drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <asm/system.h>
  37 #include <linux/poll.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/mutex.h>
  40 #include <linux/slab.h>
  41 #include <linux/ipmi.h>
  42 #include <linux/ipmi_smi.h>
  43 #include <linux/notifier.h>
  44 #include <linux/init.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/rcupdate.h>
  47
  48 #define PFX "IPMI message handler: "
  49
  50 #define IPMI_DRIVER_VERSION "39.2"
  51
  52 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  53 static int ipmi_init_msghandler(void);
  54
  55 static int initialized;
  56
  57 #ifdef CONFIG_PROC_FS
  58 static struct proc_dir_entry *proc_ipmi_root;
  59 #endif /* CONFIG_PROC_FS */
  60
  61 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  62 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  63
  64 #define MAX_EVENTS_IN_QUEUE     25
  65
  66 /*
  67  * Don't let a message sit in a queue forever, always time it with at lest
  68  * the max message timer.  This is in milliseconds.
  69  */
  70 #define MAX_MSG_TIMEOUT         60000
  71
  72 /*
  73  * The main "user" data structure.
  74  */
  75 struct ipmi_user {
  76         struct list_head link;
  77
  78         /* Set to "0" when the user is destroyed. */
  79         int valid;
  80
  81         struct kref refcount;
  82
  83         /* The upper layer that handles receive messages. */
  84         struct ipmi_user_hndl *handler;
  85         void             *handler_data;
  86
  87         /* The interface this user is bound to. */
  88         ipmi_smi_t intf;
  89
  90         /* Does this interface receive IPMI events? */
  91         int gets_events;
  92 };
  93
  94 struct cmd_rcvr {
  95         struct list_head link;
  96
  97         ipmi_user_t   user;
  98         unsigned char netfn;
  99         unsigned char cmd;
 100         unsigned int  chans;
 101
 102         /*
 103          * This is used to form a linked lised during mass deletion.
 104          * Since this is in an RCU list, we cannot use the link above
 105          * or change any data until the RCU period completes.  So we
 106          * use this next variable during mass deletion so we can have
 107          * a list and don't have to wait and restart the search on
 108          * every individual deletion of a command.
 109          */
 110         struct cmd_rcvr *next;
 111 };
 112
 113 struct seq_table {
 114         unsigned int         inuse : 1;
 115         unsigned int         broadcast : 1;
 116
 117         unsigned long        timeout;
 118         unsigned long        orig_timeout;
 119         unsigned int         retries_left;
 120
 121         /*
 122          * To verify on an incoming send message response that this is
 123          * the message that the response is for, we keep a sequence id
 124          * and increment it every time we send a message.
 125          */
 126         long                 seqid;
 127
 128         /*
 129          * This is held so we can properly respond to the message on a
 130          * timeout, and it is used to hold the temporary data for
 131          * retransmission, too.
 132          */
 133         struct ipmi_recv_msg *recv_msg;
 134 };
 135
 136 /*
 137  * Store the information in a msgid (long) to allow us to find a
 138  * sequence table entry from the msgid.
 139  */
 140 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 141
 142 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 143         do {                                                            \
 144                 seq = ((msgid >> 26) & 0x3f);                           \
 145                 seqid = (msgid & 0x3fffff);                             \
 146         } while (0)
 147
 148 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 149
 150 struct ipmi_channel {
 151         unsigned char medium;
 152         unsigned char protocol;
 153
 154         /*
 155          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 156          * but may be changed by the user.
 157          */
 158         unsigned char address;
 159
 160         /*
 161          * My LUN.  This should generally stay the SMS LUN, but just in
 162          * case...
 163          */
 164         unsigned char lun;
 165 };
 166
 167 #ifdef CONFIG_PROC_FS
 168 struct ipmi_proc_entry {
 169         char                   *name;
 170         struct ipmi_proc_entry *next;
 171 };
 172 #endif
 173
 174 struct bmc_device {
 175         struct platform_device *dev;
 176         struct ipmi_device_id  id;
 177         unsigned char          guid[16];
 178         int                    guid_set;
 179
 180         struct kref            refcount;
 181
 182         /* bmc device attributes */
 183         struct device_attribute device_id_attr;
 184         struct device_attribute provides_dev_sdrs_attr;
 185         struct device_attribute revision_attr;
 186         struct device_attribute firmware_rev_attr;
 187         struct device_attribute version_attr;
 188         struct device_attribute add_dev_support_attr;
 189         struct device_attribute manufacturer_id_attr;
 190         struct device_attribute product_id_attr;
 191         struct device_attribute guid_attr;
 192         struct device_attribute aux_firmware_rev_attr;
 193 };
 194
 195 /*
 196  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 197  * structure.
 198  */
 199 enum ipmi_stat_indexes {
 200         /* Commands we got from the user that were invalid. */
 201         IPMI_STAT_sent_invalid_commands = 0,
 202
 203         /* Commands we sent to the MC. */
 204         IPMI_STAT_sent_local_commands,
 205
 206         /* Responses from the MC that were delivered to a user. */
 207         IPMI_STAT_handled_local_responses,
 208
 209         /* Responses from the MC that were not delivered to a user. */
 210         IPMI_STAT_unhandled_local_responses,
 211
 212         /* Commands we sent out to the IPMB bus. */
 213         IPMI_STAT_sent_ipmb_commands,
 214
 215         /* Commands sent on the IPMB that had errors on the SEND CMD */
 216         IPMI_STAT_sent_ipmb_command_errs,
 217
 218         /* Each retransmit increments this count. */
 219         IPMI_STAT_retransmitted_ipmb_commands,
 220
 221         /*
 222          * When a message times out (runs out of retransmits) this is
 223          * incremented.
 224          */
 225         IPMI_STAT_timed_out_ipmb_commands,
 226
 227         /*
 228          * This is like above, but for broadcasts.  Broadcasts are
 229          * *not* included in the above count (they are expected to
 230          * time out).
 231          */
 232         IPMI_STAT_timed_out_ipmb_broadcasts,
 233
 234         /* Responses I have sent to the IPMB bus. */
 235         IPMI_STAT_sent_ipmb_responses,
 236
 237         /* The response was delivered to the user. */
 238         IPMI_STAT_handled_ipmb_responses,
 239
 240         /* The response had invalid data in it. */
 241         IPMI_STAT_invalid_ipmb_responses,
 242
 243         /* The response didn't have anyone waiting for it. */
 244         IPMI_STAT_unhandled_ipmb_responses,
 245
 246         /* Commands we sent out to the IPMB bus. */
 247         IPMI_STAT_sent_lan_commands,
 248
 249         /* Commands sent on the IPMB that had errors on the SEND CMD */
 250         IPMI_STAT_sent_lan_command_errs,
 251
 252         /* Each retransmit increments this count. */
 253         IPMI_STAT_retransmitted_lan_commands,
 254
 255         /*
 256          * When a message times out (runs out of retransmits) this is
 257          * incremented.
 258          */
 259         IPMI_STAT_timed_out_lan_commands,
 260
 261         /* Responses I have sent to the IPMB bus. */
 262         IPMI_STAT_sent_lan_responses,
 263
 264         /* The response was delivered to the user. */
 265         IPMI_STAT_handled_lan_responses,
 266
 267         /* The response had invalid data in it. */
 268         IPMI_STAT_invalid_lan_responses,
 269
 270         /* The response didn't have anyone waiting for it. */
 271         IPMI_STAT_unhandled_lan_responses,
 272
 273         /* The command was delivered to the user. */
 274         IPMI_STAT_handled_commands,
 275
 276         /* The command had invalid data in it. */
 277         IPMI_STAT_invalid_commands,
 278
 279         /* The command didn't have anyone waiting for it. */
 280         IPMI_STAT_unhandled_commands,
 281
 282         /* Invalid data in an event. */
 283         IPMI_STAT_invalid_events,
 284
 285         /* Events that were received with the proper format. */
 286         IPMI_STAT_events,
 287
 288
 289         /* This *must* remain last, add new values above this. */
 290         IPMI_NUM_STATS
 291 };
 292
 293
 294 #define IPMI_IPMB_NUM_SEQ       64
 295 #define IPMI_MAX_CHANNELS       16
 296 struct ipmi_smi {
 297         /* What interface number are we? */
 298         int intf_num;
 299
 300         struct kref refcount;
 301
 302         /* Used for a list of interfaces. */
 303         struct list_head link;
 304
 305         /*
 306          * The list of upper layers that are using me.  seq_lock
 307          * protects this.
 308          */
 309         struct list_head users;
 310
 311         /* Information to supply to users. */
 312         unsigned char ipmi_version_major;
 313         unsigned char ipmi_version_minor;
 314
 315         /* Used for wake ups at startup. */
 316         wait_queue_head_t waitq;
 317
 318         struct bmc_device *bmc;
 319         char *my_dev_name;
 320         char *sysfs_name;
 321
 322         /*
 323          * This is the lower-layer's sender routine.  Note that you
 324          * must either be holding the ipmi_interfaces_mutex or be in
 325          * an umpreemptible region to use this.  You must fetch the
 326          * value into a local variable and make sure it is not NULL.
 327          */
 328         struct ipmi_smi_handlers *handlers;
 329         void                     *send_info;
 330
 331 #ifdef CONFIG_PROC_FS
 332         /* A list of proc entries for this interface. */
 333         struct mutex           proc_entry_lock;
 334         struct ipmi_proc_entry *proc_entries;
 335 #endif
 336
 337         /* Driver-model device for the system interface. */
 338         struct device          *si_dev;
 339
 340         /*
 341          * A table of sequence numbers for this interface.  We use the
 342          * sequence numbers for IPMB messages that go out of the
 343          * interface to match them up with their responses.  A routine
 344          * is called periodically to time the items in this list.
 345          */
 346         spinlock_t       seq_lock;
 347         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 348         int curr_seq;
 349
 350         /*
 351          * Messages that were delayed for some reason (out of memory,
 352          * for instance), will go in here to be processed later in a
 353          * periodic timer interrupt.
 354          */
 355         spinlock_t       waiting_msgs_lock;
 356         struct list_head waiting_msgs;
 357
 358         /*
 359          * The list of command receivers that are registered for commands
 360          * on this interface.
 361          */
 362         struct mutex     cmd_rcvrs_mutex;
 363         struct list_head cmd_rcvrs;
 364
 365         /*
 366          * Events that were queues because no one was there to receive
 367          * them.
 368          */
 369         spinlock_t       events_lock; /* For dealing with event stuff. */
 370         struct list_head waiting_events;
 371         unsigned int     waiting_events_count; /* How many events in queue? */
 372         char             delivering_events;
 373         char             event_msg_printed;
 374
 375         /*
 376          * The event receiver for my BMC, only really used at panic
 377          * shutdown as a place to store this.
 378          */
 379         unsigned char event_receiver;
 380         unsigned char event_receiver_lun;
 381         unsigned char local_sel_device;
 382         unsigned char local_event_generator;
 383
 384         /* For handling of maintenance mode. */
 385         int maintenance_mode;
 386         int maintenance_mode_enable;
 387         int auto_maintenance_timeout;
 388         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 389
 390         /*
 391          * A cheap hack, if this is non-null and a message to an
 392          * interface comes in with a NULL user, call this routine with
 393          * it.  Note that the message will still be freed by the
 394          * caller.  This only works on the system interface.
 395          */
 396         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 397
 398         /*
 399          * When we are scanning the channels for an SMI, this will
 400          * tell which channel we are scanning.
 401          */
 402         int curr_channel;
 403
 404         /* Channel information */
 405         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 406
 407         /* Proc FS stuff. */
 408         struct proc_dir_entry *proc_dir;
 409         char                  proc_dir_name[10];
 410
 411         atomic_t stats[IPMI_NUM_STATS];
 412
 413         /*
 414          * run_to_completion duplicate of smb_info, smi_info
 415          * and ipmi_serial_info structures. Used to decrease numbers of
 416          * parameters passed by "low" level IPMI code.
 417          */
 418         int run_to_completion;
 419 };
 420 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 421
 422 /**
 423  * The driver model view of the IPMI messaging driver.
 424  */
 425 static struct platform_driver ipmidriver = {
 426         .driver = {
 427                 .name = "ipmi",
 428                 .bus = &platform_bus_type
 429         }
 430 };
 431 static DEFINE_MUTEX(ipmidriver_mutex);
 432
 433 static LIST_HEAD(ipmi_interfaces);
 434 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 435
 436 /*
 437  * List of watchers that want to know when smi's are added and deleted.
 438  */
 439 static LIST_HEAD(smi_watchers);
 440 static DEFINE_MUTEX(smi_watchers_mutex);
 441
 442
 443 #define ipmi_inc_stat(intf, stat) \
 444         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 445 #define ipmi_get_stat(intf, stat) \
 446         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 447
 448
 449 static void free_recv_msg_list(struct list_head *q)
 450 {
 451         struct ipmi_recv_msg *msg, *msg2;
 452
 453         list_for_each_entry_safe(msg, msg2, q, link) {
 454                 list_del(&msg->link);
 455                 ipmi_free_recv_msg(msg);
 456         }
 457 }
 458
 459 static void free_smi_msg_list(struct list_head *q)
 460 {
 461         struct ipmi_smi_msg *msg, *msg2;
 462
 463         list_for_each_entry_safe(msg, msg2, q, link) {
 464                 list_del(&msg->link);
 465                 ipmi_free_smi_msg(msg);
 466         }
 467 }
 468
 469 static void clean_up_interface_data(ipmi_smi_t intf)
 470 {
 471         int              i;
 472         struct cmd_rcvr  *rcvr, *rcvr2;
 473         struct list_head list;
 474
 475         free_smi_msg_list(&intf->waiting_msgs);
 476         free_recv_msg_list(&intf->waiting_events);
 477
 478         /*
 479          * Wholesale remove all the entries from the list in the
 480          * interface and wait for RCU to know that none are in use.
 481          */
 482         mutex_lock(&intf->cmd_rcvrs_mutex);
 483         INIT_LIST_HEAD(&list);
 484         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 485         mutex_unlock(&intf->cmd_rcvrs_mutex);
 486
 487         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 488                 kfree(rcvr);
 489
 490         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 491                 if ((intf->seq_table[i].inuse)
 492                                         && (intf->seq_table[i].recv_msg))
 493                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 494         }
 495 }
 496
 497 static void intf_free(struct kref *ref)
 498 {
 499         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 500
 501         clean_up_interface_data(intf);
 502         kfree(intf);
 503 }
 504
 505 struct watcher_entry {
 506         int              intf_num;
 507         ipmi_smi_t       intf;
 508         struct list_head link;
 509 };
 510
 511 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 512 {
 513         ipmi_smi_t intf;
 514         LIST_HEAD(to_deliver);
 515         struct watcher_entry *e, *e2;
 516
 517         mutex_lock(&smi_watchers_mutex);
 518
 519         mutex_lock(&ipmi_interfaces_mutex);
 520
 521         /* Build a list of things to deliver. */
 522         list_for_each_entry(intf, &ipmi_interfaces, link) {
 523                 if (intf->intf_num == -1)
 524                         continue;
 525                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 526                 if (!e)
 527                         goto out_err;
 528                 kref_get(&intf->refcount);
 529                 e->intf = intf;
 530                 e->intf_num = intf->intf_num;
 531                 list_add_tail(&e->link, &to_deliver);
 532         }
 533
 534         /* We will succeed, so add it to the list. */
 535         list_add(&watcher->link, &smi_watchers);
 536
 537         mutex_unlock(&ipmi_interfaces_mutex);
 538
 539         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 540                 list_del(&e->link);
 541                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 542                 kref_put(&e->intf->refcount, intf_free);
 543                 kfree(e);
 544         }
 545
 546         mutex_unlock(&smi_watchers_mutex);
 547
 548         return 0;
 549
 550  out_err:
 551         mutex_unlock(&ipmi_interfaces_mutex);
 552         mutex_unlock(&smi_watchers_mutex);
 553         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 554                 list_del(&e->link);
 555                 kref_put(&e->intf->refcount, intf_free);
 556                 kfree(e);
 557         }
 558         return -ENOMEM;
 559 }
 560 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 561
 562 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 563 {
 564         mutex_lock(&smi_watchers_mutex);
 565         list_del(&(watcher->link));
 566         mutex_unlock(&smi_watchers_mutex);
 567         return 0;
 568 }
 569 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 570
 571 /*
 572  * Must be called with smi_watchers_mutex held.
