free_smi_msg(msg);
 531         }
 532 }
 533
 534 static void clean_up_interface_data(ipmi_smi_t intf)
 535 {
 536         int              i;
 537         struct cmd_rcvr  *rcvr, *rcvr2;
 538         struct list_head list;
 539
 540         tasklet_kill(&intf->recv_tasklet);
 541
 542         free_smi_msg_list(&intf->waiting_rcv_msgs);
 543         free_recv_msg_list(&intf->waiting_events);
 544
 545         /*
 546          * Wholesale remove all the entries from the list in the
 547          * interface and wait for RCU to know that none are in use.
 548          */
 549         mutex_lock(&intf->cmd_rcvrs_mutex);
 550         INIT_LIST_HEAD(&list);
 551         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 552         mutex_unlock(&intf->cmd_rcvrs_mutex);
 553
 554         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 555                 kfree(rcvr);
 556
 557         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 558                 if ((intf->seq_table[i].inuse)
 559                                         && (intf->seq_table[i].recv_msg))
 560                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 561         }
 562 }
 563
 564 static void intf_free(struct kref *ref)
 565 {
 566         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 567
 568         clean_up_interface_data(intf);
 569         kfree(intf);
 570 }
 571
 572 struct watcher_entry {
 573         int              intf_num;
 574         ipmi_smi_t       intf;
 575         struct list_head link;
 576 };
 577
 578 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 579 {
 580         ipmi_smi_t intf;
 581         LIST_HEAD(to_deliver);
 582         struct watcher_entry *e, *e2;
 583
 584         mutex_lock(&smi_watchers_mutex);
 585
 586         mutex_lock(&ipmi_interfaces_mutex);
 587
 588         /* Build a list of things to deliver. */
 589         list_for_each_entry(intf, &ipmi_interfaces, link) {
 590                 if (intf->intf_num == -1)
 591                         continue;
 592                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 593                 if (!e)
 594                         goto out_err;
 595                 kref_get(&intf->refcount);
 596                 e->intf = intf;
 597                 e->intf_num = intf->intf_num;
 598                 list_add_tail(&e->link, &to_deliver);
 599         }
 600
 601         /* We will succeed, so add it to the list. */
 602         list_add(&watcher->link, &smi_watchers);
 603
 604         mutex_unlock(&ipmi_interfaces_mutex);
 605
 606         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 607                 list_del(&e->link);
 608                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 609                 kref_put(&e->intf->refcount, intf_free);
 610                 kfree(e);
 611         }
 612
 613         mutex_unlock(&smi_watchers_mutex);
 614
 615         return 0;
 616
 617  out_err:
 618         mutex_unlock(&ipmi_interfaces_mutex);
 619         mutex_unlock(&smi_watchers_mutex);
 620         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 621                 list_del(&e->link);
 622                 kref_put(&e->intf->refcount, intf_free);
 623                 kfree(e);
 624         }
 625         return -ENOMEM;
 626 }
 627 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 628
 629 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 630 {
 631         mutex_lock(&smi_watchers_mutex);
 632         list_del(&(watcher->link));
 633         mutex_unlock(&smi_watchers_mutex);
 634         return 0;
 635 }
 636 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 637
 638 /*
 639  * Must be called with smi_watchers_mutex held.
 640  */
 641 static void
 642 call_smi_watchers(int i, struct device *dev)
 643 {
 644         struct ipmi_smi_watcher *w;
 645
 646         list_for_each_entry(w, &smi_watchers, link) {
 647                 if (try_module_get(w->owner)) {
 648                         w->new_smi(i, dev);
 649                         module_put(w->owner);
 650                 }
 651         }
 652 }
 653
 654 static int
 655 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 656 {
 657         if (addr1->addr_type != addr2->addr_type)
 658                 return 0;
 659
 660         if (addr1->channel != addr2->channel)
 661                 return 0;
 662
 663         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 664                 struct ipmi_system_interface_addr *smi_addr1
 665                     = (struct ipmi_system_interface_addr *) addr1;
 666                 struct ipmi_system_interface_addr *smi_addr2
 667                     = (struct ipmi_system_interface_addr *) addr2;
 668                 return (smi_addr1->lun == smi_addr2->lun);
 669         }
 670
 671         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 672                 struct ipmi_ipmb_addr *ipmb_addr1
 673                     = (struct ipmi_ipmb_addr *) addr1;
 674                 struct ipmi_ipmb_addr *ipmb_addr2
 675                     = (struct ipmi_ipmb_addr *) addr2;
 676
 677                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 678                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 679         }
 680
 681         if (is_lan_addr(addr1)) {
 682                 struct ipmi_lan_addr *lan_addr1
 683                         = (struct ipmi_lan_addr *) addr1;
 684                 struct ipmi_lan_addr *lan_addr2
 685                     = (struct ipmi_lan_addr *) addr2;
 686
 687                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 688                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 689                         && (lan_addr1->session_handle
 690                             == lan_addr2->session_handle)
 691                         && (lan_addr1->lun == lan_addr2->lun));
 692         }
 693
 694         return 1;
 695 }
 696
 697 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 698 {
 699         if (len < sizeof(struct ipmi_system_interface_addr))
 700                 return -EINVAL;
 701
 702         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 703                 if (addr->channel != IPMI_BMC_CHANNEL)
 704                         return -EINVAL;
 705                 return 0;
 706         }
 707
 708         if ((addr->channel == IPMI_BMC_CHANNEL)
 709             || (addr->channel >= IPMI_MAX_CHANNELS)
 710             || (addr->channel < 0))
 711                 return -EINVAL;
 712
 713         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 714                 if (len < sizeof(struct ipmi_ipmb_addr))
 715                         return -EINVAL;
 716                 return 0;
 717         }
 718
 719         if (is_lan_addr(addr)) {
 720                 if (len < sizeof(struct ipmi_lan_addr))
 721                         return -EINVAL;
 722                 return 0;
 723         }
 724
 725         return -EINVAL;
 726 }
 727 EXPORT_SYMBOL(ipmi_validate_addr);
 728
 729 unsigned int ipmi_addr_length(int addr_type)
 730 {
 731         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 732                 return sizeof(struct ipmi_system_interface_addr);
 733
 734         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 735                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 736                 return sizeof(struct ipmi_ipmb_addr);
 737
 738         if (addr_type == IPMI_LAN_ADDR_TYPE)
 739                 return sizeof(struct ipmi_lan_addr);
 740
 741         return 0;
 742 }
 743 EXPORT_SYMBOL(ipmi_addr_length);
 744
 745 static void deliver_response(struct ipmi_recv_msg *msg)
 746 {
 747         if (!msg->user) {
 748                 ipmi_smi_t    intf = msg->user_msg_data;
 749
 750                 /* Special handling for NULL users. */
 751                 if (intf->null_user_handler) {
 752                         intf->null_user_handler(intf, msg);
 753                         ipmi_inc_stat(intf, handled_local_responses);
 754                 } else {
 755                         /* No handler, so give up. */
 756                         ipmi_inc_stat(intf, unhandled_local_responses);
 757                 }
 758                 ipmi_free_recv_msg(msg);
 759         } else {
 760                 ipmi_user_t user = msg->user;
 761                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 762         }
 763 }
 764
 765 static void
 766 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 767 {
 768         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 769         msg->msg_data[0] = err;
 770         msg->msg.netfn |= 1; /* Convert to a response. */
 771         msg->msg.data_len = 1;
 772         msg->msg.data = msg->msg_data;
 773         deliver_response(msg);
 774 }
 775
 776 /*
 777  * Find the next sequence number not being used and add the given
 778  * message with the given timeout to the sequence table.  This must be
 779  * called with the interface's seq_lock held.
 780  */
 781 static int intf_next_seq(ipmi_smi_t           intf,
 782                          struct ipmi_recv_msg *recv_msg,
 783                          unsigned long        timeout,
 784                          int                  retries,
 785                          int                  broadcast,
 786                          unsigned char        *seq,
 787                          long                 *seqid)
 788 {
 789         int          rv = 0;
 790         unsigned int i;
 791
 792         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 793                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 794                 if (!intf->seq_table[i].inuse)
 795                         break;
 796         }
 797
 798         if (!intf->seq_table[i].inuse) {
 799                 intf->seq_table[i].recv_msg = recv_msg;
 800
 801                 /*
 802                  * Start with the maximum timeout, when the send response
 803                  * comes in we will start the real timer.
 804                  */
 805                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 806                 intf->seq_table[i].orig_timeout = timeout;
 807                 intf->seq_table[i].retries_left = retries;
 808                 intf->seq_table[i].broadcast = broadcast;
 809                 intf->seq_table[i].inuse = 1;
 810                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 811                 *seq = i;
 812                 *seqid = intf->seq_table[i].seqid;
 813                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 814                 need_waiter(intf);
 815         } else {
 816                 rv = -EAGAIN;
 817         }
 818
 819         return rv;
 820 }
 821
 822 /*
 823  * Return the receive message for the given sequence number and
 824  * release the sequence number so it can be reused.  Some other data
 825  * is passed in to be sure the message matches up correctly (to help
 826  * guard against message coming in after their timeout and the
 827  * sequence number being reused).
 828  */
 829 static int intf_find_seq(ipmi_smi_t           intf,
 830                          unsigned char        seq,
 831                          short                channel,
 832                          unsigned char        cmd,
 833                          unsigned char        netfn,
 834                          struct ipmi_addr     *addr,
 835                          struct ipmi_recv_msg **recv_msg)
 836 {
 837         int           rv = -ENODEV;
 838         unsigned long flags;
 839
 840         if (seq >= IPMI_IPMB_NUM_SEQ)
 841                 return -EINVAL;
 842
 843         spin_lock_irqsave(&(intf->seq_lock), flags);
 844         if (intf->seq_table[seq].inuse) {
 845                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 846
 847                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 848                                 && (msg->msg.netfn == netfn)
 849                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 850                         *recv_msg = msg;
 851                         intf->seq_table[seq].inuse = 0;
 852                         rv = 0;
 853                 }
 854         }
 855         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 856
 857         return rv;
 858 }
 859
 860
 861 /* Start the timer for a specific sequence table entry. */
 862 static int intf_start_seq_timer(ipmi_smi_t intf,
 863                                 long       msgid)
 864 {
 865         int           rv = -ENODEV;
 866         unsigned long flags;
 867         unsigned char seq;
 868         unsigned long seqid;
 869
 870
 871         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 872
 873         spin_lock_irqsave(&(intf->seq_lock), flags);
 874         /*
 875          * We do this verification because the user can be deleted
 876          * while a message is outstanding.
 877          */
 878         if ((intf->seq_table[seq].inuse)
 879                                 && (intf->seq_table[seq].seqid == seqid)) {
 880                 struct seq_table *ent = &(intf->seq_table[seq]);
 881                 ent->timeout = ent->orig_timeout;
 882                 rv = 0;
 883         }
 884         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 885
 886         return rv;
 887 }
 888
 889 /* Got an error for the send message for a specific sequence number. */
 890 static int intf_err_seq(ipmi_smi_t   intf,
 891                         long         msgid,
 892                         unsigned int err)
 893 {
 894         int                  rv = -ENODEV;
 895         unsigned long        flags;
 896         unsigned char        seq;
 897         unsigned long        seqid;
 898         struct ipmi_recv_msg *msg = NULL;
 899
 900
 901         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 902
 903         spin_lock_irqsave(&(intf->seq_lock), flags);
 904         /*
 905          * We do this verification because the user can be deleted
 906          * while a message is outstanding.
 907          */
 908         if ((intf->seq_table[seq].inuse)
 909                                 && (intf->seq_table[seq].seqid == seqid)) {
 910                 struct seq_table *ent = &(intf->seq_table[seq]);
 911
 912                 ent->inuse = 0;
 913                 msg = ent->recv_msg;
 914                 rv = 0;
 915         }
 916         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 917
 918         if (msg)
 919                 deliver_err_response(msg, err);
 920
 921         return rv;
 922 }
 923
 924
 925 int ipmi_create_user(unsigned int          if_num,
 926                      struct ipmi_user_hndl *handler,
 927                      void                  *handler_data,
 928                      ipmi_user_t           *user)
 929 {
 930         unsigned long flags;
 931         ipmi_user_t   new_user;
 932         int           rv = 0;
 933         ipmi_smi_t    intf;
 934
 935         /*
 936          * There is no module usecount here, because it's not
 937          * required.  Since this can only be used by and called from
 938          * other modules, they will implicitly use this module, and
 939          * thus this can't be removed unless the other modules are
 940          * removed.
 941          */
 942
 943         if (handler == NULL)
 944                 return -EINVAL;
 945
 946         /*
 947          * Make sure the driver is actually initialized, this handles
 948          * problems with initialization order.
 949          */
 950         if (!initialized) {
 951                 rv = ipmi_init_msghandler();
 952                 if (rv)
 953                         return rv;
 954
 955                 /*
 956                  * The init code doesn't return an error if it was turned
 957                  * off, but it won't initialize.  Check that.
 958                  */
 959                 if (!initialized)
 960                         return -ENODEV;
 961         }
 962
 963         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 964         if (!new_user)
 965                 return -ENOMEM;
 966
 967         mutex_lock(&ipmi_interfaces_mutex);
 968         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 969                 if (intf->intf_num == if_num)
 970                         goto found;
 971         }
 972         /* Not found, return an error */
 973         rv = -EINVAL;
 974         goto out_kfree;
 975
 976  found:
 977         /* Note that each existing user holds a refcount to the interface. */
 978         kref_get(&intf->refcount);
 979
 980         kref_init(&new_user->refcount);
 981         new_user->handler = handler;
 982         new_user->handler_data = handler_data;
 983         new_user->intf = intf;
 984         new_user->gets_events = false;
 985
 986         if (!try_module_get(intf->handlers->owner)) {
 987                 rv = -ENODEV;
 988                 goto out_kref;
 989         }
 990
 991         if (intf->handlers->inc_usecount) {
 992                 rv = intf->handlers->inc_usecount(intf->send_info);
 993                 if (rv) {
 994                         module_put(intf->handlers->owner);
 995                         goto out_kref;
 996                 }
 997         }
 998
 999         /*
1000          * Hold the lock so intf->handlers is guaranteed to be good
1001          * until now
1002          */
1003         mutex_unlock(&ipmi_interfaces_mutex);
1004
1005         new_user->valid = true;
1006         spin_lock_irqsave(&intf->seq_lock, flags);
1007         list_add_rcu(&new_user->link, &intf->users);
1008         spin_unlock_irqrestore(&intf->seq_lock, flags);
1009         if (handler->ipmi_watchdog_pretimeout) {
1010                 /* User wants pretimeouts, so make sure to watch for them. */
1011                 if (atomic_inc_return(&intf->event_waiters) == 1)
1012                         need_waiter(intf);
1013         }
1014         *user = new_user;
1015         return 0;
1016
1017 out_kref:
1018         kref_put(&intf->refcount, intf_free);
1019 out_kfree:
1020         mutex_unlock(&ipmi_interfaces_mutex);
1021         kfree(new_user);
1022         return rv;
1023 }
1024 EXPORT_SYMBOL(ipmi_create_user);
1025
1026 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1027 {
1028         int           rv = 0;
1029         ipmi_smi_t    intf;
1030         struct ipmi_smi_handlers *handlers;
1031
1032         mutex_lock(&ipmi_interfaces_mutex);
1033         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1034                 if (intf->intf_num == if_num)
1035                         goto found;
1036         }
1037         /* Not found, return an error */
1038         rv = -EINVAL;
1039         mutex_unlock(&ipmi_interfaces_mutex);
1040         return rv;
1041
1042 found:
1043         handlers = intf->handlers;
1044         rv = -ENOSYS;
1045         if (handlers->get_smi_info)
1046                 rv = handlers->get_smi_info(intf->send_info, data);
1047         mutex_unlock(&ipmi_interfaces_mutex);
1048
1049         return rv;
1050 }
1051 EXPORT_SYMBOL(ipmi_get_smi_info);
1052
1053 static void free_user(struct kref *ref)
1054 {
1055         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1056         kfree(user);
1057 }
1058
1059 int ipmi_destroy_user(ipmi_user_t user)
1060 {
1061         ipmi_smi_t       intf = user->intf;
1062         int              i;
1063         unsigned long    flags;
1064         struct cmd_rcvr  *rcvr;
1065         struct cmd_rcvr  *rcvrs = NULL;
1066
1067         user->valid = false;
1068
1069         if (user->handler->ipmi_watchdog_pretimeout)
1070                 atomic_dec(&intf->event_waiters);
1071
1072         if (user->gets_events)
1073                 atomic_dec(&intf->event_waiters);
1074
1075         /* Remove the user from the interface's sequence table. */
1076         spin_lock_irqsave(&intf->seq_lock, flags);
1077         list_del_rcu(&user->link);
1078
1079         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1080                 if (intf->seq_table[i].inuse
1081                     && (intf->seq_table[i].recv_msg->user == user)) {
1082                         intf->seq_table[i].inuse = 0;
1083                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1084                 }
1085         }
1086         spin_unlock_irqrestore(&intf->seq_lock, flags);
1087
1088         /*
1089          * Remove the user from the command receiver's table.  First
1090          * we build a list of everything (not using the standard link,
1091          * since other things may be using it till we do
1092          * synchronize_rcu()) then free everything in that list.
