drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <asm/system.h>
  37 #include <linux/poll.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/mutex.h>
  40 #include <linux/slab.h>
  41 #include <linux/ipmi.h>
  42 #include <linux/ipmi_smi.h>
  43 #include <linux/notifier.h>
  44 #include <linux/init.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/rcupdate.h>
  47
  48 #define PFX "IPMI message handler: "
  49
  50 #define IPMI_DRIVER_VERSION "39.1"
  51
  52 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  53 static int ipmi_init_msghandler(void);
  54
  55 static int initialized;
  56
  57 #ifdef CONFIG_PROC_FS
  58 static struct proc_dir_entry *proc_ipmi_root;
  59 #endif /* CONFIG_PROC_FS */
  60
  61 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  62 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  63
  64 #define MAX_EVENTS_IN_QUEUE     25
  65
  66 /* Don't let a message sit in a queue forever, always time it with at lest
  67    the max message timer.  This is in milliseconds. */
  68 #define MAX_MSG_TIMEOUT         60000
  69
  70
  71 /*
  72  * The main "user" data structure.
  73  */
  74 struct ipmi_user
  75 {
  76         struct list_head link;
  77
  78         /* Set to "0" when the user is destroyed. */
  79         int valid;
  80
  81         struct kref refcount;
  82
  83         /* The upper layer that handles receive messages. */
  84         struct ipmi_user_hndl *handler;
  85         void             *handler_data;
  86
  87         /* The interface this user is bound to. */
  88         ipmi_smi_t intf;
  89
  90         /* Does this interface receive IPMI events? */
  91         int gets_events;
  92 };
  93
  94 struct cmd_rcvr
  95 {
  96         struct list_head link;
  97
  98         ipmi_user_t   user;
  99         unsigned char netfn;
 100         unsigned char cmd;
 101         unsigned int  chans;
 102
 103         /*
 104          * This is used to form a linked lised during mass deletion.
 105          * Since this is in an RCU list, we cannot use the link above
 106          * or change any data until the RCU period completes.  So we
 107          * use this next variable during mass deletion so we can have
 108          * a list and don't have to wait and restart the search on
 109          * every individual deletion of a command. */
 110         struct cmd_rcvr *next;
 111 };
 112
 113 struct seq_table
 114 {
 115         unsigned int         inuse : 1;
 116         unsigned int         broadcast : 1;
 117
 118         unsigned long        timeout;
 119         unsigned long        orig_timeout;
 120         unsigned int         retries_left;
 121
 122         /* To verify on an incoming send message response that this is
 123            the message that the response is for, we keep a sequence id
 124            and increment it every time we send a message. */
 125         long                 seqid;
 126
 127         /* This is held so we can properly respond to the message on a
 128            timeout, and it is used to hold the temporary data for
 129            retransmission, too. */
 130         struct ipmi_recv_msg *recv_msg;
 131 };
 132
 133 /* Store the information in a msgid (long) to allow us to find a
 134    sequence table entry from the msgid. */
 135 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 136
 137 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 138         do {                                                            \
 139                 seq = ((msgid >> 26) & 0x3f);                           \
 140                 seqid = (msgid & 0x3fffff);                             \
 141         } while (0)
 142
 143 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 144
 145 struct ipmi_channel
 146 {
 147         unsigned char medium;
 148         unsigned char protocol;
 149
 150         /* My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 151            but may be changed by the user. */
 152         unsigned char address;
 153
 154         /* My LUN.  This should generally stay the SMS LUN, but just in
 155            case... */
 156         unsigned char lun;
 157 };
 158
 159 #ifdef CONFIG_PROC_FS
 160 struct ipmi_proc_entry
 161 {
 162         char                   *name;
 163         struct ipmi_proc_entry *next;
 164 };
 165 #endif
 166
 167 struct bmc_device
 168 {
 169         struct platform_device *dev;
 170         struct ipmi_device_id  id;
 171         unsigned char          guid[16];
 172         int                    guid_set;
 173
 174         struct kref            refcount;
 175
 176         /* bmc device attributes */
 177         struct device_attribute device_id_attr;
 178         struct device_attribute provides_dev_sdrs_attr;
 179         struct device_attribute revision_attr;
 180         struct device_attribute firmware_rev_attr;
 181         struct device_attribute version_attr;
 182         struct device_attribute add_dev_support_attr;
 183         struct device_attribute manufacturer_id_attr;
 184         struct device_attribute product_id_attr;
 185         struct device_attribute guid_attr;
 186         struct device_attribute aux_firmware_rev_attr;
 187 };
 188
 189 #define IPMI_IPMB_NUM_SEQ       64
 190 #define IPMI_MAX_CHANNELS       16
 191 struct ipmi_smi
 192 {
 193         /* What interface number are we? */
 194         int intf_num;
 195
 196         struct kref refcount;
 197
 198         /* Used for a list of interfaces. */
 199         struct list_head link;
 200
 201         /* The list of upper layers that are using me.  seq_lock
 202          * protects this. */
 203         struct list_head users;
 204
 205         /* Information to supply to users. */
 206         unsigned char ipmi_version_major;
 207         unsigned char ipmi_version_minor;
 208
 209         /* Used for wake ups at startup. */
 210         wait_queue_head_t waitq;
 211
 212         struct bmc_device *bmc;
 213         char *my_dev_name;
 214         char *sysfs_name;
 215
 216         /* This is the lower-layer's sender routine.  Note that you
 217          * must either be holding the ipmi_interfaces_mutex or be in
 218          * an umpreemptible region to use this.  You must fetch the
 219          * value into a local variable and make sure it is not NULL. */
 220         struct ipmi_smi_handlers *handlers;
 221         void                     *send_info;
 222
 223 #ifdef CONFIG_PROC_FS
 224         /* A list of proc entries for this interface. */
 225         struct mutex           proc_entry_lock;
 226         struct ipmi_proc_entry *proc_entries;
 227 #endif
 228
 229         /* Driver-model device for the system interface. */
 230         struct device          *si_dev;
 231
 232         /* A table of sequence numbers for this interface.  We use the
 233            sequence numbers for IPMB messages that go out of the
 234            interface to match them up with their responses.  A routine
 235            is called periodically to time the items in this list. */
 236         spinlock_t       seq_lock;
 237         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 238         int curr_seq;
 239
 240         /* Messages that were delayed for some reason (out of memory,
 241            for instance), will go in here to be processed later in a
 242            periodic timer interrupt. */
 243         spinlock_t       waiting_msgs_lock;
 244         struct list_head waiting_msgs;
 245
 246         /* The list of command receivers that are registered for commands
 247            on this interface. */
 248         struct mutex     cmd_rcvrs_mutex;
 249         struct list_head cmd_rcvrs;
 250
 251         /* Events that were queues because no one was there to receive
 252            them. */
 253         spinlock_t       events_lock; /* For dealing with event stuff. */
 254         struct list_head waiting_events;
 255         unsigned int     waiting_events_count; /* How many events in queue? */
 256         int              delivering_events;
 257
 258         /* The event receiver for my BMC, only really used at panic
 259            shutdown as a place to store this. */
 260         unsigned char event_receiver;
 261         unsigned char event_receiver_lun;
 262         unsigned char local_sel_device;
 263         unsigned char local_event_generator;
 264
 265         /* For handling of maintenance mode. */
 266         int maintenance_mode;
 267         int maintenance_mode_enable;
 268         int auto_maintenance_timeout;
 269         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 270
 271         /* A cheap hack, if this is non-null and a message to an
 272            interface comes in with a NULL user, call this routine with
 273            it.  Note that the message will still be freed by the
 274            caller.  This only works on the system interface. */
 275         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 276
 277         /* When we are scanning the channels for an SMI, this will
 278            tell which channel we are scanning. */
 279         int curr_channel;
 280
 281         /* Channel information */
 282         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 283
 284         /* Proc FS stuff. */
 285         struct proc_dir_entry *proc_dir;
 286         char                  proc_dir_name[10];
 287
 288         spinlock_t   counter_lock; /* For making counters atomic. */
 289
 290         /* Commands we got that were invalid. */
 291         unsigned int sent_invalid_commands;
 292
 293         /* Commands we sent to the MC. */
 294         unsigned int sent_local_commands;
 295         /* Responses from the MC that were delivered to a user. */
 296         unsigned int handled_local_responses;
 297         /* Responses from the MC that were not delivered to a user. */
 298         unsigned int unhandled_local_responses;
 299
 300         /* Commands we sent out to the IPMB bus. */
 301         unsigned int sent_ipmb_commands;
 302         /* Commands sent on the IPMB that had errors on the SEND CMD */
 303         unsigned int sent_ipmb_command_errs;
 304         /* Each retransmit increments this count. */
 305         unsigned int retransmitted_ipmb_commands;
 306         /* When a message times out (runs out of retransmits) this is
 307            incremented. */
 308         unsigned int timed_out_ipmb_commands;
 309
 310         /* This is like above, but for broadcasts.  Broadcasts are
 311            *not* included in the above count (they are expected to
 312            time out). */
 313         unsigned int timed_out_ipmb_broadcasts;
 314
 315         /* Responses I have sent to the IPMB bus. */
 316         unsigned int sent_ipmb_responses;
 317
 318         /* The response was delivered to the user. */
 319         unsigned int handled_ipmb_responses;
 320         /* The response had invalid data in it. */
 321         unsigned int invalid_ipmb_responses;
 322         /* The response didn't have anyone waiting for it. */
 323         unsigned int unhandled_ipmb_responses;
 324
 325         /* Commands we sent out to the IPMB bus. */
 326         unsigned int sent_lan_commands;
 327         /* Commands sent on the IPMB that had errors on the SEND CMD */
 328         unsigned int sent_lan_command_errs;
 329         /* Each retransmit increments this count. */
 330         unsigned int retransmitted_lan_commands;
 331         /* When a message times out (runs out of retransmits) this is
 332            incremented. */
 333         unsigned int timed_out_lan_commands;
 334
 335         /* Responses I have sent to the IPMB bus. */
 336         unsigned int sent_lan_responses;
 337
 338         /* The response was delivered to the user. */
 339         unsigned int handled_lan_responses;
 340         /* The response had invalid data in it. */
 341         unsigned int invalid_lan_responses;
 342         /* The response didn't have anyone waiting for it. */
 343         unsigned int unhandled_lan_responses;
 344
 345         /* The command was delivered to the user. */
 346         unsigned int handled_commands;
 347         /* The command had invalid data in it. */
 348         unsigned int invalid_commands;
 349         /* The command didn't have anyone waiting for it. */
 350         unsigned int unhandled_commands;
 351
 352         /* Invalid data in an event. */
 353         unsigned int invalid_events;
 354         /* Events that were received with the proper format. */
 355         unsigned int events;
 356 };
 357 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 358
 359 /**
 360  * The driver model view of the IPMI messaging driver.
 361  */
 362 static struct device_driver ipmidriver = {
 363         .name = "ipmi",
 364         .bus = &platform_bus_type
 365 };
 366 static DEFINE_MUTEX(ipmidriver_mutex);
 367
 368 static LIST_HEAD(ipmi_interfaces);
 369 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 370
 371 /* List of watchers that want to know when smi's are added and
 372    deleted. */
 373 static LIST_HEAD(smi_watchers);
 374 static DEFINE_MUTEX(smi_watchers_mutex);
 375
 376
 377 static void free_recv_msg_list(struct list_head *q)
 378 {
 379         struct ipmi_recv_msg *msg, *msg2;
 380
 381         list_for_each_entry_safe(msg, msg2, q, link) {
 382                 list_del(&msg->link);
 383                 ipmi_free_recv_msg(msg);
 384         }
 385 }
 386
 387 static void free_smi_msg_list(struct list_head *q)
 388 {
 389         struct ipmi_smi_msg *msg, *msg2;
 390
 391         list_for_each_entry_safe(msg, msg2, q, link) {
 392                 list_del(&msg->link);
 393                 ipmi_free_smi_msg(msg);
 394         }
 395 }
 396
 397 static void clean_up_interface_data(ipmi_smi_t intf)
 398 {
 399         int              i;
 400         struct cmd_rcvr  *rcvr, *rcvr2;
 401         struct list_head list;
 402
 403         free_smi_msg_list(&intf->waiting_msgs);
 404         free_recv_msg_list(&intf->waiting_events);
 405
 406         /*
 407          * Wholesale remove all the entries from the list in the
 408          * interface and wait for RCU to know that none are in use.
 409          */
 410         mutex_lock(&intf->cmd_rcvrs_mutex);
 411         INIT_LIST_HEAD(&list);
 412         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 413         mutex_unlock(&intf->cmd_rcvrs_mutex);
 414
 415         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 416                 kfree(rcvr);
 417
 418         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 419                 if ((intf->seq_table[i].inuse)
 420                     && (intf->seq_table[i].recv_msg))
 421                 {
 422                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 423                 }
 424         }
 425 }
 426
 427 static void intf_free(struct kref *ref)
 428 {
 429         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 430
 431         clean_up_interface_data(intf);
 432         kfree(intf);
 433 }
 434
 435 struct watcher_entry {
 436         int              intf_num;
 437         ipmi_smi_t       intf;
 438         struct list_head link;
 439 };
 440
 441 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 442 {
 443         ipmi_smi_t intf;
 444         LIST_HEAD(to_deliver);
 445         struct watcher_entry *e, *e2;
 446
 447         mutex_lock(&smi_watchers_mutex);
 448
 449         mutex_lock(&ipmi_interfaces_mutex);
 450
 451         /* Build a list of things to deliver. */
 452         list_for_each_entry(intf, &ipmi_interfaces, link) {
 453                 if (intf->intf_num == -1)
 454                         continue;
 455                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 456                 if (!e)
 457                         goto out_err;
 458                 kref_get(&intf->refcount);
 459                 e->intf = intf;
 460                 e->intf_num = intf->intf_num;
 461                 list_add_tail(&e->link, &to_deliver);
 462         }
 463
 464         /* We will succeed, so add it to the list. */
 465         list_add(&watcher->link, &smi_watchers);
 466
 467         mutex_unlock(&ipmi_interfaces_mutex);
 468
 469         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 470                 list_del(&e->link);
 471                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 472                 kref_put(&e->intf->refcount, intf_free);
 473                 kfree(e);
 474         }
 475
 476         mutex_unlock(&smi_watchers_mutex);
 477
 478         return 0;
 479
 480  out_err:
 481         mutex_unlock(&ipmi_interfaces_mutex);
 482         mutex_unlock(&smi_watchers_mutex);
 483         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 484                 list_del(&e->link);
 485                 kref_put(&e->intf->refcount, intf_free);
 486                 kfree(e);
 487         }
 488         return -ENOMEM;
 489 }
 490
 491 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 492 {
 493         mutex_lock(&smi_watchers_mutex);
 494         list_del(&(watcher->link));
 495         mutex_unlock(&smi_watchers_mutex);
 496         return 0;
 497 }
 498
 499 /*
 500  * Must be called with smi_watchers_mutex held.