 573  */
 574 static void
 575 call_smi_watchers(int i, struct device *dev)
 576 {
 577         struct ipmi_smi_watcher *w;
 578
 579         list_for_each_entry(w, &smi_watchers, link) {
 580                 if (try_module_get(w->owner)) {
 581                         w->new_smi(i, dev);
 582                         module_put(w->owner);
 583                 }
 584         }
 585 }
 586
 587 static int
 588 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 589 {
 590         if (addr1->addr_type != addr2->addr_type)
 591                 return 0;
 592
 593         if (addr1->channel != addr2->channel)
 594                 return 0;
 595
 596         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 597                 struct ipmi_system_interface_addr *smi_addr1
 598                     = (struct ipmi_system_interface_addr *) addr1;
 599                 struct ipmi_system_interface_addr *smi_addr2
 600                     = (struct ipmi_system_interface_addr *) addr2;
 601                 return (smi_addr1->lun == smi_addr2->lun);
 602         }
 603
 604         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 605             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 606                 struct ipmi_ipmb_addr *ipmb_addr1
 607                     = (struct ipmi_ipmb_addr *) addr1;
 608                 struct ipmi_ipmb_addr *ipmb_addr2
 609                     = (struct ipmi_ipmb_addr *) addr2;
 610
 611                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 612                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 613         }
 614
 615         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 616                 struct ipmi_lan_addr *lan_addr1
 617                         = (struct ipmi_lan_addr *) addr1;
 618                 struct ipmi_lan_addr *lan_addr2
 619                     = (struct ipmi_lan_addr *) addr2;
 620
 621                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 622                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 623                         && (lan_addr1->session_handle
 624                             == lan_addr2->session_handle)
 625                         && (lan_addr1->lun == lan_addr2->lun));
 626         }
 627
 628         return 1;
 629 }
 630
 631 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 632 {
 633         if (len < sizeof(struct ipmi_system_interface_addr))
 634                 return -EINVAL;
 635
 636         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 637                 if (addr->channel != IPMI_BMC_CHANNEL)
 638                         return -EINVAL;
 639                 return 0;
 640         }
 641
 642         if ((addr->channel == IPMI_BMC_CHANNEL)
 643             || (addr->channel >= IPMI_MAX_CHANNELS)
 644             || (addr->channel < 0))
 645                 return -EINVAL;
 646
 647         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 648             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 649                 if (len < sizeof(struct ipmi_ipmb_addr))
 650                         return -EINVAL;
 651                 return 0;
 652         }
 653
 654         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 655                 if (len < sizeof(struct ipmi_lan_addr))
 656                         return -EINVAL;
 657                 return 0;
 658         }
 659
 660         return -EINVAL;
 661 }
 662 EXPORT_SYMBOL(ipmi_validate_addr);
 663
 664 unsigned int ipmi_addr_length(int addr_type)
 665 {
 666         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 667                 return sizeof(struct ipmi_system_interface_addr);
 668
 669         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 670                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 671                 return sizeof(struct ipmi_ipmb_addr);
 672
 673         if (addr_type == IPMI_LAN_ADDR_TYPE)
 674                 return sizeof(struct ipmi_lan_addr);
 675
 676         return 0;
 677 }
 678 EXPORT_SYMBOL(ipmi_addr_length);
 679
 680 static void deliver_response(struct ipmi_recv_msg *msg)
 681 {
 682         if (!msg->user) {
 683                 ipmi_smi_t    intf = msg->user_msg_data;
 684
 685                 /* Special handling for NULL users. */
 686                 if (intf->null_user_handler) {
 687                         intf->null_user_handler(intf, msg);
 688                         ipmi_inc_stat(intf, handled_local_responses);
 689                 } else {
 690                         /* No handler, so give up. */
 691                         ipmi_inc_stat(intf, unhandled_local_responses);
 692                 }
 693                 ipmi_free_recv_msg(msg);
 694         } else {
 695                 ipmi_user_t user = msg->user;
 696                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 697         }
 698 }
 699
 700 static void
 701 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 702 {
 703         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 704         msg->msg_data[0] = err;
 705         msg->msg.netfn |= 1; /* Convert to a response. */
 706         msg->msg.data_len = 1;
 707         msg->msg.data = msg->msg_data;
 708         deliver_response(msg);
 709 }
 710
 711 /*
 712  * Find the next sequence number not being used and add the given
 713  * message with the given timeout to the sequence table.  This must be
 714  * called with the interface's seq_lock held.
 715  */
 716 static int intf_next_seq(ipmi_smi_t           intf,
 717                          struct ipmi_recv_msg *recv_msg,
 718                          unsigned long        timeout,
 719                          int                  retries,
 720                          int                  broadcast,
 721                          unsigned char        *seq,
 722                          long                 *seqid)
 723 {
 724         int          rv = 0;
 725         unsigned int i;
 726
 727         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 728                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 729                 if (!intf->seq_table[i].inuse)
 730                         break;
 731         }
 732
 733         if (!intf->seq_table[i].inuse) {
 734                 intf->seq_table[i].recv_msg = recv_msg;
 735
 736                 /*
 737                  * Start with the maximum timeout, when the send response
 738                  * comes in we will start the real timer.
 739                  */
 740                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 741                 intf->seq_table[i].orig_timeout = timeout;
 742                 intf->seq_table[i].retries_left = retries;
 743                 intf->seq_table[i].broadcast = broadcast;
 744                 intf->seq_table[i].inuse = 1;
 745                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 746                 *seq = i;
 747                 *seqid = intf->seq_table[i].seqid;
 748                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 749         } else {
 750                 rv = -EAGAIN;
 751         }
 752
 753         return rv;
 754 }
 755
 756 /*
 757  * Return the receive message for the given sequence number and
 758  * release the sequence number so it can be reused.  Some other data
 759  * is passed in to be sure the message matches up correctly (to help
 760  * guard against message coming in after their timeout and the
 761  * sequence number being reused).
 762  */
 763 static int intf_find_seq(ipmi_smi_t           intf,
 764                          unsigned char        seq,
 765                          short                channel,
 766                          unsigned char        cmd,
 767                          unsigned char        netfn,
 768                          struct ipmi_addr     *addr,
 769                          struct ipmi_recv_msg **recv_msg)
 770 {
 771         int           rv = -ENODEV;
 772         unsigned long flags;
 773
 774         if (seq >= IPMI_IPMB_NUM_SEQ)
 775                 return -EINVAL;
 776
 777         spin_lock_irqsave(&(intf->seq_lock), flags);
 778         if (intf->seq_table[seq].inuse) {
 779                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 780
 781                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 782                                 && (msg->msg.netfn == netfn)
 783                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 784                         *recv_msg = msg;
 785                         intf->seq_table[seq].inuse = 0;
 786                         rv = 0;
 787                 }
 788         }
 789         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 790
 791         return rv;
 792 }
 793
 794
 795 /* Start the timer for a specific sequence table entry. */
 796 static int intf_start_seq_timer(ipmi_smi_t intf,
 797                                 long       msgid)
 798 {
 799         int           rv = -ENODEV;
 800         unsigned long flags;
 801         unsigned char seq;
 802         unsigned long seqid;
 803
 804
 805         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 806
 807         spin_lock_irqsave(&(intf->seq_lock), flags);
 808         /*
 809          * We do this verification because the user can be deleted
 810          * while a message is outstanding.
 811          */
 812         if ((intf->seq_table[seq].inuse)
 813                                 && (intf->seq_table[seq].seqid == seqid)) {
 814                 struct seq_table *ent = &(intf->seq_table[seq]);
 815                 ent->timeout = ent->orig_timeout;
 816                 rv = 0;
 817         }
 818         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 819
 820         return rv;
 821 }
 822
 823 /* Got an error for the send message for a specific sequence number. */
 824 static int intf_err_seq(ipmi_smi_t   intf,
 825                         long         msgid,
 826                         unsigned int err)
 827 {
 828         int                  rv = -ENODEV;
 829         unsigned long        flags;
 830         unsigned char        seq;
 831         unsigned long        seqid;
 832         struct ipmi_recv_msg *msg = NULL;
 833
 834
 835         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 836
 837         spin_lock_irqsave(&(intf->seq_lock), flags);
 838         /*
 839          * We do this verification because the user can be deleted
 840          * while a message is outstanding.
 841          */
 842         if ((intf->seq_table[seq].inuse)
 843                                 && (intf->seq_table[seq].seqid == seqid)) {
 844                 struct seq_table *ent = &(intf->seq_table[seq]);
 845
 846                 ent->inuse = 0;
 847                 msg = ent->recv_msg;
 848                 rv = 0;
 849         }
 850         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 851
 852         if (msg)
 853                 deliver_err_response(msg, err);
 854
 855         return rv;
 856 }
 857
 858
 859 int ipmi_create_user(unsigned int          if_num,
 860                      struct ipmi_user_hndl *handler,
 861                      void                  *handler_data,
 862                      ipmi_user_t           *user)
 863 {
 864         unsigned long flags;
 865         ipmi_user_t   new_user;
 866         int           rv = 0;
 867         ipmi_smi_t    intf;
 868
 869         /*
 870          * There is no module usecount here, because it's not
 871          * required.  Since this can only be used by and called from
 872          * other modules, they will implicitly use this module, and
 873          * thus this can't be removed unless the other modules are
 874          * removed.
 875          */
 876
 877         if (handler == NULL)
 878                 return -EINVAL;
 879
 880         /*
 881          * Make sure the driver is actually initialized, this handles
 882          * problems with initialization order.
 883          */
 884         if (!initialized) {
 885                 rv = ipmi_init_msghandler();
 886                 if (rv)
 887                         return rv;
 888
 889                 /*
 890                  * The init code doesn't return an error if it was turned
 891                  * off, but it won't initialize.  Check that.
 892                  */
 893                 if (!initialized)
 894                         return -ENODEV;
 895         }
 896
 897         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 898         if (!new_user)
 899                 return -ENOMEM;
 900
 901         mutex_lock(&ipmi_interfaces_mutex);
 902         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 903                 if (intf->intf_num == if_num)
 904                         goto found;
 905         }
 906         /* Not found, return an error */
 907         rv = -EINVAL;
 908         goto out_kfree;
 909
 910  found:
 911         /* Note that each existing user holds a refcount to the interface. */
 912         kref_get(&intf->refcount);
 913
 914         kref_init(&new_user->refcount);
 915         new_user->handler = handler;
 916         new_user->handler_data = handler_data;
 917         new_user->intf = intf;
 918         new_user->gets_events = 0;
 919
 920         if (!try_module_get(intf->handlers->owner)) {
 921                 rv = -ENODEV;
 922                 goto out_kref;
 923         }
 924
 925         if (intf->handlers->inc_usecount) {
 926                 rv = intf->handlers->inc_usecount(intf->send_info);
 927                 if (rv) {
 928                         module_put(intf->handlers->owner);
 929                         goto out_kref;
 930                 }
 931         }
 932
 933         /*
 934          * Hold the lock so intf->handlers is guaranteed to be good
 935          * until now
 936          */
 937         mutex_unlock(&ipmi_interfaces_mutex);
 938
 939         new_user->valid = 1;
 940         spin_lock_irqsave(&intf->seq_lock, flags);
 941         list_add_rcu(&new_user->link, &intf->users);
 942         spin_unlock_irqrestore(&intf->seq_lock, flags);
 943         *user = new_user;
 944         return 0;
 945
 946 out_kref:
 947         kref_put(&intf->refcount, intf_free);
 948 out_kfree:
 949         mutex_unlock(&ipmi_interfaces_mutex);
 950         kfree(new_user);
 951         return rv;
 952 }
 953 EXPORT_SYMBOL(ipmi_create_user);
 954
 955 static void free_user(struct kref *ref)
 956 {
 957         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
 958         kfree(user);
 959 }
 960
 961 int ipmi_destroy_user(ipmi_user_t user)
 962 {
 963         ipmi_smi_t       intf = user->intf;
 964         int              i;
 965         unsigned long    flags;
 966         struct cmd_rcvr  *rcvr;
 967         struct cmd_rcvr  *rcvrs = NULL;
 968
 969         user->valid = 0;
 970
 971         /* Remove the user from the interface's sequence table. */
 972         spin_lock_irqsave(&intf->seq_lock, flags);
 973         list_del_rcu(&user->link);
 974
 975         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 976                 if (intf->seq_table[i].inuse
 977                     && (intf->seq_table[i].recv_msg->user == user)) {
 978                         intf->seq_table[i].inuse = 0;
 979                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 980                 }
 981         }
 982         spin_unlock_irqrestore(&intf->seq_lock, flags);
 983
 984         /*
 985          * Remove the user from the command receiver's table.  First
 986          * we build a list of everything (not using the standard link,
 987          * since other things may be using it till we do
 988          * synchronize_rcu()) then free everything in that list.
 989          */
 990         mutex_lock(&intf->cmd_rcvrs_mutex);
 991         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
 992                 if (rcvr->user == user) {
 993                         list_del_rcu(&rcvr->link);
 994                         rcvr->next = rcvrs;
 995                         rcvrs = rcvr;
 996                 }
 997         }
 998         mutex_unlock(&intf->cmd_rcvrs_mutex);
 999         synchronize_rcu();
1000         while (rcvrs) {
1001                 rcvr = rcvrs;
1002                 rcvrs = rcvr->next;
1003                 kfree(rcvr);
1004         }
1005
1006         mutex_lock(&ipmi_interfaces_mutex);
1007         if (intf->handlers) {
1008                 module_put(intf->handlers->owner);
1009                 if (intf->handlers->dec_usecount)
1010                         intf->handlers->dec_usecount(intf->send_info);
1011         }
1012         mutex_unlock(&ipmi_interfaces_mutex);
1013
1014         kref_put(&intf->refcount, intf_free);
1015
1016         kref_put(&user->refcount, free_user);
1017
1018         return 0;
1019 }
1020 EXPORT_SYMBOL(ipmi_destroy_user);
1021
1022 void ipmi_get_version(ipmi_user_t   user,
1023                       unsigned char *major,
1024                       unsigned char *minor)
1025 {
1026         *major = user->intf->ipmi_version_major;
1027         *minor = user->intf->ipmi_version_minor;
1028 }
1029 EXPORT_SYMBOL(ipmi_get_version);
1030
1031 int ipmi_set_my_address(ipmi_user_t   user,
1032                         unsigned int  channel,
1033                         unsigned char address)
1034 {
1035         if (channel >= IPMI_MAX_CHANNELS)
1036                 return -EINVAL;
1037         user->intf->channels[channel].address = address;
1038         return 0;
1039 }
1040 EXPORT_SYMBOL(ipmi_set_my_address);
1041
1042 int ipmi_get_my_address(ipmi_user_t   user,
1043                         unsigned int  channel,
1044                         unsigned char *address)
1045 {
1046         if (channel >= IPMI_MAX_CHANNELS)
1047                 return -EINVAL;
1048         *address = user->intf->channels[channel].address;
1049         return 0;
1050 }
1051 EXPORT_SYMBOL(ipmi_get_my_address);
1052
1053 int ipmi_set_my_LUN(ipmi_user_t   user,
1054                     unsigned int  channel,
1055                     unsigned char LUN)
1056 {
1057         if (channel >= IPMI_MAX_CHANNELS)
1058                 return -EINVAL;
1059         user->intf->channels[channel].lun = LUN & 0x3;
1060         return 0;
1061 }
1062 EXPORT_SYMBOL(ipmi_set_my_LUN);
1063
1064 int ipmi_get_my_LUN(ipmi_user_t   user,
1065                     unsigned int  channel,
1066                     unsigned char *address)
1067 {
1068         if (channel >= IPMI_MAX_CHANNELS)
1069                 return -EINVAL;
1070         *address = user->intf->channels[channel].lun;
1071         return 0;
1072 }
1073 EXPORT_SYMBOL(ipmi_get_my_LUN);
1074
1075 int ipmi_get_maintenance_mode(ipmi_user_t user)
1076 {
1077         int           mode;
1078         unsigned long flags;
1079
1080         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1081         mode = user->intf->maintenance_mode;
1082         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1083
1084         return mode;
1085 }
1086 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1087
1088 static void maintenance_mode_update(ipmi_smi_t intf)
1089 {
1090         if (intf->handlers->set_maintenance_mode)
1091                 intf->handlers->set_maintenance_mode(
1092                         intf->send_info, intf->maintenance_mode_enable);
1093 }
1094
1095 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1096 {
1097         int           rv = 0;
1098         unsigned long flags;
1099         ipmi_smi_t    intf = user->intf;
1100
1101         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1102         if (intf->maintenance_mode != mode) {
1103                 switch (mode) {
1104                 case IPMI_MAINTENANCE_MODE_AUTO:
1105                         intf->maintenance_mode = mode;
1106                         intf->maintenance_mode_enable
1107                                 = (intf->auto_maintenance_timeout > 0);
1108                         break;
1109
1110                 case IPMI_MAINTENANCE_MODE_OFF:
1111                         intf->maintenance_mode = mode;
1112                         intf->maintenance_mode_enable = 0;
1113                         break;
1114
1115                 case IPMI_MAINTENANCE_MODE_ON:
1116                         intf->maintenance_mode = mode;
1117                         intf->maintenance_mode_enable = 1;
1118                         break;
1119
1120                 default:
1121                         rv = -EINVAL;
1122                         goto out_unlock;
1123                 }
1124
1125                 maintenance_mode_update(intf);
1126         }
1127  out_unlock:
1128         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1129
1130         return rv;
1131 }
1132 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1133
1134 int ipmi_set_gets_events(ipmi_user_t user, int val)
1135 {
1136         unsigned long        flags;
1137         ipmi_smi_t           intf = user->intf;
1138         struct ipmi_recv_msg *msg, *msg2;
1139         struct list_head     msgs;
1140
1141         INIT_LIST_HEAD(&msgs);
1142
1143         spin_lock_irqsave(&intf->events_lock, flags);
1144         user->gets_events = val;
1145
1146         if (intf->delivering_events)
1147                 /*
1148                  * Another thread is delivering events for this, so
1149                  * let it handle any new events.
