drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <asm/system.h>
  37 #include <linux/poll.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/mutex.h>
  40 #include <linux/slab.h>
  41 #include <linux/ipmi.h>
  42 #include <linux/ipmi_smi.h>
  43 #include <linux/notifier.h>
  44 #include <linux/init.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/rcupdate.h>
  47
  48 #define PFX "IPMI message handler: "
  49
  50 #define IPMI_DRIVER_VERSION "39.2"
  51
  52 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  53 static int ipmi_init_msghandler(void);
  54
  55 static int initialized;
  56
  57 #ifdef CONFIG_PROC_FS
  58 static struct proc_dir_entry *proc_ipmi_root;
  59 #endif /* CONFIG_PROC_FS */
  60
  61 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  62 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  63
  64 #define MAX_EVENTS_IN_QUEUE     25
  65
  66 /*
  67  * Don't let a message sit in a queue forever, always time it with at lest
  68  * the max message timer.  This is in milliseconds.
  69  */
  70 #define MAX_MSG_TIMEOUT         60000
  71
  72 /*
  73  * The main "user" data structure.
  74  */
  75 struct ipmi_user {
  76         struct list_head link;
  77
  78         /* Set to "0" when the user is destroyed. */
  79         int valid;
  80
  81         struct kref refcount;
  82
  83         /* The upper layer that handles receive messages. */
  84         struct ipmi_user_hndl *handler;
  85         void             *handler_data;
  86
  87         /* The interface this user is bound to. */
  88         ipmi_smi_t intf;
  89
  90         /* Does this interface receive IPMI events? */
  91         int gets_events;
  92 };
  93
  94 struct cmd_rcvr {
  95         struct list_head link;
  96
  97         ipmi_user_t   user;
  98         unsigned char netfn;
  99         unsigned char cmd;
 100         unsigned int  chans;
 101
 102         /*
 103          * This is used to form a linked lised during mass deletion.
 104          * Since this is in an RCU list, we cannot use the link above
 105          * or change any data until the RCU period completes.  So we
 106          * use this next variable during mass deletion so we can have
 107          * a list and don't have to wait and restart the search on
 108          * every individual deletion of a command.
 109          */
 110         struct cmd_rcvr *next;
 111 };
 112
 113 struct seq_table {
 114         unsigned int         inuse : 1;
 115         unsigned int         broadcast : 1;
 116
 117         unsigned long        timeout;
 118         unsigned long        orig_timeout;
 119         unsigned int         retries_left;
 120
 121         /*
 122          * To verify on an incoming send message response that this is
 123          * the message that the response is for, we keep a sequence id
 124          * and increment it every time we send a message.
 125          */
 126         long                 seqid;
 127
 128         /*
 129          * This is held so we can properly respond to the message on a
 130          * timeout, and it is used to hold the temporary data for
 131          * retransmission, too.
 132          */
 133         struct ipmi_recv_msg *recv_msg;
 134 };
 135
 136 /*
 137  * Store the information in a msgid (long) to allow us to find a
 138  * sequence table entry from the msgid.
 139  */
 140 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 141
 142 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 143         do {                                                            \
 144                 seq = ((msgid >> 26) & 0x3f);                           \
 145                 seqid = (msgid & 0x3fffff);                             \
 146         } while (0)
 147
 148 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 149
 150 struct ipmi_channel {
 151         unsigned char medium;
 152         unsigned char protocol;
 153
 154         /*
 155          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 156          * but may be changed by the user.
 157          */
 158         unsigned char address;
 159
 160         /*
 161          * My LUN.  This should generally stay the SMS LUN, but just in
 162          * case...
 163          */
 164         unsigned char lun;
 165 };
 166
 167 #ifdef CONFIG_PROC_FS
 168 struct ipmi_proc_entry {
 169         char                   *name;
 170         struct ipmi_proc_entry *next;
 171 };
 172 #endif
 173
 174 struct bmc_device {
 175         struct platform_device *dev;
 176         struct ipmi_device_id  id;
 177         unsigned char          guid[16];
 178         int                    guid_set;
 179
 180         struct kref            refcount;
 181
 182         /* bmc device attributes */
 183         struct device_attribute device_id_attr;
 184         struct device_attribute provides_dev_sdrs_attr;
 185         struct device_attribute revision_attr;
 186         struct device_attribute firmware_rev_attr;
 187         struct device_attribute version_attr;
 188         struct device_attribute add_dev_support_attr;
 189         struct device_attribute manufacturer_id_attr;
 190         struct device_attribute product_id_attr;
 191         struct device_attribute guid_attr;
 192         struct device_attribute aux_firmware_rev_attr;
 193 };
 194
 195 /*
 196  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 197  * structure.
 198  */
 199 enum ipmi_stat_indexes {
 200         /* Commands we got from the user that were invalid. */
 201         IPMI_STAT_sent_invalid_commands = 0,
 202
 203         /* Commands we sent to the MC. */
 204         IPMI_STAT_sent_local_commands,
 205
 206         /* Responses from the MC that were delivered to a user. */
 207         IPMI_STAT_handled_local_responses,
 208
 209         /* Responses from the MC that were not delivered to a user. */
 210         IPMI_STAT_unhandled_local_responses,
 211
 212         /* Commands we sent out to the IPMB bus. */
 213         IPMI_STAT_sent_ipmb_commands,
 214
 215         /* Commands sent on the IPMB that had errors on the SEND CMD */
 216         IPMI_STAT_sent_ipmb_command_errs,
 217
 218         /* Each retransmit increments this count. */
 219         IPMI_STAT_retransmitted_ipmb_commands,
 220
 221         /*
 222          * When a message times out (runs out of retransmits) this is
 223          * incremented.
 224          */
 225         IPMI_STAT_timed_out_ipmb_commands,
 226
 227         /*
 228          * This is like above, but for broadcasts.  Broadcasts are
 229          * *not* included in the above count (they are expected to
 230          * time out).
 231          */
 232         IPMI_STAT_timed_out_ipmb_broadcasts,
 233
 234         /* Responses I have sent to the IPMB bus. */
 235         IPMI_STAT_sent_ipmb_responses,
 236
 237         /* The response was delivered to the user. */
 238         IPMI_STAT_handled_ipmb_responses,
 239
 240         /* The response had invalid data in it. */
 241         IPMI_STAT_invalid_ipmb_responses,
 242
 243         /* The response didn't have anyone waiting for it. */
 244         IPMI_STAT_unhandled_ipmb_responses,
 245
 246         /* Commands we sent out to the IPMB bus. */
 247         IPMI_STAT_sent_lan_commands,
 248
 249         /* Commands sent on the IPMB that had errors on the SEND CMD */
 250         IPMI_STAT_sent_lan_command_errs,
 251
 252         /* Each retransmit increments this count. */
 253         IPMI_STAT_retransmitted_lan_commands,
 254
 255         /*
 256          * When a message times out (runs out of retransmits) this is
 257          * incremented.