 501  */
 502 static void
 503 call_smi_watchers(int i, struct device *dev)
 504 {
 505         struct ipmi_smi_watcher *w;
 506
 507         list_for_each_entry(w, &smi_watchers, link) {
 508                 if (try_module_get(w->owner)) {
 509                         w->new_smi(i, dev);
 510                         module_put(w->owner);
 511                 }
 512         }
 513 }
 514
 515 static int
 516 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 517 {
 518         if (addr1->addr_type != addr2->addr_type)
 519                 return 0;
 520
 521         if (addr1->channel != addr2->channel)
 522                 return 0;
 523
 524         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 525                 struct ipmi_system_interface_addr *smi_addr1
 526                     = (struct ipmi_system_interface_addr *) addr1;
 527                 struct ipmi_system_interface_addr *smi_addr2
 528                     = (struct ipmi_system_interface_addr *) addr2;
 529                 return (smi_addr1->lun == smi_addr2->lun);
 530         }
 531
 532         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 533             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 534         {
 535                 struct ipmi_ipmb_addr *ipmb_addr1
 536                     = (struct ipmi_ipmb_addr *) addr1;
 537                 struct ipmi_ipmb_addr *ipmb_addr2
 538                     = (struct ipmi_ipmb_addr *) addr2;
 539
 540                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 541                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 542         }
 543
 544         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 545                 struct ipmi_lan_addr *lan_addr1
 546                         = (struct ipmi_lan_addr *) addr1;
 547                 struct ipmi_lan_addr *lan_addr2
 548                     = (struct ipmi_lan_addr *) addr2;
 549
 550                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 551                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 552                         && (lan_addr1->session_handle
 553                             == lan_addr2->session_handle)
 554                         && (lan_addr1->lun == lan_addr2->lun));
 555         }
 556
 557         return 1;
 558 }
 559
 560 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 561 {
 562         if (len < sizeof(struct ipmi_system_interface_addr)) {
 563                 return -EINVAL;
 564         }
 565
 566         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 567                 if (addr->channel != IPMI_BMC_CHANNEL)
 568                         return -EINVAL;
 569                 return 0;
 570         }
 571
 572         if ((addr->channel == IPMI_BMC_CHANNEL)
 573             || (addr->channel >= IPMI_MAX_CHANNELS)
 574             || (addr->channel < 0))
 575                 return -EINVAL;
 576
 577         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 578             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 579         {
 580                 if (len < sizeof(struct ipmi_ipmb_addr)) {
 581                         return -EINVAL;
 582                 }
 583                 return 0;
 584         }
 585
 586         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 587                 if (len < sizeof(struct ipmi_lan_addr)) {
 588                         return -EINVAL;
 589                 }
 590                 return 0;
 591         }
 592
 593         return -EINVAL;
 594 }
 595
 596 unsigned int ipmi_addr_length(int addr_type)
 597 {
 598         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 599                 return sizeof(struct ipmi_system_interface_addr);
 600
 601         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 602             || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 603         {
 604                 return sizeof(struct ipmi_ipmb_addr);
 605         }
 606
 607         if (addr_type == IPMI_LAN_ADDR_TYPE)
 608                 return sizeof(struct ipmi_lan_addr);
 609
 610         return 0;
 611 }
 612
 613 static void deliver_response(struct ipmi_recv_msg *msg)
 614 {
 615         if (!msg->user) {
 616                 ipmi_smi_t    intf = msg->user_msg_data;
 617                 unsigned long flags;
 618
 619                 /* Special handling for NULL users. */
 620                 if (intf->null_user_handler) {
 621                         intf->null_user_handler(intf, msg);
 622                         spin_lock_irqsave(&intf->counter_lock, flags);
 623                         intf->handled_local_responses++;
 624                         spin_unlock_irqrestore(&intf->counter_lock, flags);
 625                 } else {
 626                         /* No handler, so give up. */
 627                         spin_lock_irqsave(&intf->counter_lock, flags);
 628                         intf->unhandled_local_responses++;
 629                         spin_unlock_irqrestore(&intf->counter_lock, flags);
 630                 }
 631                 ipmi_free_recv_msg(msg);
 632         } else {
 633                 ipmi_user_t user = msg->user;
 634                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 635         }
 636 }
 637
 638 static void
 639 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 640 {
 641         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 642         msg->msg_data[0] = err;
 643         msg->msg.netfn |= 1; /* Convert to a response. */
 644         msg->msg.data_len = 1;
 645         msg->msg.data = msg->msg_data;
 646         deliver_response(msg);
 647 }
 648
 649 /* Find the next sequence number not being used and add the given
 650    message with the given timeout to the sequence table.  This must be
 651    called with the interface's seq_lock held. */
 652 static int intf_next_seq(ipmi_smi_t           intf,
 653                          struct ipmi_recv_msg *recv_msg,
 654                          unsigned long        timeout,
 655                          int                  retries,
 656                          int                  broadcast,
 657                          unsigned char        *seq,
 658                          long                 *seqid)
 659 {
 660         int          rv = 0;
 661         unsigned int i;
 662
 663         for (i = intf->curr_seq;
 664              (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 665              i = (i+1)%IPMI_IPMB_NUM_SEQ)
 666         {
 667                 if (!intf->seq_table[i].inuse)
 668                         break;
 669         }
 670
 671         if (!intf->seq_table[i].inuse) {
 672                 intf->seq_table[i].recv_msg = recv_msg;
 673
 674                 /* Start with the maximum timeout, when the send response
 675                    comes in we will start the real timer. */
 676                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 677                 intf->seq_table[i].orig_timeout = timeout;
 678                 intf->seq_table[i].retries_left = retries;
 679                 intf->seq_table[i].broadcast = broadcast;
 680                 intf->seq_table[i].inuse = 1;
 681                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 682                 *seq = i;
 683                 *seqid = intf->seq_table[i].seqid;
 684                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 685         } else {
 686                 rv = -EAGAIN;
 687         }
 688
 689         return rv;
 690 }
 691
 692 /* Return the receive message for the given sequence number and
 693    release the sequence number so it can be reused.  Some other data
 694    is passed in to be sure the message matches up correctly (to help
 695    guard against message coming in after their timeout and the
 696    sequence number being reused). */
 697 static int intf_find_seq(ipmi_smi_t           intf,
 698                          unsigned char        seq,
 699                          short                channel,
 700                          unsigned char        cmd,
 701                          unsigned char        netfn,
 702                          struct ipmi_addr     *addr,
 703                          struct ipmi_recv_msg **recv_msg)
 704 {
 705         int           rv = -ENODEV;
 706         unsigned long flags;
 707
 708         if (seq >= IPMI_IPMB_NUM_SEQ)
 709                 return -EINVAL;
 710
 711         spin_lock_irqsave(&(intf->seq_lock), flags);
 712         if (intf->seq_table[seq].inuse) {
 713                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 714
 715                 if ((msg->addr.channel == channel)
 716                     && (msg->msg.cmd == cmd)
 717                     && (msg->msg.netfn == netfn)
 718                     && (ipmi_addr_equal(addr, &(msg->addr))))
 719                 {
 720                         *recv_msg = msg;
 721                         intf->seq_table[seq].inuse = 0;
 722                         rv = 0;
 723                 }
 724         }
 725         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 726
 727         return rv;
 728 }
 729
 730
 731 /* Start the timer for a specific sequence table entry. */
 732 static int intf_start_seq_timer(ipmi_smi_t intf,
 733                                 long       msgid)
 734 {
 735         int           rv = -ENODEV;
 736         unsigned long flags;
 737         unsigned char seq;
 738         unsigned long seqid;
 739
 740
 741         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 742
 743         spin_lock_irqsave(&(intf->seq_lock), flags);
 744         /* We do this verification because the user can be deleted
 745            while a message is outstanding. */
 746         if ((intf->seq_table[seq].inuse)
 747             && (intf->seq_table[seq].seqid == seqid))
 748         {
 749                 struct seq_table *ent = &(intf->seq_table[seq]);
 750                 ent->timeout = ent->orig_timeout;
 751                 rv = 0;
 752         }
 753         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 754
 755         return rv;
 756 }
 757
 758 /* Got an error for the send message for a specific sequence number. */
 759 static int intf_err_seq(ipmi_smi_t   intf,
 760                         long         msgid,
 761                         unsigned int err)
 762 {
 763         int                  rv = -ENODEV;
 764         unsigned long        flags;
 765         unsigned char        seq;
 766         unsigned long        seqid;
 767         struct ipmi_recv_msg *msg = NULL;
 768
 769
 770         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 771
 772         spin_lock_irqsave(&(intf->seq_lock), flags);
 773         /* We do this verification because the user can be deleted
 774            while a message is outstanding. */
 775         if ((intf->seq_table[seq].inuse)
 776             && (intf->seq_table[seq].seqid == seqid))
 777         {
 778                 struct seq_table *ent = &(intf->seq_table[seq]);
 779
 780                 ent->inuse = 0;
 781                 msg = ent->recv_msg;
 782                 rv = 0;
 783         }
 784         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 785
 786         if (msg)
 787                 deliver_err_response(msg, err);
 788
 789         return rv;
 790 }
 791
 792
 793 int ipmi_create_user(unsigned int          if_num,
 794                      struct ipmi_user_hndl *handler,
 795                      void                  *handler_data,
 796                      ipmi_user_t           *user)
 797 {
 798         unsigned long flags;
 799         ipmi_user_t   new_user;
 800         int           rv = 0;
 801         ipmi_smi_t    intf;
 802
 803         /* There is no module usecount here, because it's not
 804            required.  Since this can only be used by and called from
 805            other modules, they will implicitly use this module, and
 806            thus this can't be removed unless the other modules are
 807            removed. */
 808
 809         if (handler == NULL)
 810                 return -EINVAL;
 811
 812         /* Make sure the driver is actually initialized, this handles
 813            problems with initialization order. */
 814         if (!initialized) {
 815                 rv = ipmi_init_msghandler();
 816                 if (rv)
 817                         return rv;
 818
 819                 /* The init code doesn't return an error if it was turned
 820                    off, but it won't initialize.  Check that. */
 821                 if (!initialized)
 822                         return -ENODEV;
 823         }
 824
 825         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 826         if (!new_user)
 827                 return -ENOMEM;
 828
 829         mutex_lock(&ipmi_interfaces_mutex);
 830         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 831                 if (intf->intf_num == if_num)
 832                         goto found;
 833         }
 834         /* Not found, return an error */
 835         rv = -EINVAL;
 836         goto out_kfree;
 837
 838  found:
 839         /* Note that each existing user holds a refcount to the interface. */
 840         kref_get(&intf->refcount);
 841
 842         kref_init(&new_user->refcount);
 843         new_user->handler = handler;
 844         new_user->handler_data = handler_data;
 845         new_user->intf = intf;
 846         new_user->gets_events = 0;
 847
 848         if (!try_module_get(intf->handlers->owner)) {
 849                 rv = -ENODEV;
 850                 goto out_kref;
 851         }
 852
 853         if (intf->handlers->inc_usecount) {
 854                 rv = intf->handlers->inc_usecount(intf->send_info);
 855                 if (rv) {
 856                         module_put(intf->handlers->owner);
 857                         goto out_kref;
 858                 }
 859         }
 860
 861         /* Hold the lock so intf->handlers is guaranteed to be good
 862          * until now */
 863         mutex_unlock(&ipmi_interfaces_mutex);
 864
 865         new_user->valid = 1;
 866         spin_lock_irqsave(&intf->seq_lock, flags);
 867         list_add_rcu(&new_user->link, &intf->users);
 868         spin_unlock_irqrestore(&intf->seq_lock, flags);
 869         *user = new_user;
 870         return 0;
 871
 872 out_kref:
 873         kref_put(&intf->refcount, intf_free);
 874 out_kfree:
 875         mutex_unlock(&ipmi_interfaces_mutex);
 876         kfree(new_user);
 877         return rv;
 878 }
 879
 880 static void free_user(struct kref *ref)
 881 {
 882         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
 883         kfree(user);
 884 }
 885
 886 int ipmi_destroy_user(ipmi_user_t user)
 887 {
 888         ipmi_smi_t       intf = user->intf;
 889         int              i;
 890         unsigned long    flags;
 891         struct cmd_rcvr  *rcvr;
 892         struct cmd_rcvr  *rcvrs = NULL;
 893
 894         user->valid = 0;
 895
 896         /* Remove the user from the interface's sequence table. */
 897         spin_lock_irqsave(&intf->seq_lock, flags);
 898         list_del_rcu(&user->link);
 899
 900         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 901                 if (intf->seq_table[i].inuse
 902                     && (intf->seq_table[i].recv_msg->user == user))
 903                 {
 904                         intf->seq_table[i].inuse = 0;
 905                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 906                 }
 907         }
 908         spin_unlock_irqrestore(&intf->seq_lock, flags);
 909
 910         /*
 911          * Remove the user from the command receiver's table.  First
 912          * we build a list of everything (not using the standard link,
 913          * since other things may be using it till we do
 914          * synchronize_rcu()) then free everything in that list.
 915          */
 916         mutex_lock(&intf->cmd_rcvrs_mutex);
 917         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
 918                 if (rcvr->user == user) {
 919                         list_del_rcu(&rcvr->link);
 920                         rcvr->next = rcvrs;
 921                         rcvrs = rcvr;
 922                 }
 923         }
 924         mutex_unlock(&intf->cmd_rcvrs_mutex);
 925         synchronize_rcu();
 926         while (rcvrs) {
 927                 rcvr = rcvrs;
 928                 rcvrs = rcvr->next;
 929                 kfree(rcvr);
 930         }
 931
 932         mutex_lock(&ipmi_interfaces_mutex);
 933         if (intf->handlers) {
 934                 module_put(intf->handlers->owner);
 935                 if (intf->handlers->dec_usecount)
 936                         intf->handlers->dec_usecount(intf->send_info);
 937         }
 938         mutex_unlock(&ipmi_interfaces_mutex);
 939
 940         kref_put(&intf->refcount, intf_free);
 941
 942         kref_put(&user->refcount, free_user);
 943
 944         return 0;
 945 }
 946
 947 void ipmi_get_version(ipmi_user_t   user,
 948                       unsigned char *major,
 949                       unsigned char *minor)
 950 {
 951         *major = user->intf->ipmi_version_major;
 952         *minor = user->intf->ipmi_version_minor;
 953 }
 954
 955 int ipmi_set_my_address(ipmi_user_t   user,
 956                         unsigned int  channel,
 957                         unsigned char address)
 958 {
 959         if (channel >= IPMI_MAX_CHANNELS)
 960                 return -EINVAL;
 961         user->intf->channels[channel].address = address;
 962         return 0;
 963 }
 964
 965 int ipmi_get_my_address(ipmi_user_t   user,
 966                         unsigned int  channel,
 967                         unsigned char *address)
 968 {
 969         if (channel >= IPMI_MAX_CHANNELS)
 970                 return -EINVAL;
 971         *address = user->intf->channels[channel].address;
 972         return 0;
 973 }
 974
 975 int ipmi_set_my_LUN(ipmi_user_t   user,
 976                     unsigned int  channel,
 977                     unsigned char LUN)
 978 {
 979         if (channel >= IPMI_MAX_CHANNELS)
 980                 return -EINVAL;
 981         user->intf->channels[channel].lun = LUN & 0x3;
 982         return 0;
 983 }
 984
 985 int ipmi_get_my_LUN(ipmi_user_t   user,
 986                     unsigned int  channel,
 987                     unsigned char *address)
 988 {
 989         if (channel >= IPMI_MAX_CHANNELS)
 990                 return -EINVAL;
 991         *address = user->intf->channels[channel].lun;
 992         return 0;
 993 }
 994
 995 int ipmi_get_maintenance_mode(ipmi_user_t user)
 996 {
 997         int           mode;
 998         unsigned long flags;
 999
1000         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1001         mode = user->intf->maintenance_mode;
1002         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1003
1004         return mode;
1005 }
1006 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1007
1008 static void maintenance_mode_update(ipmi_smi_t intf)
1009 {
1010         if (intf->handlers->set_maintenance_mode)
1011                 intf->handlers->set_maintenance_mode(
1012                         intf->send_info, intf->maintenance_mode_enable);
1013 }
1014
1015 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1016 {
1017         int           rv = 0;
1018         unsigned long flags;
1019         ipmi_smi_t    intf = user->intf;
1020
1021         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1022         if (intf->maintenance_mode != mode) {
1023                 switch (mode) {
1024                 case IPMI_MAINTENANCE_MODE_AUTO:
1025                         intf->maintenance_mode = mode;
1026                         intf->maintenance_mode_enable
1027                                 = (intf->auto_maintenance_timeout > 0);
1028                         break;
1029
1030                 case IPMI_MAINTENANCE_MODE_OFF:
1031                         intf->maintenance_mode = mode;
1032                         intf->maintenance_mode_enable = 0;
1033                         break;
1034
1035                 case IPMI_MAINTENANCE_MODE_ON:
1036                         intf->maintenance_mode = mode;
1037                         intf->maintenance_mode_enable = 1;
1038                         break;
1039
1040                 default:
1041                         rv = -EINVAL;
1042                         goto out_unlock;
1043                 }
1044
1045                 maintenance_mode_update(intf);
1046         }
1047  out_unlock:
1048         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1049
1050         return rv;
1051 }
1052 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1053
1054 int ipmi_set_gets_events(ipmi_user_t user, int val)
1055 {
1056         unsigned long        flags;
1057         ipmi_smi_t           intf = user->intf;
1058         struct ipmi_recv_msg *msg, *msg2;
1059         struct list_head     msgs;
1060
1061         INIT_LIST_HEAD(&msgs);
1062
1063         spin_lock_irqsave(&intf->events_lock, flags);
1064         user->gets_events = val;
1065
1066         if (intf->delivering_events)
1067                 /*
1068                  * Another thread is delivering events for this, so
1069                  * let it handle any new events.