1150                  */
1151                 goto out;
1152
1153         /* Deliver any queued events. */
1154         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1155                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1156                         list_move_tail(&msg->link, &msgs);
1157                 intf->waiting_events_count = 0;
1158                 if (intf->event_msg_printed) {
1159                         printk(KERN_WARNING PFX "Event queue no longer"
1160                                " full\n");
1161                         intf->event_msg_printed = 0;
1162                 }
1163
1164                 intf->delivering_events = 1;
1165                 spin_unlock_irqrestore(&intf->events_lock, flags);
1166
1167                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1168                         msg->user = user;
1169                         kref_get(&user->refcount);
1170                         deliver_response(msg);
1171                 }
1172
1173                 spin_lock_irqsave(&intf->events_lock, flags);
1174                 intf->delivering_events = 0;
1175         }
1176
1177  out:
1178         spin_unlock_irqrestore(&intf->events_lock, flags);
1179
1180         return 0;
1181 }
1182 EXPORT_SYMBOL(ipmi_set_gets_events);
1183
1184 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1185                                       unsigned char netfn,
1186                                       unsigned char cmd,
1187                                       unsigned char chan)
1188 {
1189         struct cmd_rcvr *rcvr;
1190
1191         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1192                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1193                                         && (rcvr->chans & (1 << chan)))
1194                         return rcvr;
1195         }
1196         return NULL;
1197 }
1198
1199 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1200                                  unsigned char netfn,
1201                                  unsigned char cmd,
1202                                  unsigned int  chans)
1203 {
1204         struct cmd_rcvr *rcvr;
1205
1206         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1207                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1208                                         && (rcvr->chans & chans))
1209                         return 0;
1210         }
1211         return 1;
1212 }
1213
1214 int ipmi_register_for_cmd(ipmi_user_t   user,
1215                           unsigned char netfn,
1216                           unsigned char cmd,
1217                           unsigned int  chans)
1218 {
1219         ipmi_smi_t      intf = user->intf;
1220         struct cmd_rcvr *rcvr;
1221         int             rv = 0;
1222
1223
1224         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1225         if (!rcvr)
1226                 return -ENOMEM;
1227         rcvr->cmd = cmd;
1228         rcvr->netfn = netfn;
1229         rcvr->chans = chans;
1230         rcvr->user = user;
1231
1232         mutex_lock(&intf->cmd_rcvrs_mutex);
1233         /* Make sure the command/netfn is not already registered. */
1234         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1235                 rv = -EBUSY;
1236                 goto out_unlock;
1237         }
1238
1239         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1240
1241  out_unlock:
1242         mutex_unlock(&intf->cmd_rcvrs_mutex);
1243         if (rv)
1244                 kfree(rcvr);
1245
1246         return rv;
1247 }
1248 EXPORT_SYMBOL(ipmi_register_for_cmd);
1249
1250 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1251                             unsigned char netfn,
1252                             unsigned char cmd,
1253                             unsigned int  chans)
1254 {
1255         ipmi_smi_t      intf = user->intf;
1256         struct cmd_rcvr *rcvr;
1257         struct cmd_rcvr *rcvrs = NULL;
1258         int i, rv = -ENOENT;
1259
1260         mutex_lock(&intf->cmd_rcvrs_mutex);
1261         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1262                 if (((1 << i) & chans) == 0)
1263                         continue;
1264                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1265                 if (rcvr == NULL)
1266                         continue;
1267                 if (rcvr->user == user) {
1268                         rv = 0;
1269                         rcvr->chans &= ~chans;
1270                         if (rcvr->chans == 0) {
1271                                 list_del_rcu(&rcvr->link);
1272                                 rcvr->next = rcvrs;
1273                                 rcvrs = rcvr;
1274                         }
1275                 }
1276         }
1277         mutex_unlock(&intf->cmd_rcvrs_mutex);
1278         synchronize_rcu();
1279         while (rcvrs) {
1280                 rcvr = rcvrs;
1281                 rcvrs = rcvr->next;
1282                 kfree(rcvr);
1283         }
1284         return rv;
1285 }
1286 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1287
1288 static unsigned char
1289 ipmb_checksum(unsigned char *data, int size)
1290 {
1291         unsigned char csum = 0;
1292
1293         for (; size > 0; size--, data++)
1294                 csum += *data;
1295
1296         return -csum;
1297 }
1298
1299 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1300                                    struct kernel_ipmi_msg *msg,
1301                                    struct ipmi_ipmb_addr *ipmb_addr,
1302                                    long                  msgid,
1303                                    unsigned char         ipmb_seq,
1304                                    int                   broadcast,
1305                                    unsigned char         source_address,
1306                                    unsigned char         source_lun)
1307 {
1308         int i = broadcast;
1309
1310         /* Format the IPMB header data. */
1311         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1312         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1313         smi_msg->data[2] = ipmb_addr->channel;
1314         if (broadcast)
1315                 smi_msg->data[3] = 0;
1316         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1317         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1318         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1319         smi_msg->data[i+6] = source_address;
1320         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1321         smi_msg->data[i+8] = msg->cmd;
1322
1323         /* Now tack on the data to the message. */
1324         if (msg->data_len > 0)
1325                 memcpy(&(smi_msg->data[i+9]), msg->data,
1326                        msg->data_len);
1327         smi_msg->data_size = msg->data_len + 9;
1328
1329         /* Now calculate the checksum and tack it on. */
1330         smi_msg->data[i+smi_msg->data_size]
1331                 = ipmb_checksum(&(smi_msg->data[i+6]),
1332                                 smi_msg->data_size-6);
1333
1334         /*
1335          * Add on the checksum size and the offset from the
1336          * broadcast.
1337          */
1338         smi_msg->data_size += 1 + i;
1339
1340         smi_msg->msgid = msgid;
1341 }
1342
1343 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1344                                   struct kernel_ipmi_msg *msg,
1345                                   struct ipmi_lan_addr  *lan_addr,
1346                                   long                  msgid,
1347                                   unsigned char         ipmb_seq,
1348                                   unsigned char         source_lun)
1349 {
1350         /* Format the IPMB header data. */
1351         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1352         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1353         smi_msg->data[2] = lan_addr->channel;
1354         smi_msg->data[3] = lan_addr->session_handle;
1355         smi_msg->data[4] = lan_addr->remote_SWID;
1356         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1357         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1358         smi_msg->data[7] = lan_addr->local_SWID;
1359         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1360         smi_msg->data[9] = msg->cmd;
1361
1362         /* Now tack on the data to the message. */
1363         if (msg->data_len > 0)
1364                 memcpy(&(smi_msg->data[10]), msg->data,
1365                        msg->data_len);
1366         smi_msg->data_size = msg->data_len + 10;
1367
1368         /* Now calculate the checksum and tack it on. */
1369         smi_msg->data[smi_msg->data_size]
1370                 = ipmb_checksum(&(smi_msg->data[7]),
1371                                 smi_msg->data_size-7);
1372
1373         /*
1374          * Add on the checksum size and the offset from the
1375          * broadcast.
1376          */
1377         smi_msg->data_size += 1;
1378
1379         smi_msg->msgid = msgid;
1380 }
1381
1382 /*
1383  * Separate from ipmi_request so that the user does not have to be
1384  * supplied in certain circumstances (mainly at panic time).  If
1385  * messages are supplied, they will be freed, even if an error
1386  * occurs.
1387  */
1388 static int i_ipmi_request(ipmi_user_t          user,
1389                           ipmi_smi_t           intf,
1390                           struct ipmi_addr     *addr,
1391                           long                 msgid,
1392                           struct kernel_ipmi_msg *msg,
1393                           void                 *user_msg_data,
1394                           void                 *supplied_smi,
1395                           struct ipmi_recv_msg *supplied_recv,
1396                           int                  priority,
1397                           unsigned char        source_address,
1398                           unsigned char        source_lun,
1399                           int                  retries,
1400                           unsigned int         retry_time_ms)
1401 {
1402         int                      rv = 0;
1403         struct ipmi_smi_msg      *smi_msg;
1404         struct ipmi_recv_msg     *recv_msg;
1405         unsigned long            flags;
1406         struct ipmi_smi_handlers *handlers;
1407
1408
1409         if (supplied_recv)
1410                 recv_msg = supplied_recv;
1411         else {
1412                 recv_msg = ipmi_alloc_recv_msg();
1413                 if (recv_msg == NULL)
1414                         return -ENOMEM;
1415         }
1416         recv_msg->user_msg_data = user_msg_data;
1417
1418         if (supplied_smi)
1419                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1420         else {
1421                 smi_msg = ipmi_alloc_smi_msg();
1422                 if (smi_msg == NULL) {
1423                         ipmi_free_recv_msg(recv_msg);
1424                         return -ENOMEM;
1425                 }
1426         }
1427
1428         rcu_read_lock();
1429         handlers = intf->handlers;
1430         if (!handlers) {
1431                 rv = -ENODEV;
1432                 goto out_err;
1433         }
1434
1435         recv_msg->user = user;
1436         if (user)
1437                 kref_get(&user->refcount);
1438         recv_msg->msgid = msgid;
1439         /*
1440          * Store the message to send in the receive message so timeout
1441          * responses can get the proper response data.
1442          */
1443         recv_msg->msg = *msg;
1444
1445         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1446                 struct ipmi_system_interface_addr *smi_addr;
1447
1448                 if (msg->netfn & 1) {
1449                         /* Responses are not allowed to the SMI. */
1450                         rv = -EINVAL;
1451                         goto out_err;
1452                 }
1453
1454                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1455                 if (smi_addr->lun > 3) {
1456                         ipmi_inc_stat(intf, sent_invalid_commands);
1457                         rv = -EINVAL;
1458                         goto out_err;
1459                 }
1460
1461                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1462
1463                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1464                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1465                         || (msg->cmd == IPMI_GET_MSG_CMD)
1466                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1467                         /*
1468                          * We don't let the user do these, since we manage
1469                          * the sequence numbers.
1470                          */
1471                         ipmi_inc_stat(intf, sent_invalid_commands);
1472                         rv = -EINVAL;
1473                         goto out_err;
1474                 }
1475
1476                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1477                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1478                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1479                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1480                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1481                         intf->auto_maintenance_timeout
1482                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1483                         if (!intf->maintenance_mode
1484                             && !intf->maintenance_mode_enable) {
1485                                 intf->maintenance_mode_enable = 1;
1486                                 maintenance_mode_update(intf);
1487                         }
1488                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1489                                                flags);
1490                 }
1491
1492                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1493                         ipmi_inc_stat(intf, sent_invalid_commands);
1494                         rv = -EMSGSIZE;
1495                         goto out_err;
1496                 }
1497
1498                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1499                 smi_msg->data[1] = msg->cmd;
1500                 smi_msg->msgid = msgid;
1501                 smi_msg->user_data = recv_msg;
1502                 if (msg->data_len > 0)
1503                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1504                 smi_msg->data_size = msg->data_len + 2;
1505                 ipmi_inc_stat(intf, sent_local_commands);
1506         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1507                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
1508                 struct ipmi_ipmb_addr *ipmb_addr;
1509                 unsigned char         ipmb_seq;
1510                 long                  seqid;
1511                 int                   broadcast = 0;
1512
1513                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1514                         ipmi_inc_stat(intf, sent_invalid_commands);
1515                         rv = -EINVAL;
1516                         goto out_err;
1517                 }
1518
1519                 if (intf->channels[addr->channel].medium
1520                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1521                         ipmi_inc_stat(intf, sent_invalid_commands);
1522                         rv = -EINVAL;
1523                         goto out_err;
1524                 }
1525
1526                 if (retries < 0) {
1527                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1528                         retries = 0; /* Don't retry broadcasts. */
1529                     else
1530                         retries = 4;
1531                 }
1532                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1533                     /*
1534                      * Broadcasts add a zero at the beginning of the
1535                      * message, but otherwise is the same as an IPMB
1536                      * address.
1537                      */
1538                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1539                     broadcast = 1;
1540                 }
1541
1542
1543                 /* Default to 1 second retries. */
1544                 if (retry_time_ms == 0)
1545                     retry_time_ms = 1000;
1546
1547                 /*
1548                  * 9 for the header and 1 for the checksum, plus
1549                  * possibly one for the broadcast.
1550                  */
1551                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1552                         ipmi_inc_stat(intf, sent_invalid_commands);
1553                         rv = -EMSGSIZE;
1554                         goto out_err;
1555                 }
1556
1557                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1558                 if (ipmb_addr->lun > 3) {
1559                         ipmi_inc_stat(intf, sent_invalid_commands);
1560                         rv = -EINVAL;
1561                         goto out_err;
1562                 }
1563
1564                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1565
1566                 if (recv_msg->msg.netfn & 0x1) {
1567                         /*
1568                          * It's a response, so use the user's sequence
1569                          * from msgid.
1570                          */
1571                         ipmi_inc_stat(intf, sent_ipmb_responses);
1572                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1573                                         msgid, broadcast,
1574                                         source_address, source_lun);
1575
1576                         /*
1577                          * Save the receive message so we can use it
1578                          * to deliver the response.
1579                          */
1580                         smi_msg->user_data = recv_msg;
1581                 } else {
1582                         /* It's a command, so get a sequence for it. */
1583
1584                         spin_lock_irqsave(&(intf->seq_lock), flags);
1585
1586                         ipmi_inc_stat(intf, sent_ipmb_commands);
1587
1588                         /*
1589                          * Create a sequence number with a 1 second
1590                          * timeout and 4 retries.
1591                          */
1592                         rv = intf_next_seq(intf,
1593                                            recv_msg,
1594                                            retry_time_ms,
1595                                            retries,
1596                                            broadcast,
1597                                            &ipmb_seq,
1598                                            &seqid);
1599                         if (rv) {
1600                                 /*
1601                                  * We have used up all the sequence numbers,
1602                                  * probably, so abort.
1603                                  */
1604                                 spin_unlock_irqrestore(&(intf->seq_lock),
1605                                                        flags);
1606                                 goto out_err;
1607                         }
1608
1609                         /*
1610                          * Store the sequence number in the message,
1611                          * so that when the send message response
1612                          * comes back we can start the timer.
1613                          */
1614                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1615                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1616                                         ipmb_seq, broadcast,
1617                                         source_address, source_lun);
1618
1619                         /*
1620                          * Copy the message into the recv message data, so we
1621                          * can retransmit it later if necessary.
1622                          */
1623                         memcpy(recv_msg->msg_data, smi_msg->data,
1624                                smi_msg->data_size);
1625                         recv_msg->msg.data = recv_msg->msg_data;
1626                         recv_msg->msg.data_len = smi_msg->data_size;
1627
1628                         /*
1629                          * We don't unlock until here, because we need
1630                          * to copy the completed message into the
1631                          * recv_msg before we release the lock.
1632                          * Otherwise, race conditions may bite us.  I
1633                          * know that's pretty paranoid, but I prefer
1634                          * to be correct.
1635                          */
1636                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1637                 }
1638         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1639                 struct ipmi_lan_addr  *lan_addr;
1640                 unsigned char         ipmb_seq;
1641                 long                  seqid;
1642
1643                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1644                         ipmi_inc_stat(intf, sent_invalid_commands);
1645                         rv = -EINVAL;
1646                         goto out_err;
1647                 }
1648
1649                 if ((intf->channels[addr->channel].medium
1650                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1651                     && (intf->channels[addr->channel].medium
1652                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1653                         ipmi_inc_stat(intf, sent_invalid_commands);
1654                         rv = -EINVAL;
1655                         goto out_err;
1656                 }
1657
1658                 retries = 4;
1659
1660                 /* Default to 1 second retries. */
1661                 if (retry_time_ms == 0)
1662                     retry_time_ms = 1000;
1663
1664                 /* 11 for the header and 1 for the checksum. */
1665                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1666                         ipmi_inc_stat(intf, sent_invalid_commands);
1667                         rv = -EMSGSIZE;
1668                         goto out_err;
1669                 }
1670
1671                 lan_addr = (struct ipmi_lan_addr *) addr;
1672                 if (lan_addr->lun > 3) {
1673                         ipmi_inc_stat(intf, sent_invalid_commands);
1674                         rv = -EINVAL;
1675                         goto out_err;
1676                 }
1677
1678                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1679
1680                 if (recv_msg->msg.netfn & 0x1) {
1681                         /*
1682                          * It's a response, so use the user's sequence
1683                          * from msgid.