 258          */
 259         IPMI_STAT_timed_out_lan_commands,
 260
 261         /* Responses I have sent to the IPMB bus. */
 262         IPMI_STAT_sent_lan_responses,
 263
 264         /* The response was delivered to the user. */
 265         IPMI_STAT_handled_lan_responses,
 266
 267         /* The response had invalid data in it. */
 268         IPMI_STAT_invalid_lan_responses,
 269
 270         /* The response didn't have anyone waiting for it. */
 271         IPMI_STAT_unhandled_lan_responses,
 272
 273         /* The command was delivered to the user. */
 274         IPMI_STAT_handled_commands,
 275
 276         /* The command had invalid data in it. */
 277         IPMI_STAT_invalid_commands,
 278
 279         /* The command didn't have anyone waiting for it. */
 280         IPMI_STAT_unhandled_commands,
 281
 282         /* Invalid data in an event. */
 283         IPMI_STAT_invalid_events,
 284
 285         /* Events that were received with the proper format. */
 286         IPMI_STAT_events,
 287
 288
 289         /* This *must* remain last, add new values above this. */
 290         IPMI_NUM_STATS
 291 };
 292
 293
 294 #define IPMI_IPMB_NUM_SEQ       64
 295 #define IPMI_MAX_CHANNELS       16
 296 struct ipmi_smi {
 297         /* What interface number are we? */
 298         int intf_num;
 299
 300         struct kref refcount;
 301
 302         /* Used for a list of interfaces. */
 303         struct list_head link;
 304
 305         /*
 306          * The list of upper layers that are using me.  seq_lock
 307          * protects this.
 308          */
 309         struct list_head users;
 310
 311         /* Information to supply to users. */
 312         unsigned char ipmi_version_major;
 313         unsigned char ipmi_version_minor;
 314
 315         /* Used for wake ups at startup. */
 316         wait_queue_head_t waitq;
 317
 318         struct bmc_device *bmc;
 319         char *my_dev_name;
 320         char *sysfs_name;
 321
 322         /*
 323          * This is the lower-layer's sender routine.  Note that you
 324          * must either be holding the ipmi_interfaces_mutex or be in
 325          * an umpreemptible region to use this.  You must fetch the
 326          * value into a local variable and make sure it is not NULL.
 327          */
 328         struct ipmi_smi_handlers *handlers;
 329         void                     *send_info;
 330
 331 #ifdef CONFIG_PROC_FS
 332         /* A list of proc entries for this interface. */
 333         struct mutex           proc_entry_lock;
 334         struct ipmi_proc_entry *proc_entries;
 335 #endif
 336
 337         /* Driver-model device for the system interface. */
 338         struct device          *si_dev;
 339
 340         /*
 341          * A table of sequence numbers for this interface.  We use the
 342          * sequence numbers for IPMB messages that go out of the
 343          * interface to match them up with their responses.  A routine
 344          * is called periodically to time the items in this list.
 345          */
 346         spinlock_t       seq_lock;
 347         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 348         int curr_seq;
 349
 350         /*
 351          * Messages that were delayed for some reason (out of memory,
 352          * for instance), will go in here to be processed later in a
 353          * periodic timer interrupt.
 354          */
 355         spinlock_t       waiting_msgs_lock;
 356         struct list_head waiting_msgs;
 357
 358         /*
 359          * The list of command receivers that are registered for commands
 360          * on this interface.
 361          */
 362         struct mutex     cmd_rcvrs_mutex;
 363         struct list_head cmd_rcvrs;
 364
 365         /*
 366          * Events that were queues because no one was there to receive
 367          * them.
 368          */
 369         spinlock_t       events_lock; /* For dealing with event stuff. */
 370         struct list_head waiting_events;
 371         unsigned int     waiting_events_count; /* How many events in queue? */
 372         char             delivering_events;
 373         char             event_msg_printed;
 374
 375         /*
 376          * The event receiver for my BMC, only really used at panic
 377          * shutdown as a place to store this.
 378          */
 379         unsigned char event_receiver;
 380         unsigned char event_receiver_lun;
 381         unsigned char local_sel_device;
 382         unsigned char local_event_generator;
 383
 384         /* For handling of maintenance mode. */
 385         int maintenance_mode;
 386         int maintenance_mode_enable;
 387         int auto_maintenance_timeout;
 388         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 389
 390         /*
 391          * A cheap hack, if this is non-null and a message to an
 392          * interface comes in with a NULL user, call this routine with
 393          * it.  Note that the message will still be freed by the
 394          * caller.  This only works on the system interface.
 395          */
 396         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 397
 398         /*
 399          * When we are scanning the channels for an SMI, this will
 400          * tell which channel we are scanning.
 401          */
 402         int curr_channel;
 403
 404         /* Channel information */
 405         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 406
 407         /* Proc FS stuff. */
 408         struct proc_dir_entry *proc_dir;
 409         char                  proc_dir_name[10];
 410
 411         atomic_t stats[IPMI_NUM_STATS];
 412
 413         /*
 414          * run_to_completion duplicate of smb_info, smi_info
 415          * and ipmi_serial_info structures. Used to decrease numbers of
 416          * parameters passed by "low" level IPMI code.
 417          */
 418         int run_to_completion;
 419 };
 420 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 421
 422 /**
 423  * The driver model view of the IPMI messaging driver.
 424  */
 425 static struct platform_driver ipmidriver = {
 426         .driver = {
 427                 .name = "ipmi",
 428                 .bus = &platform_bus_type
 429         }
 430 };
 431 static DEFINE_MUTEX(ipmidriver_mutex);
 432
 433 static LIST_HEAD(ipmi_interfaces);
 434 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 435
 436 /*
 437  * List of watchers that want to know when smi's are added and deleted.
 438  */
 439 static LIST_HEAD(smi_watchers);
 440 static DEFINE_MUTEX(smi_watchers_mutex);
 441
 442
 443 #define ipmi_inc_stat(intf, stat) \
 444         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 445 #define ipmi_get_stat(intf, stat) \
 446         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 447
 448
 449 static void free_recv_msg_list(struct list_head *q)
 450 {
 451         struct ipmi_recv_msg *msg, *msg2;
 452
 453         list_for_each_entry_safe(msg, msg2, q, link) {
 454                 list_del(&msg->link);
 455                 ipmi_free_recv_msg(msg);
 456         }
 457 }
 458
 459 static void free_smi_msg_list(struct list_head *q)
 460 {
 461         struct ipmi_smi_msg *msg, *msg2;
 462
 463         list_for_each_entry_safe(msg, msg2, q, link) {
 464                 list_del(&msg->link);
 465                 ipmi_free_smi_msg(msg);
 466         }
 467 }
 468
 469 static void clean_up_interface_data(ipmi_smi_t intf)
 470 {
 471         int              i;
 472         struct cmd_rcvr  *rcvr, *rcvr2;
 473         struct list_head list;
 474
 475         free_smi_msg_list(&intf->waiting_msgs);
 476         free_recv_msg_list(&intf->waiting_events);
 477
 478         /*
 479          * Wholesale remove all the entries from the list in the
 480          * interface and wait for RCU to know that none are in use.