1093          */
1094         mutex_lock(&intf->cmd_rcvrs_mutex);
1095         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1096                 if (rcvr->user == user) {
1097                         list_del_rcu(&rcvr->link);
1098                         rcvr->next = rcvrs;
1099                         rcvrs = rcvr;
1100                 }
1101         }
1102         mutex_unlock(&intf->cmd_rcvrs_mutex);
1103         synchronize_rcu();
1104         while (rcvrs) {
1105                 rcvr = rcvrs;
1106                 rcvrs = rcvr->next;
1107                 kfree(rcvr);
1108         }
1109
1110         mutex_lock(&ipmi_interfaces_mutex);
1111         if (intf->handlers) {
1112                 module_put(intf->handlers->owner);
1113                 if (intf->handlers->dec_usecount)
1114                         intf->handlers->dec_usecount(intf->send_info);
1115         }
1116         mutex_unlock(&ipmi_interfaces_mutex);
1117
1118         kref_put(&intf->refcount, intf_free);
1119
1120         kref_put(&user->refcount, free_user);
1121
1122         return 0;
1123 }
1124 EXPORT_SYMBOL(ipmi_destroy_user);
1125
1126 void ipmi_get_version(ipmi_user_t   user,
1127                       unsigned char *major,
1128                       unsigned char *minor)
1129 {
1130         *major = user->intf->ipmi_version_major;
1131         *minor = user->intf->ipmi_version_minor;
1132 }
1133 EXPORT_SYMBOL(ipmi_get_version);
1134
1135 int ipmi_set_my_address(ipmi_user_t   user,
1136                         unsigned int  channel,
1137                         unsigned char address)
1138 {
1139         if (channel >= IPMI_MAX_CHANNELS)
1140                 return -EINVAL;
1141         user->intf->channels[channel].address = address;
1142         return 0;
1143 }
1144 EXPORT_SYMBOL(ipmi_set_my_address);
1145
1146 int ipmi_get_my_address(ipmi_user_t   user,
1147                         unsigned int  channel,
1148                         unsigned char *address)
1149 {
1150         if (channel >= IPMI_MAX_CHANNELS)
1151                 return -EINVAL;
1152         *address = user->intf->channels[channel].address;
1153         return 0;
1154 }
1155 EXPORT_SYMBOL(ipmi_get_my_address);
1156
1157 int ipmi_set_my_LUN(ipmi_user_t   user,
1158                     unsigned int  channel,
1159                     unsigned char LUN)
1160 {
1161         if (channel >= IPMI_MAX_CHANNELS)
1162                 return -EINVAL;
1163         user->intf->channels[channel].lun = LUN & 0x3;
1164         return 0;
1165 }
1166 EXPORT_SYMBOL(ipmi_set_my_LUN);
1167
1168 int ipmi_get_my_LUN(ipmi_user_t   user,
1169                     unsigned int  channel,
1170                     unsigned char *address)
1171 {
1172         if (channel >= IPMI_MAX_CHANNELS)
1173                 return -EINVAL;
1174         *address = user->intf->channels[channel].lun;
1175         return 0;
1176 }
1177 EXPORT_SYMBOL(ipmi_get_my_LUN);
1178
1179 int ipmi_get_maintenance_mode(ipmi_user_t user)
1180 {
1181         int           mode;
1182         unsigned long flags;
1183
1184         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1185         mode = user->intf->maintenance_mode;
1186         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1187
1188         return mode;
1189 }
1190 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1191
1192 static void maintenance_mode_update(ipmi_smi_t intf)
1193 {
1194         if (intf->handlers->set_maintenance_mode)
1195                 intf->handlers->set_maintenance_mode(
1196                         intf->send_info, intf->maintenance_mode_enable);
1197 }
1198
1199 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1200 {
1201         int           rv = 0;
1202         unsigned long flags;
1203         ipmi_smi_t    intf = user->intf;
1204
1205         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1206         if (intf->maintenance_mode != mode) {
1207                 switch (mode) {
1208                 case IPMI_MAINTENANCE_MODE_AUTO:
1209                         intf->maintenance_mode_enable
1210                                 = (intf->auto_maintenance_timeout > 0);
1211                         break;
1212
1213                 case IPMI_MAINTENANCE_MODE_OFF:
1214                         intf->maintenance_mode_enable = false;
1215                         break;
1216
1217                 case IPMI_MAINTENANCE_MODE_ON:
1218                         intf->maintenance_mode_enable = true;
1219                         break;
1220
1221                 default:
1222                         rv = -EINVAL;
1223                         goto out_unlock;
1224                 }
1225                 intf->maintenance_mode = mode;
1226
1227                 maintenance_mode_update(intf);
1228         }
1229  out_unlock:
1230         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1231
1232         return rv;
1233 }
1234 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1235
1236 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1237 {
1238         unsigned long        flags;
1239         ipmi_smi_t           intf = user->intf;
1240         struct ipmi_recv_msg *msg, *msg2;
1241         struct list_head     msgs;
1242
1243         INIT_LIST_HEAD(&msgs);
1244
1245         spin_lock_irqsave(&intf->events_lock, flags);
1246         if (user->gets_events == val)
1247                 goto out;
1248
1249         user->gets_events = val;
1250
1251         if (val) {
1252                 if (atomic_inc_return(&intf->event_waiters) == 1)
1253                         need_waiter(intf);
1254         } else {
1255                 atomic_dec(&intf->event_waiters);
1256         }
1257
1258         if (intf->delivering_events)
1259                 /*
1260                  * Another thread is delivering events for this, so
1261                  * let it handle any new events.
1262                  */
1263                 goto out;
1264
1265         /* Deliver any queued events. */
1266         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1267                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1268                         list_move_tail(&msg->link, &msgs);
1269                 intf->waiting_events_count = 0;
1270                 if (intf->event_msg_printed) {
1271                         printk(KERN_WARNING PFX "Event queue no longer"
1272                                " full\n");
1273                         intf->event_msg_printed = 0;
1274                 }
1275
1276                 intf->delivering_events = 1;
1277                 spin_unlock_irqrestore(&intf->events_lock, flags);
1278
1279                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1280                         msg->user = user;
1281                         kref_get(&user->refcount);
1282                         deliver_response(msg);
1283                 }
1284
1285                 spin_lock_irqsave(&intf->events_lock, flags);
1286                 intf->delivering_events = 0;
1287         }
1288
1289  out:
1290         spin_unlock_irqrestore(&intf->events_lock, flags);
1291
1292         return 0;
1293 }
1294 EXPORT_SYMBOL(ipmi_set_gets_events);
1295
1296 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1297                                       unsigned char netfn,
1298                                       unsigned char cmd,
1299                                       unsigned char chan)
1300 {
1301         struct cmd_rcvr *rcvr;
1302
1303         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1304                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1305                                         && (rcvr->chans & (1 << chan)))
1306                         return rcvr;
1307         }
1308         return NULL;
1309 }
1310
1311 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1312                                  unsigned char netfn,
1313                                  unsigned char cmd,
1314                                  unsigned int  chans)
1315 {
1316         struct cmd_rcvr *rcvr;
1317
1318         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1319                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1320                                         && (rcvr->chans & chans))
1321                         return 0;
1322         }
1323         return 1;
1324 }
1325
1326 int ipmi_register_for_cmd(ipmi_user_t   user,
1327                           unsigned char netfn,
1328                           unsigned char cmd,
1329                           unsigned int  chans)
1330 {
1331         ipmi_smi_t      intf = user->intf;
1332         struct cmd_rcvr *rcvr;
1333         int             rv = 0;
1334
1335
1336         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1337         if (!rcvr)
1338                 return -ENOMEM;
1339         rcvr->cmd = cmd;
1340         rcvr->netfn = netfn;
1341         rcvr->chans = chans;
1342         rcvr->user = user;
1343
1344         mutex_lock(&intf->cmd_rcvrs_mutex);
1345         /* Make sure the command/netfn is not already registered. */
1346         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1347                 rv = -EBUSY;
1348                 goto out_unlock;
1349         }
1350
1351         if (atomic_inc_return(&intf->event_waiters) == 1)
1352                 need_waiter(intf);
1353
1354         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1355
1356  out_unlock:
1357         mutex_unlock(&intf->cmd_rcvrs_mutex);
1358         if (rv)
1359                 kfree(rcvr);
1360
1361         return rv;
1362 }
1363 EXPORT_SYMBOL(ipmi_register_for_cmd);
1364
1365 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1366                             unsigned char netfn,
1367                             unsigned char cmd,
1368                             unsigned int  chans)
1369 {
1370         ipmi_smi_t      intf = user->intf;
1371         struct cmd_rcvr *rcvr;
1372         struct cmd_rcvr *rcvrs = NULL;
1373         int i, rv = -ENOENT;
1374
1375         mutex_lock(&intf->cmd_rcvrs_mutex);
1376         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1377                 if (((1 << i) & chans) == 0)
1378                         continue;
1379                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1380                 if (rcvr == NULL)
1381                         continue;
1382                 if (rcvr->user == user) {
1383                         rv = 0;
1384                         rcvr->chans &= ~chans;
1385                         if (rcvr->chans == 0) {
1386                                 list_del_rcu(&rcvr->link);
1387                                 rcvr->next = rcvrs;
1388                                 rcvrs = rcvr;
1389                         }
1390                 }
1391         }
1392         mutex_unlock(&intf->cmd_rcvrs_mutex);
1393         synchronize_rcu();
1394         while (rcvrs) {
1395                 atomic_dec(&intf->event_waiters);
1396                 rcvr = rcvrs;
1397                 rcvrs = rcvr->next;
1398                 kfree(rcvr);
1399         }
1400         return rv;
1401 }
1402 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1403
1404 static unsigned char
1405 ipmb_checksum(unsigned char *data, int size)
1406 {
1407         unsigned char csum = 0;
1408
1409         for (; size > 0; size--, data++)
1410                 csum += *data;
1411
1412         return -csum;
1413 }
1414
1415 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1416                                    struct kernel_ipmi_msg *msg,
1417                                    struct ipmi_ipmb_addr *ipmb_addr,
1418                                    long                  msgid,
1419                                    unsigned char         ipmb_seq,
1420                                    int                   broadcast,
1421                                    unsigned char         source_address,
1422                                    unsigned char         source_lun)
1423 {
1424         int i = broadcast;
1425
1426         /* Format the IPMB header data. */
1427         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1428         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1429         smi_msg->data[2] = ipmb_addr->channel;
1430         if (broadcast)
1431                 smi_msg->data[3] = 0;
1432         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1433         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1434         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1435         smi_msg->data[i+6] = source_address;
1436         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1437         smi_msg->data[i+8] = msg->cmd;
1438
1439         /* Now tack on the data to the message. */
1440         if (msg->data_len > 0)
1441                 memcpy(&(smi_msg->data[i+9]), msg->data,
1442                        msg->data_len);
1443         smi_msg->data_size = msg->data_len + 9;
1444
1445         /* Now calculate the checksum and tack it on. */
1446         smi_msg->data[i+smi_msg->data_size]
1447                 = ipmb_checksum(&(smi_msg->data[i+6]),
1448                                 smi_msg->data_size-6);
1449
1450         /*
1451          * Add on the checksum size and the offset from the
1452          * broadcast.
1453          */
1454         smi_msg->data_size += 1 + i;
1455
1456         smi_msg->msgid = msgid;
1457 }
1458
1459 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1460                                   struct kernel_ipmi_msg *msg,
1461                                   struct ipmi_lan_addr  *lan_addr,
1462                                   long                  msgid,
1463                                   unsigned char         ipmb_seq,
1464                                   unsigned char         source_lun)
1465 {
1466         /* Format the IPMB header data. */
1467         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1468         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1469         smi_msg->data[2] = lan_addr->channel;
1470         smi_msg->data[3] = lan_addr->session_handle;
1471         smi_msg->data[4] = lan_addr->remote_SWID;
1472         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1473         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1474         smi_msg->data[7] = lan_addr->local_SWID;
1475         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1476         smi_msg->data[9] = msg->cmd;
1477
1478         /* Now tack on the data to the message. */
1479         if (msg->data_len > 0)
1480                 memcpy(&(smi_msg->data[10]), msg->data,
1481                        msg->data_len);
1482         smi_msg->data_size = msg->data_len + 10;
1483
1484         /* Now calculate the checksum and tack it on. */
1485         smi_msg->data[smi_msg->data_size]
1486                 = ipmb_checksum(&(smi_msg->data[7]),
1487                                 smi_msg->data_size-7);
1488
1489         /*
1490          * Add on the checksum size and the offset from the
1491          * broadcast.
1492          */
1493         smi_msg->data_size += 1;
1494
1495         smi_msg->msgid = msgid;
1496 }
1497
1498 static void smi_send(ipmi_smi_t intf, struct ipmi_smi_handlers *handlers,
1499                      struct ipmi_smi_msg *smi_msg, int priority)
1500 {
1501         int run_to_completion = intf->run_to_completion;
1502         unsigned long flags;
1503
1504         if (!run_to_completion)
1505                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1506         if (intf->curr_msg) {
1507                 if (priority > 0)
1508                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1509                 else
1510                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1511                 smi_msg = NULL;
1512         } else {
1513                 intf->curr_msg = smi_msg;
1514         }
1515         if (!run_to_completion)
1516                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1517
1518         if (smi_msg)
1519                 handlers->sender(intf->send_info, smi_msg);
1520 }
1521
1522 /*
1523  * Separate from ipmi_request so that the user does not have to be
1524  * supplied in certain circumstances (mainly at panic time).  If
1525  * messages are supplied, they will be freed, even if an error
1526  * occurs.
1527  */
1528 static int i_ipmi_request(ipmi_user_t          user,
1529                           ipmi_smi_t           intf,
1530                           struct ipmi_addr     *addr,
1531                           long                 msgid,
1532                           struct kernel_ipmi_msg *msg,
1533                           void                 *user_msg_data,
1534                           void                 *supplied_smi,
1535                           struct ipmi_recv_msg *supplied_recv,
1536                           int                  priority,
1537                           unsigned char        source_address,
1538                           unsigned char        source_lun,
1539                           int                  retries,
1540                           unsigned int         retry_time_ms)
1541 {
1542         int                      rv = 0;
1543         struct ipmi_smi_msg      *smi_msg;
1544         struct ipmi_recv_msg     *recv_msg;
1545         unsigned long            flags;
1546
1547
1548         if (supplied_recv)
1549                 recv_msg = supplied_recv;
1550         else {
1551                 recv_msg = ipmi_alloc_recv_msg();
1552                 if (recv_msg == NULL)
1553                         return -ENOMEM;
1554         }
1555         recv_msg->user_msg_data = user_msg_data;
1556
1557         if (supplied_smi)
1558                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1559         else {
1560                 smi_msg = ipmi_alloc_smi_msg();
1561                 if (smi_msg == NULL) {
1562                         ipmi_free_recv_msg(recv_msg);
1563                         return -ENOMEM;
1564                 }
1565         }
1566
1567         rcu_read_lock();
1568         if (intf->in_shutdown) {
1569                 rv = -ENODEV;
1570                 goto out_err;
1571         }
1572
1573         recv_msg->user = user;
1574         if (user)
1575                 kref_get(&user->refcount);
1576         recv_msg->msgid = msgid;
1577         /*
1578          * Store the message to send in the receive message so timeout
1579          * responses can get the proper response data.