1684                          */
1685                         ipmi_inc_stat(intf, sent_lan_responses);
1686                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1687                                        msgid, source_lun);
1688
1689                         /*
1690                          * Save the receive message so we can use it
1691                          * to deliver the response.
1692                          */
1693                         smi_msg->user_data = recv_msg;
1694                 } else {
1695                         /* It's a command, so get a sequence for it. */
1696
1697                         spin_lock_irqsave(&(intf->seq_lock), flags);
1698
1699                         ipmi_inc_stat(intf, sent_lan_commands);
1700
1701                         /*
1702                          * Create a sequence number with a 1 second
1703                          * timeout and 4 retries.
1704                          */
1705                         rv = intf_next_seq(intf,
1706                                            recv_msg,
1707                                            retry_time_ms,
1708                                            retries,
1709                                            0,
1710                                            &ipmb_seq,
1711                                            &seqid);
1712                         if (rv) {
1713                                 /*
1714                                  * We have used up all the sequence numbers,
1715                                  * probably, so abort.
1716                                  */
1717                                 spin_unlock_irqrestore(&(intf->seq_lock),
1718                                                        flags);
1719                                 goto out_err;
1720                         }
1721
1722                         /*
1723                          * Store the sequence number in the message,
1724                          * so that when the send message response
1725                          * comes back we can start the timer.
1726                          */
1727                         format_lan_msg(smi_msg, msg, lan_addr,
1728                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1729                                        ipmb_seq, source_lun);
1730
1731                         /*
1732                          * Copy the message into the recv message data, so we
1733                          * can retransmit it later if necessary.
1734                          */
1735                         memcpy(recv_msg->msg_data, smi_msg->data,
1736                                smi_msg->data_size);
1737                         recv_msg->msg.data = recv_msg->msg_data;
1738                         recv_msg->msg.data_len = smi_msg->data_size;
1739
1740                         /*
1741                          * We don't unlock until here, because we need
1742                          * to copy the completed message into the
1743                          * recv_msg before we release the lock.
1744                          * Otherwise, race conditions may bite us.  I
1745                          * know that's pretty paranoid, but I prefer
1746                          * to be correct.
1747                          */
1748                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1749                 }
1750         } else {
1751             /* Unknown address type. */
1752                 ipmi_inc_stat(intf, sent_invalid_commands);
1753                 rv = -EINVAL;
1754                 goto out_err;
1755         }
1756
1757 #ifdef DEBUG_MSGING
1758         {
1759                 int m;
1760                 for (m = 0; m < smi_msg->data_size; m++)
1761                         printk(" %2.2x", smi_msg->data[m]);
1762                 printk("\n");
1763         }
1764 #endif
1765
1766         handlers->sender(intf->send_info, smi_msg, priority);
1767         rcu_read_unlock();
1768
1769         return 0;
1770
1771  out_err:
1772         rcu_read_unlock();
1773         ipmi_free_smi_msg(smi_msg);
1774         ipmi_free_recv_msg(recv_msg);
1775         return rv;
1776 }
1777
1778 static int check_addr(ipmi_smi_t       intf,
1779                       struct ipmi_addr *addr,
1780                       unsigned char    *saddr,
1781                       unsigned char    *lun)
1782 {
1783         if (addr->channel >= IPMI_MAX_CHANNELS)
1784                 return -EINVAL;
1785         *lun = intf->channels[addr->channel].lun;
1786         *saddr = intf->channels[addr->channel].address;
1787         return 0;
1788 }
1789
1790 int ipmi_request_settime(ipmi_user_t      user,
1791                          struct ipmi_addr *addr,
1792                          long             msgid,
1793                          struct kernel_ipmi_msg  *msg,
1794                          void             *user_msg_data,
1795                          int              priority,
1796                          int              retries,
1797                          unsigned int     retry_time_ms)
1798 {
1799         unsigned char saddr, lun;
1800         int           rv;
1801
1802         if (!user)
1803                 return -EINVAL;
1804         rv = check_addr(user->intf, addr, &saddr, &lun);
1805         if (rv)
1806                 return rv;
1807         return i_ipmi_request(user,
1808                               user->intf,
1809                               addr,
1810                               msgid,
1811                               msg,
1812                               user_msg_data,
1813                               NULL, NULL,
1814                               priority,
1815                               saddr,
1816                               lun,
1817                               retries,
1818                               retry_time_ms);
1819 }
1820 EXPORT_SYMBOL(ipmi_request_settime);
1821
1822 int ipmi_request_supply_msgs(ipmi_user_t          user,
1823                              struct ipmi_addr     *addr,
1824                              long                 msgid,
1825                              struct kernel_ipmi_msg *msg,
1826                              void                 *user_msg_data,
1827                              void                 *supplied_smi,
1828                              struct ipmi_recv_msg *supplied_recv,
1829                              int                  priority)
1830 {
1831         unsigned char saddr, lun;
1832         int           rv;
1833
1834         if (!user)
1835                 return -EINVAL;
1836         rv = check_addr(user->intf, addr, &saddr, &lun);
1837         if (rv)
1838                 return rv;
1839         return i_ipmi_request(user,
1840                               user->intf,
1841                               addr,
1842                               msgid,
1843                               msg,
1844                               user_msg_data,
1845                               supplied_smi,
1846                               supplied_recv,
1847                               priority,
1848                               saddr,
1849                               lun,
1850                               -1, 0);
1851 }
1852 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1853
1854 #ifdef CONFIG_PROC_FS
1855 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1856                                int count, int *eof, void *data)
1857 {
1858         char       *out = (char *) page;
1859         ipmi_smi_t intf = data;
1860         int        i;
1861         int        rv = 0;
1862
1863         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
1864                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
1865         out[rv-1] = '\n'; /* Replace the final space with a newline */
1866         out[rv] = '\0';
1867         rv++;
1868         return rv;
1869 }
1870
1871 static int version_file_read_proc(char *page, char **start, off_t off,
1872                                   int count, int *eof, void *data)
1873 {
1874         char       *out = (char *) page;
1875         ipmi_smi_t intf = data;
1876
1877         return sprintf(out, "%u.%u\n",
1878                        ipmi_version_major(&intf->bmc->id),
1879                        ipmi_version_minor(&intf->bmc->id));
1880 }
1881
1882 static int stat_file_read_proc(char *page, char **start, off_t off,
1883                                int count, int *eof, void *data)
1884 {
1885         char       *out = (char *) page;
1886         ipmi_smi_t intf = data;
1887
1888         out += sprintf(out, "sent_invalid_commands:       %u\n",
1889                        ipmi_get_stat(intf, sent_invalid_commands));
1890         out += sprintf(out, "sent_local_commands:         %u\n",
1891                        ipmi_get_stat(intf, sent_local_commands));
1892         out += sprintf(out, "handled_local_responses:     %u\n",
1893                        ipmi_get_stat(intf, handled_local_responses));
1894         out += sprintf(out, "unhandled_local_responses:   %u\n",
1895                        ipmi_get_stat(intf, unhandled_local_responses));
1896         out += sprintf(out, "sent_ipmb_commands:          %u\n",
1897                        ipmi_get_stat(intf, sent_ipmb_commands));
1898         out += sprintf(out, "sent_ipmb_command_errs:      %u\n",
1899                        ipmi_get_stat(intf, sent_ipmb_command_errs));
1900         out += sprintf(out, "retransmitted_ipmb_commands: %u\n",
1901                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
1902         out += sprintf(out, "timed_out_ipmb_commands:     %u\n",
1903                        ipmi_get_stat(intf, timed_out_ipmb_commands));
1904         out += sprintf(out, "timed_out_ipmb_broadcasts:   %u\n",
1905                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
1906         out += sprintf(out, "sent_ipmb_responses:         %u\n",
1907                        ipmi_get_stat(intf, sent_ipmb_responses));
1908         out += sprintf(out, "handled_ipmb_responses:      %u\n",
1909                        ipmi_get_stat(intf, handled_ipmb_responses));
1910         out += sprintf(out, "invalid_ipmb_responses:      %u\n",
1911                        ipmi_get_stat(intf, invalid_ipmb_responses));
1912         out += sprintf(out, "unhandled_ipmb_responses:    %u\n",
1913                        ipmi_get_stat(intf, unhandled_ipmb_responses));
1914         out += sprintf(out, "sent_lan_commands:           %u\n",
1915                        ipmi_get_stat(intf, sent_lan_commands));
1916         out += sprintf(out, "sent_lan_command_errs:       %u\n",
1917                        ipmi_get_stat(intf, sent_lan_command_errs));
1918         out += sprintf(out, "retransmitted_lan_commands:  %u\n",
1919                        ipmi_get_stat(intf, retransmitted_lan_commands));
1920         out += sprintf(out, "timed_out_lan_commands:      %u\n",
1921                        ipmi_get_stat(intf, timed_out_lan_commands));
1922         out += sprintf(out, "sent_lan_responses:          %u\n",
1923                        ipmi_get_stat(intf, sent_lan_responses));
1924         out += sprintf(out, "handled_lan_responses:       %u\n",
1925                        ipmi_get_stat(intf, handled_lan_responses));
1926         out += sprintf(out, "invalid_lan_responses:       %u\n",
1927                        ipmi_get_stat(intf, invalid_lan_responses));
1928         out += sprintf(out, "unhandled_lan_responses:     %u\n",
1929                        ipmi_get_stat(intf, unhandled_lan_responses));
1930         out += sprintf(out, "handled_commands:            %u\n",
1931                        ipmi_get_stat(intf, handled_commands));
1932         out += sprintf(out, "invalid_commands:            %u\n",
1933                        ipmi_get_stat(intf, invalid_commands));
1934         out += sprintf(out, "unhandled_commands:          %u\n",
1935                        ipmi_get_stat(intf, unhandled_commands));
1936         out += sprintf(out, "invalid_events:              %u\n",
1937                        ipmi_get_stat(intf, invalid_events));
1938         out += sprintf(out, "events:                      %u\n",
1939                        ipmi_get_stat(intf, events));
1940
1941         return (out - ((char *) page));
1942 }
1943 #endif /* CONFIG_PROC_FS */
1944
1945 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1946                             read_proc_t *read_proc,
1947                             void *data)
1948 {
1949         int                    rv = 0;
1950 #ifdef CONFIG_PROC_FS
1951         struct proc_dir_entry  *file;
1952         struct ipmi_proc_entry *entry;
1953
1954         /* Create a list element. */
1955         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1956         if (!entry)
1957                 return -ENOMEM;
1958         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1959         if (!entry->name) {
1960                 kfree(entry);
1961                 return -ENOMEM;
1962         }
1963         strcpy(entry->name, name);
1964
1965         file = create_proc_entry(name, 0, smi->proc_dir);
1966         if (!file) {
1967                 kfree(entry->name);
1968                 kfree(entry);
1969                 rv = -ENOMEM;
1970         } else {
1971                 file->data = data;
1972                 file->read_proc = read_proc;
1973
1974                 mutex_lock(&smi->proc_entry_lock);
1975                 /* Stick it on the list. */
1976                 entry->next = smi->proc_entries;
1977                 smi->proc_entries = entry;
1978                 mutex_unlock(&smi->proc_entry_lock);
1979         }
1980 #endif /* CONFIG_PROC_FS */
1981
1982         return rv;
1983 }
1984 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
1985
1986 static int add_proc_entries(ipmi_smi_t smi, int num)
1987 {
1988         int rv = 0;
1989
1990 #ifdef CONFIG_PROC_FS
1991         sprintf(smi->proc_dir_name, "%d", num);
1992         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1993         if (!smi->proc_dir)
1994                 rv = -ENOMEM;
1995
1996         if (rv == 0)
1997                 rv = ipmi_smi_add_proc_entry(smi, "stats",
1998                                              stat_file_read_proc,
1999                                              smi);
2000
2001         if (rv == 0)
2002                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2003                                              ipmb_file_read_proc,
2004                                              smi);
2005
2006         if (rv == 0)
2007                 rv = ipmi_smi_add_proc_entry(smi, "version",
2008                                              version_file_read_proc,
2009                                              smi);
2010 #endif /* CONFIG_PROC_FS */
2011
2012         return rv;
2013 }
2014
2015 static void remove_proc_entries(ipmi_smi_t smi)
2016 {
2017 #ifdef CONFIG_PROC_FS
2018         struct ipmi_proc_entry *entry;
2019
2020         mutex_lock(&smi->proc_entry_lock);
2021         while (smi->proc_entries) {
2022                 entry = smi->proc_entries;
2023                 smi->proc_entries = entry->next;
2024
2025                 remove_proc_entry(entry->name, smi->proc_dir);
2026                 kfree(entry->name);
2027                 kfree(entry);
2028         }
2029         mutex_unlock(&smi->proc_entry_lock);
2030         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2031 #endif /* CONFIG_PROC_FS */
2032 }
2033
2034 static int __find_bmc_guid(struct device *dev, void *data)
2035 {
2036         unsigned char *id = data;
2037         struct bmc_device *bmc = dev_get_drvdata(dev);
2038         return memcmp(bmc->guid, id, 16) == 0;
2039 }
2040
2041 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2042                                              unsigned char *guid)
2043 {
2044         struct device *dev;
2045
2046         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2047         if (dev)
2048                 return dev_get_drvdata(dev);
2049         else
2050                 return NULL;
2051 }
2052
2053 struct prod_dev_id {
2054         unsigned int  product_id;
2055         unsigned char device_id;
2056 };
2057
2058 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2059 {
2060         struct prod_dev_id *id = data;
2061         struct bmc_device *bmc = dev_get_drvdata(dev);
2062
2063         return (bmc->id.product_id == id->product_id
2064                 && bmc->id.device_id == id->device_id);
2065 }
2066
2067 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2068         struct device_driver *drv,
2069         unsigned int product_id, unsigned char device_id)
2070 {
2071         struct prod_dev_id id = {
2072                 .product_id = product_id,
2073                 .device_id = device_id,
2074         };
2075         struct device *dev;
2076
2077         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2078         if (dev)
2079                 return dev_get_drvdata(dev);
2080         else
2081                 return NULL;
2082 }
2083
2084 static ssize_t device_id_show(struct device *dev,
2085                               struct device_attribute *attr,
2086                               char *buf)
2087 {
2088         struct bmc_device *bmc = dev_get_drvdata(dev);
2089
2090         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2091 }
2092
2093 static ssize_t provides_dev_sdrs_show(struct device *dev,
2094                                       struct device_attribute *attr,
2095                                       char *buf)
2096 {
2097         struct bmc_device *bmc = dev_get_drvdata(dev);
2098
2099         return snprintf(buf, 10, "%u\n",
2100                         (bmc->id.device_revision & 0x80) >> 7);
2101 }
2102
2103 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2104                              char *buf)
2105 {
2106         struct bmc_device *bmc = dev_get_drvdata(dev);
2107
2108         return snprintf(buf, 20, "%u\n",
2109                         bmc->id.device_revision & 0x0F);
2110 }
2111
2112 static ssize_t firmware_rev_show(struct device *dev,
2113                                  struct device_attribute *attr,
2114                                  char *buf)
2115 {
2116         struct bmc_device *bmc = dev_get_drvdata(dev);
2117
2118         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2119                         bmc->id.firmware_revision_2);
2120 }
2121
2122 static ssize_t ipmi_version_show(struct device *dev,
2123                                  struct device_attribute *attr,
2124                                  char *buf)
2125 {
2126         struct bmc_device *bmc = dev_get_drvdata(dev);
2127
2128         return snprintf(buf, 20, "%u.%u\n",
2129                         ipmi_version_major(&bmc->id),
2130                         ipmi_version_minor(&bmc->id));
2131 }
2132
2133 static ssize_t add_dev_support_show(struct device *dev,
2134                                     struct device_attribute *attr,
2135                                     char *buf)
2136 {
2137         struct bmc_device *bmc = dev_get_drvdata(dev);
2138
2139         return snprintf(buf, 10, "0x%02x\n",
2140                         bmc->id.additional_device_support);
2141 }
2142
2143 static ssize_t manufacturer_id_show(struct device *dev,
2144                                     struct device_attribute *attr,
2145                                     char *buf)
2146 {
2147         struct bmc_device *bmc = dev_get_drvdata(dev);
2148
2149         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2150 }
2151
2152 static ssize_t product_id_show(struct device *dev,
2153                                struct device_attribute *attr,
2154                                char *buf)
2155 {
2156         struct bmc_device *bmc = dev_get_drvdata(dev);
2157
2158         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2159 }
2160
2161 static ssize_t aux_firmware_rev_show(struct device *dev,
2162                                      struct device_attribute *attr,
2163                                      char *buf)
2164 {
2165         struct bmc_device *bmc = dev_get_drvdata(dev);
2166