1070                  */
1071                 goto out;
1072
1073         /* Deliver any queued events. */
1074         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1075                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1076                         list_move_tail(&msg->link, &msgs);
1077                 intf->waiting_events_count = 0;
1078
1079                 intf->delivering_events = 1;
1080                 spin_unlock_irqrestore(&intf->events_lock, flags);
1081
1082                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1083                         msg->user = user;
1084                         kref_get(&user->refcount);
1085                         deliver_response(msg);
1086                 }
1087
1088                 spin_lock_irqsave(&intf->events_lock, flags);
1089                 intf->delivering_events = 0;
1090         }
1091
1092  out:
1093         spin_unlock_irqrestore(&intf->events_lock, flags);
1094
1095         return 0;
1096 }
1097
1098 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1099                                       unsigned char netfn,
1100                                       unsigned char cmd,
1101                                       unsigned char chan)
1102 {
1103         struct cmd_rcvr *rcvr;
1104
1105         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1106                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1107                                         && (rcvr->chans & (1 << chan)))
1108                         return rcvr;
1109         }
1110         return NULL;
1111 }
1112
1113 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1114                                  unsigned char netfn,
1115                                  unsigned char cmd,
1116                                  unsigned int  chans)
1117 {
1118         struct cmd_rcvr *rcvr;
1119
1120         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1121                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1122                                         && (rcvr->chans & chans))
1123                         return 0;
1124         }
1125         return 1;
1126 }
1127
1128 int ipmi_register_for_cmd(ipmi_user_t   user,
1129                           unsigned char netfn,
1130                           unsigned char cmd,
1131                           unsigned int  chans)
1132 {
1133         ipmi_smi_t      intf = user->intf;
1134         struct cmd_rcvr *rcvr;
1135         int             rv = 0;
1136
1137
1138         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1139         if (!rcvr)
1140                 return -ENOMEM;
1141         rcvr->cmd = cmd;
1142         rcvr->netfn = netfn;
1143         rcvr->chans = chans;
1144         rcvr->user = user;
1145
1146         mutex_lock(&intf->cmd_rcvrs_mutex);
1147         /* Make sure the command/netfn is not already registered. */
1148         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1149                 rv = -EBUSY;
1150                 goto out_unlock;
1151         }
1152
1153         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1154
1155  out_unlock:
1156         mutex_unlock(&intf->cmd_rcvrs_mutex);
1157         if (rv)
1158                 kfree(rcvr);
1159
1160         return rv;
1161 }
1162
1163 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1164                             unsigned char netfn,
1165                             unsigned char cmd,
1166                             unsigned int  chans)
1167 {
1168         ipmi_smi_t      intf = user->intf;
1169         struct cmd_rcvr *rcvr;
1170         struct cmd_rcvr *rcvrs = NULL;
1171         int i, rv = -ENOENT;
1172
1173         mutex_lock(&intf->cmd_rcvrs_mutex);
1174         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1175                 if (((1 << i) & chans) == 0)
1176                         continue;
1177                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1178                 if (rcvr == NULL)
1179                         continue;
1180                 if (rcvr->user == user) {
1181                         rv = 0;
1182                         rcvr->chans &= ~chans;
1183                         if (rcvr->chans == 0) {
1184                                 list_del_rcu(&rcvr->link);
1185                                 rcvr->next = rcvrs;
1186                                 rcvrs = rcvr;
1187                         }
1188                 }
1189         }
1190         mutex_unlock(&intf->cmd_rcvrs_mutex);
1191         synchronize_rcu();
1192         while (rcvrs) {
1193                 rcvr = rcvrs;
1194                 rcvrs = rcvr->next;
1195                 kfree(rcvr);
1196         }
1197         return rv;
1198 }
1199
1200 static unsigned char
1201 ipmb_checksum(unsigned char *data, int size)
1202 {
1203         unsigned char csum = 0;
1204
1205         for (; size > 0; size--, data++)
1206                 csum += *data;
1207
1208         return -csum;
1209 }
1210
1211 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1212                                    struct kernel_ipmi_msg *msg,
1213                                    struct ipmi_ipmb_addr *ipmb_addr,
1214                                    long                  msgid,
1215                                    unsigned char         ipmb_seq,
1216                                    int                   broadcast,
1217                                    unsigned char         source_address,
1218                                    unsigned char         source_lun)
1219 {
1220         int i = broadcast;
1221
1222         /* Format the IPMB header data. */
1223         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1224         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1225         smi_msg->data[2] = ipmb_addr->channel;
1226         if (broadcast)
1227                 smi_msg->data[3] = 0;
1228         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1229         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1230         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1231         smi_msg->data[i+6] = source_address;
1232         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1233         smi_msg->data[i+8] = msg->cmd;
1234
1235         /* Now tack on the data to the message. */
1236         if (msg->data_len > 0)
1237                 memcpy(&(smi_msg->data[i+9]), msg->data,
1238                        msg->data_len);
1239         smi_msg->data_size = msg->data_len + 9;
1240
1241         /* Now calculate the checksum and tack it on. */
1242         smi_msg->data[i+smi_msg->data_size]
1243                 = ipmb_checksum(&(smi_msg->data[i+6]),
1244                                 smi_msg->data_size-6);
1245
1246         /* Add on the checksum size and the offset from the
1247            broadcast. */
1248         smi_msg->data_size += 1 + i;
1249
1250         smi_msg->msgid = msgid;
1251 }
1252
1253 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1254                                   struct kernel_ipmi_msg *msg,
1255                                   struct ipmi_lan_addr  *lan_addr,
1256                                   long                  msgid,
1257                                   unsigned char         ipmb_seq,
1258                                   unsigned char         source_lun)
1259 {
1260         /* Format the IPMB header data. */
1261         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1262         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1263         smi_msg->data[2] = lan_addr->channel;
1264         smi_msg->data[3] = lan_addr->session_handle;
1265         smi_msg->data[4] = lan_addr->remote_SWID;
1266         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1267         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1268         smi_msg->data[7] = lan_addr->local_SWID;
1269         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1270         smi_msg->data[9] = msg->cmd;
1271
1272         /* Now tack on the data to the message. */
1273         if (msg->data_len > 0)
1274                 memcpy(&(smi_msg->data[10]), msg->data,
1275                        msg->data_len);
1276         smi_msg->data_size = msg->data_len + 10;
1277
1278         /* Now calculate the checksum and tack it on. */
1279         smi_msg->data[smi_msg->data_size]
1280                 = ipmb_checksum(&(smi_msg->data[7]),
1281                                 smi_msg->data_size-7);
1282
1283         /* Add on the checksum size and the offset from the
1284            broadcast. */
1285         smi_msg->data_size += 1;
1286
1287         smi_msg->msgid = msgid;
1288 }
1289
1290 /* Separate from ipmi_request so that the user does not have to be
1291    supplied in certain circumstances (mainly at panic time).  If
1292    messages are supplied, they will be freed, even if an error
1293    occurs. */
1294 static int i_ipmi_request(ipmi_user_t          user,
1295                           ipmi_smi_t           intf,
1296                           struct ipmi_addr     *addr,
1297                           long                 msgid,
1298                           struct kernel_ipmi_msg *msg,
1299                           void                 *user_msg_data,
1300                           void                 *supplied_smi,
1301                           struct ipmi_recv_msg *supplied_recv,
1302                           int                  priority,
1303                           unsigned char        source_address,
1304                           unsigned char        source_lun,
1305                           int                  retries,
1306                           unsigned int         retry_time_ms)
1307 {
1308         int                      rv = 0;
1309         struct ipmi_smi_msg      *smi_msg;
1310         struct ipmi_recv_msg     *recv_msg;
1311         unsigned long            flags;
1312         struct ipmi_smi_handlers *handlers;
1313
1314
1315         if (supplied_recv) {
1316                 recv_msg = supplied_recv;
1317         } else {
1318                 recv_msg = ipmi_alloc_recv_msg();
1319                 if (recv_msg == NULL) {
1320                         return -ENOMEM;
1321                 }
1322         }
1323         recv_msg->user_msg_data = user_msg_data;
1324
1325         if (supplied_smi) {
1326                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1327         } else {
1328                 smi_msg = ipmi_alloc_smi_msg();
1329                 if (smi_msg == NULL) {
1330                         ipmi_free_recv_msg(recv_msg);
1331                         return -ENOMEM;
1332                 }
1333         }
1334
1335         rcu_read_lock();
1336         handlers = intf->handlers;
1337         if (!handlers) {
1338                 rv = -ENODEV;
1339                 goto out_err;
1340         }
1341
1342         recv_msg->user = user;
1343         if (user)
1344                 kref_get(&user->refcount);
1345         recv_msg->msgid = msgid;
1346         /* Store the message to send in the receive message so timeout
1347            responses can get the proper response data. */
1348         recv_msg->msg = *msg;
1349
1350         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1351                 struct ipmi_system_interface_addr *smi_addr;
1352
1353                 if (msg->netfn & 1) {
1354                         /* Responses are not allowed to the SMI. */
1355                         rv = -EINVAL;
1356                         goto out_err;
1357                 }
1358
1359                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1360                 if (smi_addr->lun > 3) {
1361                         spin_lock_irqsave(&intf->counter_lock, flags);
1362                         intf->sent_invalid_commands++;
1363                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1364                         rv = -EINVAL;
1365                         goto out_err;
1366                 }
1367
1368                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1369
1370                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1371                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1372                         || (msg->cmd == IPMI_GET_MSG_CMD)
1373                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD)))
1374                 {
1375                         /* We don't let the user do these, since we manage
1376                            the sequence numbers. */
1377                         spin_lock_irqsave(&intf->counter_lock, flags);
1378                         intf->sent_invalid_commands++;
1379                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1380                         rv = -EINVAL;
1381                         goto out_err;
1382                 }
1383
1384                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1385                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1386                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1387                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST))
1388                 {
1389                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1390                         intf->auto_maintenance_timeout
1391                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1392                         if (!intf->maintenance_mode
1393                             && !intf->maintenance_mode_enable)
1394                         {
1395                                 intf->maintenance_mode_enable = 1;
1396                                 maintenance_mode_update(intf);
1397                         }
1398                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1399                                                flags);
1400                 }
1401
1402                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1403                         spin_lock_irqsave(&intf->counter_lock, flags);
1404                         intf->sent_invalid_commands++;
1405                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1406                         rv = -EMSGSIZE;
1407                         goto out_err;
1408                 }
1409
1410                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1411                 smi_msg->data[1] = msg->cmd;
1412                 smi_msg->msgid = msgid;
1413                 smi_msg->user_data = recv_msg;
1414                 if (msg->data_len > 0)
1415                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1416                 smi_msg->data_size = msg->data_len + 2;
1417                 spin_lock_irqsave(&intf->counter_lock, flags);
1418                 intf->sent_local_commands++;
1419                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1420         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1421                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
1422         {
1423                 struct ipmi_ipmb_addr *ipmb_addr;
1424                 unsigned char         ipmb_seq;
1425                 long                  seqid;
1426                 int                   broadcast = 0;
1427
1428                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1429                         spin_lock_irqsave(&intf->counter_lock, flags);
1430                         intf->sent_invalid_commands++;
1431                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1432                         rv = -EINVAL;
1433                         goto out_err;
1434                 }
1435
1436                 if (intf->channels[addr->channel].medium
1437                     != IPMI_CHANNEL_MEDIUM_IPMB)
1438                 {
1439                         spin_lock_irqsave(&intf->counter_lock, flags);
1440                         intf->sent_invalid_commands++;
1441                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1442                         rv = -EINVAL;
1443                         goto out_err;
1444                 }
1445
1446                 if (retries < 0) {
1447                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1448                         retries = 0; /* Don't retry broadcasts. */
1449                     else
1450                         retries = 4;
1451                 }
1452                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1453                     /* Broadcasts add a zero at the beginning of the
1454                        message, but otherwise is the same as an IPMB
1455                        address. */
1456                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1457                     broadcast = 1;
1458                 }
1459
1460
1461                 /* Default to 1 second retries. */
1462                 if (retry_time_ms == 0)
1463                     retry_time_ms = 1000;
1464
1465                 /* 9 for the header and 1 for the checksum, plus
1466                    possibly one for the broadcast. */
1467                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1468                         spin_lock_irqsave(&intf->counter_lock, flags);
1469                         intf->sent_invalid_commands++;
1470                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1471                         rv = -EMSGSIZE;
1472                         goto out_err;
1473                 }
1474
1475                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1476                 if (ipmb_addr->lun > 3) {
1477                         spin_lock_irqsave(&intf->counter_lock, flags);
1478                         intf->sent_invalid_commands++;
1479                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1480                         rv = -EINVAL;
1481                         goto out_err;
1482                 }
1483
1484                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1485
1486                 if (recv_msg->msg.netfn & 0x1) {
1487                         /* It's a response, so use the user's sequence
1488                            from msgid. */
1489                         spin_lock_irqsave(&intf->counter_lock, flags);
1490                         intf->sent_ipmb_responses++;
1491                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1492                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1493                                         msgid, broadcast,
1494                                         source_address, source_lun);
1495
1496                         /* Save the receive message so we can use it
1497                            to deliver the response. */
1498                         smi_msg->user_data = recv_msg;
1499                 } else {
1500                         /* It's a command, so get a sequence for it. */
1501
1502                         spin_lock_irqsave(&(intf->seq_lock), flags);
1503
1504                         spin_lock(&intf->counter_lock);
1505                         intf->sent_ipmb_commands++;
1506                         spin_unlock(&intf->counter_lock);
1507
1508                         /* Create a sequence number with a 1 second
1509                            timeout and 4 retries. */
1510                         rv = intf_next_seq(intf,
1511                                            recv_msg,
1512                                            retry_time_ms,
1513                                            retries,
1514                                            broadcast,
1515                                            &ipmb_seq,
1516                                            &seqid);
1517                         if (rv) {
1518                                 /* We have used up all the sequence numbers,
1519                                    probably, so abort. */
1520                                 spin_unlock_irqrestore(&(intf->seq_lock),
1521                                                        flags);
1522                                 goto out_err;
1523                         }
1524
1525                         /* Store the sequence number in the message,
1526                            so that when the send message response
1527                            comes back we can start the timer. */
1528                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1529                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1530                                         ipmb_seq, broadcast,
1531                                         source_address, source_lun);
1532
1533                         /* Copy the message into the recv message data, so we
1534                            can retransmit it later if necessary. */
1535                         memcpy(recv_msg->msg_data, smi_msg->data,
1536                                smi_msg->data_size);
1537                         recv_msg->msg.data = recv_msg->msg_data;
1538                         recv_msg->msg.data_len = smi_msg->data_size;
1539
1540                         /* We don't unlock until here, because we need
1541                            to copy the completed message into the
1542                            recv_msg before we release the lock.
1543                            Otherwise, race conditions may bite us.  I
1544                            know that's pretty paranoid, but I prefer
1545                            to be correct. */
1546                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1547                 }
1548         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1549                 struct ipmi_lan_addr  *lan_addr;
1550                 unsigned char         ipmb_seq;
1551                 long                  seqid;
1552
1553                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1554                         spin_lock_irqsave(&intf->counter_lock, flags);
1555                         intf->sent_invalid_commands++;
1556                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1557                         rv = -EINVAL;
1558                         goto out_err;
1559                 }
1560
1561                 if ((intf->channels[addr->channel].medium
1562                     != IPMI_CHANNEL_MEDIUM_8023LAN)
1563                     && (intf->channels[addr->channel].medium
1564                         != IPMI_CHANNEL_MEDIUM_ASYNC))
1565                 {
1566                         spin_lock_irqsave(&intf->counter_lock, flags);
1567                         intf->sent_invalid_commands++;
1568                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1569                         rv = -EINVAL;
1570                         goto out_err;
1571                 }
1572
1573                 retries = 4;
1574
1575                 /* Default to 1 second retries. */
1576                 if (retry_time_ms == 0)
1577                     retry_time_ms = 1000;
1578
1579                 /* 11 for the header and 1 for the checksum. */
1580                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1581                         spin_lock_irqsave(&intf->counter_lock, flags);
1582                         intf->sent_invalid_commands++;
1583                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1584                         rv = -EMSGSIZE;
1585                         goto out_err;
1586                 }
1587
1588                 lan_addr = (struct ipmi_lan_addr *) addr;
1589                 if (lan_addr->lun > 3) {
1590                         spin_lock_irqsave(&intf->counter_lock, flags);
1591                         intf->sent_invalid_commands++;
1592                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1593                         rv = -EINVAL;
1594                         goto out_err;
1595                 }
1596
1597                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1598
1599                 if (recv_msg->msg.netfn & 0x1) {
1600                         /* It's a response, so use the user's sequence
1601                            from msgid. */
1602                         spin_lock_irqsave(&intf->counter_lock, flags);
1603                         intf->sent_lan_responses++;
1604                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1605                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1606                                        msgid, source_lun);
1607
1608                         /* Save the receive message so we can use it
1609                            to deliver the response. */
1610                         smi_msg->user_data = recv_msg;
1611                 } else {
1612                         /* It's a command, so get a sequence for it. */
1613
1614                         spin_lock_irqsave(&(intf->seq_lock), flags);
1615
1616                         spin_lock(&intf->counter_lock);
1617                         intf->sent_lan_commands++;
1618                         spin_unlock(&intf->counter_lock);
1619
1620                         /* Create a sequence number with a 1 second
1621                            timeout and 4 retries. */
1622                         rv = intf_next_seq(intf,
1623                                            recv_msg,
1624                                            retry_time_ms,
1625                                            retries,
1626                                            0,
1627                                            &ipmb_seq,
1628                                            &seqid);
1629                         if (rv) {
1630                                 /* We have used up all the sequence numbers,
1631                                    probably, so abort. */
1632                                 spin_unlock_irqrestore(&(intf->seq_lock),
1633                                                        flags);
1634                                 goto out_err;
1635                         }
1636
1637                         /* Store the sequence number in the message,
1638                            so that when the send message response
1639                            comes back we can start the timer. */
1640                         format_lan_msg(smi_msg, msg, lan_addr,
1641                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1642                                        ipmb_seq, source_lun);
1643
1644                         /* Copy the message into the recv message data, so we
1645                            can retransmit it later if necessary. */
1646                         memcpy(recv_msg->msg_data, smi_msg->data,
1647                                smi_msg->data_size);
1648                         recv_msg->msg.data = recv_msg->msg_data;
1649                         recv_msg->msg.data_len = smi_msg->data_size;
1650
1651                         /* We don't unlock until here, because we need
1652                            to copy the completed message into the
1653                            recv_msg before we release the lock.