1580          */
1581         recv_msg->msg = *msg;
1582
1583         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1584                 struct ipmi_system_interface_addr *smi_addr;
1585
1586                 if (msg->netfn & 1) {
1587                         /* Responses are not allowed to the SMI. */
1588                         rv = -EINVAL;
1589                         goto out_err;
1590                 }
1591
1592                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1593                 if (smi_addr->lun > 3) {
1594                         ipmi_inc_stat(intf, sent_invalid_commands);
1595                         rv = -EINVAL;
1596                         goto out_err;
1597                 }
1598
1599                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1600
1601                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1602                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1603                         || (msg->cmd == IPMI_GET_MSG_CMD)
1604                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1605                         /*
1606                          * We don't let the user do these, since we manage
1607                          * the sequence numbers.
1608                          */
1609                         ipmi_inc_stat(intf, sent_invalid_commands);
1610                         rv = -EINVAL;
1611                         goto out_err;
1612                 }
1613
1614                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1615                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1616                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1617                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1618                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1619                         intf->auto_maintenance_timeout
1620                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1621                         if (!intf->maintenance_mode
1622                             && !intf->maintenance_mode_enable) {
1623                                 intf->maintenance_mode_enable = true;
1624                                 maintenance_mode_update(intf);
1625                         }
1626                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1627                                                flags);
1628                 }
1629
1630                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1631                         ipmi_inc_stat(intf, sent_invalid_commands);
1632                         rv = -EMSGSIZE;
1633                         goto out_err;
1634                 }
1635
1636                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1637                 smi_msg->data[1] = msg->cmd;
1638                 smi_msg->msgid = msgid;
1639                 smi_msg->user_data = recv_msg;
1640                 if (msg->data_len > 0)
1641                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1642                 smi_msg->data_size = msg->data_len + 2;
1643                 ipmi_inc_stat(intf, sent_local_commands);
1644         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1645                 struct ipmi_ipmb_addr *ipmb_addr;
1646                 unsigned char         ipmb_seq;
1647                 long                  seqid;
1648                 int                   broadcast = 0;
1649
1650                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1651                         ipmi_inc_stat(intf, sent_invalid_commands);
1652                         rv = -EINVAL;
1653                         goto out_err;
1654                 }
1655
1656                 if (intf->channels[addr->channel].medium
1657                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1658                         ipmi_inc_stat(intf, sent_invalid_commands);
1659                         rv = -EINVAL;
1660                         goto out_err;
1661                 }
1662
1663                 if (retries < 0) {
1664                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1665                         retries = 0; /* Don't retry broadcasts. */
1666                     else
1667                         retries = 4;
1668                 }
1669                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1670                     /*
1671                      * Broadcasts add a zero at the beginning of the
1672                      * message, but otherwise is the same as an IPMB
1673                      * address.
1674                      */
1675                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1676                     broadcast = 1;
1677                 }
1678
1679
1680                 /* Default to 1 second retries. */
1681                 if (retry_time_ms == 0)
1682                     retry_time_ms = 1000;
1683
1684                 /*
1685                  * 9 for the header and 1 for the checksum, plus
1686                  * possibly one for the broadcast.
1687                  */
1688                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1689                         ipmi_inc_stat(intf, sent_invalid_commands);
1690                         rv = -EMSGSIZE;
1691                         goto out_err;
1692                 }
1693
1694                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1695                 if (ipmb_addr->lun > 3) {
1696                         ipmi_inc_stat(intf, sent_invalid_commands);
1697                         rv = -EINVAL;
1698                         goto out_err;
1699                 }
1700
1701                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1702
1703                 if (recv_msg->msg.netfn & 0x1) {
1704                         /*
1705                          * It's a response, so use the user's sequence
1706                          * from msgid.
1707                          */
1708                         ipmi_inc_stat(intf, sent_ipmb_responses);
1709                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1710                                         msgid, broadcast,
1711                                         source_address, source_lun);
1712
1713                         /*
1714                          * Save the receive message so we can use it
1715                          * to deliver the response.
1716                          */
1717                         smi_msg->user_data = recv_msg;
1718                 } else {
1719                         /* It's a command, so get a sequence for it. */
1720
1721                         spin_lock_irqsave(&(intf->seq_lock), flags);
1722
1723                         /*
1724                          * Create a sequence number with a 1 second
1725                          * timeout and 4 retries.
1726                          */
1727                         rv = intf_next_seq(intf,
1728                                            recv_msg,
1729                                            retry_time_ms,
1730                                            retries,
1731                                            broadcast,
1732                                            &ipmb_seq,
1733                                            &seqid);
1734                         if (rv) {
1735                                 /*
1736                                  * We have used up all the sequence numbers,
1737                                  * probably, so abort.
1738                                  */
1739                                 spin_unlock_irqrestore(&(intf->seq_lock),
1740                                                        flags);
1741                                 goto out_err;
1742                         }
1743
1744                         ipmi_inc_stat(intf, sent_ipmb_commands);
1745
1746                         /*
1747                          * Store the sequence number in the message,
1748                          * so that when the send message response
1749                          * comes back we can start the timer.
1750                          */
1751                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1752                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1753                                         ipmb_seq, broadcast,
1754                                         source_address, source_lun);
1755
1756                         /*
1757                          * Copy the message into the recv message data, so we
1758                          * can retransmit it later if necessary.
1759                          */
1760                         memcpy(recv_msg->msg_data, smi_msg->data,
1761                                smi_msg->data_size);
1762                         recv_msg->msg.data = recv_msg->msg_data;
1763                         recv_msg->msg.data_len = smi_msg->data_size;
1764
1765                         /*
1766                          * We don't unlock until here, because we need
1767                          * to copy the completed message into the
1768                          * recv_msg before we release the lock.
1769                          * Otherwise, race conditions may bite us.  I
1770                          * know that's pretty paranoid, but I prefer
1771                          * to be correct.
1772                          */
1773                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1774                 }
1775         } else if (is_lan_addr(addr)) {
1776                 struct ipmi_lan_addr  *lan_addr;
1777                 unsigned char         ipmb_seq;
1778                 long                  seqid;
1779
1780                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1781                         ipmi_inc_stat(intf, sent_invalid_commands);
1782                         rv = -EINVAL;
1783                         goto out_err;
1784                 }
1785
1786                 if ((intf->channels[addr->channel].medium
1787                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1788                     && (intf->channels[addr->channel].medium
1789                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1790                         ipmi_inc_stat(intf, sent_invalid_commands);
1791                         rv = -EINVAL;
1792                         goto out_err;
1793                 }
1794
1795                 retries = 4;
1796
1797                 /* Default to 1 second retries. */
1798                 if (retry_time_ms == 0)
1799                     retry_time_ms = 1000;
1800
1801                 /* 11 for the header and 1 for the checksum. */
1802                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1803                         ipmi_inc_stat(intf, sent_invalid_commands);
1804                         rv = -EMSGSIZE;
1805                         goto out_err;
1806                 }
1807
1808                 lan_addr = (struct ipmi_lan_addr *) addr;
1809                 if (lan_addr->lun > 3) {
1810                         ipmi_inc_stat(intf, sent_invalid_commands);
1811                         rv = -EINVAL;
1812                         goto out_err;
1813                 }
1814
1815                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1816
1817                 if (recv_msg->msg.netfn & 0x1) {
1818                         /*
1819                          * It's a response, so use the user's sequence
1820                          * from msgid.
1821                          */
1822                         ipmi_inc_stat(intf, sent_lan_responses);
1823                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1824                                        msgid, source_lun);
1825
1826                         /*
1827                          * Save the receive message so we can use it
1828                          * to deliver the response.
1829                          */
1830                         smi_msg->user_data = recv_msg;
1831                 } else {
1832                         /* It's a command, so get a sequence for it. */
1833
1834                         spin_lock_irqsave(&(intf->seq_lock), flags);
1835
1836                         /*
1837                          * Create a sequence number with a 1 second
1838                          * timeout and 4 retries.
1839                          */
1840                         rv = intf_next_seq(intf,
1841                                            recv_msg,
1842                                            retry_time_ms,
1843                                            retries,
1844                                            0,
1845                                            &ipmb_seq,
1846                                            &seqid);
1847                         if (rv) {
1848                                 /*
1849                                  * We have used up all the sequence numbers,
1850                                  * probably, so abort.
1851                                  */
1852                                 spin_unlock_irqrestore(&(intf->seq_lock),
1853                                                        flags);
1854                                 goto out_err;
1855                         }
1856
1857                         ipmi_inc_stat(intf, sent_lan_commands);
1858
1859                         /*
1860                          * Store the sequence number in the message,
1861                          * so that when the send message response
1862                          * comes back we can start the timer.
1863                          */
1864                         format_lan_msg(smi_msg, msg, lan_addr,
1865                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1866                                        ipmb_seq, source_lun);
1867
1868                         /*
1869                          * Copy the message into the recv message data, so we
1870                          * can retransmit it later if necessary.
1871                          */
1872                         memcpy(recv_msg->msg_data, smi_msg->data,
1873                                smi_msg->data_size);
1874                         recv_msg->msg.data = recv_msg->msg_data;
1875                         recv_msg->msg.data_len = smi_msg->data_size;
1876
1877                         /*
1878                          * We don't unlock until here, because we need
1879                          * to copy the completed message into the
1880                          * recv_msg before we release the lock.
1881                          * Otherwise, race conditions may bite us.  I
1882                          * know that's pretty paranoid, but I prefer
1883                          * to be correct.
1884                          */
1885                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1886                 }
1887         } else {
1888             /* Unknown address type. */
1889                 ipmi_inc_stat(intf, sent_invalid_commands);
1890                 rv = -EINVAL;
1891                 goto out_err;
1892         }
1893
1894 #ifdef DEBUG_MSGING
1895         {
1896                 int m;
1897                 for (m = 0; m < smi_msg->data_size; m++)
1898                         printk(" %2.2x", smi_msg->data[m]);
1899                 printk("\n");
1900         }
1901 #endif
1902
1903         smi_send(intf, intf->handlers, smi_msg, priority);
1904         rcu_read_unlock();
1905
1906         return 0;
1907
1908  out_err:
1909         rcu_read_unlock();
1910         ipmi_free_smi_msg(smi_msg);
1911         ipmi_free_recv_msg(recv_msg);
1912         return rv;
1913 }
1914
1915 static int check_addr(ipmi_smi_t       intf,
1916                       struct ipmi_addr *addr,
1917                       unsigned char    *saddr,
1918                       unsigned char    *lun)
1919 {
1920         if (addr->channel >= IPMI_MAX_CHANNELS)
1921                 return -EINVAL;
1922         *lun = intf->channels[addr->channel].lun;
1923         *saddr = intf->channels[addr->channel].address;
1924         return 0;
1925 }
1926
1927 int ipmi_request_settime(ipmi_user_t      user,
1928                          struct ipmi_addr *addr,
1929                          long             msgid,
1930                          struct kernel_ipmi_msg  *msg,
1931                          void             *user_msg_data,
1932                          int              priority,
1933                          int              retries,
1934                          unsigned int     retry_time_ms)
1935 {
1936         unsigned char saddr = 0, lun = 0;
1937         int           rv;
1938
1939         if (!user)
1940                 return -EINVAL;
1941         rv = check_addr(user->intf, addr, &saddr, &lun);
1942         if (rv)
1943                 return rv;
1944         return i_ipmi_request(user,
1945                               user->intf,
1946                               addr,
1947                               msgid,
1948                               msg,
1949                               user_msg_data,
1950                               NULL, NULL,
1951                               priority,
1952                               saddr,
1953                               lun,
1954                               retries,
1955                               retry_time_ms);
1956 }
1957 EXPORT_SYMBOL(ipmi_request_settime);
1958
1959 int ipmi_request_supply_msgs(ipmi_user_t          user,
1960                              struct ipmi_addr     *addr,
1961                              long                 msgid,
1962                              struct kernel_ipmi_msg *msg,
1963                              void                 *user_msg_data,
1964                              void                 *supplied_smi,
1965                              struct ipmi_recv_msg *supplied_recv,
1966                              int                  priority)
1967 {
1968         unsigned char saddr = 0, lun = 0;
1969         int           rv;
1970
1971         if (!user)
1972                 return -EINVAL;
1973         rv = check_addr(user->intf, addr, &saddr, &lun);
1974         if (rv)
1975                 return rv;
1976         return i_ipmi_request(user,
1977                               user->intf,
1978                               addr,
1979                               msgid,
1980                               msg,
1981                               user_msg_data,
1982                               supplied_smi,
1983                               supplied_recv,
1984                               priority,
1985                               saddr,
1986                               lun,
1987                               -1, 0);
1988 }
1989 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1990
1991 #ifdef CONFIG_PROC_FS
1992 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
1993 {
1994         ipmi_smi_t intf = m->private;
1995         int        i;
1996
1997         seq_printf(m, "%x", intf->channels[0].address);
1998         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
1999                 seq_printf(m, " %x", intf->channels[i].address);
2000         return seq_putc(m, '\n');
2001 }
2002
2003 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
2004 {
2005         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
2006 }
2007
2008 static const struct file_operations smi_ipmb_proc_ops = {
2009         .open           = smi_ipmb_proc_open,
2010         .read           = seq_read,
2011         .llseek         = seq_lseek,
2012         .release        = single_release,
2013 };
2014
2015 static int smi_version_proc_show(struct seq_file *m, void *v)
2016 {
2017         ipmi_smi_t intf = m->private;
2018
2019         return seq_printf(m, "%u.%u\n",
2020                        ipmi_version_major(&intf->bmc->id),
2021                        ipmi_version_minor(&intf->bmc->id));
2022 }
2023
2024 static int smi_version_proc_open(struct inode *inode, struct file *file)
2025 {
2026         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
2027 }
2028
2029 static const struct file_operations smi_version_proc_ops = {
2030         .open           = smi_version_proc_open,
2031         .read           = seq_read,
2032         .llseek         = seq_lseek,
2033         .release        = single_release,
2034 };
2035
2036 static int smi_stats_proc_show(struct seq_file *m, void *v)
2037 {
2038         ipmi_smi_t intf = m->private;
2039
2040         seq_printf(m, "sent_invalid_commands:       %u\n",
2041                        ipmi_get_stat(intf, sent_invalid_commands));
2042         seq_printf(m, "sent_local_commands:         %u\n",
2043                        ipmi_get_stat(intf, sent_local_commands));
2044         seq_printf(m, "handled_local_responses:     %u\n",
2045                        ipmi_get_stat(intf, handled_local_responses));