 481          */
 482         mutex_lock(&intf->cmd_rcvrs_mutex);
 483         INIT_LIST_HEAD(&list);
 484         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 485         mutex_unlock(&intf->cmd_rcvrs_mutex);
 486
 487         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 488                 kfree(rcvr);
 489
 490         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 491                 if ((intf->seq_table[i].inuse)
 492                                         && (intf->seq_table[i].recv_msg))
 493                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 494         }
 495 }
 496
 497 static void intf_free(struct kref *ref)
 498 {
 499         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 500
 501         clean_up_interface_data(intf);
 502         kfree(intf);
 503 }
 504
 505 struct watcher_entry {
 506         int              intf_num;
 507         ipmi_smi_t       intf;
 508         struct list_head link;
 509 };
 510
 511 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 512 {
 513         ipmi_smi_t intf;
 514         LIST_HEAD(to_deliver);
 515         struct watcher_entry *e, *e2;
 516
 517         mutex_lock(&smi_watchers_mutex);
 518
 519         mutex_lock(&ipmi_interfaces_mutex);
 520
 521         /* Build a list of things to deliver. */
 522         list_for_each_entry(intf, &ipmi_interfaces, link) {
 523                 if (intf->intf_num == -1)
 524                         continue;
 525                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 526                 if (!e)
 527                         goto out_err;
 528                 kref_get(&intf->refcount);
 529                 e->intf = intf;
 530                 e->intf_num = intf->intf_num;
 531                 list_add_tail(&e->link, &to_deliver);
 532         }
 533
 534         /* We will succeed, so add it to the list. */
 535         list_add(&watcher->link, &smi_watchers);
 536
 537         mutex_unlock(&ipmi_interfaces_mutex);
 538
 539         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 540                 list_del(&e->link);
 541                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 542                 kref_put(&e->intf->refcount, intf_free);
 543                 kfree(e);
 544         }
 545
 546         mutex_unlock(&smi_watchers_mutex);
 547
 548         return 0;
 549
 550  out_err:
 551         mutex_unlock(&ipmi_interfaces_mutex);
 552         mutex_unlock(&smi_watchers_mutex);
 553         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 554                 list_del(&e->link);
 555                 kref_put(&e->intf->refcount, intf_free);
 556                 kfree(e);
 557         }
 558         return -ENOMEM;
 559 }
 560 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 561
 562 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 563 {
 564         mutex_lock(&smi_watchers_mutex);
 565         list_del(&(watcher->link));
 566         mutex_unlock(&smi_watchers_mutex);
 567         return 0;
 568 }
 569 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 570
 571 /*
 572  * Must be called with smi_watchers_mutex held.
 573  */
 574 static void
 575 call_smi_watchers(int i, struct device *dev)
 576 {
 577         struct ipmi_smi_watcher *w;
 578
 579         list_for_each_entry(w, &smi_watchers, link) {
 580                 if (try_module_get(w->owner)) {
 581                         w->new_smi(i, dev);
 582                         module_put(w->owner);
 583                 }
 584         }
 585 }
 586
 587 static int
 588 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 589 {
 590         if (addr1->addr_type != addr2->addr_type)
 591                 return 0;
 592
 593         if (addr1->channel != addr2->channel)
 594                 return 0;
 595
 596         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 597                 struct ipmi_system_interface_addr *smi_addr1
 598                     = (struct ipmi_system_interface_addr *) addr1;
 599                 struct ipmi_system_interface_addr *smi_addr2
 600                     = (struct ipmi_system_interface_addr *) addr2;
 601                 return (smi_addr1->lun == smi_addr2->lun);
 602         }
 603
 604         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 605             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 606                 struct ipmi_ipmb_addr *ipmb_addr1
 607                     = (struct ipmi_ipmb_addr *) addr1;
 608                 struct ipmi_ipmb_addr *ipmb_addr2
 609                     = (struct ipmi_ipmb_addr *) addr2;
 610
 611                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 612                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 613         }
 614
 615         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 616                 struct ipmi_lan_addr *lan_addr1
 617                         = (struct ipmi_lan_addr *) addr1;
 618                 struct ipmi_lan_addr *lan_addr2
 619                     = (struct ipmi_lan_addr *) addr2;
 620
 621                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 622                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 623                         && (lan_addr1->session_handle
 624                             == lan_addr2->session_handle)
 625                         && (lan_addr1->lun == lan_addr2->lun));
 626         }
 627
 628         return 1;
 629 }
 630
 631 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 632 {
 633         if (len < sizeof(struct ipmi_system_interface_addr))
 634                 return -EINVAL;
 635
 636         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 637                 if (addr->channel != IPMI_BMC_CHANNEL)
 638                         return -EINVAL;
 639                 return 0;
 640         }
 641
 642         if ((addr->channel == IPMI_BMC_CHANNEL)
 643             || (addr->channel >= IPMI_MAX_CHANNELS)
 644             || (addr->channel < 0))
 645                 return -EINVAL;
 646
 647         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 648             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 649                 if (len < sizeof(struct ipmi_ipmb_addr))
 650                         return -EINVAL;
 651                 return 0;
 652         }
 653
 654         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 655                 if (len < sizeof(struct ipmi_lan_addr))
 656                         return -EINVAL;
 657                 return 0;
 658         }
 659
 660         return -EINVAL;
 661 }
 662 EXPORT_SYMBOL(ipmi_validate_addr);
 663
 664 unsigned int ipmi_addr_length(int addr_type)
 665 {
 666         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 667                 return sizeof(struct ipmi_system_interface_addr);
 668
 669         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 670                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 671                 return sizeof(struct ipmi_ipmb_addr);
 672
 673         if (addr_type == IPMI_LAN_ADDR_TYPE)
 674                 return sizeof(struct ipmi_lan_addr);
 675
 676         return 0;
 677 }
 678 EXPORT_SYMBOL(ipmi_addr_length);
 679
 680 static void deliver_response(struct ipmi_recv_msg *msg)
 681 {
 682         if (!msg->user) {
 683                 ipmi_smi_t    intf = msg->user_msg_data;
 684
 685                 /* Special handling for NULL users. */
 686                 if (intf->null_user_handler) {
 687                         intf->null_user_handler(intf, msg);
 688                         ipmi_inc_stat(intf, handled_local_responses);
 689                 } else {
 690                         /* No handler, so give up. */
 691                         ipmi_inc_stat(intf, unhandled_local_responses);
 692                 }
 693                 ipmi_free_recv_msg(msg);
 694         } else {
 695                 ipmi_user_t user = msg->user;
 696                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 697         }
 698 }
 699
 700 static void
 701 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 702 {
 703         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 704         msg->msg_data[0] = err;
 705         msg->msg.netfn |= 1; /* Convert to a response. */
 706         msg->msg.data_len = 1;
 707         msg->msg.data = msg->msg_data;
 708         deliver_response(msg);
 709 }
 710
 711 /*
 712  * Find the next sequence number not being used and add the given
 713  * message with the given timeout to the sequence table.  This must be
 714  * called with the interface's seq_lock held.