1654                            Otherwise, race conditions may bite us.  I
1655                            know that's pretty paranoid, but I prefer
1656                            to be correct. */
1657                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1658                 }
1659         } else {
1660             /* Unknown address type. */
1661                 spin_lock_irqsave(&intf->counter_lock, flags);
1662                 intf->sent_invalid_commands++;
1663                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1664                 rv = -EINVAL;
1665                 goto out_err;
1666         }
1667
1668 #ifdef DEBUG_MSGING
1669         {
1670                 int m;
1671                 for (m = 0; m < smi_msg->data_size; m++)
1672                         printk(" %2.2x", smi_msg->data[m]);
1673                 printk("\n");
1674         }
1675 #endif
1676
1677         handlers->sender(intf->send_info, smi_msg, priority);
1678         rcu_read_unlock();
1679
1680         return 0;
1681
1682  out_err:
1683         rcu_read_unlock();
1684         ipmi_free_smi_msg(smi_msg);
1685         ipmi_free_recv_msg(recv_msg);
1686         return rv;
1687 }
1688
1689 static int check_addr(ipmi_smi_t       intf,
1690                       struct ipmi_addr *addr,
1691                       unsigned char    *saddr,
1692                       unsigned char    *lun)
1693 {
1694         if (addr->channel >= IPMI_MAX_CHANNELS)
1695                 return -EINVAL;
1696         *lun = intf->channels[addr->channel].lun;
1697         *saddr = intf->channels[addr->channel].address;
1698         return 0;
1699 }
1700
1701 int ipmi_request_settime(ipmi_user_t      user,
1702                          struct ipmi_addr *addr,
1703                          long             msgid,
1704                          struct kernel_ipmi_msg  *msg,
1705                          void             *user_msg_data,
1706                          int              priority,
1707                          int              retries,
1708                          unsigned int     retry_time_ms)
1709 {
1710         unsigned char saddr, lun;
1711         int           rv;
1712
1713         if (!user)
1714                 return -EINVAL;
1715         rv = check_addr(user->intf, addr, &saddr, &lun);
1716         if (rv)
1717                 return rv;
1718         return i_ipmi_request(user,
1719                               user->intf,
1720                               addr,
1721                               msgid,
1722                               msg,
1723                               user_msg_data,
1724                               NULL, NULL,
1725                               priority,
1726                               saddr,
1727                               lun,
1728                               retries,
1729                               retry_time_ms);
1730 }
1731
1732 int ipmi_request_supply_msgs(ipmi_user_t          user,
1733                              struct ipmi_addr     *addr,
1734                              long                 msgid,
1735                              struct kernel_ipmi_msg *msg,
1736                              void                 *user_msg_data,
1737                              void                 *supplied_smi,
1738                              struct ipmi_recv_msg *supplied_recv,
1739                              int                  priority)
1740 {
1741         unsigned char saddr, lun;
1742         int           rv;
1743
1744         if (!user)
1745                 return -EINVAL;
1746         rv = check_addr(user->intf, addr, &saddr, &lun);
1747         if (rv)
1748                 return rv;
1749         return i_ipmi_request(user,
1750                               user->intf,
1751                               addr,
1752                               msgid,
1753                               msg,
1754                               user_msg_data,
1755                               supplied_smi,
1756                               supplied_recv,
1757                               priority,
1758                               saddr,
1759                               lun,
1760                               -1, 0);
1761 }
1762
1763 #ifdef CONFIG_PROC_FS
1764 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1765                                int count, int *eof, void *data)
1766 {
1767         char       *out = (char *) page;
1768         ipmi_smi_t intf = data;
1769         int        i;
1770         int        rv = 0;
1771
1772         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
1773                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
1774         out[rv-1] = '\n'; /* Replace the final space with a newline */
1775         out[rv] = '\0';
1776         rv++;
1777         return rv;
1778 }
1779
1780 static int version_file_read_proc(char *page, char **start, off_t off,
1781                                   int count, int *eof, void *data)
1782 {
1783         char       *out = (char *) page;
1784         ipmi_smi_t intf = data;
1785
1786         return sprintf(out, "%d.%d\n",
1787                        ipmi_version_major(&intf->bmc->id),
1788                        ipmi_version_minor(&intf->bmc->id));
1789 }
1790
1791 static int stat_file_read_proc(char *page, char **start, off_t off,
1792                                int count, int *eof, void *data)
1793 {
1794         char       *out = (char *) page;
1795         ipmi_smi_t intf = data;
1796
1797         out += sprintf(out, "sent_invalid_commands:       %d\n",
1798                        intf->sent_invalid_commands);
1799         out += sprintf(out, "sent_local_commands:         %d\n",
1800                        intf->sent_local_commands);
1801         out += sprintf(out, "handled_local_responses:     %d\n",
1802                        intf->handled_local_responses);
1803         out += sprintf(out, "unhandled_local_responses:   %d\n",
1804                        intf->unhandled_local_responses);
1805         out += sprintf(out, "sent_ipmb_commands:          %d\n",
1806                        intf->sent_ipmb_commands);
1807         out += sprintf(out, "sent_ipmb_command_errs:      %d\n",
1808                        intf->sent_ipmb_command_errs);
1809         out += sprintf(out, "retransmitted_ipmb_commands: %d\n",
1810                        intf->retransmitted_ipmb_commands);
1811         out += sprintf(out, "timed_out_ipmb_commands:     %d\n",
1812                        intf->timed_out_ipmb_commands);
1813         out += sprintf(out, "timed_out_ipmb_broadcasts:   %d\n",
1814                        intf->timed_out_ipmb_broadcasts);
1815         out += sprintf(out, "sent_ipmb_responses:         %d\n",
1816                        intf->sent_ipmb_responses);
1817         out += sprintf(out, "handled_ipmb_responses:      %d\n",
1818                        intf->handled_ipmb_responses);
1819         out += sprintf(out, "invalid_ipmb_responses:      %d\n",
1820                        intf->invalid_ipmb_responses);
1821         out += sprintf(out, "unhandled_ipmb_responses:    %d\n",
1822                        intf->unhandled_ipmb_responses);
1823         out += sprintf(out, "sent_lan_commands:           %d\n",
1824                        intf->sent_lan_commands);
1825         out += sprintf(out, "sent_lan_command_errs:       %d\n",
1826                        intf->sent_lan_command_errs);
1827         out += sprintf(out, "retransmitted_lan_commands:  %d\n",
1828                        intf->retransmitted_lan_commands);
1829         out += sprintf(out, "timed_out_lan_commands:      %d\n",
1830                        intf->timed_out_lan_commands);
1831         out += sprintf(out, "sent_lan_responses:          %d\n",
1832                        intf->sent_lan_responses);
1833         out += sprintf(out, "handled_lan_responses:       %d\n",
1834                        intf->handled_lan_responses);
1835         out += sprintf(out, "invalid_lan_responses:       %d\n",
1836                        intf->invalid_lan_responses);
1837         out += sprintf(out, "unhandled_lan_responses:     %d\n",
1838                        intf->unhandled_lan_responses);
1839         out += sprintf(out, "handled_commands:            %d\n",
1840                        intf->handled_commands);
1841         out += sprintf(out, "invalid_commands:            %d\n",
1842                        intf->invalid_commands);
1843         out += sprintf(out, "unhandled_commands:          %d\n",
1844                        intf->unhandled_commands);
1845         out += sprintf(out, "invalid_events:              %d\n",
1846                        intf->invalid_events);
1847         out += sprintf(out, "events:                      %d\n",
1848                        intf->events);
1849
1850         return (out - ((char *) page));
1851 }
1852 #endif /* CONFIG_PROC_FS */
1853
1854 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1855                             read_proc_t *read_proc, write_proc_t *write_proc,
1856                             void *data, struct module *owner)
1857 {
1858         int                    rv = 0;
1859 #ifdef CONFIG_PROC_FS
1860         struct proc_dir_entry  *file;
1861         struct ipmi_proc_entry *entry;
1862
1863         /* Create a list element. */
1864         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1865         if (!entry)
1866                 return -ENOMEM;
1867         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1868         if (!entry->name) {
1869                 kfree(entry);
1870                 return -ENOMEM;
1871         }
1872         strcpy(entry->name, name);
1873
1874         file = create_proc_entry(name, 0, smi->proc_dir);
1875         if (!file) {
1876                 kfree(entry->name);
1877                 kfree(entry);
1878                 rv = -ENOMEM;
1879         } else {
1880                 file->data = data;
1881                 file->read_proc = read_proc;
1882                 file->write_proc = write_proc;
1883                 file->owner = owner;
1884
1885                 mutex_lock(&smi->proc_entry_lock);
1886                 /* Stick it on the list. */
1887                 entry->next = smi->proc_entries;
1888                 smi->proc_entries = entry;
1889                 mutex_unlock(&smi->proc_entry_lock);
1890         }
1891 #endif /* CONFIG_PROC_FS */
1892
1893         return rv;
1894 }
1895
1896 static int add_proc_entries(ipmi_smi_t smi, int num)
1897 {
1898         int rv = 0;
1899
1900 #ifdef CONFIG_PROC_FS
1901         sprintf(smi->proc_dir_name, "%d", num);
1902         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1903         if (!smi->proc_dir)
1904                 rv = -ENOMEM;
1905         else {
1906                 smi->proc_dir->owner = THIS_MODULE;
1907         }
1908
1909         if (rv == 0)
1910                 rv = ipmi_smi_add_proc_entry(smi, "stats",
1911                                              stat_file_read_proc, NULL,
1912                                              smi, THIS_MODULE);
1913
1914         if (rv == 0)
1915                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
1916                                              ipmb_file_read_proc, NULL,
1917                                              smi, THIS_MODULE);
1918
1919         if (rv == 0)
1920                 rv = ipmi_smi_add_proc_entry(smi, "version",
1921                                              version_file_read_proc, NULL,
1922                                              smi, THIS_MODULE);
1923 #endif /* CONFIG_PROC_FS */
1924
1925         return rv;
1926 }
1927
1928 static void remove_proc_entries(ipmi_smi_t smi)
1929 {
1930 #ifdef CONFIG_PROC_FS
1931         struct ipmi_proc_entry *entry;
1932
1933         mutex_lock(&smi->proc_entry_lock);
1934         while (smi->proc_entries) {
1935                 entry = smi->proc_entries;
1936                 smi->proc_entries = entry->next;
1937
1938                 remove_proc_entry(entry->name, smi->proc_dir);
1939                 kfree(entry->name);
1940                 kfree(entry);
1941         }
1942         mutex_unlock(&smi->proc_entry_lock);
1943         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
1944 #endif /* CONFIG_PROC_FS */
1945 }
1946
1947 static int __find_bmc_guid(struct device *dev, void *data)
1948 {
1949         unsigned char *id = data;
1950         struct bmc_device *bmc = dev_get_drvdata(dev);
1951         return memcmp(bmc->guid, id, 16) == 0;
1952 }
1953
1954 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
1955                                              unsigned char *guid)
1956 {
1957         struct device *dev;
1958
1959         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
1960         if (dev)
1961                 return dev_get_drvdata(dev);
1962         else
1963                 return NULL;
1964 }
1965
1966 struct prod_dev_id {
1967         unsigned int  product_id;
1968         unsigned char device_id;
1969 };
1970
1971 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
1972 {
1973         struct prod_dev_id *id = data;
1974         struct bmc_device *bmc = dev_get_drvdata(dev);
1975
1976         return (bmc->id.product_id == id->product_id
1977                 && bmc->id.device_id == id->device_id);
1978 }
1979
1980 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
1981         struct device_driver *drv,
1982         unsigned int product_id, unsigned char device_id)
1983 {
1984         struct prod_dev_id id = {
1985                 .product_id = product_id,
1986                 .device_id = device_id,
1987         };
1988         struct device *dev;
1989
1990         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
1991         if (dev)
1992                 return dev_get_drvdata(dev);
1993         else
1994                 return NULL;
1995 }
1996
1997 static ssize_t device_id_show(struct device *dev,
1998                               struct device_attribute *attr,
1999                               char *buf)
2000 {
2001         struct bmc_device *bmc = dev_get_drvdata(dev);
2002
2003         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2004 }
2005
2006 static ssize_t provides_dev_sdrs_show(struct device *dev,
2007                                       struct device_attribute *attr,
2008                                       char *buf)
2009 {
2010         struct bmc_device *bmc = dev_get_drvdata(dev);
2011
2012         return snprintf(buf, 10, "%u\n",
2013                         (bmc->id.device_revision & 0x80) >> 7);
2014 }
2015
2016 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2017                              char *buf)
2018 {
2019         struct bmc_device *bmc = dev_get_drvdata(dev);
2020
2021         return snprintf(buf, 20, "%u\n",
2022                         bmc->id.device_revision & 0x0F);
2023 }
2024
2025 static ssize_t firmware_rev_show(struct device *dev,
2026                                  struct device_attribute *attr,
2027                                  char *buf)
2028 {
2029         struct bmc_device *bmc = dev_get_drvdata(dev);
2030
2031         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2032                         bmc->id.firmware_revision_2);
2033 }
2034
2035 static ssize_t ipmi_version_show(struct device *dev,
2036                                  struct device_attribute *attr,
2037                                  char *buf)
2038 {
2039         struct bmc_device *bmc = dev_get_drvdata(dev);
2040
2041         return snprintf(buf, 20, "%u.%u\n",
2042                         ipmi_version_major(&bmc->id),
2043                         ipmi_version_minor(&bmc->id));
2044 }
2045
2046 static ssize_t add_dev_support_show(struct device *dev,
2047                                     struct device_attribute *attr,
2048                                     char *buf)
2049 {
2050         struct bmc_device *bmc = dev_get_drvdata(dev);
2051
2052         return snprintf(buf, 10, "0x%02x\n",
2053                         bmc->id.additional_device_support);
2054 }
2055
2056 static ssize_t manufacturer_id_show(struct device *dev,
2057                                     struct device_attribute *attr,
2058                                     char *buf)
2059 {
2060         struct bmc_device *bmc = dev_get_drvdata(dev);
2061
2062         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2063 }
2064
2065 static ssize_t product_id_show(struct device *dev,
2066                                struct device_attribute *attr,
2067                                char *buf)
2068 {
2069         struct bmc_device *bmc = dev_get_drvdata(dev);
2070
2071         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2072 }
2073
2074 static ssize_t aux_firmware_rev_show(struct device *dev,
2075                                      struct device_attribute *attr,
2076                                      char *buf)
2077 {
2078         struct bmc_device *bmc = dev_get_drvdata(dev);
2079
2080         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2081                         bmc->id.aux_firmware_revision[3],
2082                         bmc->id.aux_firmware_revision[2],
2083                         bmc->id.aux_firmware_revision[1],
2084                         bmc->id.aux_firmware_revision[0]);
2085 }
2086
2087 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2088                          char *buf)
2089 {
2090         struct bmc_device *bmc = dev_get_drvdata(dev);
2091
2092         return snprintf(buf, 100, "%Lx%Lx\n",
2093                         (long long) bmc->guid[0],
2094                         (long long) bmc->guid[8]);
2095 }
2096
2097 static void remove_files(struct bmc_device *bmc)
2098 {
2099         if (!bmc->dev)
2100                 return;
2101
2102         device_remove_file(&bmc->dev->dev,
2103                            &bmc->device_id_attr);
2104         device_remove_file(&bmc->dev->dev,
2105                            &bmc->provides_dev_sdrs_attr);
2106         device_remove_file(&bmc->dev->dev,
2107                            &bmc->revision_attr);
2108         device_remove_file(&bmc->dev->dev,
2109                            &bmc->firmware_rev_attr);
2110         device_remove_file(&bmc->dev->dev,
2111                            &bmc->version_attr);
2112         device_remove_file(&bmc->dev->dev,
2113                            &bmc->add_dev_support_attr);
2114         device_remove_file(&bmc->dev->dev,
2115                            &bmc->manufacturer_id_attr);
2116         device_remove_file(&bmc->dev->dev,
2117                            &bmc->product_id_attr);
2118
2119         if (bmc->id.aux_firmware_revision_set)
2120                 device_remove_file(&bmc->dev->dev,
2121                                    &bmc->aux_firmware_rev_attr);
2122         if (bmc->guid_set)
2123                 device_remove_file(&bmc->dev->dev,
2124                                    &bmc->guid_attr);
2125 }
2126
2127 static void
2128 cleanup_bmc_device(struct kref *ref)
2129 {
2130         struct bmc_device *bmc;
2131
2132         bmc = container_of(ref, struct bmc_device, refcount);
2133
2134         remove_files(bmc);
2135         platform_device_unregister(bmc->dev);
2136         kfree(bmc);
2137 }
2138
2139 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2140 {
2141         struct bmc_device *bmc = intf->bmc;
2142
2143         if (intf->sysfs_name) {
2144                 sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
2145                 kfree(intf->sysfs_name);
2146                 intf->sysfs_name = NULL;
2147         }
2148         if (intf->my_dev_name) {
2149                 sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
2150                 kfree(intf->my_dev_name);
2151                 intf->my_dev_name = NULL;
2152         }
2153
2154         mutex_lock(&ipmidriver_mutex);
2155         kref_put(&bmc->refcount, cleanup_bmc_device);
2156         intf->bmc = NULL;
2157         mutex_unlock(&ipmidriver_mutex);
2158 }
2159
2160 static int create_files(struct bmc_device *bmc)
2161 {
2162         int err;
2163
2164         bmc->device_id_attr.attr.name = "device_id";
2165         bmc->device_id_attr.attr.mode = S_IRUGO;
2166         bmc->device_id_attr.show = device_id_show;
2167
2168         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
2169         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
2170         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
2171
2172         bmc->revision_attr.attr.name = "revision";
2173         bmc->revision_attr.attr.mode = S_IRUGO;
2174         bmc->revision_attr.show = revision_show;
2175
2176         bmc->firmware_rev_attr.attr.name = "firmware_revision";
2177         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
2178         bmc->firmware_rev_attr.show = firmware_rev_show;
2179
2180         bmc->version_attr.attr.name = "ipmi_version";
2181         bmc->version_attr.attr.mode = S_IRUGO;
2182         bmc->version_attr.show = ipmi_version_show;
2183
2184         bmc->add_dev_support_attr.attr.name = "additional_device_support";
2185         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
2186         bmc->add_dev_support_attr.show = add_dev_support_show;
2187
2188         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
2189         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
2190         bmc->manufacturer_id_attr.show = manufacturer_id_show;
2191
2192         bmc->product_id_attr.attr.name = "product_id";
2193         bmc->product_id_attr.attr.mode = S_IRUGO;
2194         bmc->product_id_attr.show = product_id_show;
2195
2196         bmc->guid_attr.attr.name = "guid";
2197         bmc->guid_attr.attr.mode = S_IRUGO;
2198         bmc->guid_attr.show = guid_show;
2199
2200         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2201         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
2202         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
2203
2204         err = device_create_file(&bmc->dev->dev,
2205                            &bmc->device_id_attr);
2206         if (err) goto out;
2207         err = device_create_file(&bmc->dev->dev,
2208                            &bmc->provides_dev_sdrs_attr);
2209         if (err) goto out_devid;
2210         err = device_create_file(&bmc->dev->dev,
2211                            &bmc->revision_attr);