2046         seq_printf(m, "unhandled_local_responses:   %u\n",
2047                        ipmi_get_stat(intf, unhandled_local_responses));
2048         seq_printf(m, "sent_ipmb_commands:          %u\n",
2049                        ipmi_get_stat(intf, sent_ipmb_commands));
2050         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2051                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2052         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2053                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2054         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2055                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2056         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2057                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2058         seq_printf(m, "sent_ipmb_responses:         %u\n",
2059                        ipmi_get_stat(intf, sent_ipmb_responses));
2060         seq_printf(m, "handled_ipmb_responses:      %u\n",
2061                        ipmi_get_stat(intf, handled_ipmb_responses));
2062         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2063                        ipmi_get_stat(intf, invalid_ipmb_responses));
2064         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2065                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2066         seq_printf(m, "sent_lan_commands:           %u\n",
2067                        ipmi_get_stat(intf, sent_lan_commands));
2068         seq_printf(m, "sent_lan_command_errs:       %u\n",
2069                        ipmi_get_stat(intf, sent_lan_command_errs));
2070         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2071                        ipmi_get_stat(intf, retransmitted_lan_commands));
2072         seq_printf(m, "timed_out_lan_commands:      %u\n",
2073                        ipmi_get_stat(intf, timed_out_lan_commands));
2074         seq_printf(m, "sent_lan_responses:          %u\n",
2075                        ipmi_get_stat(intf, sent_lan_responses));
2076         seq_printf(m, "handled_lan_responses:       %u\n",
2077                        ipmi_get_stat(intf, handled_lan_responses));
2078         seq_printf(m, "invalid_lan_responses:       %u\n",
2079                        ipmi_get_stat(intf, invalid_lan_responses));
2080         seq_printf(m, "unhandled_lan_responses:     %u\n",
2081                        ipmi_get_stat(intf, unhandled_lan_responses));
2082         seq_printf(m, "handled_commands:            %u\n",
2083                        ipmi_get_stat(intf, handled_commands));
2084         seq_printf(m, "invalid_commands:            %u\n",
2085                        ipmi_get_stat(intf, invalid_commands));
2086         seq_printf(m, "unhandled_commands:          %u\n",
2087                        ipmi_get_stat(intf, unhandled_commands));
2088         seq_printf(m, "invalid_events:              %u\n",
2089                        ipmi_get_stat(intf, invalid_events));
2090         seq_printf(m, "events:                      %u\n",
2091                        ipmi_get_stat(intf, events));
2092         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2093                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2094         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2095                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2096         return 0;
2097 }
2098
2099 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2100 {
2101         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2102 }
2103
2104 static const struct file_operations smi_stats_proc_ops = {
2105         .open           = smi_stats_proc_open,
2106         .read           = seq_read,
2107         .llseek         = seq_lseek,
2108         .release        = single_release,
2109 };
2110 #endif /* CONFIG_PROC_FS */
2111
2112 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2113                             const struct file_operations *proc_ops,
2114                             void *data)
2115 {
2116         int                    rv = 0;
2117 #ifdef CONFIG_PROC_FS
2118         struct proc_dir_entry  *file;
2119         struct ipmi_proc_entry *entry;
2120
2121         /* Create a list element. */
2122         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2123         if (!entry)
2124                 return -ENOMEM;
2125         entry->name = kstrdup(name, GFP_KERNEL);
2126         if (!entry->name) {
2127                 kfree(entry);
2128                 return -ENOMEM;
2129         }
2130
2131         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2132         if (!file) {
2133                 kfree(entry->name);
2134                 kfree(entry);
2135                 rv = -ENOMEM;
2136         } else {
2137                 mutex_lock(&smi->proc_entry_lock);
2138                 /* Stick it on the list. */
2139                 entry->next = smi->proc_entries;
2140                 smi->proc_entries = entry;
2141                 mutex_unlock(&smi->proc_entry_lock);
2142         }
2143 #endif /* CONFIG_PROC_FS */
2144
2145         return rv;
2146 }
2147 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2148
2149 static int add_proc_entries(ipmi_smi_t smi, int num)
2150 {
2151         int rv = 0;
2152
2153 #ifdef CONFIG_PROC_FS
2154         sprintf(smi->proc_dir_name, "%d", num);
2155         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2156         if (!smi->proc_dir)
2157                 rv = -ENOMEM;
2158
2159         if (rv == 0)
2160                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2161                                              &smi_stats_proc_ops,
2162                                              smi);
2163
2164         if (rv == 0)
2165                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2166                                              &smi_ipmb_proc_ops,
2167                                              smi);
2168
2169         if (rv == 0)
2170                 rv = ipmi_smi_add_proc_entry(smi, "version",
2171                                              &smi_version_proc_ops,
2172                                              smi);
2173 #endif /* CONFIG_PROC_FS */
2174
2175         return rv;
2176 }
2177
2178 static void remove_proc_entries(ipmi_smi_t smi)
2179 {
2180 #ifdef CONFIG_PROC_FS
2181         struct ipmi_proc_entry *entry;
2182
2183         mutex_lock(&smi->proc_entry_lock);
2184         while (smi->proc_entries) {
2185                 entry = smi->proc_entries;
2186                 smi->proc_entries = entry->next;
2187
2188                 remove_proc_entry(entry->name, smi->proc_dir);
2189                 kfree(entry->name);
2190                 kfree(entry);
2191         }
2192         mutex_unlock(&smi->proc_entry_lock);
2193         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2194 #endif /* CONFIG_PROC_FS */
2195 }
2196
2197 static int __find_bmc_guid(struct device *dev, void *data)
2198 {
2199         unsigned char *id = data;
2200         struct bmc_device *bmc = to_bmc_device(dev);
2201         return memcmp(bmc->guid, id, 16) == 0;
2202 }
2203
2204 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2205                                              unsigned char *guid)
2206 {
2207         struct device *dev;
2208
2209         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2210         if (dev)
2211                 return to_bmc_device(dev);
2212         else
2213                 return NULL;
2214 }
2215
2216 struct prod_dev_id {
2217         unsigned int  product_id;
2218         unsigned char device_id;
2219 };
2220
2221 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2222 {
2223         struct prod_dev_id *id = data;
2224         struct bmc_device *bmc = to_bmc_device(dev);
2225
2226         return (bmc->id.product_id == id->product_id
2227                 && bmc->id.device_id == id->device_id);
2228 }
2229
2230 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2231         struct device_driver *drv,
2232         unsigned int product_id, unsigned char device_id)
2233 {
2234         struct prod_dev_id id = {
2235                 .product_id = product_id,
2236                 .device_id = device_id,
2237         };
2238         struct device *dev;
2239
2240         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2241         if (dev)
2242                 return to_bmc_device(dev);
2243         else
2244                 return NULL;
2245 }
2246
2247 static ssize_t device_id_show(struct device *dev,
2248                               struct device_attribute *attr,
2249                               char *buf)
2250 {
2251         struct bmc_device *bmc = to_bmc_device(dev);
2252
2253         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2254 }
2255 DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
2256
2257 static ssize_t provides_device_sdrs_show(struct device *dev,
2258                                          struct device_attribute *attr,
2259                                          char *buf)
2260 {
2261         struct bmc_device *bmc = to_bmc_device(dev);
2262
2263         return snprintf(buf, 10, "%u\n",
2264                         (bmc->id.device_revision & 0x80) >> 7);
2265 }
2266 DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show, NULL);
2267
2268 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2269                              char *buf)
2270 {
2271         struct bmc_device *bmc = to_bmc_device(dev);
2272
2273         return snprintf(buf, 20, "%u\n",
2274                         bmc->id.device_revision & 0x0F);
2275 }
2276 DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
2277
2278 static ssize_t firmware_revision_show(struct device *dev,
2279                                       struct device_attribute *attr,
2280                                       char *buf)
2281 {
2282         struct bmc_device *bmc = to_bmc_device(dev);
2283
2284         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2285                         bmc->id.firmware_revision_2);
2286 }
2287 DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
2288
2289 static ssize_t ipmi_version_show(struct device *dev,
2290                                  struct device_attribute *attr,
2291                                  char *buf)
2292 {
2293         struct bmc_device *bmc = to_bmc_device(dev);
2294
2295         return snprintf(buf, 20, "%u.%u\n",
2296                         ipmi_version_major(&bmc->id),
2297                         ipmi_version_minor(&bmc->id));
2298 }
2299 DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
2300
2301 static ssize_t add_dev_support_show(struct device *dev,
2302                                     struct device_attribute *attr,
2303                                     char *buf)
2304 {
2305         struct bmc_device *bmc = to_bmc_device(dev);
2306
2307         return snprintf(buf, 10, "0x%02x\n",
2308                         bmc->id.additional_device_support);
2309 }
2310 DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, NULL);
2311
2312 static ssize_t manufacturer_id_show(struct device *dev,
2313                                     struct device_attribute *attr,
2314                                     char *buf)
2315 {
2316         struct bmc_device *bmc = to_bmc_device(dev);
2317
2318         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2319 }
2320 DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
2321
2322 static ssize_t product_id_show(struct device *dev,
2323                                struct device_attribute *attr,
2324                                char *buf)
2325 {
2326         struct bmc_device *bmc = to_bmc_device(dev);
2327
2328         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2329 }
2330 DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
2331
2332 static ssize_t aux_firmware_rev_show(struct device *dev,
2333                                      struct device_attribute *attr,
2334                                      char *buf)
2335 {
2336         struct bmc_device *bmc = to_bmc_device(dev);
2337
2338         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2339                         bmc->id.aux_firmware_revision[3],
2340                         bmc->id.aux_firmware_revision[2],
2341                         bmc->id.aux_firmware_revision[1],
2342                         bmc->id.aux_firmware_revision[0]);
2343 }
2344 DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2345
2346 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2347                          char *buf)
2348 {
2349         struct bmc_device *bmc = to_bmc_device(dev);
2350
2351         return snprintf(buf, 100, "%Lx%Lx\n",
2352                         (long long) bmc->guid[0],
2353                         (long long) bmc->guid[8]);
2354 }
2355 DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
2356
2357 static struct attribute *bmc_dev_attrs[] = {
2358         &dev_attr_device_id.attr,
2359         &dev_attr_provides_device_sdrs.attr,
2360         &dev_attr_revision.attr,
2361         &dev_attr_firmware_revision.attr,
2362         &dev_attr_ipmi_version.attr,
2363         &dev_attr_additional_device_support.attr,
2364         &dev_attr_manufacturer_id.attr,
2365         &dev_attr_product_id.attr,
2366         NULL
2367 };
2368
2369 static struct attribute_group bmc_dev_attr_group = {
2370         .attrs          = bmc_dev_attrs,
2371 };
2372
2373 static const struct attribute_group *bmc_dev_attr_groups[] = {
2374         &bmc_dev_attr_group,
2375         NULL
2376 };
2377
2378 static struct device_type bmc_device_type = {
2379         .groups         = bmc_dev_attr_groups,
2380 };
2381
2382 static void
2383 release_bmc_device(struct device *dev)
2384 {
2385         kfree(to_bmc_device(dev));
2386 }
2387
2388 static void
2389 cleanup_bmc_device(struct kref *ref)
2390 {
2391         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2392
2393         if (bmc->id.aux_firmware_revision_set)
2394                 device_remove_file(&bmc->pdev.dev,
2395                                    &bmc->aux_firmware_rev_attr);
2396         if (bmc->guid_set)
2397                 device_remove_file(&bmc->pdev.dev,
2398                                    &bmc->guid_attr);
2399
2400         platform_device_unregister(&bmc->pdev);
2401 }
2402
2403 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2404 {
2405         struct bmc_device *bmc = intf->bmc;
2406
2407         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2408         if (intf->my_dev_name) {
2409                 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2410                 kfree(intf->my_dev_name);
2411                 intf->my_dev_name = NULL;
2412         }
2413
2414         mutex_lock(&ipmidriver_mutex);
2415         kref_put(&bmc->usecount, cleanup_bmc_device);
2416         intf->bmc = NULL;
2417         mutex_unlock(&ipmidriver_mutex);
2418 }
2419
2420 static int create_bmc_files(struct bmc_device *bmc)
2421 {
2422         int err;
2423
2424         if (bmc->id.aux_firmware_revision_set) {
2425                 bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2426                 err = device_create_file(&bmc->pdev.dev,
2427                                    &bmc->aux_firmware_rev_attr);
2428                 if (err)
2429                         goto out;
2430         }
2431         if (bmc->guid_set) {
2432                 bmc->guid_attr.attr.name = "guid";
2433                 err = device_create_file(&bmc->pdev.dev,
2434                                    &bmc->guid_attr);
2435                 if (err)
2436                         goto out_aux_firm;
2437         }
2438
2439         return 0;
2440
2441 out_aux_firm:
2442         if (bmc->id.aux_firmware_revision_set)
2443                 device_remove_file(&bmc->pdev.dev,
2444                                    &bmc->aux_firmware_rev_attr);
2445 out:
2446         return err;
2447 }
2448
2449 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
2450 {
2451         int               rv;
2452         struct bmc_device *bmc = intf->bmc;
2453         struct bmc_device *old_bmc;
2454
2455         mutex_lock(&ipmidriver_mutex);
2456
2457         /*
2458          * Try to find if there is an bmc_device struct
2459          * representing the interfaced BMC already
2460          */
2461         if (bmc->guid_set)
2462                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2463         else
2464                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2465                                                     bmc->id.product_id,
2466                                                     bmc->id.device_id);
2467
2468         /*
2469          * If there is already an bmc_device, free the new one,
2470          * otherwise register the new BMC device
2471          */
2472         if (old_bmc) {
2473                 kfree(bmc);
2474                 intf->bmc = old_bmc;
2475                 bmc = old_bmc;
2476
2477                 kref_get(&bmc->usecount);
2478                 mutex_unlock(&ipmidriver_mutex);
2479
2480                 printk(KERN_INFO
2481                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2482                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2483                        bmc->id.manufacturer_id,
2484                        bmc->id.product_id,
2485                        bmc->id.device_id);
2486         } else {
2487                 unsigned char orig_dev_id = bmc->id.device_id;
2488                 int warn_printed = 0;
2489
2490                 snprintf(bmc->name, sizeof(bmc->name),
2491                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2492                 bmc->pdev.name = bmc->name;
2493
2494                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2495                                                  bmc->id.product_id,
2496                                                  bmc->id.device_id)) {
2497                         if (!warn_printed) {
2498                                 printk(KERN_WARNING PFX
2499                                        "This machine has two different BMCs"
2500                                        " with the same product id and device"
2501                                        " id.  This is an error in the"
2502                                        " firmware, but incrementing the"
2503                                        " device id to work around the problem."
2504                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2505                                        bmc->id.product_id, bmc->id.device_id);
2506                                 warn_printed = 1;
2507                         }
2508                         bmc->id.device_id++; /* Wraps at 255 */
2509                         if (bmc->id.device_id == orig_dev_id) {
2510                                 printk(KERN_ERR PFX
2511                                        "Out of device ids!\n");
2512                                 break;
2513                         }
2514                 }
2515
2516                 bmc->pdev.dev.driver = &ipmidriver.driver;
2517                 bmc->pdev.id = bmc->id.device_id;
2518                 bmc->pdev.dev.release = release_bmc_device;
2519                 bmc->pdev.dev.type = &bmc_device_type;
2520                 kref_init(&bmc->usecount);
2521
2522                 rv = platform_device_register(&bmc->pdev);
2523                 mutex_unlock(&ipmidriver_mutex);
2524                 if (rv) {
2525                         put_device(&bmc->pdev.dev);
2526                         printk(KERN_ERR
2527                                "ipmi_msghandler:"
2528                                " Unable to register bmc device: %d\n",
2529                                rv);
2530                         /*
2531                          * Don't go to out_err, you can only do that if
2532                          * the device is registered already.
2533                          */
2534                         return rv;
2535                 }
2536
2537                 rv = create_bmc_files(bmc);
2538                 if (rv) {
2539                         mutex_lock(&ipmidriver_mutex);
2540                         platform_device_unregister(&bmc->pdev);
2541                         mutex_unlock(&ipmidriver_mutex);
2542
2543                         return rv;
2544                 }
2545
2546                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2547                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2548                          bmc->id.manufacturer_id,
2549                          bmc->id.product_id,
2550                          bmc->id.device_id);
2551         }
2552
2553         /*
2554          * create symlink from system interface device to bmc device
2555          * and back.