 715  */
 716 static int intf_next_seq(ipmi_smi_t           intf,
 717                          struct ipmi_recv_msg *recv_msg,
 718                          unsigned long        timeout,
 719                          int                  retries,
 720                          int                  broadcast,
 721                          unsigned char        *seq,
 722                          long                 *seqid)
 723 {
 724         int          rv = 0;
 725         unsigned int i;
 726
 727         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 728                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 729                 if (!intf->seq_table[i].inuse)
 730                         break;
 731         }
 732
 733         if (!intf->seq_table[i].inuse) {
 734                 intf->seq_table[i].recv_msg = recv_msg;
 735
 736                 /*
 737                  * Start with the maximum timeout, when the send response
 738                  * comes in we will start the real timer.
 739                  */
 740                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 741                 intf->seq_table[i].orig_timeout = timeout;
 742                 intf->seq_table[i].retries_left = retries;
 743                 intf->seq_table[i].broadcast = broadcast;
 744                 intf->seq_table[i].inuse = 1;
 745                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 746                 *seq = i;
 747                 *seqid = intf->seq_table[i].seqid;
 748                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 749         } else {
 750                 rv = -EAGAIN;
 751         }
 752
 753         return rv;
 754 }
 755
 756 /*
 757  * Return the receive message for the given sequence number and
 758  * release the sequence number so it can be reused.  Some other data
 759  * is passed in to be sure the message matches up correctly (to help
 760  * guard against message coming in after their timeout and the
 761  * sequence number being reused).
 762  */
 763 static int intf_find_seq(ipmi_smi_t           intf,
 764                          unsigned char        seq,
 765                          short                channel,
 766                          unsigned char        cmd,
 767                          unsigned char        netfn,
 768                          struct ipmi_addr     *addr,
 769                          struct ipmi_recv_msg **recv_msg)
 770 {
 771         int           rv = -ENODEV;
 772         unsigned long flags;
 773
 774         if (seq >= IPMI_IPMB_NUM_SEQ)
 775                 return -EINVAL;
 776
 777         spin_lock_irqsave(&(intf->seq_lock), flags);
 778         if (intf->seq_table[seq].inuse) {
 779                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 780
 781                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 782                                 && (msg->msg.netfn == netfn)
 783                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 784                         *recv_msg = msg;
 785                         intf->seq_table[seq].inuse = 0;
 786                         rv = 0;
 787                 }
 788         }
 789         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 790
 791         return rv;
 792 }
 793
 794
 795 /* Start the timer for a specific sequence table entry. */
 796 static int intf_start_seq_timer(ipmi_smi_t intf,
 797                                 long       msgid)
 798 {
 799         int           rv = -ENODEV;
 800         unsigned long flags;
 801         unsigned char seq;
 802         unsigned long seqid;
 803
 804
 805         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 806
 807         spin_lock_irqsave(&(intf->seq_lock), flags);
 808         /*
 809          * We do this verification because the user can be deleted
 810          * while a message is outstanding.
 811          */
 812         if ((intf->seq_table[seq].inuse)
 813                                 && (intf->seq_table[seq].seqid == seqid)) {
 814                 struct seq_table *ent = &(intf->seq_table[seq]);
 815                 ent->timeout = ent->orig_timeout;
 816                 rv = 0;
 817         }
 818         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 819
 820         return rv;
 821 }
 822
 823 /* Got an error for the send message for a specific sequence number. */
 824 static int intf_err_seq(ipmi_smi_t   intf,
 825                         long         msgid,
 826                         unsigned int err)
 827 {
 828         int                  rv = -ENODEV;
 829         unsigned long        flags;
 830         unsigned char        seq;
 831         unsigned long        seqid;
 832         struct ipmi_recv_msg *msg = NULL;
 833
 834
 835         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 836
 837         spin_lock_irqsave(&(intf->seq_lock), flags);
 838         /*
 839          * We do this verification because the user can be deleted
 840          * while a message is outstanding.
 841          */
 842         if ((intf->seq_table[seq].inuse)
 843                                 && (intf->seq_table[seq].seqid == seqid)) {
 844                 struct seq_table *ent = &(intf->seq_table[seq]);
 845
 846                 ent->inuse = 0;
 847                 msg = ent->recv_msg;
 848                 rv = 0;
 849         }
 850         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 851
 852         if (msg)
 853                 deliver_err_response(msg, err);
 854
 855         return rv;
 856 }
 857
 858
 859 int ipmi_create_user(unsigned int          if_num,
 860                      struct ipmi_user_hndl *handler,
 861                      void                  *handler_data,
 862                      ipmi_user_t           *user)
 863 {
 864         unsigned long flags;
 865         ipmi_user_t   new_user;
 866         int           rv = 0;
 867         ipmi_smi_t    intf;
 868
 869         /*
 870          * There is no module usecount here, because it's not
 871          * required.  Since this can only be used by and called from
 872          * other modules, they will implicitly use this module, and
 873          * thus this can't be removed unless the other modules are
 874          * removed.
 875          */
 876
 877         if (handler == NULL)
 878                 return -EINVAL;
 879
 880         /*
 881          * Make sure the driver is actually initialized, this handles
 882          * problems with initialization order.
 883          */
 884         if (!initialized) {
 885                 rv = ipmi_init_msghandler();
 886                 if (rv)
 887                         return rv;
 888
 889                 /*
 890                  * The init code doesn't return an error if it was turned
 891                  * off, but it won't initialize.  Check that.