2167         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2168                         bmc->id.aux_firmware_revision[3],
2169                         bmc->id.aux_firmware_revision[2],
2170                         bmc->id.aux_firmware_revision[1],
2171                         bmc->id.aux_firmware_revision[0]);
2172 }
2173
2174 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2175                          char *buf)
2176 {
2177         struct bmc_device *bmc = dev_get_drvdata(dev);
2178
2179         return snprintf(buf, 100, "%Lx%Lx\n",
2180                         (long long) bmc->guid[0],
2181                         (long long) bmc->guid[8]);
2182 }
2183
2184 static void remove_files(struct bmc_device *bmc)
2185 {
2186         if (!bmc->dev)
2187                 return;
2188
2189         device_remove_file(&bmc->dev->dev,
2190                            &bmc->device_id_attr);
2191         device_remove_file(&bmc->dev->dev,
2192                            &bmc->provides_dev_sdrs_attr);
2193         device_remove_file(&bmc->dev->dev,
2194                            &bmc->revision_attr);
2195         device_remove_file(&bmc->dev->dev,
2196                            &bmc->firmware_rev_attr);
2197         device_remove_file(&bmc->dev->dev,
2198                            &bmc->version_attr);
2199         device_remove_file(&bmc->dev->dev,
2200                            &bmc->add_dev_support_attr);
2201         device_remove_file(&bmc->dev->dev,
2202                            &bmc->manufacturer_id_attr);
2203         device_remove_file(&bmc->dev->dev,
2204                            &bmc->product_id_attr);
2205
2206         if (bmc->id.aux_firmware_revision_set)
2207                 device_remove_file(&bmc->dev->dev,
2208                                    &bmc->aux_firmware_rev_attr);
2209         if (bmc->guid_set)
2210                 device_remove_file(&bmc->dev->dev,
2211                                    &bmc->guid_attr);
2212 }
2213
2214 static void
2215 cleanup_bmc_device(struct kref *ref)
2216 {
2217         struct bmc_device *bmc;
2218
2219         bmc = container_of(ref, struct bmc_device, refcount);
2220
2221         remove_files(bmc);
2222         platform_device_unregister(bmc->dev);
2223         kfree(bmc);
2224 }
2225
2226 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2227 {
2228         struct bmc_device *bmc = intf->bmc;
2229
2230         if (intf->sysfs_name) {
2231                 sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
2232                 kfree(intf->sysfs_name);
2233                 intf->sysfs_name = NULL;
2234         }
2235         if (intf->my_dev_name) {
2236                 sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
2237                 kfree(intf->my_dev_name);
2238                 intf->my_dev_name = NULL;
2239         }
2240
2241         mutex_lock(&ipmidriver_mutex);
2242         kref_put(&bmc->refcount, cleanup_bmc_device);
2243         intf->bmc = NULL;
2244         mutex_unlock(&ipmidriver_mutex);
2245 }
2246
2247 static int create_files(struct bmc_device *bmc)
2248 {
2249         int err;
2250
2251         bmc->device_id_attr.attr.name = "device_id";
2252         bmc->device_id_attr.attr.mode = S_IRUGO;
2253         bmc->device_id_attr.show = device_id_show;
2254
2255         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
2256         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
2257         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
2258
2259         bmc->revision_attr.attr.name = "revision";
2260         bmc->revision_attr.attr.mode = S_IRUGO;
2261         bmc->revision_attr.show = revision_show;
2262
2263         bmc->firmware_rev_attr.attr.name = "firmware_revision";
2264         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
2265         bmc->firmware_rev_attr.show = firmware_rev_show;
2266
2267         bmc->version_attr.attr.name = "ipmi_version";
2268         bmc->version_attr.attr.mode = S_IRUGO;
2269         bmc->version_attr.show = ipmi_version_show;
2270
2271         bmc->add_dev_support_attr.attr.name = "additional_device_support";
2272         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
2273         bmc->add_dev_support_attr.show = add_dev_support_show;
2274
2275         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
2276         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
2277         bmc->manufacturer_id_attr.show = manufacturer_id_show;
2278
2279         bmc->product_id_attr.attr.name = "product_id";
2280         bmc->product_id_attr.attr.mode = S_IRUGO;
2281         bmc->product_id_attr.show = product_id_show;
2282
2283         bmc->guid_attr.attr.name = "guid";
2284         bmc->guid_attr.attr.mode = S_IRUGO;
2285         bmc->guid_attr.show = guid_show;
2286
2287         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2288         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
2289         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
2290
2291         err = device_create_file(&bmc->dev->dev,
2292                            &bmc->device_id_attr);
2293         if (err)
2294                 goto out;
2295         err = device_create_file(&bmc->dev->dev,
2296                            &bmc->provides_dev_sdrs_attr);
2297         if (err)
2298                 goto out_devid;
2299         err = device_create_file(&bmc->dev->dev,
2300                            &bmc->revision_attr);
2301         if (err)
2302                 goto out_sdrs;
2303         err = device_create_file(&bmc->dev->dev,
2304                            &bmc->firmware_rev_attr);
2305         if (err)
2306                 goto out_rev;
2307         err = device_create_file(&bmc->dev->dev,
2308                            &bmc->version_attr);
2309         if (err)
2310                 goto out_firm;
2311         err = device_create_file(&bmc->dev->dev,
2312                            &bmc->add_dev_support_attr);
2313         if (err)
2314                 goto out_version;
2315         err = device_create_file(&bmc->dev->dev,
2316                            &bmc->manufacturer_id_attr);
2317         if (err)
2318                 goto out_add_dev;
2319         err = device_create_file(&bmc->dev->dev,
2320                            &bmc->product_id_attr);
2321         if (err)
2322                 goto out_manu;
2323         if (bmc->id.aux_firmware_revision_set) {
2324                 err = device_create_file(&bmc->dev->dev,
2325                                    &bmc->aux_firmware_rev_attr);
2326                 if (err)
2327                         goto out_prod_id;
2328         }
2329         if (bmc->guid_set) {
2330                 err = device_create_file(&bmc->dev->dev,
2331                                    &bmc->guid_attr);
2332                 if (err)
2333                         goto out_aux_firm;
2334         }
2335
2336         return 0;
2337
2338 out_aux_firm:
2339         if (bmc->id.aux_firmware_revision_set)
2340                 device_remove_file(&bmc->dev->dev,
2341                                    &bmc->aux_firmware_rev_attr);
2342 out_prod_id:
2343         device_remove_file(&bmc->dev->dev,
2344                            &bmc->product_id_attr);
2345 out_manu:
2346         device_remove_file(&bmc->dev->dev,
2347                            &bmc->manufacturer_id_attr);
2348 out_add_dev:
2349         device_remove_file(&bmc->dev->dev,
2350                            &bmc->add_dev_support_attr);
2351 out_version:
2352         device_remove_file(&bmc->dev->dev,
2353                            &bmc->version_attr);
2354 out_firm:
2355         device_remove_file(&bmc->dev->dev,
2356                            &bmc->firmware_rev_attr);
2357 out_rev:
2358         device_remove_file(&bmc->dev->dev,
2359                            &bmc->revision_attr);
2360 out_sdrs:
2361         device_remove_file(&bmc->dev->dev,
2362                            &bmc->provides_dev_sdrs_attr);
2363 out_devid:
2364         device_remove_file(&bmc->dev->dev,
2365                            &bmc->device_id_attr);
2366 out:
2367         return err;
2368 }
2369
2370 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
2371                              const char *sysfs_name)
2372 {
2373         int               rv;
2374         struct bmc_device *bmc = intf->bmc;
2375         struct bmc_device *old_bmc;
2376         int               size;
2377         char              dummy[1];
2378
2379         mutex_lock(&ipmidriver_mutex);
2380
2381         /*
2382          * Try to find if there is an bmc_device struct
2383          * representing the interfaced BMC already
2384          */
2385         if (bmc->guid_set)
2386                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2387         else
2388                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2389                                                     bmc->id.product_id,
2390                                                     bmc->id.device_id);
2391
2392         /*
2393          * If there is already an bmc_device, free the new one,
2394          * otherwise register the new BMC device
2395          */
2396         if (old_bmc) {
2397                 kfree(bmc);
2398                 intf->bmc = old_bmc;
2399                 bmc = old_bmc;
2400
2401                 kref_get(&bmc->refcount);
2402                 mutex_unlock(&ipmidriver_mutex);
2403
2404                 printk(KERN_INFO
2405                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2406                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2407                        bmc->id.manufacturer_id,
2408                        bmc->id.product_id,
2409                        bmc->id.device_id);
2410         } else {
2411                 char name[14];
2412                 unsigned char orig_dev_id = bmc->id.device_id;
2413                 int warn_printed = 0;
2414
2415                 snprintf(name, sizeof(name),
2416                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2417
2418                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2419                                                  bmc->id.product_id,
2420                                                  bmc->id.device_id)) {
2421                         if (!warn_printed) {
2422                                 printk(KERN_WARNING PFX
2423                                        "This machine has two different BMCs"
2424                                        " with the same product id and device"
2425                                        " id.  This is an error in the"
2426                                        " firmware, but incrementing the"
2427                                        " device id to work around the problem."
2428                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2429                                        bmc->id.product_id, bmc->id.device_id);
2430                                 warn_printed = 1;
2431                         }
2432                         bmc->id.device_id++; /* Wraps at 255 */
2433                         if (bmc->id.device_id == orig_dev_id) {
2434                                 printk(KERN_ERR PFX
2435                                        "Out of device ids!\n");
2436                                 break;
2437                         }
2438                 }
2439
2440                 bmc->dev = platform_device_alloc(name, bmc->id.device_id);
2441                 if (!bmc->dev) {
2442                         mutex_unlock(&ipmidriver_mutex);
2443                         printk(KERN_ERR
2444                                "ipmi_msghandler:"
2445                                " Unable to allocate platform device\n");
2446                         return -ENOMEM;
2447                 }
2448                 bmc->dev->dev.driver = &ipmidriver.driver;
2449                 dev_set_drvdata(&bmc->dev->dev, bmc);
2450                 kref_init(&bmc->refcount);
2451
2452                 rv = platform_device_add(bmc->dev);
2453                 mutex_unlock(&ipmidriver_mutex);
2454                 if (rv) {
2455                         platform_device_put(bmc->dev);
2456                         bmc->dev = NULL;
2457                         printk(KERN_ERR
2458                                "ipmi_msghandler:"
2459                                " Unable to register bmc device: %d\n",
2460                                rv);
2461                         /*
2462                          * Don't go to out_err, you can only do that if
2463                          * the device is registered already.
2464                          */
2465                         return rv;
2466                 }
2467
2468                 rv = create_files(bmc);
2469                 if (rv) {
2470                         mutex_lock(&ipmidriver_mutex);
2471                         platform_device_unregister(bmc->dev);
2472                         mutex_unlock(&ipmidriver_mutex);
2473
2474                         return rv;
2475                 }
2476
2477                 printk(KERN_INFO
2478                        "ipmi: Found new BMC (man_id: 0x%6.6x, "
2479                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2480                        bmc->id.manufacturer_id,
2481                        bmc->id.product_id,
2482                        bmc->id.device_id);
2483         }
2484
2485         /*
2486          * create symlink from system interface device to bmc device
2487          * and back.
2488          */
2489         intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
2490         if (!intf->sysfs_name) {
2491                 rv = -ENOMEM;
2492                 printk(KERN_ERR
2493                        "ipmi_msghandler: allocate link to BMC: %d\n",
2494                        rv);
2495                 goto out_err;
2496         }
2497
2498         rv = sysfs_create_link(&intf->si_dev->kobj,
2499                                &bmc->dev->dev.kobj, intf->sysfs_name);
2500         if (rv) {
2501                 kfree(intf->sysfs_name);
2502                 intf->sysfs_name = NULL;
2503                 printk(KERN_ERR
2504                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2505                        rv);
2506                 goto out_err;
2507         }
2508
2509         size = snprintf(dummy, 0, "ipmi%d", ifnum);
2510         intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
2511         if (!intf->my_dev_name) {
2512                 kfree(intf->sysfs_name);
2513                 intf->sysfs_name = NULL;
2514                 rv = -ENOMEM;
2515                 printk(KERN_ERR
2516                        "ipmi_msghandler: allocate link from BMC: %d\n",
2517                        rv);
2518                 goto out_err;
2519         }
2520         snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
2521
2522         rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
2523                                intf->my_dev_name);
2524         if (rv) {
2525                 kfree(intf->sysfs_name);
2526                 intf->sysfs_name = NULL;
2527                 kfree(intf->my_dev_name);
2528                 intf->my_dev_name = NULL;
2529                 printk(KERN_ERR
2530                        "ipmi_msghandler:"
2531                        " Unable to create symlink to bmc: %d\n",
2532                        rv);
2533                 goto out_err;
2534         }
2535
2536         return 0;
2537
2538 out_err:
2539         ipmi_bmc_unregister(intf);
2540         return rv;
2541 }
2542
2543 static int
2544 send_guid_cmd(ipmi_smi_t intf, int chan)
2545 {
2546         struct kernel_ipmi_msg            msg;
2547         struct ipmi_system_interface_addr si;
2548
2549         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2550         si.channel = IPMI_BMC_CHANNEL;
2551         si.lun = 0;
2552
2553         msg.netfn = IPMI_NETFN_APP_REQUEST;
2554         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2555         msg.data = NULL;
2556         msg.data_len = 0;
2557         return i_ipmi_request(NULL,
2558                               intf,
2559                               (struct ipmi_addr *) &si,
2560                               0,
2561                               &msg,
2562                               intf,
2563                               NULL,
2564                               NULL,
2565                               0,
2566                               intf->channels[0].address,
2567                               intf->channels[0].lun,
2568                               -1, 0);
2569 }
2570
2571 static void
2572 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2573 {
2574         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2575             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2576             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2577                 /* Not for me */
2578                 return;
2579
2580         if (msg->msg.data[0] != 0) {
2581                 /* Error from getting the GUID, the BMC doesn't have one. */
2582                 intf->bmc->guid_set = 0;
2583                 goto out;
2584         }
2585
2586         if (msg->msg.data_len < 17) {
2587                 intf->bmc->guid_set = 0;
2588                 printk(KERN_WARNING PFX
2589                        "guid_handler: The GUID response from the BMC was too"
2590                        " short, it was %d but should have been 17.  Assuming"
2591                        " GUID is not available.\n",
2592                        msg->msg.data_len);
2593                 goto out;
2594         }
2595
2596         memcpy(intf->bmc->guid, msg->msg.data, 16);
2597         intf->bmc->guid_set = 1;
2598  out:
2599         wake_up(&intf->waitq);
2600 }
2601
2602 static void
2603 get_guid(ipmi_smi_t intf)
2604 {
2605         int rv;
2606
2607         intf->bmc->guid_set = 0x2;
2608         intf->null_user_handler = guid_handler;
2609         rv = send_guid_cmd(intf, 0);
2610         if (rv)
2611                 /* Send failed, no GUID available. */
2612                 intf->bmc->guid_set = 0;
2613         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2614         intf->null_user_handler = NULL;
2615 }
2616
2617 static int
2618 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2619 {
2620         struct kernel_ipmi_msg            msg;
2621         unsigned char                     data[1];
2622         struct ipmi_system_interface_addr si;
2623
2624         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2625         si.channel = IPMI_BMC_CHANNEL;
2626         si.lun = 0;
2627
2628         msg.netfn = IPMI_NETFN_APP_REQUEST;
2629         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2630         msg.data = data;
2631         msg.data_len = 1;
2632         data[0] = chan;
2633         return i_ipmi_request(NULL,
2634                               intf,
2635                               (struct ipmi_addr *) &si,
2636                               0,
2637                               &msg,
2638                               intf,
2639                               NULL,
2640                               NULL,
2641                               0,
2642                               intf->channels[0].address,
2643                               intf->channels[0].lun,
2644                               -1, 0);
2645 }
2646
2647 static void
2648 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2649 {
2650         int rv = 0;
2651         int chan;
2652
2653         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2654             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2655             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2656                 /* It's the one we want */
2657                 if (msg->msg.data[0] != 0) {
2658                         /* Got an error from the channel, just go on. */
2659
2660                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2661                                 /*
2662                                  * If the MC does not support this
2663                                  * command, that is legal.  We just
2664                                  * assume it has one IPMB at channel
2665                                  * zero.