2556          */
2557         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
2558         if (rv) {
2559                 printk(KERN_ERR
2560                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2561                        rv);
2562                 goto out_err;
2563         }
2564
2565         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
2566         if (!intf->my_dev_name) {
2567                 rv = -ENOMEM;
2568                 printk(KERN_ERR
2569                        "ipmi_msghandler: allocate link from BMC: %d\n",
2570                        rv);
2571                 goto out_err;
2572         }
2573
2574         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
2575                                intf->my_dev_name);
2576         if (rv) {
2577                 kfree(intf->my_dev_name);
2578                 intf->my_dev_name = NULL;
2579                 printk(KERN_ERR
2580                        "ipmi_msghandler:"
2581                        " Unable to create symlink to bmc: %d\n",
2582                        rv);
2583                 goto out_err;
2584         }
2585
2586         return 0;
2587
2588 out_err:
2589         ipmi_bmc_unregister(intf);
2590         return rv;
2591 }
2592
2593 static int
2594 send_guid_cmd(ipmi_smi_t intf, int chan)
2595 {
2596         struct kernel_ipmi_msg            msg;
2597         struct ipmi_system_interface_addr si;
2598
2599         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2600         si.channel = IPMI_BMC_CHANNEL;
2601         si.lun = 0;
2602
2603         msg.netfn = IPMI_NETFN_APP_REQUEST;
2604         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2605         msg.data = NULL;
2606         msg.data_len = 0;
2607         return i_ipmi_request(NULL,
2608                               intf,
2609                               (struct ipmi_addr *) &si,
2610                               0,
2611                               &msg,
2612                               intf,
2613                               NULL,
2614                               NULL,
2615                               0,
2616                               intf->channels[0].address,
2617                               intf->channels[0].lun,
2618                               -1, 0);
2619 }
2620
2621 static void
2622 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2623 {
2624         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2625             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2626             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2627                 /* Not for me */
2628                 return;
2629
2630         if (msg->msg.data[0] != 0) {
2631                 /* Error from getting the GUID, the BMC doesn't have one. */
2632                 intf->bmc->guid_set = 0;
2633                 goto out;
2634         }
2635
2636         if (msg->msg.data_len < 17) {
2637                 intf->bmc->guid_set = 0;
2638                 printk(KERN_WARNING PFX
2639                        "guid_handler: The GUID response from the BMC was too"
2640                        " short, it was %d but should have been 17.  Assuming"
2641                        " GUID is not available.\n",
2642                        msg->msg.data_len);
2643                 goto out;
2644         }
2645
2646         memcpy(intf->bmc->guid, msg->msg.data, 16);
2647         intf->bmc->guid_set = 1;
2648  out:
2649         wake_up(&intf->waitq);
2650 }
2651
2652 static void
2653 get_guid(ipmi_smi_t intf)
2654 {
2655         int rv;
2656
2657         intf->bmc->guid_set = 0x2;
2658         intf->null_user_handler = guid_handler;
2659         rv = send_guid_cmd(intf, 0);
2660         if (rv)
2661                 /* Send failed, no GUID available. */
2662                 intf->bmc->guid_set = 0;
2663         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2664         intf->null_user_handler = NULL;
2665 }
2666
2667 static int
2668 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2669 {
2670         struct kernel_ipmi_msg            msg;
2671         unsigned char                     data[1];
2672         struct ipmi_system_interface_addr si;
2673
2674         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2675         si.channel = IPMI_BMC_CHANNEL;
2676         si.lun = 0;
2677
2678         msg.netfn = IPMI_NETFN_APP_REQUEST;
2679         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2680         msg.data = data;
2681         msg.data_len = 1;
2682         data[0] = chan;
2683         return i_ipmi_request(NULL,
2684                               intf,
2685                               (struct ipmi_addr *) &si,
2686                               0,
2687                               &msg,
2688                               intf,
2689                               NULL,
2690                               NULL,
2691                               0,
2692                               intf->channels[0].address,
2693                               intf->channels[0].lun,
2694                               -1, 0);
2695 }
2696
2697 static void
2698 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2699 {
2700         int rv = 0;
2701         int chan;
2702
2703         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2704             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2705             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2706                 /* It's the one we want */
2707                 if (msg->msg.data[0] != 0) {
2708                         /* Got an error from the channel, just go on. */
2709
2710                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2711                                 /*
2712                                  * If the MC does not support this
2713                                  * command, that is legal.  We just
2714                                  * assume it has one IPMB at channel
2715                                  * zero.
2716                                  */
2717                                 intf->channels[0].medium
2718                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2719                                 intf->channels[0].protocol
2720                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2721
2722                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2723                                 wake_up(&intf->waitq);
2724                                 goto out;
2725                         }
2726                         goto next_channel;
2727                 }
2728                 if (msg->msg.data_len < 4) {
2729                         /* Message not big enough, just go on. */
2730                         goto next_channel;
2731                 }
2732                 chan = intf->curr_channel;
2733                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2734                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2735
2736  next_channel:
2737                 intf->curr_channel++;
2738                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2739                         wake_up(&intf->waitq);
2740                 else
2741                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2742
2743                 if (rv) {
2744                         /* Got an error somehow, just give up. */
2745                         printk(KERN_WARNING PFX
2746                                "Error sending channel information for channel"
2747                                " %d: %d\n", intf->curr_channel, rv);
2748
2749                         intf->curr_channel = IPMI_MAX_CHANNELS;
2750                         wake_up(&intf->waitq);
2751                 }
2752         }
2753  out:
2754         return;
2755 }
2756
2757 static void ipmi_poll(ipmi_smi_t intf)
2758 {
2759         if (intf->handlers->poll)
2760                 intf->handlers->poll(intf->send_info);
2761         /* In case something came in */
2762         handle_new_recv_msgs(intf);
2763 }
2764
2765 void ipmi_poll_interface(ipmi_user_t user)
2766 {
2767         ipmi_poll(user->intf);
2768 }
2769 EXPORT_SYMBOL(ipmi_poll_interface);
2770
2771 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2772                       void                     *send_info,
2773                       struct ipmi_device_id    *device_id,
2774                       struct device            *si_dev,
2775                       unsigned char            slave_addr)
2776 {
2777         int              i, j;
2778         int              rv;
2779         ipmi_smi_t       intf;
2780         ipmi_smi_t       tintf;
2781         struct list_head *link;
2782
2783         /*
2784          * Make sure the driver is actually initialized, this handles
2785          * problems with initialization order.
2786          */
2787         if (!initialized) {
2788                 rv = ipmi_init_msghandler();
2789                 if (rv)
2790                         return rv;
2791                 /*
2792                  * The init code doesn't return an error if it was turned
2793                  * off, but it won't initialize.  Check that.
2794                  */
2795                 if (!initialized)
2796                         return -ENODEV;
2797         }
2798
2799         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2800         if (!intf)
2801                 return -ENOMEM;
2802
2803         intf->ipmi_version_major = ipmi_version_major(device_id);
2804         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2805
2806         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2807         if (!intf->bmc) {
2808                 kfree(intf);
2809                 return -ENOMEM;
2810         }
2811         intf->intf_num = -1; /* Mark it invalid for now. */
2812         kref_init(&intf->refcount);
2813         intf->bmc->id = *device_id;
2814         intf->si_dev = si_dev;
2815         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2816                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2817                 intf->channels[j].lun = 2;
2818         }
2819         if (slave_addr != 0)
2820                 intf->channels[0].address = slave_addr;
2821         INIT_LIST_HEAD(&intf->users);
2822         intf->handlers = handlers;
2823         intf->send_info = send_info;
2824         spin_lock_init(&intf->seq_lock);
2825         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2826                 intf->seq_table[j].inuse = 0;
2827                 intf->seq_table[j].seqid = 0;
2828         }
2829         intf->curr_seq = 0;
2830 #ifdef CONFIG_PROC_FS
2831         mutex_init(&intf->proc_entry_lock);
2832 #endif
2833         spin_lock_init(&intf->waiting_rcv_msgs_lock);
2834         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
2835         tasklet_init(&intf->recv_tasklet,
2836                      smi_recv_tasklet,
2837                      (unsigned long) intf);
2838         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2839         spin_lock_init(&intf->xmit_msgs_lock);
2840         INIT_LIST_HEAD(&intf->xmit_msgs);
2841         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
2842         spin_lock_init(&intf->events_lock);
2843         atomic_set(&intf->event_waiters, 0);
2844         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2845         INIT_LIST_HEAD(&intf->waiting_events);
2846         intf->waiting_events_count = 0;
2847         mutex_init(&intf->cmd_rcvrs_mutex);
2848         spin_lock_init(&intf->maintenance_mode_lock);
2849         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2850         init_waitqueue_head(&intf->waitq);
2851         for (i = 0; i < IPMI_NUM_STATS; i++)
2852                 atomic_set(&intf->stats[i], 0);
2853
2854         intf->proc_dir = NULL;
2855
2856         mutex_lock(&smi_watchers_mutex);
2857         mutex_lock(&ipmi_interfaces_mutex);
2858         /* Look for a hole in the numbers. */
2859         i = 0;
2860         link = &ipmi_interfaces;
2861         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2862                 if (tintf->intf_num != i) {
2863                         link = &tintf->link;
2864                         break;
2865                 }
2866                 i++;
2867         }
2868         /* Add the new interface in numeric order. */
2869         if (i == 0)
2870                 list_add_rcu(&intf->link, &ipmi_interfaces);
2871         else
2872                 list_add_tail_rcu(&intf->link, link);
2873
2874         rv = handlers->start_processing(send_info, intf);
2875         if (rv)
2876                 goto out;
2877
2878         get_guid(intf);
2879
2880         if ((intf->ipmi_version_major > 1)
2881                         || ((intf->ipmi_version_major == 1)
2882                             && (intf->ipmi_version_minor >= 5))) {
2883                 /*
2884                  * Start scanning the channels to see what is
2885                  * available.
2886                  */
2887                 intf->null_user_handler = channel_handler;
2888                 intf->curr_channel = 0;
2889                 rv = send_channel_info_cmd(intf, 0);
2890                 if (rv) {
2891                         printk(KERN_WARNING PFX
2892                                "Error sending channel information for channel"
2893                                " 0, %d\n", rv);
2894                         goto out;
2895                 }
2896
2897                 /* Wait for the channel info to be read. */
2898                 wait_event(intf->waitq,
2899                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2900                 intf->null_user_handler = NULL;
2901         } else {
2902                 /* Assume a single IPMB channel at zero. */
2903                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2904                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2905                 intf->curr_channel = IPMI_MAX_CHANNELS;
2906         }
2907
2908         if (rv == 0)
2909                 rv = add_proc_entries(intf, i);
2910
2911         rv = ipmi_bmc_register(intf, i);
2912
2913  out:
2914         if (rv) {
2915                 if (intf->proc_dir)
2916                         remove_proc_entries(intf);
2917                 intf->handlers = NULL;
2918                 list_del_rcu(&intf->link);
2919                 mutex_unlock(&ipmi_interfaces_mutex);
2920                 mutex_unlock(&smi_watchers_mutex);
2921                 synchronize_rcu();
2922                 kref_put(&intf->refcount, intf_free);
2923         } else {
2924                 /*
2925                  * Keep memory order straight for RCU readers.  Make
2926                  * sure everything else is committed to memory before
2927                  * setting intf_num to mark the interface valid.
2928                  */
2929                 smp_wmb();
2930                 intf->intf_num = i;
2931                 mutex_unlock(&ipmi_interfaces_mutex);
2932                 /* After this point the interface is legal to use. */
2933                 call_smi_watchers(i, intf->si_dev);
2934                 mutex_unlock(&smi_watchers_mutex);
2935         }
2936
2937         return rv;
2938 }
2939 EXPORT_SYMBOL(ipmi_register_smi);
2940
2941 static void deliver_smi_err_response(ipmi_smi_t intf,
2942                                      struct ipmi_smi_msg *msg,
2943                                      unsigned char err)
2944 {
2945         msg->rsp[0] = msg->data[0] | 4;
2946         msg->rsp[1] = msg->data[1];
2947         msg->rsp[2] = err;
2948         msg->rsp_size = 3;
2949         /* It's an error, so it will never requeue, no need to check return. */
2950         handle_one_recv_msg(intf, msg);
2951 }
2952
2953 static void cleanup_smi_msgs(ipmi_smi_t intf)
2954 {
2955         int              i;
2956         struct seq_table *ent;
2957         struct ipmi_smi_msg *msg;
2958         struct list_head *entry;
2959         struct list_head tmplist;
2960
2961         /* Clear out our transmit queues and hold the messages. */
2962         INIT_LIST_HEAD(&tmplist);
2963         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
2964         list_splice_tail(&intf->xmit_msgs, &tmplist);
2965
2966         /* Current message first, to preserve order */
2967         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
2968                 /* Wait for the message to clear out. */
2969                 schedule_timeout(1);
2970         }
2971
2972         /* No need for locks, the interface is down. */
2973
2974         /*
2975          * Return errors for all pending messages in queue and in the
2976          * tables waiting for remote responses.
2977          */
2978         while (!list_empty(&tmplist)) {
2979                 entry = tmplist.next;
2980                 list_del(entry);
2981                 msg = list_entry(entry, struct ipmi_smi_msg, link);
2982                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
2983         }
2984
2985         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2986                 ent = &(intf->seq_table[i]);
2987                 if (!ent->inuse)
2988                         continue;
2989                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2990         }
2991 }
2992
2993 int ipmi_unregister_smi(ipmi_smi_t intf)
2994 {
2995         struct ipmi_smi_watcher *w;
2996         int intf_num = intf->intf_num;
2997         ipmi_user_t user;
2998
2999         ipmi_bmc_unregister(intf);
3000
3001         mutex_lock(&smi_watchers_mutex);
3002         mutex_lock(&ipmi_interfaces_mutex);
3003         intf->intf_num = -1;
3004         intf->in_shutdown = true;
3005         list_del_rcu(&intf->link);
3006         mutex_unlock(&ipmi_interfaces_mutex);
3007         synchronize_rcu();
3008
3009         cleanup_smi_msgs(intf);
3010
3011         /* Clean up the effects of users on the lower-level software. */
3012         mutex_lock(&ipmi_interfaces_mutex);
3013         rcu_read_lock();
3014         list_for_each_entry_rcu(user, &intf->users, link) {
3015                 module_put(intf->handlers->owner);
3016                 if (intf->handlers->dec_usecount)
3017                         intf->handlers->dec_usecount(intf->send_info);
3018         }
3019         rcu_read_unlock();
3020         intf->handlers = NULL;
3021         mutex_unlock(&ipmi_interfaces_mutex);
3022
3023         remove_proc_entries(intf);
3024
3025         /*
3026          * Call all the watcher interfaces to tell them that
3027          * an interface is gone.
3028          */
3029         list_for_each_entry(w, &smi_watchers, link)
3030                 w->smi_gone(intf_num);
3031         mutex_unlock(&smi_watchers_mutex);
3032
3033         kref_put(&intf->refcount, intf_free);
3034         return 0;
3035 }
3036 EXPORT_SYMBOL(ipmi_unregister_smi);
3037
3038 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3039                                    struct ipmi_smi_msg *msg)
3040 {
3041         struct ipmi_ipmb_addr ipmb_addr;
3042         struct ipmi_recv_msg  *recv_msg;
3043
3044         /*
3045          * This is 11, not 10, because the response must contain a
3046          * completion code.
3047          */
3048         if (msg->rsp_size < 11) {
3049                 /* Message not big enough, just ignore it. */
3050                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3051                 return 0;
3052         }
3053
3054         if (msg->rsp[2] != 0) {
3055                 /* An error getting the response, just ignore it. */
3056                 return 0;
3057         }
3058
3059         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3060         ipmb_addr.slave_addr = msg->rsp[6];
3061         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3062         ipmb_addr.lun = msg->rsp[7] & 3;
3063
3064         /*
3065          * It's a response from a remote entity.  Look up the sequence
3066          * number and handle the response.
3067          */
3068         if (intf_find_seq(intf,
3069                           msg->rsp[7] >> 2,
3070                           msg->rsp[3] & 0x0f,
3071                           msg->rsp[8],
3072                           (msg->rsp[4] >> 2) & (~1),
3073                           (struct ipmi_addr *) &(ipmb_addr),
3074                           &recv_msg)) {
3075                 /*
3076                  * We were unable to find the sequence number,
3077                  * so just nuke the message.