 892                  */
 893                 if (!initialized)
 894                         return -ENODEV;
 895         }
 896
 897         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 898         if (!new_user)
 899                 return -ENOMEM;
 900
 901         mutex_lock(&ipmi_interfaces_mutex);
 902         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 903                 if (intf->intf_num == if_num)
 904                         goto found;
 905         }
 906         /* Not found, return an error */
 907         rv = -EINVAL;
 908         goto out_kfree;
 909
 910  found:
 911         /* Note that each existing user holds a refcount to the interface. */
 912         kref_get(&intf->refcount);
 913
 914         kref_init(&new_user->refcount);
 915         new_user->handler = handler;
 916         new_user->handler_data = handler_data;
 917         new_user->intf = intf;
 918         new_user->gets_events = 0;
 919
 920         if (!try_module_get(intf->handlers->owner)) {
 921                 rv = -ENODEV;
 922                 goto out_kref;
 923         }
 924
 925         if (intf->handlers->inc_usecount) {
 926                 rv = intf->handlers->inc_usecount(intf->send_info);
 927                 if (rv) {
 928                         module_put(intf->handlers->owner);
 929                         goto out_kref;
 930                 }
 931         }
 932
 933         /*
 934          * Hold the lock so intf->handlers is guaranteed to be good
 935          * until now
 936          */
 937         mutex_unlock(&ipmi_interfaces_mutex);
 938
 939         new_user->valid = 1;
 940         spin_lock_irqsave(&intf->seq_lock, flags);
 941         list_add_rcu(&new_user->link, &intf->users);
 942         spin_unlock_irqrestore(&intf->seq_lock, flags);
 943         *user = new_user;
 944         return 0;
 945
 946 out_kref:
 947         kref_put(&intf->refcount, intf_free);
 948 out_kfree:
 949         mutex_unlock(&ipmi_interfaces_mutex);
 950         kfree(new_user);
 951         return rv;
 952 }
 953 EXPORT_SYMBOL(ipmi_create_user);
 954
 955 static void free_user(struct kref *ref)
 956 {
 957         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
 958         kfree(user);
 959 }
 960
 961 int ipmi_destroy_user(ipmi_user_t user)
 962 {
 963         ipmi_smi_t       intf = user->intf;
 964         int              i;
 965         unsigned long    flags;
 966         struct cmd_rcvr  *rcvr;
 967         struct cmd_rcvr  *rcvrs = NULL;
 968
 969         user->valid = 0;
 970
 971         /* Remove the user from the interface's sequence table. */
 972         spin_lock_irqsave(&intf->seq_lock, flags);
 973         list_del_rcu(&user->link);
 974
 975         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 976                 if (intf->seq_table[i].inuse
 977                     && (intf->seq_table[i].recv_msg->user == user)) {
 978                         intf->seq_table[i].inuse = 0;
 979                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 980                 }
 981         }
 982         spin_unlock_irqrestore(&intf->seq_lock, flags);
 983
 984         /*
 985          * Remove the user from the command receiver's table.  First
 986          * we build a list of everything (not using the standard link,
 987          * since other things may be using it till we do
 988          * synchronize_rcu()) then free everything in that list.
 989          */
 990         mutex_lock(&intf->cmd_rcvrs_mutex);
 991         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
 992                 if (rcvr->user == user) {
 993                         list_del_rcu(&rcvr->link);
 994                         rcvr->next = rcvrs;
 995                         rcvrs = rcvr;
 996                 }
 997         }
 998         mutex_unlock(&intf->cmd_rcvrs_mutex);
 999         synchronize_rcu();
1000         while (rcvrs) {
1001                 rcvr = rcvrs;
1002                 rcvrs = rcvr->next;
1003                 kfree(rcvr);
1004         }
1005
1006         mutex_lock(&ipmi_interfaces_mutex);
1007         if (intf->handlers) {
1008                 module_put(intf->handlers->owner);
1009                 if (intf->handlers->dec_usecount)
1010                         intf->handlers->dec_usecount(intf->send_info);
1011         }
1012         mutex_unlock(&ipmi_interfaces_mutex);
1013
1014         kref_put(&intf->refcount, intf_free);
1015
1016         kref_put(&user->refcount, free_user);
1017
1018         return 0;
1019 }
1020 EXPORT_SYMBOL(ipmi_destroy_user);
1021
1022 void ipmi_get_version(ipmi_user_t   user,
1023                       unsigned char *major,
1024                       unsigned char *minor)
1025 {
1026         *major = user->intf->ipmi_version_major;
1027         *minor = user->intf->ipmi_version_minor;
1028 }
1029 EXPORT_SYMBOL(ipmi_get_version);
1030
1031 int ipmi_set_my_address(ipmi_user_t   user,
1032                         unsigned int  channel,
1033                         unsigned char address)
1034 {
1035         if (channel >= IPMI_MAX_CHANNELS)
1036                 return -EINVAL;
1037         user->intf->channels[channel].address = address;
1038         return 0;
1039 }
1040 EXPORT_SYMBOL(ipmi_set_my_address);
1041
1042 int ipmi_get_my_address(ipmi_user_t   user,
1043                         unsigned int  channel,
1044                         unsigned char *address)
1045 {
1046         if (channel >= IPMI_MAX_CHANNELS)
1047                 return -EINVAL;
1048         *address = user->intf->channels[channel].address;
1049         return 0;
1050 }
1051 EXPORT_SYMBOL(ipmi_get_my_address);
1052
1053 int ipmi_set_my_LUN(ipmi_user_t   user,
1054                     unsigned int  channel,
1055                     unsigned char LUN)
1056 {
1057         if (channel >= IPMI_MAX_CHANNELS)
1058                 return -EINVAL;
1059         user->intf->channels[channel].lun = LUN & 0x3;
1060         return 0;
1061 }
1062 EXPORT_SYMBOL(ipmi_set_my_LUN);
1063
1064 int ipmi_get_my_LUN(ipmi_user_t   user,
1065                     unsigned int  channel,
1066                     unsigned char *address)
1067 {
1068         if (channel >= IPMI_MAX_CHANNELS)
1069                 return -EINVAL;
1070         *address = user->intf->channels[channel].lun;
1071         return 0;
1072 }
1073 EXPORT_SYMBOL(ipmi_get_my_LUN);
1074
1075 int ipmi_get_maintenance_mode(ipmi_user_t user)
1076 {
1077         int           mode;
1078         unsigned long flags;
1079
1080         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1081         mode = user->intf->maintenance_mode;
1082         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1083
1084         return mode;
1085 }
1086 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1087
1088 static void maintenance_mode_update(ipmi_smi_t intf)
1089 {
1090         if (intf->handlers->set_maintenance_mode)
1091                 intf->handlers->set_maintenance_mode(
1092                         intf->send_info, intf->maintenance_mode_enable);
1093 }
1094
1095 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1096 {
1097         int           rv = 0;
1098         unsigned long flags;
1099         ipmi_smi_t    intf = user->intf;
1100
1101         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1102         if (intf->maintenance_mode != mode) {
1103                 switch (mode) {
1104                 case IPMI_MAINTENANCE_MODE_AUTO:
1105                         intf->maintenance_mode = mode;
1106                         intf->maintenance_mode_enable
1107                                 = (intf->auto_maintenance_timeout > 0);
1108                         break;
1109
1110                 case IPMI_MAINTENANCE_MODE_OFF:
1111                         intf->maintenance_mode = mode;
1112                         intf->maintenance_mode_enable = 0;
1113                         break;
1114
1115                 case IPMI_MAINTENANCE_MODE_ON:
1116                         intf->maintenance_mode = mode;
1117                         intf->maintenance_mode_enable = 1;
1118                         break;
1119
1120                 default:
1121                         rv = -EINVAL;
1122                         goto out_unlock;
1123                 }
1124
1125                 maintenance_mode_update(intf);
1126         }
1127  out_unlock:
1128         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1129
1130         return rv;
1131 }
1132 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1133
1134 int ipmi_set_gets_events(ipmi_user_t user, int val)
1135 {
1136         unsigned long        flags;
1137         ipmi_smi_t           intf = user->intf;
1138         struct ipmi_recv_msg *msg, *msg2;
1139         struct list_head     msgs;
1140
1141         INIT_LIST_HEAD(&msgs);
1142
1143         spin_lock_irqsave(&intf->events_lock, flags);
1144         user->gets_events = val;
1145
1146         if (intf->delivering_events)
1147                 /*
1148                  * Another thread is delivering events for this, so
1149                  * let it handle any new events.