2212         if (err) goto out_sdrs;
2213         err = device_create_file(&bmc->dev->dev,
2214                            &bmc->firmware_rev_attr);
2215         if (err) goto out_rev;
2216         err = device_create_file(&bmc->dev->dev,
2217                            &bmc->version_attr);
2218         if (err) goto out_firm;
2219         err = device_create_file(&bmc->dev->dev,
2220                            &bmc->add_dev_support_attr);
2221         if (err) goto out_version;
2222         err = device_create_file(&bmc->dev->dev,
2223                            &bmc->manufacturer_id_attr);
2224         if (err) goto out_add_dev;
2225         err = device_create_file(&bmc->dev->dev,
2226                            &bmc->product_id_attr);
2227         if (err) goto out_manu;
2228         if (bmc->id.aux_firmware_revision_set) {
2229                 err = device_create_file(&bmc->dev->dev,
2230                                    &bmc->aux_firmware_rev_attr);
2231                 if (err) goto out_prod_id;
2232         }
2233         if (bmc->guid_set) {
2234                 err = device_create_file(&bmc->dev->dev,
2235                                    &bmc->guid_attr);
2236                 if (err) goto out_aux_firm;
2237         }
2238
2239         return 0;
2240
2241 out_aux_firm:
2242         if (bmc->id.aux_firmware_revision_set)
2243                 device_remove_file(&bmc->dev->dev,
2244                                    &bmc->aux_firmware_rev_attr);
2245 out_prod_id:
2246         device_remove_file(&bmc->dev->dev,
2247                            &bmc->product_id_attr);
2248 out_manu:
2249         device_remove_file(&bmc->dev->dev,
2250                            &bmc->manufacturer_id_attr);
2251 out_add_dev:
2252         device_remove_file(&bmc->dev->dev,
2253                            &bmc->add_dev_support_attr);
2254 out_version:
2255         device_remove_file(&bmc->dev->dev,
2256                            &bmc->version_attr);
2257 out_firm:
2258         device_remove_file(&bmc->dev->dev,
2259                            &bmc->firmware_rev_attr);
2260 out_rev:
2261         device_remove_file(&bmc->dev->dev,
2262                            &bmc->revision_attr);
2263 out_sdrs:
2264         device_remove_file(&bmc->dev->dev,
2265                            &bmc->provides_dev_sdrs_attr);
2266 out_devid:
2267         device_remove_file(&bmc->dev->dev,
2268                            &bmc->device_id_attr);
2269 out:
2270         return err;
2271 }
2272
2273 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
2274                              const char *sysfs_name)
2275 {
2276         int               rv;
2277         struct bmc_device *bmc = intf->bmc;
2278         struct bmc_device *old_bmc;
2279         int               size;
2280         char              dummy[1];
2281
2282         mutex_lock(&ipmidriver_mutex);
2283
2284         /*
2285          * Try to find if there is an bmc_device struct
2286          * representing the interfaced BMC already
2287          */
2288         if (bmc->guid_set)
2289                 old_bmc = ipmi_find_bmc_guid(&ipmidriver, bmc->guid);
2290         else
2291                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver,
2292                                                     bmc->id.product_id,
2293                                                     bmc->id.device_id);
2294
2295         /*
2296          * If there is already an bmc_device, free the new one,
2297          * otherwise register the new BMC device
2298          */
2299         if (old_bmc) {
2300                 kfree(bmc);
2301                 intf->bmc = old_bmc;
2302                 bmc = old_bmc;
2303
2304                 kref_get(&bmc->refcount);
2305                 mutex_unlock(&ipmidriver_mutex);
2306
2307                 printk(KERN_INFO
2308                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2309                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2310                        bmc->id.manufacturer_id,
2311                        bmc->id.product_id,
2312                        bmc->id.device_id);
2313         } else {
2314                 char name[14];
2315                 unsigned char orig_dev_id = bmc->id.device_id;
2316                 int warn_printed = 0;
2317
2318                 snprintf(name, sizeof(name),
2319                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2320
2321                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver,
2322                                                  bmc->id.product_id,
2323                                                  bmc->id.device_id)) {
2324                         if (!warn_printed) {
2325                                 printk(KERN_WARNING PFX
2326                                        "This machine has two different BMCs"
2327                                        " with the same product id and device"
2328                                        " id.  This is an error in the"
2329                                        " firmware, but incrementing the"
2330                                        " device id to work around the problem."
2331                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2332                                        bmc->id.product_id, bmc->id.device_id);
2333                                 warn_printed = 1;
2334                         }
2335                         bmc->id.device_id++; /* Wraps at 255 */
2336                         if (bmc->id.device_id == orig_dev_id) {
2337                                 printk(KERN_ERR PFX
2338                                        "Out of device ids!\n");
2339                                 break;
2340                         }
2341                 }
2342
2343                 bmc->dev = platform_device_alloc(name, bmc->id.device_id);
2344                 if (!bmc->dev) {
2345                         mutex_unlock(&ipmidriver_mutex);
2346                         printk(KERN_ERR
2347                                "ipmi_msghandler:"
2348                                " Unable to allocate platform device\n");
2349                         return -ENOMEM;
2350                 }
2351                 bmc->dev->dev.driver = &ipmidriver;
2352                 dev_set_drvdata(&bmc->dev->dev, bmc);
2353                 kref_init(&bmc->refcount);
2354
2355                 rv = platform_device_add(bmc->dev);
2356                 mutex_unlock(&ipmidriver_mutex);
2357                 if (rv) {
2358                         platform_device_put(bmc->dev);
2359                         bmc->dev = NULL;
2360                         printk(KERN_ERR
2361                                "ipmi_msghandler:"
2362                                " Unable to register bmc device: %d\n",
2363                                rv);
2364                         /* Don't go to out_err, you can only do that if
2365                            the device is registered already. */
2366                         return rv;
2367                 }
2368
2369                 rv = create_files(bmc);
2370                 if (rv) {
2371                         mutex_lock(&ipmidriver_mutex);
2372                         platform_device_unregister(bmc->dev);
2373                         mutex_unlock(&ipmidriver_mutex);
2374
2375                         return rv;
2376                 }
2377
2378                 printk(KERN_INFO
2379                        "ipmi: Found new BMC (man_id: 0x%6.6x, "
2380                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2381                        bmc->id.manufacturer_id,
2382                        bmc->id.product_id,
2383                        bmc->id.device_id);
2384         }
2385
2386         /*
2387          * create symlink from system interface device to bmc device
2388          * and back.
2389          */
2390         intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
2391         if (!intf->sysfs_name) {
2392                 rv = -ENOMEM;
2393                 printk(KERN_ERR
2394                        "ipmi_msghandler: allocate link to BMC: %d\n",
2395                        rv);
2396                 goto out_err;
2397         }
2398
2399         rv = sysfs_create_link(&intf->si_dev->kobj,
2400                                &bmc->dev->dev.kobj, intf->sysfs_name);
2401         if (rv) {
2402                 kfree(intf->sysfs_name);
2403                 intf->sysfs_name = NULL;
2404                 printk(KERN_ERR
2405                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2406                        rv);
2407                 goto out_err;
2408         }
2409
2410         size = snprintf(dummy, 0, "ipmi%d", ifnum);
2411         intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
2412         if (!intf->my_dev_name) {
2413                 kfree(intf->sysfs_name);
2414                 intf->sysfs_name = NULL;
2415                 rv = -ENOMEM;
2416                 printk(KERN_ERR
2417                        "ipmi_msghandler: allocate link from BMC: %d\n",
2418                        rv);
2419                 goto out_err;
2420         }
2421         snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
2422
2423         rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
2424                                intf->my_dev_name);
2425         if (rv) {
2426                 kfree(intf->sysfs_name);
2427                 intf->sysfs_name = NULL;
2428                 kfree(intf->my_dev_name);
2429                 intf->my_dev_name = NULL;
2430                 printk(KERN_ERR
2431                        "ipmi_msghandler:"
2432                        " Unable to create symlink to bmc: %d\n",
2433                        rv);
2434                 goto out_err;
2435         }
2436
2437         return 0;
2438
2439 out_err:
2440         ipmi_bmc_unregister(intf);
2441         return rv;
2442 }
2443
2444 static int
2445 send_guid_cmd(ipmi_smi_t intf, int chan)
2446 {
2447         struct kernel_ipmi_msg            msg;
2448         struct ipmi_system_interface_addr si;
2449
2450         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2451         si.channel = IPMI_BMC_CHANNEL;
2452         si.lun = 0;
2453
2454         msg.netfn = IPMI_NETFN_APP_REQUEST;
2455         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2456         msg.data = NULL;
2457         msg.data_len = 0;
2458         return i_ipmi_request(NULL,
2459                               intf,
2460                               (struct ipmi_addr *) &si,
2461                               0,
2462                               &msg,
2463                               intf,
2464                               NULL,
2465                               NULL,
2466                               0,
2467                               intf->channels[0].address,
2468                               intf->channels[0].lun,
2469                               -1, 0);
2470 }
2471
2472 static void
2473 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2474 {
2475         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2476             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2477             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2478                 /* Not for me */
2479                 return;
2480
2481         if (msg->msg.data[0] != 0) {
2482                 /* Error from getting the GUID, the BMC doesn't have one. */
2483                 intf->bmc->guid_set = 0;
2484                 goto out;
2485         }
2486
2487         if (msg->msg.data_len < 17) {
2488                 intf->bmc->guid_set = 0;
2489                 printk(KERN_WARNING PFX
2490                        "guid_handler: The GUID response from the BMC was too"
2491                        " short, it was %d but should have been 17.  Assuming"
2492                        " GUID is not available.\n",
2493                        msg->msg.data_len);
2494                 goto out;
2495         }
2496
2497         memcpy(intf->bmc->guid, msg->msg.data, 16);
2498         intf->bmc->guid_set = 1;
2499  out:
2500         wake_up(&intf->waitq);
2501 }
2502
2503 static void
2504 get_guid(ipmi_smi_t intf)
2505 {
2506         int rv;
2507
2508         intf->bmc->guid_set = 0x2;
2509         intf->null_user_handler = guid_handler;
2510         rv = send_guid_cmd(intf, 0);
2511         if (rv)
2512                 /* Send failed, no GUID available. */
2513                 intf->bmc->guid_set = 0;
2514         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2515         intf->null_user_handler = NULL;
2516 }
2517
2518 static int
2519 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2520 {
2521         struct kernel_ipmi_msg            msg;
2522         unsigned char                     data[1];
2523         struct ipmi_system_interface_addr si;
2524
2525         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2526         si.channel = IPMI_BMC_CHANNEL;
2527         si.lun = 0;
2528
2529         msg.netfn = IPMI_NETFN_APP_REQUEST;
2530         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2531         msg.data = data;
2532         msg.data_len = 1;
2533         data[0] = chan;
2534         return i_ipmi_request(NULL,
2535                               intf,
2536                               (struct ipmi_addr *) &si,
2537                               0,
2538                               &msg,
2539                               intf,
2540                               NULL,
2541                               NULL,
2542                               0,
2543                               intf->channels[0].address,
2544                               intf->channels[0].lun,
2545                               -1, 0);
2546 }
2547
2548 static void
2549 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2550 {
2551         int rv = 0;
2552         int chan;
2553
2554         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2555             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2556             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD))
2557         {
2558                 /* It's the one we want */
2559                 if (msg->msg.data[0] != 0) {
2560                         /* Got an error from the channel, just go on. */
2561
2562                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2563                                 /* If the MC does not support this
2564                                    command, that is legal.  We just
2565                                    assume it has one IPMB at channel
2566                                    zero. */
2567                                 intf->channels[0].medium
2568                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2569                                 intf->channels[0].protocol
2570                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2571                                 rv = -ENOSYS;
2572
2573                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2574                                 wake_up(&intf->waitq);
2575                                 goto out;
2576                         }
2577                         goto next_channel;
2578                 }
2579                 if (msg->msg.data_len < 4) {
2580                         /* Message not big enough, just go on. */
2581                         goto next_channel;
2582                 }
2583                 chan = intf->curr_channel;
2584                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2585                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2586
2587         next_channel:
2588                 intf->curr_channel++;
2589                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2590                         wake_up(&intf->waitq);
2591                 else
2592                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2593
2594                 if (rv) {
2595                         /* Got an error somehow, just give up. */
2596                         intf->curr_channel = IPMI_MAX_CHANNELS;
2597                         wake_up(&intf->waitq);
2598
2599                         printk(KERN_WARNING PFX
2600                                "Error sending channel information: %d\n",
2601                                rv);
2602                 }
2603         }
2604  out:
2605         return;
2606 }
2607
2608 void ipmi_poll_interface(ipmi_user_t user)
2609 {
2610         ipmi_smi_t intf = user->intf;
2611
2612         if (intf->handlers->poll)
2613                 intf->handlers->poll(intf->send_info);
2614 }
2615
2616 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2617                       void                     *send_info,
2618                       struct ipmi_device_id    *device_id,
2619                       struct device            *si_dev,
2620                       const char               *sysfs_name,
2621                       unsigned char            slave_addr)
2622 {
2623         int              i, j;
2624         int              rv;
2625         ipmi_smi_t       intf;
2626         ipmi_smi_t       tintf;
2627         struct list_head *link;
2628
2629         /* Make sure the driver is actually initialized, this handles
2630            problems with initialization order. */
2631         if (!initialized) {
2632                 rv = ipmi_init_msghandler();
2633                 if (rv)
2634                         return rv;
2635                 /* The init code doesn't return an error if it was turned
2636                    off, but it won't initialize.  Check that. */
2637                 if (!initialized)
2638                         return -ENODEV;
2639         }
2640
2641         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2642         if (!intf)
2643                 return -ENOMEM;
2644
2645         intf->ipmi_version_major = ipmi_version_major(device_id);
2646         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2647
2648         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2649         if (!intf->bmc) {
2650                 kfree(intf);
2651                 return -ENOMEM;
2652         }
2653         intf->intf_num = -1; /* Mark it invalid for now. */
2654         kref_init(&intf->refcount);
2655         intf->bmc->id = *device_id;
2656         intf->si_dev = si_dev;
2657         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2658                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2659                 intf->channels[j].lun = 2;
2660         }
2661         if (slave_addr != 0)
2662                 intf->channels[0].address = slave_addr;
2663         INIT_LIST_HEAD(&intf->users);
2664         intf->handlers = handlers;
2665         intf->send_info = send_info;
2666         spin_lock_init(&intf->seq_lock);
2667         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2668                 intf->seq_table[j].inuse = 0;
2669                 intf->seq_table[j].seqid = 0;
2670         }
2671         intf->curr_seq = 0;
2672 #ifdef CONFIG_PROC_FS
2673         mutex_init(&intf->proc_entry_lock);
2674 #endif
2675         spin_lock_init(&intf->waiting_msgs_lock);
2676         INIT_LIST_HEAD(&intf->waiting_msgs);
2677         spin_lock_init(&intf->events_lock);
2678         INIT_LIST_HEAD(&intf->waiting_events);
2679         intf->waiting_events_count = 0;
2680         mutex_init(&intf->cmd_rcvrs_mutex);
2681         spin_lock_init(&intf->maintenance_mode_lock);
2682         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2683         init_waitqueue_head(&intf->waitq);
2684
2685         spin_lock_init(&intf->counter_lock);
2686         intf->proc_dir = NULL;
2687
2688         mutex_lock(&smi_watchers_mutex);
2689         mutex_lock(&ipmi_interfaces_mutex);
2690         /* Look for a hole in the numbers. */
2691         i = 0;
2692         link = &ipmi_interfaces;
2693         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2694                 if (tintf->intf_num != i) {
2695                         link = &tintf->link;
2696                         break;
2697                 }
2698                 i++;
2699         }
2700         /* Add the new interface in numeric order. */
2701         if (i == 0)
2702                 list_add_rcu(&intf->link, &ipmi_interfaces);
2703         else
2704                 list_add_tail_rcu(&intf->link, link);
2705
2706         rv = handlers->start_processing(send_info, intf);
2707         if (rv)
2708                 goto out;
2709
2710         get_guid(intf);
2711
2712         if ((intf->ipmi_version_major > 1)
2713             || ((intf->ipmi_version_major == 1)
2714                 && (intf->ipmi_version_minor >= 5)))
2715         {
2716                 /* Start scanning the channels to see what is
2717                    available. */
2718                 intf->null_user_handler = channel_handler;
2719                 intf->curr_channel = 0;
2720                 rv = send_channel_info_cmd(intf, 0);
2721                 if (rv)
2722                         goto out;
2723
2724                 /* Wait for the channel info to be read. */
2725                 wait_event(intf->waitq,
2726                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2727                 intf->null_user_handler = NULL;
2728         } else {
2729                 /* Assume a single IPMB channel at zero. */
2730                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2731                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2732         }
2733
2734         if (rv == 0)
2735                 rv = add_proc_entries(intf, i);
2736
2737         rv = ipmi_bmc_register(intf, i, sysfs_name);
2738
2739  out:
2740         if (rv) {
2741                 if (intf->proc_dir)
2742                         remove_proc_entries(intf);
2743                 intf->handlers = NULL;
2744                 list_del_rcu(&intf->link);
2745                 mutex_unlock(&ipmi_interfaces_mutex);
2746                 mutex_unlock(&smi_watchers_mutex);
2747                 synchronize_rcu();
2748                 kref_put(&intf->refcount, intf_free);
2749         } else {
2750                 /*
2751                  * Keep memory order straight for RCU readers.  Make
2752                  * sure everything else is committed to memory before
2753                  * setting intf_num to mark the interface valid.