2666                                  */
2667                                 intf->channels[0].medium
2668                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2669                                 intf->channels[0].protocol
2670                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2671                                 rv = -ENOSYS;
2672
2673                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2674                                 wake_up(&intf->waitq);
2675                                 goto out;
2676                         }
2677                         goto next_channel;
2678                 }
2679                 if (msg->msg.data_len < 4) {
2680                         /* Message not big enough, just go on. */
2681                         goto next_channel;
2682                 }
2683                 chan = intf->curr_channel;
2684                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2685                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2686
2687  next_channel:
2688                 intf->curr_channel++;
2689                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2690                         wake_up(&intf->waitq);
2691                 else
2692                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2693
2694                 if (rv) {
2695                         /* Got an error somehow, just give up. */
2696                         intf->curr_channel = IPMI_MAX_CHANNELS;
2697                         wake_up(&intf->waitq);
2698
2699                         printk(KERN_WARNING PFX
2700                                "Error sending channel information: %d\n",
2701                                rv);
2702                 }
2703         }
2704  out:
2705         return;
2706 }
2707
2708 void ipmi_poll_interface(ipmi_user_t user)
2709 {
2710         ipmi_smi_t intf = user->intf;
2711
2712         if (intf->handlers->poll)
2713                 intf->handlers->poll(intf->send_info);
2714 }
2715 EXPORT_SYMBOL(ipmi_poll_interface);
2716
2717 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2718                       void                     *send_info,
2719                       struct ipmi_device_id    *device_id,
2720                       struct device            *si_dev,
2721                       const char               *sysfs_name,
2722                       unsigned char            slave_addr)
2723 {
2724         int              i, j;
2725         int              rv;
2726         ipmi_smi_t       intf;
2727         ipmi_smi_t       tintf;
2728         struct list_head *link;
2729
2730         /*
2731          * Make sure the driver is actually initialized, this handles
2732          * problems with initialization order.
2733          */
2734         if (!initialized) {
2735                 rv = ipmi_init_msghandler();
2736                 if (rv)
2737                         return rv;
2738                 /*
2739                  * The init code doesn't return an error if it was turned
2740                  * off, but it won't initialize.  Check that.
2741                  */
2742                 if (!initialized)
2743                         return -ENODEV;
2744         }
2745
2746         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2747         if (!intf)
2748                 return -ENOMEM;
2749
2750         intf->ipmi_version_major = ipmi_version_major(device_id);
2751         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2752
2753         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2754         if (!intf->bmc) {
2755                 kfree(intf);
2756                 return -ENOMEM;
2757         }
2758         intf->intf_num = -1; /* Mark it invalid for now. */
2759         kref_init(&intf->refcount);
2760         intf->bmc->id = *device_id;
2761         intf->si_dev = si_dev;
2762         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2763                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2764                 intf->channels[j].lun = 2;
2765         }
2766         if (slave_addr != 0)
2767                 intf->channels[0].address = slave_addr;
2768         INIT_LIST_HEAD(&intf->users);
2769         intf->handlers = handlers;
2770         intf->send_info = send_info;
2771         spin_lock_init(&intf->seq_lock);
2772         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2773                 intf->seq_table[j].inuse = 0;
2774                 intf->seq_table[j].seqid = 0;
2775         }
2776         intf->curr_seq = 0;
2777 #ifdef CONFIG_PROC_FS
2778         mutex_init(&intf->proc_entry_lock);
2779 #endif
2780         spin_lock_init(&intf->waiting_msgs_lock);
2781         INIT_LIST_HEAD(&intf->waiting_msgs);
2782         spin_lock_init(&intf->events_lock);
2783         INIT_LIST_HEAD(&intf->waiting_events);
2784         intf->waiting_events_count = 0;
2785         mutex_init(&intf->cmd_rcvrs_mutex);
2786         spin_lock_init(&intf->maintenance_mode_lock);
2787         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2788         init_waitqueue_head(&intf->waitq);
2789         for (i = 0; i < IPMI_NUM_STATS; i++)
2790                 atomic_set(&intf->stats[i], 0);
2791
2792         intf->proc_dir = NULL;
2793
2794         mutex_lock(&smi_watchers_mutex);
2795         mutex_lock(&ipmi_interfaces_mutex);
2796         /* Look for a hole in the numbers. */
2797         i = 0;
2798         link = &ipmi_interfaces;
2799         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2800                 if (tintf->intf_num != i) {
2801                         link = &tintf->link;
2802                         break;
2803                 }
2804                 i++;
2805         }
2806         /* Add the new interface in numeric order. */
2807         if (i == 0)
2808                 list_add_rcu(&intf->link, &ipmi_interfaces);
2809         else
2810                 list_add_tail_rcu(&intf->link, link);
2811
2812         rv = handlers->start_processing(send_info, intf);
2813         if (rv)
2814                 goto out;
2815
2816         get_guid(intf);
2817
2818         if ((intf->ipmi_version_major > 1)
2819                         || ((intf->ipmi_version_major == 1)
2820                             && (intf->ipmi_version_minor >= 5))) {
2821                 /*
2822                  * Start scanning the channels to see what is
2823                  * available.
2824                  */
2825                 intf->null_user_handler = channel_handler;
2826                 intf->curr_channel = 0;
2827                 rv = send_channel_info_cmd(intf, 0);
2828                 if (rv)
2829                         goto out;
2830
2831                 /* Wait for the channel info to be read. */
2832                 wait_event(intf->waitq,
2833                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2834                 intf->null_user_handler = NULL;
2835         } else {
2836                 /* Assume a single IPMB channel at zero. */
2837                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2838                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2839         }
2840
2841         if (rv == 0)
2842                 rv = add_proc_entries(intf, i);
2843
2844         rv = ipmi_bmc_register(intf, i, sysfs_name);
2845
2846  out:
2847         if (rv) {
2848                 if (intf->proc_dir)
2849                         remove_proc_entries(intf);
2850                 intf->handlers = NULL;
2851                 list_del_rcu(&intf->link);
2852                 mutex_unlock(&ipmi_interfaces_mutex);
2853                 mutex_unlock(&smi_watchers_mutex);
2854                 synchronize_rcu();
2855                 kref_put(&intf->refcount, intf_free);
2856         } else {
2857                 /*
2858                  * Keep memory order straight for RCU readers.  Make
2859                  * sure everything else is committed to memory before
2860                  * setting intf_num to mark the interface valid.
2861                  */
2862                 smp_wmb();
2863                 intf->intf_num = i;
2864                 mutex_unlock(&ipmi_interfaces_mutex);
2865                 /* After this point the interface is legal to use. */
2866                 call_smi_watchers(i, intf->si_dev);
2867                 mutex_unlock(&smi_watchers_mutex);
2868         }
2869
2870         return rv;
2871 }
2872 EXPORT_SYMBOL(ipmi_register_smi);
2873
2874 static void cleanup_smi_msgs(ipmi_smi_t intf)
2875 {
2876         int              i;
2877         struct seq_table *ent;
2878
2879         /* No need for locks, the interface is down. */
2880         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2881                 ent = &(intf->seq_table[i]);
2882                 if (!ent->inuse)
2883                         continue;
2884                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2885         }
2886 }
2887
2888 int ipmi_unregister_smi(ipmi_smi_t intf)
2889 {
2890         struct ipmi_smi_watcher *w;
2891         int    intf_num = intf->intf_num;
2892
2893         ipmi_bmc_unregister(intf);
2894
2895         mutex_lock(&smi_watchers_mutex);
2896         mutex_lock(&ipmi_interfaces_mutex);
2897         intf->intf_num = -1;
2898         intf->handlers = NULL;
2899         list_del_rcu(&intf->link);
2900         mutex_unlock(&ipmi_interfaces_mutex);
2901         synchronize_rcu();
2902
2903         cleanup_smi_msgs(intf);
2904
2905         remove_proc_entries(intf);
2906
2907         /*
2908          * Call all the watcher interfaces to tell them that
2909          * an interface is gone.
2910          */
2911         list_for_each_entry(w, &smi_watchers, link)
2912                 w->smi_gone(intf_num);
2913         mutex_unlock(&smi_watchers_mutex);
2914
2915         kref_put(&intf->refcount, intf_free);
2916         return 0;
2917 }
2918 EXPORT_SYMBOL(ipmi_unregister_smi);
2919
2920 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
2921                                    struct ipmi_smi_msg *msg)
2922 {
2923         struct ipmi_ipmb_addr ipmb_addr;
2924         struct ipmi_recv_msg  *recv_msg;
2925
2926         /*
2927          * This is 11, not 10, because the response must contain a
2928          * completion code.
2929          */
2930         if (msg->rsp_size < 11) {
2931                 /* Message not big enough, just ignore it. */
2932                 ipmi_inc_stat(intf, invalid_ipmb_responses);
2933                 return 0;
2934         }
2935
2936         if (msg->rsp[2] != 0) {
2937                 /* An error getting the response, just ignore it. */
2938                 return 0;
2939         }
2940
2941         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
2942         ipmb_addr.slave_addr = msg->rsp[6];
2943         ipmb_addr.channel = msg->rsp[3] & 0x0f;
2944         ipmb_addr.lun = msg->rsp[7] & 3;
2945
2946         /*
2947          * It's a response from a remote entity.  Look up the sequence
2948          * number and handle the response.
2949          */
2950         if (intf_find_seq(intf,
2951                           msg->rsp[7] >> 2,
2952                           msg->rsp[3] & 0x0f,
2953                           msg->rsp[8],
2954                           (msg->rsp[4] >> 2) & (~1),
2955                           (struct ipmi_addr *) &(ipmb_addr),
2956                           &recv_msg)) {
2957                 /*
2958                  * We were unable to find the sequence number,
2959                  * so just nuke the message.
2960                  */
2961                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
2962                 return 0;
2963         }
2964
2965         memcpy(recv_msg->msg_data,
2966                &(msg->rsp[9]),
2967                msg->rsp_size - 9);
2968         /*
2969          * The other fields matched, so no need to set them, except
2970          * for netfn, which needs to be the response that was
2971          * returned, not the request value.
2972          */
2973         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2974         recv_msg->msg.data = recv_msg->msg_data;
2975         recv_msg->msg.data_len = msg->rsp_size - 10;
2976         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2977         ipmi_inc_stat(intf, handled_ipmb_responses);
2978         deliver_response(recv_msg);
2979
2980         return 0;
2981 }
2982
2983 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
2984                                    struct ipmi_smi_msg *msg)
2985 {
2986         struct cmd_rcvr          *rcvr;
2987         int                      rv = 0;
2988         unsigned char            netfn;
2989         unsigned char            cmd;
2990         unsigned char            chan;
2991         ipmi_user_t              user = NULL;
2992         struct ipmi_ipmb_addr    *ipmb_addr;
2993         struct ipmi_recv_msg     *recv_msg;
2994         struct ipmi_smi_handlers *handlers;
2995
2996         if (msg->rsp_size < 10) {
2997                 /* Message not big enough, just ignore it. */
2998                 ipmi_inc_stat(intf, invalid_commands);
2999                 return 0;
3000         }
3001
3002         if (msg->rsp[2] != 0) {
3003                 /* An error getting the response, just ignore it. */
3004                 return 0;
3005         }
3006
3007         netfn = msg->rsp[4] >> 2;
3008         cmd = msg->rsp[8];
3009         chan = msg->rsp[3] & 0xf;
3010
3011         rcu_read_lock();
3012         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3013         if (rcvr) {
3014                 user = rcvr->user;
3015                 kref_get(&user->refcount);
3016         } else
3017                 user = NULL;
3018         rcu_read_unlock();
3019
3020         if (user == NULL) {
3021                 /* We didn't find a user, deliver an error response. */
3022                 ipmi_inc_stat(intf, unhandled_commands);
3023
3024                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3025                 msg->data[1] = IPMI_SEND_MSG_CMD;
3026                 msg->data[2] = msg->rsp[3];
3027                 msg->data[3] = msg->rsp[6];
3028                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3029                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3030                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3031                 /* rqseq/lun */
3032                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3033                 msg->data[8] = msg->rsp[8]; /* cmd */
3034                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3035                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3036                 msg->data_size = 11;
3037
3038 #ifdef DEBUG_MSGING
3039         {
3040                 int m;
3041                 printk("Invalid command:");
3042                 for (m = 0; m < msg->data_size; m++)
3043                         printk(" %2.2x", msg->data[m]);
3044                 printk("\n");
3045         }
3046 #endif
3047                 rcu_read_lock();
3048                 handlers = intf->handlers;
3049                 if (handlers) {
3050                         handlers->sender(intf->send_info, msg, 0);
3051                         /*
3052                          * We used the message, so return the value
3053                          * that causes it to not be freed or
3054                          * queued.
3055                          */
3056                         rv = -1;
3057                 }
3058                 rcu_read_unlock();
3059         } else {
3060                 /* Deliver the message to the user. */
3061                 ipmi_inc_stat(intf, handled_commands);
3062
3063                 recv_msg = ipmi_alloc_recv_msg();
3064                 if (!recv_msg) {
3065                         /*
3066                          * We couldn't allocate memory for the
3067                          * message, so requeue it for handling
3068                          * later.
3069                          */
3070                         rv = 1;
3071                         kref_put(&user->refcount, free_user);
3072                 } else {
3073                         /* Extract the source address from the data. */
3074                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3075                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3076                         ipmb_addr->slave_addr = msg->rsp[6];
3077                         ipmb_addr->lun = msg->rsp[7] & 3;
3078                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3079
3080                         /*
3081                          * Extract the rest of the message information
3082                          * from the IPMB header.
3083                          */
3084                         recv_msg->user = user;
3085                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3086                         recv_msg->msgid = msg->rsp[7] >> 2;
3087                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3088                         recv_msg->msg.cmd = msg->rsp[8];
3089                         recv_msg->msg.data = recv_msg->msg_data;
3090
3091                         /*
3092                          * We chop off 10, not 9 bytes because the checksum
3093                          * at the end also needs to be removed.
3094                          */
3095                         recv_msg->msg.data_len = msg->rsp_size - 10;
3096                         memcpy(recv_msg->msg_data,
3097                                &(msg->rsp[9]),
3098                                msg->rsp_size - 10);
3099                         deliver_response(recv_msg);
3100                 }
3101         }
3102
3103         return rv;
3104 }
3105
3106 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3107                                   struct ipmi_smi_msg *msg)
3108 {
3109         struct ipmi_lan_addr  lan_addr;
3110         struct ipmi_recv_msg  *recv_msg;
3111
3112
3113         /*
3114          * This is 13, not 12, because the response must contain a
3115          * completion code.
3116          */
3117         if (msg->rsp_size < 13) {
3118                 /* Message not big enough, just ignore it. */
3119                 ipmi_inc_stat(intf, invalid_lan_responses);
3120                 return 0;
3121         }
3122
3123         if (msg->rsp[2] != 0) {
3124                 /* An error getting the response, just ignore it. */
3125                 return 0;
3126         }
3127
3128         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3129         lan_addr.session_handle = msg->rsp[4];
3130         lan_addr.remote_SWID = msg->rsp[8];
3131         lan_addr.local_SWID = msg->rsp[5];
3132         lan_addr.channel = msg->rsp[3] & 0x0f;
3133         lan_addr.privilege = msg->rsp[3] >> 4;
3134         lan_addr.lun = msg->rsp[9] & 3;
3135
3136         /*
3137          * It's a response from a remote entity.  Look up the sequence
3138          * number and handle the response.
3139          */
3140         if (intf_find_seq(intf,
3141                           msg->rsp[9] >> 2,
3142                           msg->rsp[3] & 0x0f,
3143                           msg->rsp[10],
3144                           (msg->rsp[6] >> 2) & (~1),
3145                           (struct ipmi_addr *) &(lan_addr),
3146                           &recv_msg)) {
3147                 /*
3148                  * We were unable to find the sequence number,
3149                  * so just nuke the message.
3150                  */
3151                 ipmi_inc_stat(intf, unhandled_lan_responses);
3152                 return 0;
3153         }
3154
3155         memcpy(recv_msg->msg_data,
3156                &(msg->rsp[11]),
3157                msg->rsp_size - 11);
3158         /*
3159          * The other fields matched, so no need to set them, except
3160          * for netfn, which needs to be the response that was
3161          * returned, not the request value.
3162          */
3163         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3164         recv_msg->msg.data = recv_msg->msg_data;
3165         recv_msg->msg.data_len = msg->rsp_size - 12;
3166         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3167         ipmi_inc_stat(intf, handled_lan_responses);
3168         deliver_response(recv_msg);
3169
3170         return 0;
3171 }
3172
3173 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3174                                   struct ipmi_smi_msg *msg)
3175 {
3176         struct cmd_rcvr          *rcvr;
3177         int                      rv = 0;
3178         unsigned char            netfn;
3179         unsigned char            cmd;
3180         unsigned char            chan;
3181         ipmi_user_t              user = NULL;
3182         struct ipmi_lan_addr     *lan_addr;
3183         struct ipmi_recv_msg     *recv_msg;
3184
3185         if (msg->rsp_size < 12) {
3186                 /* Message not big enough, just ignore it. */
3187                 ipmi_inc_stat(intf, invalid_commands);
3188                 return 0;
3189         }
3190
3191         if (msg->rsp[2] != 0) {
3192                 /* An error getting the response, just ignore it. */
3193                 return 0;
3194         }
3195
3196         netfn = msg->rsp[6] >> 2;
3197         cmd = msg->rsp[10];
3198         chan = msg->rsp[3] & 0xf;
3199
3200         rcu_read_lock();
3201         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3202         if (rcvr) {
3203                 user = rcvr->user;
3204                 kref_get(&user->refcount);
3205         } else
3206                 user = NULL;
3207         rcu_read_unlock();
3208
3209         if (user == NULL) {
3210                 /* We didn't find a user, just give up. */
3211                 ipmi_inc_stat(intf, unhandled_commands);
3212
3213                 /*
3214                  * Don't do anything with these messages, just allow
3215                  * them to be freed.