1150                  */
1151                 goto out;
1152
1153         /* Deliver any queued events. */
1154         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1155                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1156                         list_move_tail(&msg->link, &msgs);
1157                 intf->waiting_events_count = 0;
1158                 if (intf->event_msg_printed) {
1159                         printk(KERN_WARNING PFX "Event queue no longer"
1160                                " full\n");
1161                         intf->event_msg_printed = 0;
1162                 }
1163
1164                 intf->delivering_events = 1;
1165                 spin_unlock_irqrestore(&intf->events_lock, flags);
1166
1167                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1168                         msg->user = user;
1169                         kref_get(&user->refcount);
1170                         deliver_response(msg);
1171                 }
1172
1173                 spin_lock_irqsave(&intf->events_lock, flags);
1174                 intf->delivering_events = 0;
1175         }
1176
1177  out:
1178         spin_unlock_irqrestore(&intf->events_lock, flags);
1179
1180         return 0;
1181 }
1182 EXPORT_SYMBOL(ipmi_set_gets_events);
1183
1184 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1185                                       unsigned char netfn,
1186                                       unsigned char cmd,
1187                                       unsigned char chan)
1188 {
1189         struct cmd_rcvr *rcvr;
1190
1191         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1192                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1193                                         && (rcvr->chans & (1 << chan)))
1194                         return rcvr;
1195         }
1196         return NULL;
1197 }
1198
1199 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1200                                  unsigned char netfn,
1201                                  unsigned char cmd,
1202                                  unsigned int  chans)
1203 {
1204         struct cmd_rcvr *rcvr;
1205
1206         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1207                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1208                                         && (rcvr->chans & chans))
1209                         return 0;
1210         }
1211         return 1;
1212 }
1213
1214 int ipmi_register_for_cmd(ipmi_user_t   user,
1215                           unsigned char netfn,
1216                           unsigned char cmd,
1217                           unsigned int  chans)
1218 {
1219         ipmi_smi_t      intf = user->intf;
1220         struct cmd_rcvr *rcvr;
1221         int             rv = 0;
1222
1223
1224         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1225         if (!rcvr)
1226                 return -ENOMEM;
1227         rcvr->cmd = cmd;
1228         rcvr->netfn = netfn;
1229         rcvr->chans = chans;
1230         rcvr->user = user;
1231
1232         mutex_lock(&intf->cmd_rcvrs_mutex);
1233         /* Make sure the command/netfn is not already registered. */
1234         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1235                 rv = -EBUSY;
1236                 goto out_unlock;
1237         }
1238
1239         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1240
1241  out_unlock:
1242         mutex_unlock(&intf->cmd_rcvrs_mutex);
1243         if (rv)
1244                 kfree(rcvr);
1245
1246         return rv;
1247 }
1248 EXPORT_SYMBOL(ipmi_register_for_cmd);
1249
1250 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1251                             unsigned char netfn,
1252                             unsigned char cmd,
1253                             unsigned int  chans)
1254 {
1255         ipmi_smi_t      intf = user->intf;
1256         struct cmd_rcvr *rcvr;
1257         struct cmd_rcvr *rcvrs = NULL;
1258         int i, rv = -ENOENT;
1259
1260         mutex_lock(&intf->cmd_rcvrs_mutex);
1261         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1262                 if (((1 << i) & chans) == 0)
1263                         continue;
1264                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1265                 if (rcvr == NULL)
1266                         continue;
1267                 if (rcvr->user == user) {
1268                         rv = 0;
1269                         rcvr->chans &= ~chans;
1270                         if (rcvr->chans == 0) {
1271                                 list_del_rcu(&rcvr->link);
1272                                 rcvr->next = rcvrs;
1273                                 rcvrs = rcvr;
1274                         }
1275                 }
1276         }
1277         mutex_unlock(&intf->cmd_rcvrs_mutex);
1278         synchronize_rcu();
1279         while (rcvrs) {
1280                 rcvr = rcvrs;
1281                 rcvrs = rcvr->next;
1282                 kfree(rcvr);
1283         }
1284         return rv;
1285 }
1286 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1287
1288 static unsigned char
1289 ipmb_checksum(unsigned char *data, int size)
1290 {
1291         unsigned char csum = 0;
1292
1293         for (; size > 0; size--, data++)
1294                 csum += *data;
1295
1296         return -csum;
1297 }
1298
1299 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1300                                    struct kernel_ipmi_msg *msg,
1301                                    struct ipmi_ipmb_addr *ipmb_addr,
1302                                    long                  msgid,
1303                                    unsigned char         ipmb_seq,
1304                                    int                   broadcast,
1305                                    unsigned char         source_address,
1306                                    unsigned char         source_lun)
1307 {
1308         int i = broadcast;
1309
1310         /* Format the IPMB header data. */
1311         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1312         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1313         smi_msg->data[2] = ipmb_addr->channel;
1314         if (broadcast)
1315                 smi_msg->data[3] = 0;
1316         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1317         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1318         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1319         smi_msg->data[i+6] = source_address;
1320         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1321         smi_msg->data[i+8] = msg->cmd;
1322
1323         /* Now tack on the data to the message. */
1324         if (msg->data_len > 0)
1325                 memcpy(&(smi_msg->data[i+9]), msg->data,
1326                        msg->data_len);
1327         smi_msg->data_size = msg->data_len + 9;
1328
1329         /* Now calculate the checksum and tack it on. */
1330         smi_msg->data[i+smi_msg->data_size]
1331                 = ipmb_checksum(&(smi_msg->data[i+6]),
1332                                 smi_msg->data_size-6);
1333
1334         /*
1335          * Add on the checksum size and the offset from the
1336          * broadcast.