2754                  */
2755                 smp_wmb();
2756                 intf->intf_num = i;
2757                 mutex_unlock(&ipmi_interfaces_mutex);
2758                 /* After this point the interface is legal to use. */
2759                 call_smi_watchers(i, intf->si_dev);
2760                 mutex_unlock(&smi_watchers_mutex);
2761         }
2762
2763         return rv;
2764 }
2765
2766 static void cleanup_smi_msgs(ipmi_smi_t intf)
2767 {
2768         int              i;
2769         struct seq_table *ent;
2770
2771         /* No need for locks, the interface is down. */
2772         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2773                 ent = &(intf->seq_table[i]);
2774                 if (!ent->inuse)
2775                         continue;
2776                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2777         }
2778 }
2779
2780 int ipmi_unregister_smi(ipmi_smi_t intf)
2781 {
2782         struct ipmi_smi_watcher *w;
2783         int    intf_num = intf->intf_num;
2784
2785         ipmi_bmc_unregister(intf);
2786
2787         mutex_lock(&smi_watchers_mutex);
2788         mutex_lock(&ipmi_interfaces_mutex);
2789         intf->intf_num = -1;
2790         intf->handlers = NULL;
2791         list_del_rcu(&intf->link);
2792         mutex_unlock(&ipmi_interfaces_mutex);
2793         synchronize_rcu();
2794
2795         cleanup_smi_msgs(intf);
2796
2797         remove_proc_entries(intf);
2798
2799         /* Call all the watcher interfaces to tell them that
2800            an interface is gone. */
2801         list_for_each_entry(w, &smi_watchers, link)
2802                 w->smi_gone(intf_num);
2803         mutex_unlock(&smi_watchers_mutex);
2804
2805         kref_put(&intf->refcount, intf_free);
2806         return 0;
2807 }
2808
2809 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
2810                                    struct ipmi_smi_msg *msg)
2811 {
2812         struct ipmi_ipmb_addr ipmb_addr;
2813         struct ipmi_recv_msg  *recv_msg;
2814         unsigned long         flags;
2815
2816
2817         /* This is 11, not 10, because the response must contain a
2818          * completion code. */
2819         if (msg->rsp_size < 11) {
2820                 /* Message not big enough, just ignore it. */
2821                 spin_lock_irqsave(&intf->counter_lock, flags);
2822                 intf->invalid_ipmb_responses++;
2823                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2824                 return 0;
2825         }
2826
2827         if (msg->rsp[2] != 0) {
2828                 /* An error getting the response, just ignore it. */
2829                 return 0;
2830         }
2831
2832         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
2833         ipmb_addr.slave_addr = msg->rsp[6];
2834         ipmb_addr.channel = msg->rsp[3] & 0x0f;
2835         ipmb_addr.lun = msg->rsp[7] & 3;
2836
2837         /* It's a response from a remote entity.  Look up the sequence
2838            number and handle the response. */
2839         if (intf_find_seq(intf,
2840                           msg->rsp[7] >> 2,
2841                           msg->rsp[3] & 0x0f,
2842                           msg->rsp[8],
2843                           (msg->rsp[4] >> 2) & (~1),
2844                           (struct ipmi_addr *) &(ipmb_addr),
2845                           &recv_msg))
2846         {
2847                 /* We were unable to find the sequence number,
2848                    so just nuke the message. */
2849                 spin_lock_irqsave(&intf->counter_lock, flags);
2850                 intf->unhandled_ipmb_responses++;
2851                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2852                 return 0;
2853         }
2854
2855         memcpy(recv_msg->msg_data,
2856                &(msg->rsp[9]),
2857                msg->rsp_size - 9);
2858         /* THe other fields matched, so no need to set them, except
2859            for netfn, which needs to be the response that was
2860            returned, not the request value. */
2861         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2862         recv_msg->msg.data = recv_msg->msg_data;
2863         recv_msg->msg.data_len = msg->rsp_size - 10;
2864         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2865         spin_lock_irqsave(&intf->counter_lock, flags);
2866         intf->handled_ipmb_responses++;
2867         spin_unlock_irqrestore(&intf->counter_lock, flags);
2868         deliver_response(recv_msg);
2869
2870         return 0;
2871 }
2872
2873 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
2874                                    struct ipmi_smi_msg *msg)
2875 {
2876         struct cmd_rcvr          *rcvr;
2877         int                      rv = 0;
2878         unsigned char            netfn;
2879         unsigned char            cmd;
2880         unsigned char            chan;
2881         ipmi_user_t              user = NULL;
2882         struct ipmi_ipmb_addr    *ipmb_addr;
2883         struct ipmi_recv_msg     *recv_msg;
2884         unsigned long            flags;
2885         struct ipmi_smi_handlers *handlers;
2886
2887         if (msg->rsp_size < 10) {
2888                 /* Message not big enough, just ignore it. */
2889                 spin_lock_irqsave(&intf->counter_lock, flags);
2890                 intf->invalid_commands++;
2891                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2892                 return 0;
2893         }
2894
2895         if (msg->rsp[2] != 0) {
2896                 /* An error getting the response, just ignore it. */
2897                 return 0;
2898         }
2899
2900         netfn = msg->rsp[4] >> 2;
2901         cmd = msg->rsp[8];
2902         chan = msg->rsp[3] & 0xf;
2903
2904         rcu_read_lock();
2905         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
2906         if (rcvr) {
2907                 user = rcvr->user;
2908                 kref_get(&user->refcount);
2909         } else
2910                 user = NULL;
2911         rcu_read_unlock();
2912
2913         if (user == NULL) {
2914                 /* We didn't find a user, deliver an error response. */
2915                 spin_lock_irqsave(&intf->counter_lock, flags);
2916                 intf->unhandled_commands++;
2917                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2918
2919                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
2920                 msg->data[1] = IPMI_SEND_MSG_CMD;
2921                 msg->data[2] = msg->rsp[3];
2922                 msg->data[3] = msg->rsp[6];
2923                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
2924                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
2925                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
2926                 /* rqseq/lun */
2927                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
2928                 msg->data[8] = msg->rsp[8]; /* cmd */
2929                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
2930                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
2931                 msg->data_size = 11;
2932
2933 #ifdef DEBUG_MSGING
2934         {
2935                 int m;
2936                 printk("Invalid command:");
2937                 for (m = 0; m < msg->data_size; m++)
2938                         printk(" %2.2x", msg->data[m]);
2939                 printk("\n");
2940         }
2941 #endif
2942                 rcu_read_lock();
2943                 handlers = intf->handlers;
2944                 if (handlers) {
2945                         handlers->sender(intf->send_info, msg, 0);
2946                         /* We used the message, so return the value
2947                            that causes it to not be freed or
2948                            queued. */
2949                         rv = -1;
2950                 }
2951                 rcu_read_unlock();
2952         } else {
2953                 /* Deliver the message to the user. */
2954                 spin_lock_irqsave(&intf->counter_lock, flags);
2955                 intf->handled_commands++;
2956                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2957
2958                 recv_msg = ipmi_alloc_recv_msg();
2959                 if (!recv_msg) {
2960                         /* We couldn't allocate memory for the
2961                            message, so requeue it for handling
2962                            later. */
2963                         rv = 1;
2964                         kref_put(&user->refcount, free_user);
2965                 } else {
2966                         /* Extract the source address from the data. */
2967                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
2968                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
2969                         ipmb_addr->slave_addr = msg->rsp[6];
2970                         ipmb_addr->lun = msg->rsp[7] & 3;
2971                         ipmb_addr->channel = msg->rsp[3] & 0xf;
2972
2973                         /* Extract the rest of the message information
2974                            from the IPMB header.*/
2975                         recv_msg->user = user;
2976                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
2977                         recv_msg->msgid = msg->rsp[7] >> 2;
2978                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2979                         recv_msg->msg.cmd = msg->rsp[8];
2980                         recv_msg->msg.data = recv_msg->msg_data;
2981
2982                         /* We chop off 10, not 9 bytes because the checksum
2983                            at the end also needs to be removed. */
2984                         recv_msg->msg.data_len = msg->rsp_size - 10;
2985                         memcpy(recv_msg->msg_data,
2986                                &(msg->rsp[9]),
2987                                msg->rsp_size - 10);
2988                         deliver_response(recv_msg);
2989                 }
2990         }
2991
2992         return rv;
2993 }
2994
2995 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
2996                                   struct ipmi_smi_msg *msg)
2997 {
2998         struct ipmi_lan_addr  lan_addr;
2999         struct ipmi_recv_msg  *recv_msg;
3000         unsigned long         flags;
3001
3002
3003         /* This is 13, not 12, because the response must contain a
3004          * completion code. */
3005         if (msg->rsp_size < 13) {
3006                 /* Message not big enough, just ignore it. */
3007                 spin_lock_irqsave(&intf->counter_lock, flags);
3008                 intf->invalid_lan_responses++;
3009                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3010                 return 0;
3011         }
3012
3013         if (msg->rsp[2] != 0) {
3014                 /* An error getting the response, just ignore it. */
3015                 return 0;
3016         }
3017
3018         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3019         lan_addr.session_handle = msg->rsp[4];
3020         lan_addr.remote_SWID = msg->rsp[8];
3021         lan_addr.local_SWID = msg->rsp[5];
3022         lan_addr.channel = msg->rsp[3] & 0x0f;
3023         lan_addr.privilege = msg->rsp[3] >> 4;
3024         lan_addr.lun = msg->rsp[9] & 3;
3025
3026         /* It's a response from a remote entity.  Look up the sequence
3027            number and handle the response. */
3028         if (intf_find_seq(intf,
3029                           msg->rsp[9] >> 2,
3030                           msg->rsp[3] & 0x0f,
3031                           msg->rsp[10],
3032                           (msg->rsp[6] >> 2) & (~1),
3033                           (struct ipmi_addr *) &(lan_addr),
3034                           &recv_msg))
3035         {
3036                 /* We were unable to find the sequence number,
3037                    so just nuke the message. */
3038                 spin_lock_irqsave(&intf->counter_lock, flags);
3039                 intf->unhandled_lan_responses++;
3040                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3041                 return 0;
3042         }
3043
3044         memcpy(recv_msg->msg_data,
3045                &(msg->rsp[11]),
3046                msg->rsp_size - 11);
3047         /* The other fields matched, so no need to set them, except
3048            for netfn, which needs to be the response that was
3049            returned, not the request value. */
3050         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3051         recv_msg->msg.data = recv_msg->msg_data;
3052         recv_msg->msg.data_len = msg->rsp_size - 12;
3053         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3054         spin_lock_irqsave(&intf->counter_lock, flags);
3055         intf->handled_lan_responses++;
3056         spin_unlock_irqrestore(&intf->counter_lock, flags);
3057         deliver_response(recv_msg);
3058
3059         return 0;
3060 }
3061
3062 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3063                                   struct ipmi_smi_msg *msg)
3064 {
3065         struct cmd_rcvr          *rcvr;
3066         int                      rv = 0;
3067         unsigned char            netfn;
3068         unsigned char            cmd;
3069         unsigned char            chan;
3070         ipmi_user_t              user = NULL;
3071         struct ipmi_lan_addr     *lan_addr;
3072         struct ipmi_recv_msg     *recv_msg;
3073         unsigned long            flags;
3074
3075         if (msg->rsp_size < 12) {
3076                 /* Message not big enough, just ignore it. */
3077                 spin_lock_irqsave(&intf->counter_lock, flags);
3078                 intf->invalid_commands++;
3079                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3080                 return 0;
3081         }
3082
3083         if (msg->rsp[2] != 0) {
3084                 /* An error getting the response, just ignore it. */
3085                 return 0;
3086         }
3087
3088         netfn = msg->rsp[6] >> 2;
3089         cmd = msg->rsp[10];
3090         chan = msg->rsp[3] & 0xf;
3091
3092         rcu_read_lock();
3093         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3094         if (rcvr) {
3095                 user = rcvr->user;
3096                 kref_get(&user->refcount);
3097         } else
3098                 user = NULL;
3099         rcu_read_unlock();
3100
3101         if (user == NULL) {
3102                 /* We didn't find a user, just give up. */
3103                 spin_lock_irqsave(&intf->counter_lock, flags);
3104                 intf->unhandled_commands++;
3105                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3106
3107                 rv = 0; /* Don't do anything with these messages, just
3108                            allow them to be freed. */
3109         } else {
3110                 /* Deliver the message to the user. */
3111                 spin_lock_irqsave(&intf->counter_lock, flags);
3112                 intf->handled_commands++;
3113                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3114
3115                 recv_msg = ipmi_alloc_recv_msg();
3116                 if (!recv_msg) {
3117                         /* We couldn't allocate memory for the
3118                            message, so requeue it for handling
3119                            later. */
3120                         rv = 1;
3121                         kref_put(&user->refcount, free_user);
3122                 } else {
3123                         /* Extract the source address from the data. */
3124                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3125                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3126                         lan_addr->session_handle = msg->rsp[4];
3127                         lan_addr->remote_SWID = msg->rsp[8];
3128                         lan_addr->local_SWID = msg->rsp[5];
3129                         lan_addr->lun = msg->rsp[9] & 3;
3130                         lan_addr->channel = msg->rsp[3] & 0xf;
3131                         lan_addr->privilege = msg->rsp[3] >> 4;
3132
3133                         /* Extract the rest of the message information
3134                            from the IPMB header.*/
3135                         recv_msg->user = user;
3136                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3137                         recv_msg->msgid = msg->rsp[9] >> 2;
3138                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3139                         recv_msg->msg.cmd = msg->rsp[10];
3140                         recv_msg->msg.data = recv_msg->msg_data;
3141
3142                         /* We chop off 12, not 11 bytes because the checksum
3143                            at the end also needs to be removed. */
3144                         recv_msg->msg.data_len = msg->rsp_size - 12;
3145                         memcpy(recv_msg->msg_data,
3146                                &(msg->rsp[11]),
3147                                msg->rsp_size - 12);
3148                         deliver_response(recv_msg);
3149                 }
3150         }
3151
3152         return rv;
3153 }
3154
3155 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3156                                      struct ipmi_smi_msg  *msg)
3157 {
3158         struct ipmi_system_interface_addr *smi_addr;
3159
3160         recv_msg->msgid = 0;
3161         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3162         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3163         smi_addr->channel = IPMI_BMC_CHANNEL;
3164         smi_addr->lun = msg->rsp[0] & 3;
3165         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3166         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3167         recv_msg->msg.cmd = msg->rsp[1];
3168         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3169         recv_msg->msg.data = recv_msg->msg_data;
3170         recv_msg->msg.data_len = msg->rsp_size - 3;
3171 }
3172
3173 static int handle_read_event_rsp(ipmi_smi_t          intf,
3174                                  struct ipmi_smi_msg *msg)
3175 {
3176         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3177         struct list_head     msgs;
3178         ipmi_user_t          user;
3179         int                  rv = 0;
3180         int                  deliver_count = 0;
3181         unsigned long        flags;
3182
3183         if (msg->rsp_size < 19) {
3184                 /* Message is too small to be an IPMB event. */
3185                 spin_lock_irqsave(&intf->counter_lock, flags);
3186                 intf->invalid_events++;
3187                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3188                 return 0;
3189         }
3190
3191         if (msg->rsp[2] != 0) {
3192                 /* An error getting the event, just ignore it. */
3193                 return 0;
3194         }
3195
3196         INIT_LIST_HEAD(&msgs);
3197
3198         spin_lock_irqsave(&intf->events_lock, flags);
3199
3200         spin_lock(&intf->counter_lock);
3201         intf->events++;
3202         spin_unlock(&intf->counter_lock);
3203
3204         /* Allocate and fill in one message for every user that is getting
3205            events. */
3206         rcu_read_lock();
3207         list_for_each_entry_rcu(user, &intf->users, link) {
3208                 if (!user->gets_events)
3209                         continue;
3210
3211                 recv_msg = ipmi_alloc_recv_msg();
3212                 if (!recv_msg) {
3213                         rcu_read_unlock();
3214                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3215                                                  link) {
3216                                 list_del(&recv_msg->link);
3217                                 ipmi_free_recv_msg(recv_msg);
3218                         }
3219                         /* We couldn't allocate memory for the
3220                            message, so requeue it for handling
3221                            later. */
3222                         rv = 1;
3223                         goto out;
3224                 }
3225
3226                 deliver_count++;
3227
3228                 copy_event_into_recv_msg(recv_msg, msg);
3229                 recv_msg->user = user;
3230                 kref_get(&user->refcount);
3231                 list_add_tail(&(recv_msg->link), &msgs);
3232         }