3216                  */
3217                 rv = 0;
3218         } else {
3219                 /* Deliver the message to the user. */
3220                 ipmi_inc_stat(intf, handled_commands);
3221
3222                 recv_msg = ipmi_alloc_recv_msg();
3223                 if (!recv_msg) {
3224                         /*
3225                          * We couldn't allocate memory for the
3226                          * message, so requeue it for handling later.
3227                          */
3228                         rv = 1;
3229                         kref_put(&user->refcount, free_user);
3230                 } else {
3231                         /* Extract the source address from the data. */
3232                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3233                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3234                         lan_addr->session_handle = msg->rsp[4];
3235                         lan_addr->remote_SWID = msg->rsp[8];
3236                         lan_addr->local_SWID = msg->rsp[5];
3237                         lan_addr->lun = msg->rsp[9] & 3;
3238                         lan_addr->channel = msg->rsp[3] & 0xf;
3239                         lan_addr->privilege = msg->rsp[3] >> 4;
3240
3241                         /*
3242                          * Extract the rest of the message information
3243                          * from the IPMB header.
3244                          */
3245                         recv_msg->user = user;
3246                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3247                         recv_msg->msgid = msg->rsp[9] >> 2;
3248                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3249                         recv_msg->msg.cmd = msg->rsp[10];
3250                         recv_msg->msg.data = recv_msg->msg_data;
3251
3252                         /*
3253                          * We chop off 12, not 11 bytes because the checksum
3254                          * at the end also needs to be removed.
3255                          */
3256                         recv_msg->msg.data_len = msg->rsp_size - 12;
3257                         memcpy(recv_msg->msg_data,
3258                                &(msg->rsp[11]),
3259                                msg->rsp_size - 12);
3260                         deliver_response(recv_msg);
3261                 }
3262         }
3263
3264         return rv;
3265 }
3266
3267 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3268                                      struct ipmi_smi_msg  *msg)
3269 {
3270         struct ipmi_system_interface_addr *smi_addr;
3271
3272         recv_msg->msgid = 0;
3273         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3274         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3275         smi_addr->channel = IPMI_BMC_CHANNEL;
3276         smi_addr->lun = msg->rsp[0] & 3;
3277         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3278         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3279         recv_msg->msg.cmd = msg->rsp[1];
3280         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3281         recv_msg->msg.data = recv_msg->msg_data;
3282         recv_msg->msg.data_len = msg->rsp_size - 3;
3283 }
3284
3285 static int handle_read_event_rsp(ipmi_smi_t          intf,
3286                                  struct ipmi_smi_msg *msg)
3287 {
3288         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3289         struct list_head     msgs;
3290         ipmi_user_t          user;
3291         int                  rv = 0;
3292         int                  deliver_count = 0;
3293         unsigned long        flags;
3294
3295         if (msg->rsp_size < 19) {
3296                 /* Message is too small to be an IPMB event. */
3297                 ipmi_inc_stat(intf, invalid_events);
3298                 return 0;
3299         }
3300
3301         if (msg->rsp[2] != 0) {
3302                 /* An error getting the event, just ignore it. */
3303                 return 0;
3304         }
3305
3306         INIT_LIST_HEAD(&msgs);
3307
3308         spin_lock_irqsave(&intf->events_lock, flags);
3309
3310         ipmi_inc_stat(intf, events);
3311
3312         /*
3313          * Allocate and fill in one message for every user that is
3314          * getting events.
3315          */
3316         rcu_read_lock();
3317         list_for_each_entry_rcu(user, &intf->users, link) {
3318                 if (!user->gets_events)
3319                         continue;
3320
3321                 recv_msg = ipmi_alloc_recv_msg();
3322                 if (!recv_msg) {
3323                         rcu_read_unlock();
3324                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3325                                                  link) {
3326                                 list_del(&recv_msg->link);
3327                                 ipmi_free_recv_msg(recv_msg);
3328                         }
3329                         /*
3330                          * We couldn't allocate memory for the
3331                          * message, so requeue it for handling
3332                          * later.
3333                          */
3334                         rv = 1;
3335                         goto out;
3336                 }
3337
3338                 deliver_count++;
3339
3340                 copy_event_into_recv_msg(recv_msg, msg);
3341                 recv_msg->user = user;
3342                 kref_get(&user->refcount);
3343                 list_add_tail(&(recv_msg->link), &msgs);
3344         }
3345         rcu_read_unlock();
3346
3347         if (deliver_count) {
3348                 /* Now deliver all the messages. */
3349                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3350                         list_del(&recv_msg->link);
3351                         deliver_response(recv_msg);
3352                 }
3353         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3354                 /*
3355                  * No one to receive the message, put it in queue if there's
3356                  * not already too many things in the queue.
3357                  */
3358                 recv_msg = ipmi_alloc_recv_msg();
3359                 if (!recv_msg) {
3360                         /*
3361                          * We couldn't allocate memory for the
3362                          * message, so requeue it for handling
3363                          * later.
3364                          */
3365                         rv = 1;
3366                         goto out;
3367                 }
3368
3369                 copy_event_into_recv_msg(recv_msg, msg);
3370                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3371                 intf->waiting_events_count++;
3372         } else if (!intf->event_msg_printed) {
3373                 /*
3374                  * There's too many things in the queue, discard this
3375                  * message.
3376                  */
3377                 printk(KERN_WARNING PFX "Event queue full, discarding"
3378                        " incoming events\n");
3379                 intf->event_msg_printed = 1;
3380         }
3381
3382  out:
3383         spin_unlock_irqrestore(&(intf->events_lock), flags);
3384
3385         return rv;
3386 }
3387
3388 static int handle_bmc_rsp(ipmi_smi_t          intf,
3389                           struct ipmi_smi_msg *msg)
3390 {
3391         struct ipmi_recv_msg *recv_msg;
3392         struct ipmi_user     *user;
3393
3394         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3395         if (recv_msg == NULL) {
3396                 printk(KERN_WARNING
3397                        "IPMI message received with no owner. This\n"
3398                        "could be because of a malformed message, or\n"
3399                        "because of a hardware error.  Contact your\n"
3400                        "hardware vender for assistance\n");
3401                 return 0;
3402         }
3403
3404         user = recv_msg->user;
3405         /* Make sure the user still exists. */
3406         if (user && !user->valid) {
3407                 /* The user for the message went away, so give up. */
3408                 ipmi_inc_stat(intf, unhandled_local_responses);
3409                 ipmi_free_recv_msg(recv_msg);
3410         } else {
3411                 struct ipmi_system_interface_addr *smi_addr;
3412
3413                 ipmi_inc_stat(intf, handled_local_responses);
3414                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3415                 recv_msg->msgid = msg->msgid;
3416                 smi_addr = ((struct ipmi_system_interface_addr *)
3417                             &(recv_msg->addr));
3418                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3419                 smi_addr->channel = IPMI_BMC_CHANNEL;
3420                 smi_addr->lun = msg->rsp[0] & 3;
3421                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3422                 recv_msg->msg.cmd = msg->rsp[1];
3423                 memcpy(recv_msg->msg_data,
3424                        &(msg->rsp[2]),
3425                        msg->rsp_size - 2);
3426                 recv_msg->msg.data = recv_msg->msg_data;
3427                 recv_msg->msg.data_len = msg->rsp_size - 2;
3428                 deliver_response(recv_msg);
3429         }
3430
3431         return 0;
3432 }
3433
3434 /*
3435  * Handle a new message.  Return 1 if the message should be requeued,
3436  * 0 if the message should be freed, or -1 if the message should not
3437  * be freed or requeued.
3438  */
3439 static int handle_new_recv_msg(ipmi_smi_t          intf,
3440                                struct ipmi_smi_msg *msg)
3441 {
3442         int requeue;
3443         int chan;
3444
3445 #ifdef DEBUG_MSGING
3446         int m;
3447         printk("Recv:");
3448         for (m = 0; m < msg->rsp_size; m++)
3449                 printk(" %2.2x", msg->rsp[m]);
3450         printk("\n");
3451 #endif
3452         if (msg->rsp_size < 2) {
3453                 /* Message is too small to be correct. */
3454                 printk(KERN_WARNING PFX "BMC returned to small a message"
3455                        " for netfn %x cmd %x, got %d bytes\n",
3456                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3457
3458                 /* Generate an error response for the message. */
3459                 msg->rsp[0] = msg->data[0] | (1 << 2);
3460                 msg->rsp[1] = msg->data[1];
3461                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3462                 msg->rsp_size = 3;
3463         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3464                    || (msg->rsp[1] != msg->data[1])) {
3465                 /*
3466                  * The NetFN and Command in the response is not even
3467                  * marginally correct.
3468                  */
3469                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3470                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3471                        (msg->data[0] >> 2) | 1, msg->data[1],
3472                        msg->rsp[0] >> 2, msg->rsp[1]);
3473
3474                 /* Generate an error response for the message. */
3475                 msg->rsp[0] = msg->data[0] | (1 << 2);
3476                 msg->rsp[1] = msg->data[1];
3477                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3478                 msg->rsp_size = 3;
3479         }
3480
3481         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3482             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3483             && (msg->user_data != NULL)) {
3484                 /*
3485                  * It's a response to a response we sent.  For this we
3486                  * deliver a send message response to the user.
3487                  */
3488                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3489
3490                 requeue = 0;
3491                 if (msg->rsp_size < 2)
3492                         /* Message is too small to be correct. */
3493                         goto out;
3494
3495                 chan = msg->data[2] & 0x0f;
3496                 if (chan >= IPMI_MAX_CHANNELS)
3497                         /* Invalid channel number */
3498                         goto out;
3499
3500                 if (!recv_msg)
3501                         goto out;
3502
3503                 /* Make sure the user still exists. */
3504                 if (!recv_msg->user || !recv_msg->user->valid)
3505                         goto out;
3506
3507                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3508                 recv_msg->msg.data = recv_msg->msg_data;
3509                 recv_msg->msg.data_len = 1;
3510                 recv_msg->msg_data[0] = msg->rsp[2];
3511                 deliver_response(recv_msg);
3512         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3513                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3514                 /* It's from the receive queue. */
3515                 chan = msg->rsp[3] & 0xf;
3516                 if (chan >= IPMI_MAX_CHANNELS) {
3517                         /* Invalid channel number */
3518                         requeue = 0;
3519                         goto out;
3520                 }
3521
3522                 switch (intf->channels[chan].medium) {
3523                 case IPMI_CHANNEL_MEDIUM_IPMB:
3524                         if (msg->rsp[4] & 0x04) {
3525                                 /*
3526                                  * It's a response, so find the
3527                                  * requesting message and send it up.
3528                                  */
3529                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3530                         } else {
3531                                 /*
3532                                  * It's a command to the SMS from some other
3533                                  * entity.  Handle that.
3534                                  */
3535                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3536                         }
3537                         break;
3538
3539                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3540                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3541                         if (msg->rsp[6] & 0x04) {
3542                                 /*
3543                                  * It's a response, so find the
3544                                  * requesting message and send it up.
3545                                  */
3546                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3547                         } else {
3548                                 /*
3549                                  * It's a command to the SMS from some other
3550                                  * entity.  Handle that.
3551                                  */
3552                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3553                         }
3554                         break;
3555
3556                 default:
3557                         /*
3558                          * We don't handle the channel type, so just
3559                          * free the message.
3560                          */
3561                         requeue = 0;
3562                 }
3563
3564         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3565                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3566                 /* It's an asyncronous event. */
3567                 requeue = handle_read_event_rsp(intf, msg);
3568         } else {
3569                 /* It's a response from the local BMC. */
3570                 requeue = handle_bmc_rsp(intf, msg);
3571         }
3572
3573  out:
3574         return requeue;
3575 }
3576
3577 /* Handle a new message from the lower layer. */
3578 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3579                            struct ipmi_smi_msg *msg)
3580 {
3581         unsigned long flags = 0; /* keep us warning-free. */
3582         int           rv;
3583         int           run_to_completion;
3584
3585
3586         if ((msg->data_size >= 2)
3587             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3588             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3589             && (msg->user_data == NULL)) {
3590                 /*
3591                  * This is the local response to a command send, start
3592                  * the timer for these.  The user_data will not be
3593                  * NULL if this is a response send, and we will let
3594                  * response sends just go through.
3595                  */
3596
3597                 /*
3598                  * Check for errors, if we get certain errors (ones
3599                  * that mean basically we can try again later), we
3600                  * ignore them and start the timer.  Otherwise we
3601                  * report the error immediately.
3602                  */
3603                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3604                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3605                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3606                     && (msg->rsp[2] != IPMI_BUS_ERR)
3607                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3608                         int chan = msg->rsp[3] & 0xf;
3609
3610                         /* Got an error sending the message, handle it. */
3611                         if (chan >= IPMI_MAX_CHANNELS)
3612                                 ; /* This shouldn't happen */
3613                         else if ((intf->channels[chan].medium
3614                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3615                                  || (intf->channels[chan].medium
3616                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3617                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3618                         else
3619                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3620                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3621                 } else
3622                         /* The message was sent, start the timer. */
3623                         intf_start_seq_timer(intf, msg->msgid);
3624
3625                 ipmi_free_smi_msg(msg);
3626                 goto out;
3627         }
3628
3629         /*
3630          * To preserve message order, if the list is not empty, we
3631          * tack this message onto the end of the list.
3632          */
3633         run_to_completion = intf->run_to_completion;
3634         if (!run_to_completion)
3635                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3636         if (!list_empty(&intf->waiting_msgs)) {
3637                 list_add_tail(&msg->link, &intf->waiting_msgs);
3638                 if (!run_to_completion)
3639                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3640                 goto out;
3641         }
3642         if (!run_to_completion)
3643                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3644
3645         rv = handle_new_recv_msg(intf, msg);
3646         if (rv > 0) {
3647                 /*
3648                  * Could not handle the message now, just add it to a
3649                  * list to handle later.
3650                  */
3651                 run_to_completion = intf->run_to_completion;
3652                 if (!run_to_completion)
3653                         spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3654                 list_add_tail(&msg->link, &intf->waiting_msgs);
3655                 if (!run_to_completion)
3656                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3657         } else if (rv == 0) {
3658                 ipmi_free_smi_msg(msg);
3659         }
3660
3661  out:
3662         return;
3663 }
3664 EXPORT_SYMBOL(ipmi_smi_msg_received);
3665
3666 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3667 {
3668         ipmi_user_t user;
3669
3670         rcu_read_lock();
3671         list_for_each_entry_rcu(user, &intf->users, link) {
3672                 if (!user->handler->ipmi_watchdog_pretimeout)
3673                         continue;
3674
3675                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
3676         }
3677         rcu_read_unlock();
3678 }
3679 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3680
3681 static struct ipmi_smi_msg *
3682 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3683                   unsigned char seq, long seqid)
3684 {
3685         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3686         if (!smi_msg)
3687                 /*
3688                  * If we can't allocate the message, then just return, we
3689                  * get 4 retries, so this should be ok.
3690                  */
3691                 return NULL;
3692
3693         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3694         smi_msg->data_size = recv_msg->msg.data_len;
3695         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3696
3697 #ifdef DEBUG_MSGING
3698         {
3699                 int m;
3700                 printk("Resend: ");
3701                 for (m = 0; m < smi_msg->data_size; m++)
3702                         printk(" %2.2x", smi_msg->data[m]);
3703                 printk("\n");
3704         }
3705 #endif
3706         return smi_msg;
3707 }
3708
3709 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3710                               struct list_head *timeouts, long timeout_period,
3711                               int slot, unsigned long *flags)
3712 {
3713         struct ipmi_recv_msg     *msg;
3714         struct ipmi_smi_handlers *handlers;
3715
3716         if (intf->intf_num == -1)
3717                 return;
3718
3719         if (!ent->inuse)
3720                 return;
3721
3722         ent->timeout -= timeout_period;
3723         if (ent->timeout > 0)
3724                 return;
3725
3726         if (ent->retries_left == 0) {
3727                 /* The message has used all its retries. */
3728                 ent->inuse = 0;
3729                 msg = ent->recv_msg;
3730                 list_add_tail(&msg->link, timeouts);
3731                 if (ent->broadcast)
3732                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
3733                 else if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3734                         ipmi_inc_stat(intf, timed_out_lan_commands);
3735                 else
3736                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
3737         } else {
3738                 struct ipmi_smi_msg *smi_msg;
3739                 /* More retries, send again. */
3740
3741                 /*
3742                  * Start with the max timer, set to normal timer after
3743                  * the message is sent.