1337          */
1338         smi_msg->data_size += 1 + i;
1339
1340         smi_msg->msgid = msgid;
1341 }
1342
1343 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1344                                   struct kernel_ipmi_msg *msg,
1345                                   struct ipmi_lan_addr  *lan_addr,
1346                                   long                  msgid,
1347                                   unsigned char         ipmb_seq,
1348                                   unsigned char         source_lun)
1349 {
1350         /* Format the IPMB header data. */
1351         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1352         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1353         smi_msg->data[2] = lan_addr->channel;
1354         smi_msg->data[3] = lan_addr->session_handle;
1355         smi_msg->data[4] = lan_addr->remote_SWID;
1356         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1357         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1358         smi_msg->data[7] = lan_addr->local_SWID;
1359         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1360         smi_msg->data[9] = msg->cmd;
1361
1362         /* Now tack on the data to the message. */
1363         if (msg->data_len > 0)
1364                 memcpy(&(smi_msg->data[10]), msg->data,
1365                        msg->data_len);
1366         smi_msg->data_size = msg->data_len + 10;
1367
1368         /* Now calculate the checksum and tack it on. */
1369         smi_msg->data[smi_msg->data_size]
1370                 = ipmb_checksum(&(smi_msg->data[7]),
1371                                 smi_msg->data_size-7);
1372
1373         /*
1374          * Add on the checksum size and the offset from the
1375          * broadcast.
1376          */
1377         smi_msg->data_size += 1;
1378
1379         smi_msg->msgid = msgid;
1380 }
1381
1382 /*
1383  * Separate from ipmi_request so that the user does not have to be
1384  * supplied in certain circumstances (mainly at panic time).  If
1385  * messages are supplied, they will be freed, even if an error
1386  * occurs.
1387  */
1388 static int i_ipmi_request(ipmi_user_t          user,
1389                           ipmi_smi_t           intf,
1390                           struct ipmi_addr     *addr,
1391                           long                 msgid,
1392                           struct kernel_ipmi_msg *msg,
1393                           void                 *user_msg_data,
1394                           void                 *supplied_smi,
1395                           struct ipmi_recv_msg *supplied_recv,
1396                           int                  priority,
1397                           unsigned char        source_address,
1398                           unsigned char        source_lun,
1399                           int                  retries,
1400                           unsigned int         retry_time_ms)
1401 {
1402         int                      rv = 0;
1403         struct ipmi_smi_msg      *smi_msg;
1404         struct ipmi_recv_msg     *recv_msg;
1405         unsigned long            flags;
1406         struct ipmi_smi_handlers *handlers;
1407
1408
1409         if (supplied_recv)
1410                 recv_msg = supplied_recv;
1411         else {
1412                 recv_msg = ipmi_alloc_recv_msg();
1413                 if (recv_msg == NULL)
1414                         return -ENOMEM;
1415         }
1416         recv_msg->user_msg_data = user_msg_data;
1417
1418         if (supplied_smi)
1419                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1420         else {
1421                 smi_msg = ipmi_alloc_smi_msg();
1422                 if (smi_msg == NULL) {
1423                         ipmi_free_recv_msg(recv_msg);
1424                         return -ENOMEM;
1425                 }
1426         }
1427
1428         rcu_read_lock();
1429         handlers = intf->handlers;
1430         if (!handlers) {
1431                 rv = -ENODEV;
1432                 goto out_err;
1433         }
1434
1435         recv_msg->user = user;
1436         if (user)
1437                 kref_get(&user->refcount);
1438         recv_msg->msgid = msgid;
1439         /*
1440          * Store the message to send in the receive message so timeout
1441          * responses can get the proper response data.
1442          */
1443         recv_msg->msg = *msg;
1444
1445         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1446                 struct ipmi_system_interface_addr *smi_addr;
1447
1448                 if (msg->netfn & 1) {
1449                         /* Responses are not allowed to the SMI. */
1450                         rv = -EINVAL;
1451                         goto out_err;
1452                 }
1453
1454                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1455                 if (smi_addr->lun > 3) {
1456                         ipmi_inc_stat(intf, sent_invalid_commands);
1457                         rv = -EINVAL;
1458                         goto out_err;
1459                 }
1460
1461                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1462
1463                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1464                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1465                         || (msg->cmd == IPMI_GET_MSG_CMD)
1466                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1467                         /*
1468                          * We don't let the user do these, since we manage
1469                          * the sequence numbers.
1470                          */
1471                         ipmi_inc_stat(intf, sent_invalid_commands);
1472                         rv = -EINVAL;
1473                         goto out_err;
1474                 }
1475
1476                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1477                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1478                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1479                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1480                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1481                         intf->auto_maintenance_timeout
1482                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1483                         if (!intf->maintenance_mode
1484                             && !intf->maintenance_mode_enable) {
1485                                 intf->maintenance_mode_enable = 1;
1486                                 maintenance_mode_update(intf);
1487                         }
1488                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1489                                                flags);
1490                 }
1491
1492                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1493                         ipmi_inc_stat(intf, sent_invalid_commands);
1494                         rv = -EMSGSIZE;
1495                         goto out_err;
1496                 }
1497
1498                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1499                 smi_msg->data[1] = msg->cmd;
1500                 smi_msg->msgid = msgid;
1501                 smi_msg->user_data = recv_msg;
1502                 if (msg->data_len > 0)
1503                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1504                 smi_msg->data_size = msg->data_len + 2;
1505                 ipmi_inc_stat(intf, sent_local_commands);
1506         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1507                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
1508                 struct ipmi_ipmb_addr *ipmb_addr;
1509                 unsigned char         ipmb_seq;
1510                 long                  seqid;
1511                 int                   broadcast = 0;
1512
1513                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1514                         ipmi_inc_stat(intf, sent_invalid_commands);
1515                         rv = -EINVAL;
1516                         goto out_err;
1517                 }
1518
1519                 if (intf->channels[addr->channel].medium
1520                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1521                         ipmi_inc_stat(intf, sent_invalid_commands);
1522                         rv = -EINVAL;
1523                         goto out_err;
1524                 }
1525
1526                 if (retries < 0) {
1527                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1528                         retries = 0; /* Don't retry broadcasts. */
1529                     else
1530                         retries = 4;
1531                 }
1532                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1533                     /*
1534                      * Broadcasts add a zero at the beginning of the
1535                      * message, but otherwise is the same as an IPMB
1536                      * address.
1537                      */
1538                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1539                     broadcast = 1;
1540                 }
1541
1542
1543                 /* Default to 1 second retries. */
1544                 if (retry_time_ms == 0)
1545                     retry_time_ms = 1000;
1546
1547                 /*
1548                  * 9 for the header and 1 for the checksum, plus
1549                  * possibly one for the broadcast.
1550                  */
1551                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1552                         ipmi_inc_stat(intf, sent_invalid_commands);
1553                         rv = -EMSGSIZE;
1554                         goto out_err;
1555                 }
1556
1557                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1558                 if (ipmb_addr->lun > 3) {
1559                         ipmi_inc_stat(intf, sent_invalid_commands);
1560                         rv = -EINVAL;
1561                         goto out_err;
1562                 }
1563
1564                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1565
1566                 if (recv_msg->msg.netfn & 0x1) {
1567                         /*
1568                          * It's a response, so use the user's sequence
1569                          * from msgid.
1570                          */
1571                         ipmi_inc_stat(intf, sent_ipmb_responses);
1572                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1573                                         msgid, broadcast,
1574                                         source_address, source_lun);
1575
1576                         /*
1577                          * Save the receive message so we can use it
1578                          * to deliver the response.