3233         rcu_read_unlock();
3234
3235         if (deliver_count) {
3236                 /* Now deliver all the messages. */
3237                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3238                         list_del(&recv_msg->link);
3239                         deliver_response(recv_msg);
3240                 }
3241         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3242                 /* No one to receive the message, put it in queue if there's
3243                    not already too many things in the queue. */
3244                 recv_msg = ipmi_alloc_recv_msg();
3245                 if (!recv_msg) {
3246                         /* We couldn't allocate memory for the
3247                            message, so requeue it for handling
3248                            later. */
3249                         rv = 1;
3250                         goto out;
3251                 }
3252
3253                 copy_event_into_recv_msg(recv_msg, msg);
3254                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3255                 intf->waiting_events_count++;
3256         } else {
3257                 /* There's too many things in the queue, discard this
3258                    message. */
3259                 printk(KERN_WARNING PFX "Event queue full, discarding an"
3260                        " incoming event\n");
3261         }
3262
3263  out:
3264         spin_unlock_irqrestore(&(intf->events_lock), flags);
3265
3266         return rv;
3267 }
3268
3269 static int handle_bmc_rsp(ipmi_smi_t          intf,
3270                           struct ipmi_smi_msg *msg)
3271 {
3272         struct ipmi_recv_msg *recv_msg;
3273         unsigned long        flags;
3274         struct ipmi_user     *user;
3275
3276         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3277         if (recv_msg == NULL)
3278         {
3279                 printk(KERN_WARNING"IPMI message received with no owner. This\n"
3280                         "could be because of a malformed message, or\n"
3281                         "because of a hardware error.  Contact your\n"
3282                         "hardware vender for assistance\n");
3283                 return 0;
3284         }
3285
3286         user = recv_msg->user;
3287         /* Make sure the user still exists. */
3288         if (user && !user->valid) {
3289                 /* The user for the message went away, so give up. */
3290                 spin_lock_irqsave(&intf->counter_lock, flags);
3291                 intf->unhandled_local_responses++;
3292                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3293                 ipmi_free_recv_msg(recv_msg);
3294         } else {
3295                 struct ipmi_system_interface_addr *smi_addr;
3296
3297                 spin_lock_irqsave(&intf->counter_lock, flags);
3298                 intf->handled_local_responses++;
3299                 spin_unlock_irqrestore(&intf->counter_lock, flags);
3300                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3301                 recv_msg->msgid = msg->msgid;
3302                 smi_addr = ((struct ipmi_system_interface_addr *)
3303                             &(recv_msg->addr));
3304                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3305                 smi_addr->channel = IPMI_BMC_CHANNEL;
3306                 smi_addr->lun = msg->rsp[0] & 3;
3307                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3308                 recv_msg->msg.cmd = msg->rsp[1];
3309                 memcpy(recv_msg->msg_data,
3310                        &(msg->rsp[2]),
3311                        msg->rsp_size - 2);
3312                 recv_msg->msg.data = recv_msg->msg_data;
3313                 recv_msg->msg.data_len = msg->rsp_size - 2;
3314                 deliver_response(recv_msg);
3315         }
3316
3317         return 0;
3318 }
3319
3320 /* Handle a new message.  Return 1 if the message should be requeued,
3321    0 if the message should be freed, or -1 if the message should not
3322    be freed or requeued. */
3323 static int handle_new_recv_msg(ipmi_smi_t          intf,
3324                                struct ipmi_smi_msg *msg)
3325 {
3326         int requeue;
3327         int chan;
3328
3329 #ifdef DEBUG_MSGING
3330         int m;
3331         printk("Recv:");
3332         for (m = 0; m < msg->rsp_size; m++)
3333                 printk(" %2.2x", msg->rsp[m]);
3334         printk("\n");
3335 #endif
3336         if (msg->rsp_size < 2) {
3337                 /* Message is too small to be correct. */
3338                 printk(KERN_WARNING PFX "BMC returned to small a message"
3339                        " for netfn %x cmd %x, got %d bytes\n",
3340                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3341
3342                 /* Generate an error response for the message. */
3343                 msg->rsp[0] = msg->data[0] | (1 << 2);
3344                 msg->rsp[1] = msg->data[1];
3345                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3346                 msg->rsp_size = 3;
3347         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))/* Netfn */
3348                    || (msg->rsp[1] != msg->data[1]))              /* Command */
3349         {
3350                 /* The response is not even marginally correct. */
3351                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3352                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3353                        (msg->data[0] >> 2) | 1, msg->data[1],
3354                        msg->rsp[0] >> 2, msg->rsp[1]);
3355
3356                 /* Generate an error response for the message. */
3357                 msg->rsp[0] = msg->data[0] | (1 << 2);
3358                 msg->rsp[1] = msg->data[1];
3359                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3360                 msg->rsp_size = 3;
3361         }
3362
3363         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3364             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3365             && (msg->user_data != NULL))
3366         {
3367                 /* It's a response to a response we sent.  For this we
3368                    deliver a send message response to the user. */
3369                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3370
3371                 requeue = 0;
3372                 if (msg->rsp_size < 2)
3373                         /* Message is too small to be correct. */
3374                         goto out;
3375
3376                 chan = msg->data[2] & 0x0f;
3377                 if (chan >= IPMI_MAX_CHANNELS)
3378                         /* Invalid channel number */
3379                         goto out;
3380
3381                 if (!recv_msg)
3382                         goto out;
3383
3384                 /* Make sure the user still exists. */
3385                 if (!recv_msg->user || !recv_msg->user->valid)
3386                         goto out;
3387
3388                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3389                 recv_msg->msg.data = recv_msg->msg_data;
3390                 recv_msg->msg.data_len = 1;
3391                 recv_msg->msg_data[0] = msg->rsp[2];
3392                 deliver_response(recv_msg);
3393         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3394                    && (msg->rsp[1] == IPMI_GET_MSG_CMD))
3395         {
3396                 /* It's from the receive queue. */
3397                 chan = msg->rsp[3] & 0xf;
3398                 if (chan >= IPMI_MAX_CHANNELS) {
3399                         /* Invalid channel number */
3400                         requeue = 0;
3401                         goto out;
3402                 }
3403
3404                 switch (intf->channels[chan].medium) {
3405                 case IPMI_CHANNEL_MEDIUM_IPMB:
3406                         if (msg->rsp[4] & 0x04) {
3407                                 /* It's a response, so find the
3408                                    requesting message and send it up. */
3409                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3410                         } else {
3411                                 /* It's a command to the SMS from some other
3412                                    entity.  Handle that. */
3413                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3414                         }
3415                         break;
3416
3417                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3418                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3419                         if (msg->rsp[6] & 0x04) {
3420                                 /* It's a response, so find the
3421                                    requesting message and send it up. */
3422                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3423                         } else {
3424                                 /* It's a command to the SMS from some other
3425                                    entity.  Handle that. */
3426                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3427                         }
3428                         break;
3429
3430                 default:
3431                         /* We don't handle the channel type, so just
3432                          * free the message. */
3433                         requeue = 0;
3434                 }
3435
3436         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3437                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD))
3438         {
3439                 /* It's an asyncronous event. */
3440                 requeue = handle_read_event_rsp(intf, msg);
3441         } else {
3442                 /* It's a response from the local BMC. */
3443                 requeue = handle_bmc_rsp(intf, msg);
3444         }
3445
3446  out:
3447         return requeue;
3448 }
3449
3450 /* Handle a new message from the lower layer. */
3451 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3452                            struct ipmi_smi_msg *msg)
3453 {
3454         unsigned long flags;
3455         int           rv;
3456
3457
3458         if ((msg->data_size >= 2)
3459             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3460             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3461             && (msg->user_data == NULL))
3462         {
3463                 /* This is the local response to a command send, start
3464                    the timer for these.  The user_data will not be
3465                    NULL if this is a response send, and we will let
3466                    response sends just go through. */
3467
3468                 /* Check for errors, if we get certain errors (ones
3469                    that mean basically we can try again later), we
3470                    ignore them and start the timer.  Otherwise we
3471                    report the error immediately. */
3472                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3473                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3474                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3475                     && (msg->rsp[2] != IPMI_BUS_ERR)
3476                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR))
3477                 {
3478                         int chan = msg->rsp[3] & 0xf;
3479
3480                         /* Got an error sending the message, handle it. */
3481                         spin_lock_irqsave(&intf->counter_lock, flags);
3482                         if (chan >= IPMI_MAX_CHANNELS)
3483                                 ; /* This shouldn't happen */
3484                         else if ((intf->channels[chan].medium
3485                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3486                                  || (intf->channels[chan].medium
3487                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3488                                 intf->sent_lan_command_errs++;
3489                         else
3490                                 intf->sent_ipmb_command_errs++;
3491                         spin_unlock_irqrestore(&intf->counter_lock, flags);
3492                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3493                 } else {
3494                         /* The message was sent, start the timer. */
3495                         intf_start_seq_timer(intf, msg->msgid);
3496                 }
3497
3498                 ipmi_free_smi_msg(msg);
3499                 goto out;
3500         }
3501
3502         /* To preserve message order, if the list is not empty, we
3503            tack this message onto the end of the list. */
3504         spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3505         if (!list_empty(&intf->waiting_msgs)) {
3506                 list_add_tail(&msg->link, &intf->waiting_msgs);
3507                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3508                 goto out;
3509         }
3510         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3511
3512         rv = handle_new_recv_msg(intf, msg);
3513         if (rv > 0) {
3514                 /* Could not handle the message now, just add it to a
3515                    list to handle later. */
3516                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3517                 list_add_tail(&msg->link, &intf->waiting_msgs);
3518                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3519         } else if (rv == 0) {
3520                 ipmi_free_smi_msg(msg);
3521         }
3522
3523  out:
3524         return;
3525 }
3526
3527 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3528 {
3529         ipmi_user_t user;
3530
3531         rcu_read_lock();
3532         list_for_each_entry_rcu(user, &intf->users, link) {
3533                 if (!user->handler->ipmi_watchdog_pretimeout)
3534                         continue;
3535
3536                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
3537         }
3538         rcu_read_unlock();
3539 }
3540
3541
3542 static struct ipmi_smi_msg *
3543 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3544                   unsigned char seq, long seqid)
3545 {
3546         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3547         if (!smi_msg)
3548                 /* If we can't allocate the message, then just return, we
3549                    get 4 retries, so this should be ok. */
3550                 return NULL;
3551
3552         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3553         smi_msg->data_size = recv_msg->msg.data_len;
3554         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3555
3556 #ifdef DEBUG_MSGING
3557         {
3558                 int m;
3559                 printk("Resend: ");
3560                 for (m = 0; m < smi_msg->data_size; m++)
3561                         printk(" %2.2x", smi_msg->data[m]);
3562                 printk("\n");
3563         }
3564 #endif
3565         return smi_msg;
3566 }
3567
3568 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3569                               struct list_head *timeouts, long timeout_period,
3570                               int slot, unsigned long *flags)
3571 {
3572         struct ipmi_recv_msg     *msg;
3573         struct ipmi_smi_handlers *handlers;
3574
3575         if (intf->intf_num == -1)
3576                 return;
3577
3578         if (!ent->inuse)
3579                 return;
3580
3581         ent->timeout -= timeout_period;
3582         if (ent->timeout > 0)
3583                 return;
3584
3585         if (ent->retries_left == 0) {
3586                 /* The message has used all its retries. */
3587                 ent->inuse = 0;
3588                 msg = ent->recv_msg;
3589                 list_add_tail(&msg->link, timeouts);
3590                 spin_lock(&intf->counter_lock);
3591                 if (ent->broadcast)
3592                         intf->timed_out_ipmb_broadcasts++;
3593                 else if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3594                         intf->timed_out_lan_commands++;
3595                 else
3596                         intf->timed_out_ipmb_commands++;
3597                 spin_unlock(&intf->counter_lock);
3598         } else {
3599                 struct ipmi_smi_msg *smi_msg;
3600                 /* More retries, send again. */
3601
3602                 /* Start with the max timer, set to normal
3603                    timer after the message is sent. */
3604                 ent->timeout = MAX_MSG_TIMEOUT;
3605                 ent->retries_left--;
3606                 spin_lock(&intf->counter_lock);
3607                 if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3608                         intf->retransmitted_lan_commands++;
3609                 else
3610                         intf->retransmitted_ipmb_commands++;
3611                 spin_unlock(&intf->counter_lock);
3612
3613                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
3614                                             ent->seqid);
3615                 if (!smi_msg)
3616                         return;
3617
3618                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
3619
3620                 /* Send the new message.  We send with a zero
3621                  * priority.  It timed out, I doubt time is
3622                  * that critical now, and high priority
3623                  * messages are really only for messages to the
3624                  * local MC, which don't get resent. */
3625                 handlers = intf->handlers;
3626                 if (handlers)
3627                         intf->handlers->sender(intf->send_info,
3628                                                smi_msg, 0);
3629                 else
3630                         ipmi_free_smi_msg(smi_msg);
3631
3632                 spin_lock_irqsave(&intf->seq_lock, *flags);
3633         }
3634 }
3635
3636 static void ipmi_timeout_handler(long timeout_period)
3637 {
3638         ipmi_smi_t           intf;
3639         struct list_head     timeouts;
3640         struct ipmi_recv_msg *msg, *msg2;
3641         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
3642         unsigned long        flags;
3643         int                  i;
3644
3645         rcu_read_lock();
3646         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3647                 /* See if any waiting messages need to be processed. */
3648                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3649                 list_for_each_entry_safe(smi_msg, smi_msg2,
3650                                          &intf->waiting_msgs, link) {
3651                         if (!handle_new_recv_msg(intf, smi_msg)) {
3652                                 list_del(&smi_msg->link);
3653                                 ipmi_free_smi_msg(smi_msg);
3654                         } else {
3655                                 /* To preserve message order, quit if we
3656                                    can't handle a message. */
3657                                 break;
3658                         }
3659                 }
3660                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3661
3662                 /* Go through the seq table and find any messages that
3663                    have timed out, putting them in the timeouts
3664                    list. */
3665                 INIT_LIST_HEAD(&timeouts);
3666                 spin_lock_irqsave(&intf->seq_lock, flags);
3667                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
3668                         check_msg_timeout(intf, &(intf->seq_table[i]),
3669                                           &timeouts, timeout_period, i,
3670                                           &flags);
3671                 spin_unlock_irqrestore(&intf->seq_lock, flags);
3672
3673                 list_for_each_entry_safe(msg, msg2, &timeouts, link)
3674                         deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
3675
3676                 /*
3677                  * Maintenance mode handling.  Check the timeout
3678                  * optimistically before we claim the lock.  It may
3679                  * mean a timeout gets missed occasionally, but that
3680                  * only means the timeout gets extended by one period
3681                  * in that case.  No big deal, and it avoids the lock
3682                  * most of the time.