3744                  */
3745                 ent->timeout = MAX_MSG_TIMEOUT;
3746                 ent->retries_left--;
3747                 if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3748                         ipmi_inc_stat(intf, retransmitted_lan_commands);
3749                 else
3750                         ipmi_inc_stat(intf, retransmitted_ipmb_commands);
3751
3752                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
3753                                             ent->seqid);
3754                 if (!smi_msg)
3755                         return;
3756
3757                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
3758
3759                 /*
3760                  * Send the new message.  We send with a zero
3761                  * priority.  It timed out, I doubt time is that
3762                  * critical now, and high priority messages are really
3763                  * only for messages to the local MC, which don't get
3764                  * resent.
3765                  */
3766                 handlers = intf->handlers;
3767                 if (handlers)
3768                         intf->handlers->sender(intf->send_info,
3769                                                smi_msg, 0);
3770                 else
3771                         ipmi_free_smi_msg(smi_msg);
3772
3773                 spin_lock_irqsave(&intf->seq_lock, *flags);
3774         }
3775 }
3776
3777 static void ipmi_timeout_handler(long timeout_period)
3778 {
3779         ipmi_smi_t           intf;
3780         struct list_head     timeouts;
3781         struct ipmi_recv_msg *msg, *msg2;
3782         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
3783         unsigned long        flags;
3784         int                  i;
3785
3786         rcu_read_lock();
3787         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3788                 /* See if any waiting messages need to be processed. */
3789                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3790                 list_for_each_entry_safe(smi_msg, smi_msg2,
3791                                          &intf->waiting_msgs, link) {
3792                         if (!handle_new_recv_msg(intf, smi_msg)) {
3793                                 list_del(&smi_msg->link);
3794                                 ipmi_free_smi_msg(smi_msg);
3795                         } else {
3796                                 /*
3797                                  * To preserve message order, quit if we
3798                                  * can't handle a message.
3799                                  */
3800                                 break;
3801                         }
3802                 }
3803                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3804
3805                 /*
3806                  * Go through the seq table and find any messages that
3807                  * have timed out, putting them in the timeouts
3808                  * list.
3809                  */
3810                 INIT_LIST_HEAD(&timeouts);
3811                 spin_lock_irqsave(&intf->seq_lock, flags);
3812                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
3813                         check_msg_timeout(intf, &(intf->seq_table[i]),
3814                                           &timeouts, timeout_period, i,
3815                                           &flags);
3816                 spin_unlock_irqrestore(&intf->seq_lock, flags);
3817
3818                 list_for_each_entry_safe(msg, msg2, &timeouts, link)
3819                         deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
3820
3821                 /*
3822                  * Maintenance mode handling.  Check the timeout
3823                  * optimistically before we claim the lock.  It may
3824                  * mean a timeout gets missed occasionally, but that
3825                  * only means the timeout gets extended by one period
3826                  * in that case.  No big deal, and it avoids the lock
3827                  * most of the time.
3828                  */
3829                 if (intf->auto_maintenance_timeout > 0) {
3830                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
3831                         if (intf->auto_maintenance_timeout > 0) {
3832                                 intf->auto_maintenance_timeout
3833                                         -= timeout_period;
3834                                 if (!intf->maintenance_mode
3835                                     && (intf->auto_maintenance_timeout <= 0)) {
3836                                         intf->maintenance_mode_enable = 0;
3837                                         maintenance_mode_update(intf);
3838                                 }
3839                         }
3840                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
3841                                                flags);
3842                 }
3843         }
3844         rcu_read_unlock();
3845 }
3846
3847 static void ipmi_request_event(void)
3848 {
3849         ipmi_smi_t               intf;
3850         struct ipmi_smi_handlers *handlers;
3851
3852         rcu_read_lock();
3853         /*
3854          * Called from the timer, no need to check if handlers is
3855          * valid.
3856          */
3857         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3858                 /* No event requests when in maintenance mode. */
3859                 if (intf->maintenance_mode_enable)
3860                         continue;
3861
3862                 handlers = intf->handlers;
3863                 if (handlers)
3864                         handlers->request_events(intf->send_info);
3865         }
3866         rcu_read_unlock();
3867 }
3868
3869 static struct timer_list ipmi_timer;
3870
3871 /* Call every ~100 ms. */
3872 #define IPMI_TIMEOUT_TIME       100
3873
3874 /* How many jiffies does it take to get to the timeout time. */
3875 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
3876
3877 /*
3878  * Request events from the queue every second (this is the number of
3879  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
3880  * future, IPMI will add a way to know immediately if an event is in
3881  * the queue and this silliness can go away.
3882  */
3883 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
3884
3885 static atomic_t stop_operation;
3886 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3887
3888 static void ipmi_timeout(unsigned long data)
3889 {
3890         if (atomic_read(&stop_operation))
3891                 return;
3892
3893         ticks_to_req_ev--;
3894         if (ticks_to_req_ev == 0) {
3895                 ipmi_request_event();
3896                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3897         }
3898
3899         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
3900
3901         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
3902 }
3903
3904
3905 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
3906 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
3907
3908 /* FIXME - convert these to slabs. */
3909 static void free_smi_msg(struct ipmi_smi_msg *msg)
3910 {
3911         atomic_dec(&smi_msg_inuse_count);
3912         kfree(msg);
3913 }
3914
3915 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
3916 {
3917         struct ipmi_smi_msg *rv;
3918         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
3919         if (rv) {
3920                 rv->done = free_smi_msg;
3921                 rv->user_data = NULL;
3922                 atomic_inc(&smi_msg_inuse_count);
3923         }
3924         return rv;
3925 }
3926 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
3927
3928 static void free_recv_msg(struct ipmi_recv_msg *msg)
3929 {
3930         atomic_dec(&recv_msg_inuse_count);
3931         kfree(msg);
3932 }
3933
3934 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
3935 {
3936         struct ipmi_recv_msg *rv;
3937
3938         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
3939         if (rv) {
3940                 rv->user = NULL;
3941                 rv->done = free_recv_msg;
3942                 atomic_inc(&recv_msg_inuse_count);
3943         }
3944         return rv;
3945 }
3946
3947 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
3948 {
3949         if (msg->user)
3950                 kref_put(&msg->user->refcount, free_user);
3951         msg->done(msg);
3952 }
3953 EXPORT_SYMBOL(ipmi_free_recv_msg);
3954
3955 #ifdef CONFIG_IPMI_PANIC_EVENT
3956
3957 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
3958 {
3959 }
3960
3961 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
3962 {
3963 }
3964
3965 #ifdef CONFIG_IPMI_PANIC_STRING
3966 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3967 {
3968         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3969             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
3970             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
3971             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3972                 /* A get event receiver command, save it. */
3973                 intf->event_receiver = msg->msg.data[1];
3974                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
3975         }
3976 }
3977
3978 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3979 {
3980         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3981             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3982             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
3983             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3984                 /*
3985                  * A get device id command, save if we are an event
3986                  * receiver or generator.
3987                  */
3988                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
3989                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
3990         }
3991 }
3992 #endif
3993
3994 static void send_panic_events(char *str)
3995 {
3996         struct kernel_ipmi_msg            msg;
3997         ipmi_smi_t                        intf;
3998         unsigned char                     data[16];
3999         struct ipmi_system_interface_addr *si;
4000         struct ipmi_addr                  addr;
4001         struct ipmi_smi_msg               smi_msg;
4002         struct ipmi_recv_msg              recv_msg;
4003
4004         si = (struct ipmi_system_interface_addr *) &addr;
4005         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4006         si->channel = IPMI_BMC_CHANNEL;
4007         si->lun = 0;
4008
4009         /* Fill in an event telling that we have failed. */
4010         msg.netfn = 0x04; /* Sensor or Event. */
4011         msg.cmd = 2; /* Platform event command. */
4012         msg.data = data;
4013         msg.data_len = 8;
4014         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4015         data[1] = 0x03; /* This is for IPMI 1.0. */
4016         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4017         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4018         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4019
4020         /*
4021          * Put a few breadcrumbs in.  Hopefully later we can add more things
4022          * to make the panic events more useful.
4023          */
4024         if (str) {
4025                 data[3] = str[0];
4026                 data[6] = str[1];
4027                 data[7] = str[2];
4028         }
4029
4030         smi_msg.done = dummy_smi_done_handler;
4031         recv_msg.done = dummy_recv_done_handler;
4032
4033         /* For every registered interface, send the event. */
4034         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4035                 if (!intf->handlers)
4036                         /* Interface is not ready. */
4037                         continue;
4038
4039                 intf->run_to_completion = 1;
4040                 /* Send the event announcing the panic. */
4041                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4042                 i_ipmi_request(NULL,
4043                                intf,
4044                                &addr,
4045                                0,
4046                                &msg,
4047                                intf,
4048                                &smi_msg,
4049                                &recv_msg,
4050                                0,
4051                                intf->channels[0].address,
4052                                intf->channels[0].lun,
4053                                0, 1); /* Don't retry, and don't wait. */
4054         }
4055
4056 #ifdef CONFIG_IPMI_PANIC_STRING
4057         /*
4058          * On every interface, dump a bunch of OEM event holding the
4059          * string.
4060          */
4061         if (!str)
4062                 return;
4063
4064         /* For every registered interface, send the event. */
4065         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4066                 char                  *p = str;
4067                 struct ipmi_ipmb_addr *ipmb;
4068                 int                   j;
4069
4070                 if (intf->intf_num == -1)
4071                         /* Interface was not ready yet. */
4072                         continue;
4073
4074                 /*
4075                  * intf_num is used as an marker to tell if the
4076                  * interface is valid.  Thus we need a read barrier to
4077                  * make sure data fetched before checking intf_num
4078                  * won't be used.
4079                  */
4080                 smp_rmb();
4081
4082                 /*
4083                  * First job here is to figure out where to send the
4084                  * OEM events.  There's no way in IPMI to send OEM
4085                  * events using an event send command, so we have to
4086                  * find the SEL to put them in and stick them in
4087                  * there.
4088                  */
4089
4090                 /* Get capabilities from the get device id. */
4091                 intf->local_sel_device = 0;
4092                 intf->local_event_generator = 0;
4093                 intf->event_receiver = 0;
4094
4095                 /* Request the device info from the local MC. */
4096                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4097                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4098                 msg.data = NULL;
4099                 msg.data_len = 0;
4100                 intf->null_user_handler = device_id_fetcher;
4101                 i_ipmi_request(NULL,
4102                                intf,
4103                                &addr,
4104                                0,
4105                                &msg,
4106                                intf,
4107                                &smi_msg,
4108                                &recv_msg,
4109                                0,
4110                                intf->channels[0].address,
4111                                intf->channels[0].lun,
4112                                0, 1); /* Don't retry, and don't wait. */
4113
4114                 if (intf->local_event_generator) {
4115                         /* Request the event receiver from the local MC. */
4116                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4117                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4118                         msg.data = NULL;
4119                         msg.data_len = 0;
4120                         intf->null_user_handler = event_receiver_fetcher;
4121                         i_ipmi_request(NULL,
4122                                        intf,
4123                                        &addr,
4124                                        0,
4125                                        &msg,
4126                                        intf,
4127                                        &smi_msg,
4128                                        &recv_msg,
4129                                        0,
4130                                        intf->channels[0].address,
4131                                        intf->channels[0].lun,
4132                                        0, 1); /* no retry, and no wait. */
4133                 }
4134                 intf->null_user_handler = NULL;
4135
4136                 /*
4137                  * Validate the event receiver.  The low bit must not
4138                  * be 1 (it must be a valid IPMB address), it cannot
4139                  * be zero, and it must not be my address.
4140                  */
4141                 if (((intf->event_receiver & 1) == 0)
4142                     && (intf->event_receiver != 0)
4143                     && (intf->event_receiver != intf->channels[0].address)) {
4144                         /*
4145                          * The event receiver is valid, send an IPMB
4146                          * message.
4147                          */
4148                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4149                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4150                         ipmb->channel = 0; /* FIXME - is this right? */
4151                         ipmb->lun = intf->event_receiver_lun;
4152                         ipmb->slave_addr = intf->event_receiver;
4153                 } else if (intf->local_sel_device) {
4154                         /*
4155                          * The event receiver was not valid (or was
4156                          * me), but I am an SEL device, just dump it
4157                          * in my SEL.
4158                          */
4159                         si = (struct ipmi_system_interface_addr *) &addr;
4160                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4161                         si->channel = IPMI_BMC_CHANNEL;
4162                         si->lun = 0;
4163                 } else
4164                         continue; /* No where to send the event. */
4165
4166                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4167                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4168                 msg.data = data;
4169                 msg.data_len = 16;
4170
4171                 j = 0;
4172                 while (*p) {
4173                         int size = strlen(p);
4174
4175                         if (size > 11)
4176                                 size = 11;
4177                         data[0] = 0;
4178                         data[1] = 0;
4179                         data[2] = 0xf0; /* OEM event without timestamp. */
4180                         data[3] = intf->channels[0].address;
4181                         data[4] = j++; /* sequence # */
4182                         /*
4183                          * Always give 11 bytes, so strncpy will fill
4184                          * it with zeroes for me.
4185                          */
4186                         strncpy(data+5, p, 11);
4187                         p += size;
4188
4189                         i_ipmi_request(NULL,
4190                                        intf,
4191                                        &addr,
4192                                        0,
4193                                        &msg,
4194                                        intf,
4195                                        &smi_msg,
4196                                        &recv_msg,
4197                                        0,
4198                                        intf->channels[0].address,
4199                                        intf->channels[0].lun,
4200                                        0, 1); /* no retry, and no wait. */
4201                 }
4202         }
4203 #endif /* CONFIG_IPMI_PANIC_STRING */
4204 }
4205 #endif /* CONFIG_IPMI_PANIC_EVENT */
4206
4207 static int has_panicked;
4208
4209 static int panic_event(struct notifier_block *this,
4210                        unsigned long         event,
4211                        void                  *ptr)
4212 {
4213         ipmi_smi_t intf;
4214
4215         if (has_panicked)
4216                 return NOTIFY_DONE;
4217         has_panicked = 1;
4218
4219         /* For every registered interface, set it to run to completion. */
4220         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4221                 if (!intf->handlers)
4222                         /* Interface is not ready. */
4223                         continue;
4224
4225                 intf->run_to_completion = 1;
4226                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4227         }
4228
4229 #ifdef CONFIG_IPMI_PANIC_EVENT
4230         send_panic_events(ptr);
4231 #endif
4232
4233         return NOTIFY_DONE;
4234 }
4235
4236 static struct notifier_block panic_block = {
4237         .notifier_call  = panic_event,
4238         .next           = NULL,
4239         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4240 };
4241
4242 static int ipmi_init_msghandler(void)
4243 {
4244         int rv;
4245
4246         if (initialized)
4247                 return 0;
4248
4249         rv = driver_register(&ipmidriver.driver);
4250         if (rv) {
4251                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4252                 return rv;
4253         }
4254
4255         printk(KERN_INFO "ipmi message handler version "
4256                IPMI_DRIVER_VERSION "\n");
4257
4258 #ifdef CONFIG_PROC_FS
4259         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4260         if (!proc_ipmi_root) {
4261             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4262             return -ENOMEM;
4263         }
4264
4265 #endif /* CONFIG_PROC_FS */
4266
4267         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4268         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4269
4270         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4271
4272         initialized = 1;
4273
4274         return 0;
4275 }
4276
4277 static __init int ipmi_init_msghandler_mod(void)
4278 {
4279         ipmi_init_msghandler();
4280         return 0;
4281 }
4282
4283 static __exit void cleanup_ipmi(void)
4284 {
4285         int count;
4286
4287         if (!initialized)
4288                 return;
4289
4290         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4291
4292         /*
4293          * This can't be called if any interfaces exist, so no worry
4294          * about shutting down the interfaces.
4295          */
4296
4297         /*
4298          * Tell the timer to stop, then wait for it to stop.  This
4299          * avoids problems with race conditions removing the timer
4300          * here.
4301          */
4302         atomic_inc(&stop_operation);
4303         del_timer_sync(&ipmi_timer);
4304
4305 #ifdef CONFIG_PROC_FS
4306         remove_proc_entry(proc_ipmi_root->name, NULL);
4307 #endif /* CONFIG_PROC_FS */
4308
4309         driver_unregister(&ipmidriver.driver);
4310
4311         initialized = 0;
4312
4313         /* Check for buffer leaks. */
4314         count = atomic_read(&smi_msg_inuse_count);
4315         if (count != 0)
4316                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4317                        count);
4318         count = atomic_read(&recv_msg_inuse_count);
4319         if (count != 0)
4320                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4321                        count);
4322 }
4323 module_exit(cleanup_ipmi);
4324
4325 module_init(ipmi_init_msghandler_mod);
4326 MODULE_LICENSE("GPL");
4327 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4328 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4329                    " interface.");
4330 MODULE_VERSION(IPMI_DRIVER_VERSION);