3078                  */
3079                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3080                 return 0;
3081         }
3082
3083         memcpy(recv_msg->msg_data,
3084                &(msg->rsp[9]),
3085                msg->rsp_size - 9);
3086         /*
3087          * The other fields matched, so no need to set them, except
3088          * for netfn, which needs to be the response that was
3089          * returned, not the request value.
3090          */
3091         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3092         recv_msg->msg.data = recv_msg->msg_data;
3093         recv_msg->msg.data_len = msg->rsp_size - 10;
3094         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3095         ipmi_inc_stat(intf, handled_ipmb_responses);
3096         deliver_response(recv_msg);
3097
3098         return 0;
3099 }
3100
3101 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3102                                    struct ipmi_smi_msg *msg)
3103 {
3104         struct cmd_rcvr          *rcvr;
3105         int                      rv = 0;
3106         unsigned char            netfn;
3107         unsigned char            cmd;
3108         unsigned char            chan;
3109         ipmi_user_t              user = NULL;
3110         struct ipmi_ipmb_addr    *ipmb_addr;
3111         struct ipmi_recv_msg     *recv_msg;
3112
3113         if (msg->rsp_size < 10) {
3114                 /* Message not big enough, just ignore it. */
3115                 ipmi_inc_stat(intf, invalid_commands);
3116                 return 0;
3117         }
3118
3119         if (msg->rsp[2] != 0) {
3120                 /* An error getting the response, just ignore it. */
3121                 return 0;
3122         }
3123
3124         netfn = msg->rsp[4] >> 2;
3125         cmd = msg->rsp[8];
3126         chan = msg->rsp[3] & 0xf;
3127
3128         rcu_read_lock();
3129         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3130         if (rcvr) {
3131                 user = rcvr->user;
3132                 kref_get(&user->refcount);
3133         } else
3134                 user = NULL;
3135         rcu_read_unlock();
3136
3137         if (user == NULL) {
3138                 /* We didn't find a user, deliver an error response. */
3139                 ipmi_inc_stat(intf, unhandled_commands);
3140
3141                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3142                 msg->data[1] = IPMI_SEND_MSG_CMD;
3143                 msg->data[2] = msg->rsp[3];
3144                 msg->data[3] = msg->rsp[6];
3145                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3146                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3147                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3148                 /* rqseq/lun */
3149                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3150                 msg->data[8] = msg->rsp[8]; /* cmd */
3151                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3152                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3153                 msg->data_size = 11;
3154
3155 #ifdef DEBUG_MSGING
3156         {
3157                 int m;
3158                 printk("Invalid command:");
3159                 for (m = 0; m < msg->data_size; m++)
3160                         printk(" %2.2x", msg->data[m]);
3161                 printk("\n");
3162         }
3163 #endif
3164                 rcu_read_lock();
3165                 if (!intf->in_shutdown) {
3166                         smi_send(intf, intf->handlers, msg, 0);
3167                         /*
3168                          * We used the message, so return the value
3169                          * that causes it to not be freed or
3170                          * queued.
3171                          */
3172                         rv = -1;
3173                 }
3174                 rcu_read_unlock();
3175         } else {
3176                 /* Deliver the message to the user. */
3177                 ipmi_inc_stat(intf, handled_commands);
3178
3179                 recv_msg = ipmi_alloc_recv_msg();
3180                 if (!recv_msg) {
3181                         /*
3182                          * We couldn't allocate memory for the
3183                          * message, so requeue it for handling
3184                          * later.
3185                          */
3186                         rv = 1;
3187                         kref_put(&user->refcount, free_user);
3188                 } else {
3189                         /* Extract the source address from the data. */
3190                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3191                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3192                         ipmb_addr->slave_addr = msg->rsp[6];
3193                         ipmb_addr->lun = msg->rsp[7] & 3;
3194                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3195
3196                         /*
3197                          * Extract the rest of the message information
3198                          * from the IPMB header.
3199                          */
3200                         recv_msg->user = user;
3201                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3202                         recv_msg->msgid = msg->rsp[7] >> 2;
3203                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3204                         recv_msg->msg.cmd = msg->rsp[8];
3205                         recv_msg->msg.data = recv_msg->msg_data;
3206
3207                         /*
3208                          * We chop off 10, not 9 bytes because the checksum
3209                          * at the end also needs to be removed.
3210                          */
3211                         recv_msg->msg.data_len = msg->rsp_size - 10;
3212                         memcpy(recv_msg->msg_data,
3213                                &(msg->rsp[9]),
3214                                msg->rsp_size - 10);
3215                         deliver_response(recv_msg);
3216                 }
3217         }
3218
3219         return rv;
3220 }
3221
3222 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3223                                   struct ipmi_smi_msg *msg)
3224 {
3225         struct ipmi_lan_addr  lan_addr;
3226         struct ipmi_recv_msg  *recv_msg;
3227
3228
3229         /*
3230          * This is 13, not 12, because the response must contain a
3231          * completion code.
3232          */
3233         if (msg->rsp_size < 13) {
3234                 /* Message not big enough, just ignore it. */
3235                 ipmi_inc_stat(intf, invalid_lan_responses);
3236                 return 0;
3237         }
3238
3239         if (msg->rsp[2] != 0) {
3240                 /* An error getting the response, just ignore it. */
3241                 return 0;
3242         }
3243
3244         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3245         lan_addr.session_handle = msg->rsp[4];
3246         lan_addr.remote_SWID = msg->rsp[8];
3247         lan_addr.local_SWID = msg->rsp[5];
3248         lan_addr.channel = msg->rsp[3] & 0x0f;
3249         lan_addr.privilege = msg->rsp[3] >> 4;
3250         lan_addr.lun = msg->rsp[9] & 3;
3251
3252         /*
3253          * It's a response from a remote entity.  Look up the sequence
3254          * number and handle the response.
3255          */
3256         if (intf_find_seq(intf,
3257                           msg->rsp[9] >> 2,
3258                           msg->rsp[3] & 0x0f,
3259                           msg->rsp[10],
3260                           (msg->rsp[6] >> 2) & (~1),
3261                           (struct ipmi_addr *) &(lan_addr),
3262                           &recv_msg)) {
3263                 /*
3264                  * We were unable to find the sequence number,
3265                  * so just nuke the message.
3266                  */
3267                 ipmi_inc_stat(intf, unhandled_lan_responses);
3268                 return 0;
3269         }
3270
3271         memcpy(recv_msg->msg_data,
3272                &(msg->rsp[11]),
3273                msg->rsp_size - 11);
3274         /*
3275          * The other fields matched, so no need to set them, except
3276          * for netfn, which needs to be the response that was
3277          * returned, not the request value.
3278          */
3279         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3280         recv_msg->msg.data = recv_msg->msg_data;
3281         recv_msg->msg.data_len = msg->rsp_size - 12;
3282         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3283         ipmi_inc_stat(intf, handled_lan_responses);
3284         deliver_response(recv_msg);
3285
3286         return 0;
3287 }
3288
3289 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3290                                   struct ipmi_smi_msg *msg)
3291 {
3292         struct cmd_rcvr          *rcvr;
3293         int                      rv = 0;
3294         unsigned char            netfn;
3295         unsigned char            cmd;
3296         unsigned char            chan;
3297         ipmi_user_t              user = NULL;
3298         struct ipmi_lan_addr     *lan_addr;
3299         struct ipmi_recv_msg     *recv_msg;
3300
3301         if (msg->rsp_size < 12) {
3302                 /* Message not big enough, just ignore it. */
3303                 ipmi_inc_stat(intf, invalid_commands);
3304                 return 0;
3305         }
3306
3307         if (msg->rsp[2] != 0) {
3308                 /* An error getting the response, just ignore it. */
3309                 return 0;
3310         }
3311
3312         netfn = msg->rsp[6] >> 2;
3313         cmd = msg->rsp[10];
3314         chan = msg->rsp[3] & 0xf;
3315
3316         rcu_read_lock();
3317         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3318         if (rcvr) {
3319                 user = rcvr->user;
3320                 kref_get(&user->refcount);
3321         } else
3322                 user = NULL;
3323         rcu_read_unlock();
3324
3325         if (user == NULL) {
3326                 /* We didn't find a user, just give up. */
3327                 ipmi_inc_stat(intf, unhandled_commands);
3328
3329                 /*
3330                  * Don't do anything with these messages, just allow
3331                  * them to be freed.
3332                  */
3333                 rv = 0;
3334         } else {
3335                 /* Deliver the message to the user. */
3336                 ipmi_inc_stat(intf, handled_commands);
3337
3338                 recv_msg = ipmi_alloc_recv_msg();
3339                 if (!recv_msg) {
3340                         /*
3341                          * We couldn't allocate memory for the
3342                          * message, so requeue it for handling later.
3343                          */
3344                         rv = 1;
3345                         kref_put(&user->refcount, free_user);
3346                 } else {
3347                         /* Extract the source address from the data. */
3348                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3349                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3350                         lan_addr->session_handle = msg->rsp[4];
3351                         lan_addr->remote_SWID = msg->rsp[8];
3352                         lan_addr->local_SWID = msg->rsp[5];
3353                         lan_addr->lun = msg->rsp[9] & 3;
3354                         lan_addr->channel = msg->rsp[3] & 0xf;
3355                         lan_addr->privilege = msg->rsp[3] >> 4;
3356
3357                         /*
3358                          * Extract the rest of the message information
3359                          * from the IPMB header.
3360                          */
3361                         recv_msg->user = user;
3362                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3363                         recv_msg->msgid = msg->rsp[9] >> 2;
3364                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3365                         recv_msg->msg.cmd = msg->rsp[10];
3366                         recv_msg->msg.data = recv_msg->msg_data;
3367
3368                         /*
3369                          * We chop off 12, not 11 bytes because the checksum
3370                          * at the end also needs to be removed.
3371                          */
3372                         recv_msg->msg.data_len = msg->rsp_size - 12;
3373                         memcpy(recv_msg->msg_data,
3374                                &(msg->rsp[11]),
3375                                msg->rsp_size - 12);
3376                         deliver_response(recv_msg);
3377                 }
3378         }
3379
3380         return rv;
3381 }
3382
3383 /*
3384  * This routine will handle "Get Message" command responses with
3385  * channels that use an OEM Medium. The message format belongs to
3386  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3387  * Chapter 22, sections 22.6 and 22.24 for more details.
3388  */
3389 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3390                                   struct ipmi_smi_msg *msg)
3391 {
3392         struct cmd_rcvr       *rcvr;
3393         int                   rv = 0;
3394         unsigned char         netfn;
3395         unsigned char         cmd;
3396         unsigned char         chan;
3397         ipmi_user_t           user = NULL;
3398         struct ipmi_system_interface_addr *smi_addr;
3399         struct ipmi_recv_msg  *recv_msg;
3400
3401         /*
3402          * We expect the OEM SW to perform error checking
3403          * so we just do some basic sanity checks
3404          */
3405         if (msg->rsp_size < 4) {
3406                 /* Message not big enough, just ignore it. */
3407                 ipmi_inc_stat(intf, invalid_commands);
3408                 return 0;
3409         }
3410
3411         if (msg->rsp[2] != 0) {
3412                 /* An error getting the response, just ignore it. */
3413                 return 0;
3414         }
3415
3416         /*
3417          * This is an OEM Message so the OEM needs to know how
3418          * handle the message. We do no interpretation.
3419          */
3420         netfn = msg->rsp[0] >> 2;
3421         cmd = msg->rsp[1];
3422         chan = msg->rsp[3] & 0xf;
3423
3424         rcu_read_lock();
3425         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3426         if (rcvr) {
3427                 user = rcvr->user;
3428                 kref_get(&user->refcount);
3429         } else
3430                 user = NULL;
3431         rcu_read_unlock();
3432
3433         if (user == NULL) {
3434                 /* We didn't find a user, just give up. */
3435                 ipmi_inc_stat(intf, unhandled_commands);
3436
3437                 /*
3438                  * Don't do anything with these messages, just allow
3439                  * them to be freed.
3440                  */
3441
3442                 rv = 0;
3443         } else {
3444                 /* Deliver the message to the user. */
3445                 ipmi_inc_stat(intf, handled_commands);
3446
3447                 recv_msg = ipmi_alloc_recv_msg();
3448                 if (!recv_msg) {
3449                         /*
3450                          * We couldn't allocate memory for the
3451                          * message, so requeue it for handling
3452                          * later.
3453                          */
3454                         rv = 1;
3455                         kref_put(&user->refcount, free_user);
3456                 } else {
3457                         /*
3458                          * OEM Messages are expected to be delivered via
3459                          * the system interface to SMS software.  We might
3460                          * need to visit this again depending on OEM
3461                          * requirements
3462                          */
3463                         smi_addr = ((struct ipmi_system_interface_addr *)
3464                                     &(recv_msg->addr));
3465                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3466                         smi_addr->channel = IPMI_BMC_CHANNEL;
3467                         smi_addr->lun = msg->rsp[0] & 3;
3468
3469                         recv_msg->user = user;
3470                         recv_msg->user_msg_data = NULL;
3471                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3472                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3473                         recv_msg->msg.cmd = msg->rsp[1];
3474                         recv_msg->msg.data = recv_msg->msg_data;
3475
3476                         /*
3477                          * The message starts at byte 4 which follows the
3478                          * the Channel Byte in the "GET MESSAGE" command
3479                          */
3480                         recv_msg->msg.data_len = msg->rsp_size - 4;
3481                         memcpy(recv_msg->msg_data,
3482                                &(msg->rsp[4]),
3483                                msg->rsp_size - 4);
3484                         deliver_response(recv_msg);
3485                 }
3486         }
3487
3488         return rv;
3489 }
3490
3491 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3492                                      struct ipmi_smi_msg  *msg)
3493 {
3494         struct ipmi_system_interface_addr *smi_addr;
3495
3496         recv_msg->msgid = 0;
3497         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3498         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3499         smi_addr->channel = IPMI_BMC_CHANNEL;
3500         smi_addr->lun = msg->rsp[0] & 3;
3501         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3502         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3503         recv_msg->msg.cmd = msg->rsp[1];
3504         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3505         recv_msg->msg.data = recv_msg->msg_data;
3506         recv_msg->msg.data_len = msg->rsp_size - 3;
3507 }
3508
3509 static int handle_read_event_rsp(ipmi_smi_t          intf,
3510                                  struct ipmi_smi_msg *msg)
3511 {
3512         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3513         struct list_head     msgs;
3514         ipmi_user_t          user;
3515         int                  rv = 0;
3516         int                  deliver_count = 0;
3517         unsigned long        flags;
3518
3519         if (msg->rsp_size < 19) {
3520                 /* Message is too small to be an IPMB event. */
3521                 ipmi_inc_stat(intf, invalid_events);
3522                 return 0;
3523         }
3524
3525         if (msg->rsp[2] != 0) {
3526                 /* An error getting the event, just ignore it. */
3527                 return 0;
3528         }
3529
3530         INIT_LIST_HEAD(&msgs);
3531
3532         spin_lock_irqsave(&intf->events_lock, flags);
3533
3534         ipmi_inc_stat(intf, events);
3535
3536         /*
3537          * Allocate and fill in one message for every user that is
3538          * getting events.
3539          */
3540         rcu_read_lock();
3541         list_for_each_entry_rcu(user, &intf->users, link) {
3542                 if (!user->gets_events)
3543                         continue;
3544
3545                 recv_msg = ipmi_alloc_recv_msg();
3546                 if (!recv_msg) {
3547                         rcu_read_unlock();
3548                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3549                                                  link) {
3550                                 list_del(&recv_msg->link);
3551                                 ipmi_free_recv_msg(recv_msg);
3552                         }
3553                         /*
3554                          * We couldn't allocate memory for the
3555                          * message, so requeue it for handling
3556                          * later.