3683                  */
3684                 if (intf->auto_maintenance_timeout > 0) {
3685                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
3686                         if (intf->auto_maintenance_timeout > 0) {
3687                                 intf->auto_maintenance_timeout
3688                                         -= timeout_period;
3689                                 if (!intf->maintenance_mode
3690                                     && (intf->auto_maintenance_timeout <= 0))
3691                                 {
3692                                         intf->maintenance_mode_enable = 0;
3693                                         maintenance_mode_update(intf);
3694                                 }
3695                         }
3696                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
3697                                                flags);
3698                 }
3699         }
3700         rcu_read_unlock();
3701 }
3702
3703 static void ipmi_request_event(void)
3704 {
3705         ipmi_smi_t               intf;
3706         struct ipmi_smi_handlers *handlers;
3707
3708         rcu_read_lock();
3709         /* Called from the timer, no need to check if handlers is
3710          * valid. */
3711         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3712                 /* No event requests when in maintenance mode. */
3713                 if (intf->maintenance_mode_enable)
3714                         continue;
3715
3716                 handlers = intf->handlers;
3717                 if (handlers)
3718                         handlers->request_events(intf->send_info);
3719         }
3720         rcu_read_unlock();
3721 }
3722
3723 static struct timer_list ipmi_timer;
3724
3725 /* Call every ~100 ms. */
3726 #define IPMI_TIMEOUT_TIME       100
3727
3728 /* How many jiffies does it take to get to the timeout time. */
3729 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
3730
3731 /* Request events from the queue every second (this is the number of
3732    IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
3733    future, IPMI will add a way to know immediately if an event is in
3734    the queue and this silliness can go away. */
3735 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
3736
3737 static atomic_t stop_operation;
3738 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3739
3740 static void ipmi_timeout(unsigned long data)
3741 {
3742         if (atomic_read(&stop_operation))
3743                 return;
3744
3745         ticks_to_req_ev--;
3746         if (ticks_to_req_ev == 0) {
3747                 ipmi_request_event();
3748                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3749         }
3750
3751         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
3752
3753         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
3754 }
3755
3756
3757 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
3758 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
3759
3760 /* FIXME - convert these to slabs. */
3761 static void free_smi_msg(struct ipmi_smi_msg *msg)
3762 {
3763         atomic_dec(&smi_msg_inuse_count);
3764         kfree(msg);
3765 }
3766
3767 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
3768 {
3769         struct ipmi_smi_msg *rv;
3770         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
3771         if (rv) {
3772                 rv->done = free_smi_msg;
3773                 rv->user_data = NULL;
3774                 atomic_inc(&smi_msg_inuse_count);
3775         }
3776         return rv;
3777 }
3778
3779 static void free_recv_msg(struct ipmi_recv_msg *msg)
3780 {
3781         atomic_dec(&recv_msg_inuse_count);
3782         kfree(msg);
3783 }
3784
3785 struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
3786 {
3787         struct ipmi_recv_msg *rv;
3788
3789         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
3790         if (rv) {
3791                 rv->user = NULL;
3792                 rv->done = free_recv_msg;
3793                 atomic_inc(&recv_msg_inuse_count);
3794         }
3795         return rv;
3796 }
3797
3798 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
3799 {
3800         if (msg->user)
3801                 kref_put(&msg->user->refcount, free_user);
3802         msg->done(msg);
3803 }
3804
3805 #ifdef CONFIG_IPMI_PANIC_EVENT
3806
3807 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
3808 {
3809 }
3810
3811 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
3812 {
3813 }
3814
3815 #ifdef CONFIG_IPMI_PANIC_STRING
3816 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3817 {
3818         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3819             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
3820             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
3821             && (msg->msg.data[0] == IPMI_CC_NO_ERROR))
3822         {
3823                 /* A get event receiver command, save it. */
3824                 intf->event_receiver = msg->msg.data[1];
3825                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
3826         }
3827 }
3828
3829 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3830 {
3831         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3832             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3833             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
3834             && (msg->msg.data[0] == IPMI_CC_NO_ERROR))
3835         {
3836                 /* A get device id command, save if we are an event
3837                    receiver or generator. */
3838                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
3839                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
3840         }
3841 }
3842 #endif
3843
3844 static void send_panic_events(char *str)
3845 {
3846         struct kernel_ipmi_msg            msg;
3847         ipmi_smi_t                        intf;
3848         unsigned char                     data[16];
3849         struct ipmi_system_interface_addr *si;
3850         struct ipmi_addr                  addr;
3851         struct ipmi_smi_msg               smi_msg;
3852         struct ipmi_recv_msg              recv_msg;
3853
3854         si = (struct ipmi_system_interface_addr *) &addr;
3855         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3856         si->channel = IPMI_BMC_CHANNEL;
3857         si->lun = 0;
3858
3859         /* Fill in an event telling that we have failed. */
3860         msg.netfn = 0x04; /* Sensor or Event. */
3861         msg.cmd = 2; /* Platform event command. */
3862         msg.data = data;
3863         msg.data_len = 8;
3864         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
3865         data[1] = 0x03; /* This is for IPMI 1.0. */
3866         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
3867         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
3868         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
3869
3870         /* Put a few breadcrumbs in.  Hopefully later we can add more things
3871            to make the panic events more useful. */
3872         if (str) {
3873                 data[3] = str[0];
3874                 data[6] = str[1];
3875                 data[7] = str[2];
3876         }
3877
3878         smi_msg.done = dummy_smi_done_handler;
3879         recv_msg.done = dummy_recv_done_handler;
3880
3881         /* For every registered interface, send the event. */
3882         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3883                 if (!intf->handlers)
3884                         /* Interface is not ready. */
3885                         continue;
3886
3887                 /* Send the event announcing the panic. */
3888                 intf->handlers->set_run_to_completion(intf->send_info, 1);
3889                 i_ipmi_request(NULL,
3890                                intf,
3891                                &addr,
3892                                0,
3893                                &msg,
3894                                intf,
3895                                &smi_msg,
3896                                &recv_msg,
3897                                0,
3898                                intf->channels[0].address,
3899                                intf->channels[0].lun,
3900                                0, 1); /* Don't retry, and don't wait. */
3901         }
3902
3903 #ifdef CONFIG_IPMI_PANIC_STRING
3904         /* On every interface, dump a bunch of OEM event holding the
3905            string. */
3906         if (!str)
3907                 return;
3908
3909         /* For every registered interface, send the event. */
3910         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3911                 char                  *p = str;
3912                 struct ipmi_ipmb_addr *ipmb;
3913                 int                   j;
3914
3915                 if (intf->intf_num == -1)
3916                         /* Interface was not ready yet. */
3917                         continue;
3918
3919                 /*
3920                  * intf_num is used as an marker to tell if the
3921                  * interface is valid.  Thus we need a read barrier to
3922                  * make sure data fetched before checking intf_num
3923                  * won't be used.
3924                  */
3925                 smp_rmb();
3926
3927                 /* First job here is to figure out where to send the
3928                    OEM events.  There's no way in IPMI to send OEM
3929                    events using an event send command, so we have to
3930                    find the SEL to put them in and stick them in
3931                    there. */
3932
3933                 /* Get capabilities from the get device id. */
3934                 intf->local_sel_device = 0;
3935                 intf->local_event_generator = 0;
3936                 intf->event_receiver = 0;
3937
3938                 /* Request the device info from the local MC. */
3939                 msg.netfn = IPMI_NETFN_APP_REQUEST;
3940                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
3941                 msg.data = NULL;
3942                 msg.data_len = 0;
3943                 intf->null_user_handler = device_id_fetcher;
3944                 i_ipmi_request(NULL,
3945                                intf,
3946                                &addr,
3947                                0,
3948                                &msg,
3949                                intf,
3950                                &smi_msg,
3951                                &recv_msg,
3952                                0,
3953                                intf->channels[0].address,
3954                                intf->channels[0].lun,
3955                                0, 1); /* Don't retry, and don't wait. */
3956
3957                 if (intf->local_event_generator) {
3958                         /* Request the event receiver from the local MC. */
3959                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
3960                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
3961                         msg.data = NULL;
3962                         msg.data_len = 0;
3963                         intf->null_user_handler = event_receiver_fetcher;
3964                         i_ipmi_request(NULL,
3965                                        intf,
3966                                        &addr,
3967                                        0,
3968                                        &msg,
3969                                        intf,
3970                                        &smi_msg,
3971                                        &recv_msg,
3972                                        0,
3973                                        intf->channels[0].address,
3974                                        intf->channels[0].lun,
3975                                        0, 1); /* no retry, and no wait. */
3976                 }
3977                 intf->null_user_handler = NULL;
3978
3979                 /* Validate the event receiver.  The low bit must not
3980                    be 1 (it must be a valid IPMB address), it cannot
3981                    be zero, and it must not be my address. */
3982                 if (((intf->event_receiver & 1) == 0)
3983                     && (intf->event_receiver != 0)
3984                     && (intf->event_receiver != intf->channels[0].address))
3985                 {
3986                         /* The event receiver is valid, send an IPMB
3987                            message. */
3988                         ipmb = (struct ipmi_ipmb_addr *) &addr;
3989                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
3990                         ipmb->channel = 0; /* FIXME - is this right? */
3991                         ipmb->lun = intf->event_receiver_lun;
3992                         ipmb->slave_addr = intf->event_receiver;
3993                 } else if (intf->local_sel_device) {
3994                         /* The event receiver was not valid (or was
3995                            me), but I am an SEL device, just dump it
3996                            in my SEL. */
3997                         si = (struct ipmi_system_interface_addr *) &addr;
3998                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3999                         si->channel = IPMI_BMC_CHANNEL;
4000                         si->lun = 0;
4001                 } else
4002                         continue; /* No where to send the event. */
4003
4004
4005                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4006                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4007                 msg.data = data;
4008                 msg.data_len = 16;
4009
4010                 j = 0;
4011                 while (*p) {
4012                         int size = strlen(p);
4013
4014                         if (size > 11)
4015                                 size = 11;
4016                         data[0] = 0;
4017                         data[1] = 0;
4018                         data[2] = 0xf0; /* OEM event without timestamp. */
4019                         data[3] = intf->channels[0].address;
4020                         data[4] = j++; /* sequence # */
4021                         /* Always give 11 bytes, so strncpy will fill
4022                            it with zeroes for me. */
4023                         strncpy(data+5, p, 11);
4024                         p += size;
4025
4026                         i_ipmi_request(NULL,
4027                                        intf,
4028                                        &addr,
4029                                        0,
4030                                        &msg,
4031                                        intf,
4032                                        &smi_msg,
4033                                        &recv_msg,
4034                                        0,
4035                                        intf->channels[0].address,
4036                                        intf->channels[0].lun,
4037                                        0, 1); /* no retry, and no wait. */
4038                 }
4039         }
4040 #endif /* CONFIG_IPMI_PANIC_STRING */
4041 }
4042 #endif /* CONFIG_IPMI_PANIC_EVENT */
4043
4044 static int has_panicked;
4045
4046 static int panic_event(struct notifier_block *this,
4047                        unsigned long         event,
4048                        void                  *ptr)
4049 {
4050         ipmi_smi_t intf;
4051
4052         if (has_panicked)
4053                 return NOTIFY_DONE;
4054         has_panicked = 1;
4055
4056         /* For every registered interface, set it to run to completion. */
4057         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4058                 if (!intf->handlers)
4059                         /* Interface is not ready. */
4060                         continue;
4061
4062                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4063         }
4064
4065 #ifdef CONFIG_IPMI_PANIC_EVENT
4066         send_panic_events(ptr);
4067 #endif
4068
4069         return NOTIFY_DONE;
4070 }
4071
4072 static struct notifier_block panic_block = {
4073         .notifier_call  = panic_event,
4074         .next           = NULL,
4075         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4076 };
4077
4078 static int ipmi_init_msghandler(void)
4079 {
4080         int rv;
4081
4082         if (initialized)
4083                 return 0;
4084
4085         rv = driver_register(&ipmidriver);
4086         if (rv) {
4087                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4088                 return rv;
4089         }
4090
4091         printk(KERN_INFO "ipmi message handler version "
4092                IPMI_DRIVER_VERSION "\n");
4093
4094 #ifdef CONFIG_PROC_FS
4095         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4096         if (!proc_ipmi_root) {
4097             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4098             return -ENOMEM;
4099         }
4100
4101         proc_ipmi_root->owner = THIS_MODULE;
4102 #endif /* CONFIG_PROC_FS */
4103
4104         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4105         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4106
4107         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4108
4109         initialized = 1;
4110
4111         return 0;
4112 }
4113
4114 static __init int ipmi_init_msghandler_mod(void)
4115 {
4116         ipmi_init_msghandler();
4117         return 0;
4118 }
4119
4120 static __exit void cleanup_ipmi(void)
4121 {
4122         int count;
4123
4124         if (!initialized)
4125                 return;
4126
4127         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4128
4129         /* This can't be called if any interfaces exist, so no worry about
4130            shutting down the interfaces. */
4131
4132         /* Tell the timer to stop, then wait for it to stop.  This avoids
4133            problems with race conditions removing the timer here. */
4134         atomic_inc(&stop_operation);
4135         del_timer_sync(&ipmi_timer);
4136
4137 #ifdef CONFIG_PROC_FS
4138         remove_proc_entry(proc_ipmi_root->name, NULL);
4139 #endif /* CONFIG_PROC_FS */
4140
4141         driver_unregister(&ipmidriver);
4142
4143         initialized = 0;
4144
4145         /* Check for buffer leaks. */
4146         count = atomic_read(&smi_msg_inuse_count);
4147         if (count != 0)
4148                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4149                        count);
4150         count = atomic_read(&recv_msg_inuse_count);
4151         if (count != 0)
4152                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4153                        count);
4154 }
4155 module_exit(cleanup_ipmi);
4156
4157 module_init(ipmi_init_msghandler_mod);
4158 MODULE_LICENSE("GPL");
4159 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4160 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI interface.");
4161 MODULE_VERSION(IPMI_DRIVER_VERSION);
4162
4163 EXPORT_SYMBOL(ipmi_create_user);
4164 EXPORT_SYMBOL(ipmi_destroy_user);
4165 EXPORT_SYMBOL(ipmi_get_version);
4166 EXPORT_SYMBOL(ipmi_request_settime);
4167 EXPORT_SYMBOL(ipmi_request_supply_msgs);
4168 EXPORT_SYMBOL(ipmi_poll_interface);
4169 EXPORT_SYMBOL(ipmi_register_smi);
4170 EXPORT_SYMBOL(ipmi_unregister_smi);
4171 EXPORT_SYMBOL(ipmi_register_for_cmd);
4172 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
4173 EXPORT_SYMBOL(ipmi_smi_msg_received);
4174 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
4175 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4176 EXPORT_SYMBOL(ipmi_addr_length);
4177 EXPORT_SYMBOL(ipmi_validate_addr);
4178 EXPORT_SYMBOL(ipmi_set_gets_events);
4179 EXPORT_SYMBOL(ipmi_smi_watcher_register);
4180 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
4181 EXPORT_SYMBOL(ipmi_set_my_address);
4182 EXPORT_SYMBOL(ipmi_get_my_address);
4183 EXPORT_SYMBOL(ipmi_set_my_LUN);
4184 EXPORT_SYMBOL(ipmi_get_my_LUN);
4185 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
4186 EXPORT_SYMBOL(ipmi_free_recv_msg);