3557                          */
3558                         rv = 1;
3559                         goto out;
3560                 }
3561
3562                 deliver_count++;
3563
3564                 copy_event_into_recv_msg(recv_msg, msg);
3565                 recv_msg->user = user;
3566                 kref_get(&user->refcount);
3567                 list_add_tail(&(recv_msg->link), &msgs);
3568         }
3569         rcu_read_unlock();
3570
3571         if (deliver_count) {
3572                 /* Now deliver all the messages. */
3573                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3574                         list_del(&recv_msg->link);
3575                         deliver_response(recv_msg);
3576                 }
3577         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3578                 /*
3579                  * No one to receive the message, put it in queue if there's
3580                  * not already too many things in the queue.
3581                  */
3582                 recv_msg = ipmi_alloc_recv_msg();
3583                 if (!recv_msg) {
3584                         /*
3585                          * We couldn't allocate memory for the
3586                          * message, so requeue it for handling
3587                          * later.
3588                          */
3589                         rv = 1;
3590                         goto out;
3591                 }
3592
3593                 copy_event_into_recv_msg(recv_msg, msg);
3594                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3595                 intf->waiting_events_count++;
3596         } else if (!intf->event_msg_printed) {
3597                 /*
3598                  * There's too many things in the queue, discard this
3599                  * message.
3600                  */
3601                 printk(KERN_WARNING PFX "Event queue full, discarding"
3602                        " incoming events\n");
3603                 intf->event_msg_printed = 1;
3604         }
3605
3606  out:
3607         spin_unlock_irqrestore(&(intf->events_lock), flags);
3608
3609         return rv;
3610 }
3611
3612 static int handle_bmc_rsp(ipmi_smi_t          intf,
3613                           struct ipmi_smi_msg *msg)
3614 {
3615         struct ipmi_recv_msg *recv_msg;
3616         struct ipmi_user     *user;
3617
3618         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3619         if (recv_msg == NULL) {
3620                 printk(KERN_WARNING
3621                        "IPMI message received with no owner. This\n"
3622                        "could be because of a malformed message, or\n"
3623                        "because of a hardware error.  Contact your\n"
3624                        "hardware vender for assistance\n");
3625                 return 0;
3626         }
3627
3628         user = recv_msg->user;
3629         /* Make sure the user still exists. */
3630         if (user && !user->valid) {
3631                 /* The user for the message went away, so give up. */
3632                 ipmi_inc_stat(intf, unhandled_local_responses);
3633                 ipmi_free_recv_msg(recv_msg);
3634         } else {
3635                 struct ipmi_system_interface_addr *smi_addr;
3636
3637                 ipmi_inc_stat(intf, handled_local_responses);
3638                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3639                 recv_msg->msgid = msg->msgid;
3640                 smi_addr = ((struct ipmi_system_interface_addr *)
3641                             &(recv_msg->addr));
3642                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3643                 smi_addr->channel = IPMI_BMC_CHANNEL;
3644                 smi_addr->lun = msg->rsp[0] & 3;
3645                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3646                 recv_msg->msg.cmd = msg->rsp[1];
3647                 memcpy(recv_msg->msg_data,
3648                        &(msg->rsp[2]),
3649                        msg->rsp_size - 2);
3650                 recv_msg->msg.data = recv_msg->msg_data;
3651                 recv_msg->msg.data_len = msg->rsp_size - 2;
3652                 deliver_response(recv_msg);
3653         }
3654
3655         return 0;
3656 }
3657
3658 /*
3659  * Handle a received message.  Return 1 if the message should be requeued,
3660  * 0 if the message should be freed, or -1 if the message should not
3661  * be freed or requeued.
3662  */
3663 static int handle_one_recv_msg(ipmi_smi_t          intf,
3664                                struct ipmi_smi_msg *msg)
3665 {
3666         int requeue;
3667         int chan;
3668
3669 #ifdef DEBUG_MSGING
3670         int m;
3671         printk("Recv:");
3672         for (m = 0; m < msg->rsp_size; m++)
3673                 printk(" %2.2x", msg->rsp[m]);
3674         printk("\n");
3675 #endif
3676         if (msg->rsp_size < 2) {
3677                 /* Message is too small to be correct. */
3678                 printk(KERN_WARNING PFX "BMC returned to small a message"
3679                        " for netfn %x cmd %x, got %d bytes\n",
3680                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3681
3682                 /* Generate an error response for the message. */
3683                 msg->rsp[0] = msg->data[0] | (1 << 2);
3684                 msg->rsp[1] = msg->data[1];
3685                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3686                 msg->rsp_size = 3;
3687         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3688                    || (msg->rsp[1] != msg->data[1])) {
3689                 /*
3690                  * The NetFN and Command in the response is not even
3691                  * marginally correct.
3692                  */
3693                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3694                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3695                        (msg->data[0] >> 2) | 1, msg->data[1],
3696                        msg->rsp[0] >> 2, msg->rsp[1]);
3697
3698                 /* Generate an error response for the message. */
3699                 msg->rsp[0] = msg->data[0] | (1 << 2);
3700                 msg->rsp[1] = msg->data[1];
3701                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3702                 msg->rsp_size = 3;
3703         }
3704
3705         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3706             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3707             && (msg->user_data != NULL)) {
3708                 /*
3709                  * It's a response to a response we sent.  For this we
3710                  * deliver a send message response to the user.
3711                  */
3712                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3713
3714                 requeue = 0;
3715                 if (msg->rsp_size < 2)
3716                         /* Message is too small to be correct. */
3717                         goto out;
3718
3719                 chan = msg->data[2] & 0x0f;
3720                 if (chan >= IPMI_MAX_CHANNELS)
3721                         /* Invalid channel number */
3722                         goto out;
3723
3724                 if (!recv_msg)
3725                         goto out;
3726
3727                 /* Make sure the user still exists. */
3728                 if (!recv_msg->user || !recv_msg->user->valid)
3729                         goto out;
3730
3731                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3732                 recv_msg->msg.data = recv_msg->msg_data;
3733                 recv_msg->msg.data_len = 1;
3734                 recv_msg->msg_data[0] = msg->rsp[2];
3735                 deliver_response(recv_msg);
3736         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3737                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3738                 /* It's from the receive queue. */
3739                 chan = msg->rsp[3] & 0xf;
3740                 if (chan >= IPMI_MAX_CHANNELS) {
3741                         /* Invalid channel number */
3742                         requeue = 0;
3743                         goto out;
3744                 }
3745
3746                 /*
3747                  * We need to make sure the channels have been initialized.
3748                  * The channel_handler routine will set the "curr_channel"
3749                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3750                  * channels for this interface have been initialized.
3751                  */
3752                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3753                         requeue = 0; /* Throw the message away */
3754                         goto out;
3755                 }
3756
3757                 switch (intf->channels[chan].medium) {
3758                 case IPMI_CHANNEL_MEDIUM_IPMB:
3759                         if (msg->rsp[4] & 0x04) {
3760                                 /*
3761                                  * It's a response, so find the
3762                                  * requesting message and send it up.
3763                                  */
3764                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3765                         } else {
3766                                 /*
3767                                  * It's a command to the SMS from some other
3768                                  * entity.  Handle that.
3769                                  */
3770                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3771                         }
3772                         break;
3773
3774                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3775                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3776                         if (msg->rsp[6] & 0x04) {
3777                                 /*
3778                                  * It's a response, so find the
3779                                  * requesting message and send it up.
3780                                  */
3781                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3782                         } else {
3783                                 /*
3784                                  * It's a command to the SMS from some other
3785                                  * entity.  Handle that.
3786                                  */
3787                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3788                         }
3789                         break;
3790
3791                 default:
3792                         /* Check for OEM Channels.  Clients had better
3793                            register for these commands. */
3794                         if ((intf->channels[chan].medium
3795                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3796                             && (intf->channels[chan].medium
3797                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3798                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3799                         } else {
3800                                 /*
3801                                  * We don't handle the channel type, so just
3802                                  * free the message.
3803                                  */
3804                                 requeue = 0;
3805                         }
3806                 }
3807
3808         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3809                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3810                 /* It's an asynchronous event. */
3811                 requeue = handle_read_event_rsp(intf, msg);
3812         } else {
3813                 /* It's a response from the local BMC. */
3814                 requeue = handle_bmc_rsp(intf, msg);
3815         }
3816
3817  out:
3818         return requeue;
3819 }
3820
3821 /*
3822  * If there are messages in the queue or pretimeouts, handle them.
3823  */
3824 static void handle_new_recv_msgs(ipmi_smi_t intf)
3825 {
3826         struct ipmi_smi_msg  *smi_msg;
3827         unsigned long        flags = 0;
3828         int                  rv;
3829         int                  run_to_completion = intf->run_to_completion;
3830
3831         /* See if any waiting messages need to be processed. */
3832         if (!run_to_completion)
3833                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3834         while (!list_empty(&intf->waiting_rcv_msgs)) {
3835                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
3836                                      struct ipmi_smi_msg, link);
3837                 if (!run_to_completion)
3838                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3839                                                flags);
3840                 rv = handle_one_recv_msg(intf, smi_msg);
3841                 if (!run_to_completion)
3842                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3843                 if (rv > 0) {
3844                         /*
3845                          * To preserve message order, quit if we
3846                          * can't handle a message.
3847                          */
3848                         break;
3849                 } else {
3850                         list_del(&smi_msg->link);
3851                         if (rv == 0)
3852                                 /* Message handled */
3853                                 ipmi_free_smi_msg(smi_msg);
3854                         /* If rv < 0, fatal error, del but don't free. */
3855                 }
3856         }
3857         if (!run_to_completion)
3858                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3859
3860         /*
3861          * If the pretimout count is non-zero, decrement one from it and
3862          * deliver pretimeouts to all the users.
3863          */
3864         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3865                 ipmi_user_t user;
3866
3867                 rcu_read_lock();
3868                 list_for_each_entry_rcu(user, &intf->users, link) {
3869                         if (user->handler->ipmi_watchdog_pretimeout)
3870                                 user->handler->ipmi_watchdog_pretimeout(
3871                                         user->handler_data);
3872                 }
3873                 rcu_read_unlock();
3874         }
3875 }
3876
3877 static void smi_recv_tasklet(unsigned long val)
3878 {
3879         unsigned long flags = 0; /* keep us warning-free. */
3880         ipmi_smi_t intf = (ipmi_smi_t) val;
3881         int run_to_completion = intf->run_to_completion;
3882         struct ipmi_smi_msg *newmsg = NULL;
3883
3884         /*
3885          * Start the next message if available.
3886          *
3887          * Do this here, not in the actual receiver, because we may deadlock
3888          * because the lower layer is allowed to hold locks while calling
3889          * message delivery.
3890          */
3891         if (!run_to_completion)
3892                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3893         if (intf->curr_msg == NULL && !intf->in_shutdown) {
3894                 struct list_head *entry = NULL;
3895
3896                 /* Pick the high priority queue first. */
3897                 if (!list_empty(&intf->hp_xmit_msgs))
3898                         entry = intf->hp_xmit_msgs.next;
3899                 else if (!list_empty(&intf->xmit_msgs))
3900                         entry = intf->xmit_msgs.next;
3901
3902                 if (entry) {
3903                         list_del(entry);
3904                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
3905                         intf->curr_msg = newmsg;
3906                 }
3907         }
3908         if (!run_to_completion)
3909                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3910         if (newmsg)
3911                 intf->handlers->sender(intf->send_info, newmsg);
3912
3913         handle_new_recv_msgs(intf);
3914 }
3915
3916 /* Handle a new message from the lower layer. */
3917 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3918                            struct ipmi_smi_msg *msg)
3919 {
3920         unsigned long flags = 0; /* keep us warning-free. */
3921         int run_to_completion = intf->run_to_completion;
3922
3923         if ((msg->data_size >= 2)
3924             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3925             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3926             && (msg->user_data == NULL)) {
3927
3928                 if (intf->in_shutdown)
3929                         goto free_msg;
3930
3931                 /*
3932                  * This is the local response to a command send, start
3933                  * the timer for these.  The user_data will not be
3934                  * NULL if this is a response send, and we will let
3935                  * response sends just go through.
3936                  */
3937
3938                 /*
3939                  * Check for errors, if we get certain errors (ones
3940                  * that mean basically we can try again later), we
3941                  * ignore them and start the timer.  Otherwise we
3942                  * report the error immediately.
3943                  */
3944                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3945                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3946                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3947                     && (msg->rsp[2] != IPMI_BUS_ERR)
3948                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3949                         int chan = msg->rsp[3] & 0xf;
3950
3951                         /* Got an error sending the message, handle it. */
3952                         if (chan >= IPMI_MAX_CHANNELS)
3953                                 ; /* This shouldn't happen */
3954                         else if ((intf->channels[chan].medium
3955                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3956                                  || (intf->channels[chan].medium
3957                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3958                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3959                         else
3960                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3961                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3962                 } else
3963                         /* The message was sent, start the timer. */
3964                         intf_start_seq_timer(intf, msg->msgid);
3965
3966 free_msg:
3967                 ipmi_free_smi_msg(msg);
3968         } else {
3969                 /*
3970                  * To preserve message order, we keep a queue and deliver from
3971                  * a tasklet.
3972                  */
3973                 if (!run_to_completion)
3974                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3975                 list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
3976                 if (!run_to_completion)
3977                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3978                                                flags);
3979         }
3980
3981         if (!run_to_completion)
3982                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3983         if (msg == intf->curr_msg)
3984                 intf->curr_msg = NULL;
3985         if (!run_to_completion)
3986                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3987
3988         if (run_to_completion)
3989                 smi_recv_tasklet((unsigned long) intf);
3990         else
3991                 tasklet_schedule(&intf->recv_tasklet);
3992 }
3993 EXPORT_SYMBOL(ipmi_smi_msg_received);
3994
3995 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3996 {
3997         if (intf->in_shutdown)
3998                 return;
3999
4000         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
4001         tasklet_schedule(&intf->recv_tasklet);
4002 }
4003 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4004
4005 static struct ipmi_smi_msg *
4006 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
4007                   unsigned char seq, long seqid)
4008 {
4009         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4010         if (!smi_msg)
4011                 /*
4012                  * If we can't allocate the message, then just return, we
4013                  * get 4 retries, so this should be ok.
4014                  */
4015                 return NULL;
4016
4017         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4018         smi_msg->data_size = recv_msg->msg.data_len;
4019         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4020
4021 #ifdef DEBUG_MSGING
4022         {
4023                 int m;
4024                 printk("Resend: ");
4025                 for (m = 0; m < smi_msg->data_size; m++)
4026                         printk(" %2.2x", smi_msg->data[m]);
4027                 printk("\n");
4028         }
4029 #endif
4030         return smi_msg;
4031 }
4032
4033 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
4034                               struct list_head *timeouts, long timeout_period,
4035                               int slot, unsigned long *flags,
4036                               unsigned int *waiting_msgs)
4037 {
4038         struct ipmi_recv_msg     *msg;
4039         struct ipmi_smi_handlers *handlers;
4040
4041         if (intf->in_shutdown)
4042                 return;
4043
4044         if (!ent->inuse)
4045                 return;
4046
4047         ent->timeout -= timeout_period;
4048         if (ent->timeout > 0) {
4049                 (*waiting_msgs)++;
4050                 return;
4051         }
4052
4053         if (ent->retries_left == 0) {
4054                 /* The message has used all its retries. */
4055                 ent->inuse = 0;
4056                 msg = ent->recv_msg;
4057                 list_add_tail(&msg->link, timeouts);
4058                 if (ent->broadcast)
4059                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4060                 else if (is_lan_addr(&ent->recv_msg->addr))
4061                         ipmi_inc_stat(intf, timed_out_lan_commands);
4062                 else
4063                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4064         } else {
4065                 struct ipmi_smi_msg *smi_msg;
4066                 /* More retries, send again. */
4067
4068                 (*waiting_msgs)++;
4069
4070                 /*
4071                  * Start with the max timer, set to normal timer after
4072                  * the message is sent.
4073                  */
4074                 ent->timeout = MAX_MSG_TIMEOUT;
4075                 ent->retries_left--;
4076                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4077                                             ent->seqid);
4078                 if (!smi_msg) {
4079                         if (is_lan_addr(&ent->recv_msg->addr))
4080                                 ipmi_inc_stat(intf,
4081                                               dropped_rexmit_lan_commands);
4082                         else
4083                                 ipmi_inc_stat(intf,
4084                                               dropped_rexmit_ipmb_commands);
4085                         return;
4086                 }
4087
4088                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4089
4090                 /*
4091                  * Send the new message.  We send with a zero
4092                  * priority.  It timed out, I doubt time is that
4093                  * critical now, and high priority messages are really
4094                  * only for messages to the local MC, which don't get
4095                  * resent.
4096                  */
4097                 handlers = intf->handlers;
4098                 if (handlers) {
4099                         if (is_lan_addr(&ent->recv_msg->addr))
4100                                 ipmi_inc_stat(intf,
4101                                               retransmitted_lan_commands);
4102                         else
4103                                 ipmi_inc_stat(intf,
4104                                               retransmitted_ipmb_commands);
4105
4106                         smi_send(intf, intf->handlers, smi_msg, 0);
4107                 } else
4108                         ipmi_free_smi_msg(smi_msg);
4109
4110                 spin_lock_irqsave(&intf->seq_lock, *flags);
4111         }
4112 }
4113
4114 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
4115 {
4116         struct list_head     timeouts;
4117         struct ipmi_recv_msg *msg, *msg2;
4118         unsigned long        flags;
4119         int                  i;
4120         unsigned int         waiting_msgs = 0;
4121
4122         /*
4123          * Go through the seq table and find any messages that
4124          * have timed out, putting them in the timeouts
4125          * list.
4126          */
4127         INIT_LIST_HEAD(&timeouts);
4128         spin_lock_irqsave(&intf->seq_lock, flags);
4129         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4130                 check_msg_timeout(intf, &(intf->seq_table[i]),
4131                                   &timeouts, timeout_period, i,
4132                                   &flags, &waiting_msgs);
4133         spin_unlock_irqrestore(&intf->seq_lock, flags);
4134
4135         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4136                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4137
4138         /*
4139          * Maintenance mode handling.  Check the timeout
4140          * optimistically before we claim the lock.  It may
4141          * mean a timeout gets missed occasionally, but that
4142          * only means the timeout gets extended by one period
4143          * in that case.  No big deal, and it avoids the lock
4144          * most of the time.
4145          */
4146         if (intf->auto_maintenance_timeout > 0) {
4147                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4148                 if (intf->auto_maintenance_timeout > 0) {
4149                         intf->auto_maintenance_timeout
4150                                 -= timeout_period;
4151                         if (!intf->maintenance_mode
4152                             && (intf->auto_maintenance_timeout <= 0)) {
4153                                 intf->maintenance_mode_enable = false;
4154                                 maintenance_mode_update(intf);
4155                         }
4156                 }
4157                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4158                                        flags);
4159         }
4160
4161         tasklet_schedule(&intf->recv_tasklet);
4162
4163         return waiting_msgs;
4164 }
4165
4166 static void ipmi_request_event(ipmi_smi_t intf)
4167 {
4168         /* No event requests when in maintenance mode. */
4169         if (intf->maintenance_mode_enable)
4170                 return;
4171
4172         if (!intf->in_shutdown)
4173                 intf->handlers->request_events(intf->send_info);
4174 }
4175
4176 static struct timer_list ipmi_timer;
4177
4178 static atomic_t stop_operation;
4179
4180 static void ipmi_timeout(unsigned long data)
4181 {
4182         ipmi_smi_t intf;
4183         int nt = 0;
4184
4185         if (atomic_read(&stop_operation))
4186                 return;
4187
4188         rcu_read_lock();
4189         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4190                 int lnt = 0;
4191
4192                 if (atomic_read(&intf->event_waiters)) {
4193                         intf->ticks_to_req_ev--;
4194                         if (intf->ticks_to_req_ev == 0) {
4195                                 ipmi_request_event(intf);
4196                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4197                         }
4198                         lnt++;
4199                 }
4200
4201                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4202
4203                 lnt = !!lnt;
4204                 if (lnt != intf->last_needs_timer &&
4205                                         intf->handlers->set_need_watch)
4206                         intf->handlers->set_need_watch(intf->send_info, lnt);
4207                 intf->last_needs_timer = lnt;
4208
4209                 nt += lnt;
4210         }
4211         rcu_read_unlock();
4212
4213         if (nt)
4214                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4215 }
4216
4217 static void need_waiter(ipmi_smi_t intf)
4218 {
4219         /* Racy, but worst case we start the timer twice. */
4220         if (!timer_pending(&ipmi_timer))
4221                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4222 }
4223
4224 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4225 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4226
4227 /* FIXME - convert these to slabs. */
4228 static void free_smi_msg(struct ipmi_smi_msg *msg)
4229 {
4230         atomic_dec(&smi_msg_inuse_count);
4231         kfree(msg);
4232 }
4233
4234 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4235 {
4236         struct ipmi_smi_msg *rv;
4237         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4238         if (rv) {
4239                 rv->done = free_smi_msg;
4240                 rv->user_data = NULL;
4241                 atomic_inc(&smi_msg_inuse_count);
4242         }
4243         return rv;
4244 }
4245 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4246
4247 static void free_recv_msg(struct ipmi_recv_msg *msg)
4248 {
4249         atomic_dec(&recv_msg_inuse_count);
4250         kfree(msg);
4251 }
4252
4253 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4254 {
4255         struct ipmi_recv_msg *rv;
4256
4257         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4258         if (rv) {
4259                 rv->user = NULL;
4260                 rv->done = free_recv_msg;
4261                 atomic_inc(&recv_msg_inuse_count);
4262         }
4263         return rv;
4264 }
4265
4266 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4267 {
4268         if (msg->user)
4269                 kref_put(&msg->user->refcount, free_user);
4270         msg->done(msg);
4271 }
4272 EXPORT_SYMBOL(ipmi_free_recv_msg);
4273
4274 #ifdef CONFIG_IPMI_PANIC_EVENT
4275
4276 static atomic_t panic_done_count = ATOMIC_INIT(0);
4277
4278 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4279 {
4280         atomic_dec(&panic_done_count);
4281 }
4282
4283 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4284 {
4285         atomic_dec(&panic_done_count);
4286 }
4287
4288 /*
4289  * Inside a panic, send a message and wait for a response.
4290  */
4291 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4292                                         struct ipmi_addr     *addr,
4293                                         struct kernel_ipmi_msg *msg)
4294 {
4295         struct ipmi_smi_msg  smi_msg;
4296         struct ipmi_recv_msg recv_msg;
4297         int rv;
4298
4299         smi_msg.done = dummy_smi_done_handler;
4300         recv_msg.done = dummy_recv_done_handler;
4301         atomic_add(2, &panic_done_count);
4302         rv = i_ipmi_request(NULL,
4303                             intf,
4304                             addr,
4305                             0,
4306                             msg,
4307                             intf,
4308                             &smi_msg,
4309                             &recv_msg,
4310                             0,
4311                             intf->channels[0].address,
4312                             intf->channels[0].lun,
4313                             0, 1); /* Don't retry, and don't wait. */
4314         if (rv)
4315                 atomic_sub(2, &panic_done_count);
4316         while (atomic_read(&panic_done_count) != 0)
4317                 ipmi_poll(intf);
4318 }
4319
4320 #ifdef CONFIG_IPMI_PANIC_STRING
4321 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4322 {
4323         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4324             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4325             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4326             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4327                 /* A get event receiver command, save it. */
4328                 intf->event_receiver = msg->msg.data[1];
4329                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4330         }
4331 }
4332
4333 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4334 {
4335         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4336             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4337             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4338             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4339                 /*
4340                  * A get device id command, save if we are an event
4341                  * receiver or generator.
4342                  */
4343                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4344                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4345         }
4346 }
4347 #endif
4348
4349 static void send_panic_events(char *str)
4350 {
4351         struct kernel_ipmi_msg            msg;
4352         ipmi_smi_t                        intf;
4353         unsigned char                     data[16];
4354         struct ipmi_system_interface_addr *si;
4355         struct ipmi_addr                  addr;
4356
4357         si = (struct ipmi_system_interface_addr *) &addr;
4358         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4359         si->channel = IPMI_BMC_CHANNEL;
4360         si->lun = 0;
4361
4362         /* Fill in an event telling that we have failed. */
4363         msg.netfn = 0x04; /* Sensor or Event. */
4364         msg.cmd = 2; /* Platform event command. */
4365         msg.data = data;
4366         msg.data_len = 8;
4367         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4368         data[1] = 0x03; /* This is for IPMI 1.0. */
4369         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4370         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4371         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4372
4373         /*
4374          * Put a few breadcrumbs in.  Hopefully later we can add more things
4375          * to make the panic events more useful.
4376          */
4377         if (str) {
4378                 data[3] = str[0];
4379                 data[6] = str[1];
4380                 data[7] = str[2];
4381         }
4382
4383         /* For every registered interface, send the event. */
4384         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4385                 if (!intf->handlers)
4386                         /* Interface is not ready. */
4387                         continue;
4388
4389                 intf->run_to_completion = 1;
4390                 /* Send the event announcing the panic. */
4391                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4392                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4393         }
4394
4395 #ifdef CONFIG_IPMI_PANIC_STRING
4396         /*
4397          * On every interface, dump a bunch of OEM event holding the
4398          * string.
4399          */
4400         if (!str)
4401                 return;
4402
4403         /* For every registered interface, send the event. */
4404         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4405                 char                  *p = str;
4406                 struct ipmi_ipmb_addr *ipmb;
4407                 int                   j;
4408
4409                 if (intf->intf_num == -1)
4410                         /* Interface was not ready yet. */
4411                         continue;
4412
4413                 /*
4414                  * intf_num is used as an marker to tell if the
4415                  * interface is valid.  Thus we need a read barrier to
4416                  * make sure data fetched before checking intf_num
4417                  * won't be used.
4418                  */
4419                 smp_rmb();
4420
4421                 /*
4422                  * First job here is to figure out where to send the
4423                  * OEM events.  There's no way in IPMI to send OEM
4424                  * events using an event send command, so we have to
4425                  * find the SEL to put them in and stick them in
4426                  * there.
4427                  */
4428
4429                 /* Get capabilities from the get device id. */
4430                 intf->local_sel_device = 0;
4431                 intf->local_event_generator = 0;
4432                 intf->event_receiver = 0;
4433
4434                 /* Request the device info from the local MC. */
4435                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4436                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4437                 msg.data = NULL;
4438                 msg.data_len = 0;
4439                 intf->null_user_handler = device_id_fetcher;
4440                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4441
4442                 if (intf->local_event_generator) {
4443                         /* Request the event receiver from the local MC. */
4444                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4445                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4446                         msg.data = NULL;
4447                         msg.data_len = 0;
4448                         intf->null_user_handler = event_receiver_fetcher;
4449                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4450                 }
4451                 intf->null_user_handler = NULL;
4452
4453                 /*
4454                  * Validate the event receiver.  The low bit must not
4455                  * be 1 (it must be a valid IPMB address), it cannot
4456                  * be zero, and it must not be my address.
4457                  */
4458                 if (((intf->event_receiver & 1) == 0)
4459                     && (intf->event_receiver != 0)
4460                     && (intf->event_receiver != intf->channels[0].address)) {
4461                         /*
4462                          * The event receiver is valid, send an IPMB
4463                          * message.
4464                          */
4465                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4466                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4467                         ipmb->channel = 0; /* FIXME - is this right? */
4468                         ipmb->lun = intf->event_receiver_lun;
4469                         ipmb->slave_addr = intf->event_receiver;
4470                 } else if (intf->local_sel_device) {
4471                         /*
4472                          * The event receiver was not valid (or was
4473                          * me), but I am an SEL device, just dump it
4474                          * in my SEL.
4475                          */
4476                         si = (struct ipmi_system_interface_addr *) &addr;
4477                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4478                         si->channel = IPMI_BMC_CHANNEL;
4479                         si->lun = 0;
4480                 } else
4481                         continue; /* No where to send the event. */
4482
4483                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4484                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4485                 msg.data = data;
4486                 msg.data_len = 16;
4487
4488                 j = 0;
4489                 while (*p) {
4490                         int size = strlen(p);
4491
4492                         if (size > 11)
4493                                 size = 11;
4494                         data[0] = 0;
4495                         data[1] = 0;
4496                         data[2] = 0xf0; /* OEM event without timestamp. */
4497                         data[3] = intf->channels[0].address;
4498                         data[4] = j++; /* sequence # */
4499                         /*
4500                          * Always give 11 bytes, so strncpy will fill
4501                          * it with zeroes for me.
4502                          */
4503                         strncpy(data+5, p, 11);
4504                         p += size;
4505
4506                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4507                 }
4508         }
4509 #endif /* CONFIG_IPMI_PANIC_STRING */
4510 }
4511 #endif /* CONFIG_IPMI_PANIC_EVENT */
4512
4513 static int has_panicked;
4514
4515 static int panic_event(struct notifier_block *this,
4516                        unsigned long         event,
4517                        void                  *ptr)
4518 {
4519         ipmi_smi_t intf;
4520
4521         if (has_panicked)
4522                 return NOTIFY_DONE;
4523         has_panicked = 1;
4524
4525         /* For every registered interface, set it to run to completion. */
4526         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4527                 if (!intf->handlers)
4528                         /* Interface is not ready. */
4529                         continue;
4530
4531                 intf->run_to_completion = 1;
4532                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4533         }
4534
4535 #ifdef CONFIG_IPMI_PANIC_EVENT
4536         send_panic_events(ptr);
4537 #endif
4538
4539         return NOTIFY_DONE;
4540 }
4541
4542 static struct notifier_block panic_block = {
4543         .notifier_call  = panic_event,
4544         .next           = NULL,
4545         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4546 };
4547
4548 static int ipmi_init_msghandler(void)
4549 {
4550         int rv;
4551
4552         if (initialized)
4553                 return 0;
4554
4555         rv = driver_register(&ipmidriver.driver);
4556         if (rv) {
4557                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4558                 return rv;
4559         }
4560
4561         printk(KERN_INFO "ipmi message handler version "
4562                IPMI_DRIVER_VERSION "\n");
4563
4564 #ifdef CONFIG_PROC_FS
4565         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4566         if (!proc_ipmi_root) {
4567             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4568             driver_unregister(&ipmidriver.driver);
4569             return -ENOMEM;
4570         }
4571
4572 #endif /* CONFIG_PROC_FS */
4573
4574         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4575         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4576
4577         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4578
4579         initialized = 1;
4580
4581         return 0;
4582 }
4583
4584 static int __init ipmi_init_msghandler_mod(void)
4585 {
4586         ipmi_init_msghandler();
4587         return 0;
4588 }
4589
4590 static void __exit cleanup_ipmi(void)
4591 {
4592         int count;
4593
4594         if (!initialized)
4595                 return;
4596
4597         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4598
4599         /*
4600          * This can't be called if any interfaces exist, so no worry
4601          * about shutting down the interfaces.
4602          */
4603
4604         /*
4605          * Tell the timer to stop, then wait for it to stop.  This
4606          * avoids problems with race conditions removing the timer
4607          * here.
4608          */
4609         atomic_inc(&stop_operation);
4610         del_timer_sync(&ipmi_timer);
4611
4612 #ifdef CONFIG_PROC_FS
4613         proc_remove(proc_ipmi_root);
4614 #endif /* CONFIG_PROC_FS */
4615
4616         driver_unregister(&ipmidriver.driver);
4617
4618         initialized = 0;
4619
4620         /* Check for buffer leaks. */
4621         count = atomic_read(&smi_msg_inuse_count);
4622         if (count != 0)
4623                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4624                        count);
4625         count = atomic_read(&recv_msg_inuse_count);
4626         if (count != 0)
4627                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4628                        count);
4629 }
4630 module_exit(cleanup_ipmi);
4631
4632 module_init(ipmi_init_msghandler_mod);
4633 MODULE_LICENSE("GPL");
4634 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4635 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4636                    " interface.");
4637 MODULE_VERSION(IPMI_DRIVER_VERSION);