1579                          */
1580                         smi_msg->user_data = recv_msg;
1581                 } else {
1582                         /* It's a command, so get a sequence for it. */
1583
1584                         spin_lock_irqsave(&(intf->seq_lock), flags);
1585
1586                         ipmi_inc_stat(intf, sent_ipmb_commands);
1587
1588                         /*
1589                          * Create a sequence number with a 1 second
1590                          * timeout and 4 retries.
1591                          */
1592                         rv = intf_next_seq(intf,
1593                                            recv_msg,
1594                                            retry_time_ms,
1595                                            retries,
1596                                            broadcast,
1597                                            &ipmb_seq,
1598                                            &seqid);
1599                         if (rv) {
1600                                 /*
1601                                  * We have used up all the sequence numbers,
1602                                  * probably, so abort.
1603                                  */
1604                                 spin_unlock_irqrestore(&(intf->seq_lock),
1605                                                        flags);
1606                                 goto out_err;
1607                         }
1608
1609                         /*
1610                          * Store the sequence number in the message,
1611                          * so that when the send message response
1612                          * comes back we can start the timer.
1613                          */
1614                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1615                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1616                                         ipmb_seq, broadcast,
1617                                         source_address, source_lun);
1618
1619                         /*
1620                          * Copy the message into the recv message data, so we
1621                          * can retransmit it later if necessary.
1622                          */
1623                         memcpy(recv_msg->msg_data, smi_msg->data,
1624                                smi_msg->data_size);
1625                         recv_msg->msg.data = recv_msg->msg_data;
1626                         recv_msg->msg.data_len = smi_msg->data_size;
1627
1628                         /*
1629                          * We don't unlock until here, because we need
1630                          * to copy the completed message into the
1631                          * recv_msg before we release the lock.
1632                          * Otherwise, race conditions may bite us.  I
1633                          * know that's pretty paranoid, but I prefer
1634                          * to be correct.
1635                          */
1636                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1637                 }
1638         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1639                 struct ipmi_lan_addr  *lan_addr;
1640                 unsigned char         ipmb_seq;
1641                 long                  seqid;
1642
1643                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1644                         ipmi_inc_stat(intf, sent_invalid_commands);
1645                         rv = -EINVAL;
1646                         goto out_err;
1647                 }
1648
1649                 if ((intf->channels[addr->channel].medium
1650                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1651                     && (intf->channels[addr->channel].medium
1652                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1653                         ipmi_inc_stat(intf, sent_invalid_commands);
1654                         rv = -EINVAL;
1655                         goto out_err;
1656                 }
1657
1658                 retries = 4;
1659
1660                 /* Default to 1 second retries. */
1661                 if (retry_time_ms == 0)
1662                     retry_time_ms = 1000;
1663
1664                 /* 11 for the header and 1 for the checksum. */
1665                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1666                         ipmi_inc_stat(intf, sent_invalid_commands);
1667                         rv = -EMSGSIZE;
1668                         goto out_err;
1669                 }
1670
1671                 lan_addr = (struct ipmi_lan_addr *) addr;
1672                 if (lan_addr->lun > 3) {
1673                         ipmi_inc_stat(intf, sent_invalid_commands);
1674                         rv = -EINVAL;
1675                         goto out_err;
1676                 }
1677
1678                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1679
1680                 if (recv_msg->msg.netfn & 0x1) {
1681                         /*
1682                          * It's a response, so use the user's sequence
1683                          * from msgid.
1684                          */
1685                         ipmi_inc_stat(intf, sent_lan_responses);
1686                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1687                                        msgid, source_lun);
1688
1689                         /*
1690                          * Save the receive message so we can use it
1691                          * to deliver the response.
1692                          */
1693                         smi_msg->user_data = recv_msg;
1694                 } else {
1695                         /* It's a command, so get a sequence for it. */
1696
1697                         spin_lock_irqsave(&(intf->seq_lock), flags);
1698
1699                         ipmi_inc_stat(intf, sent_lan_commands);
1700
1701                         /*
1702                          * Create a sequence number with a 1 second
1703                          * timeout and 4 retries.
1704                          */
1705                         rv = intf_next_seq(intf,
1706                                            recv_msg,
1707                                            retry_time_ms,
1708                                            retries,
1709                                            0,
1710                                            &ipmb_seq,
1711                                            &seqid);
1712                         if (rv) {
1713                                 /*
1714                                  * We have used up all the sequence numbers,
1715                                  * probably, so abort.
1716                                  */
1717                                 spin_unlock_irqrestore(&(intf->seq_lock),
1718                                                        flags);
1719                                 goto out_err;
1720                         }
1721
1722                         /*
1723                          * Store the sequence number in the message,
1724                          * so that when the send message response
1725                          * comes back we can start the timer.
1726                          */
1727                         format_lan_msg(smi_msg, msg, lan_addr,
1728                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1729                                        ipmb_seq, source_lun);
1730
1731                         /*
1732                          * Copy the message into the recv message data, so we
1733                          * can retransmit it later if necessary.
1734                          */
1735                         memcpy(recv_msg->msg_data, smi_msg->data,
1736                                smi_msg->data_size);
1737                         recv_msg->msg.data = recv_msg->msg_data;
1738                         recv_msg->msg.data_len = smi_msg->data_size;
1739
1740                         /*
1741                          * We don't unlock until here, because we need
1742                          * to copy the completed message into the
1743                          * recv_msg before we release the lock.
1744                          * Otherwise, race conditions may bite us.  I
1745                          * know that's pretty paranoid, but I prefer
1746                          * to be correct.
1747                          */
1748                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1749                 }
1750         } else {
1751             /* Unknown address type. */
1752                 ipmi_inc_stat(intf, sent_invalid_commands);
1753                 rv = -EINVAL;
1754                 goto out_err;
1755         }
1756
1757 #ifdef DEBUG_MSGING
1758         {
1759                 int m;
1760                 for (m = 0; m < smi_msg->data_size; m++)
1761                         printk(" %2.2x", smi_msg->data[m]);
1762                 printk("\n");
1763         }
1764 #endif
1765
1766         handlers->sender(intf->send_info, smi_msg, priority);
1767         rcu_read_unlock();
1768
1769         return 0;
1770
1771  out_err:
1772         rcu_read_unlock();
1773         ipmi_free_smi_msg(smi_msg);
1774         ipmi_free_recv_msg(recv_msg);
1775         return rv;
1776 }
1777
1778 static int check_addr(ipmi_smi_t       intf,
1779                       struct ipmi_addr *addr,
1780                       unsigned char    *saddr,
1781                       unsigned char    *lun)
1782 {
1783         if (addr->channel >= IPMI_MAX_CHANNELS)
1784                 return -EINVAL;
1785         *lun = intf->channels[addr->channel].lun;
1786         *saddr = intf->channels[addr->channel].address;
1787         return 0;
1788 }
1789
1790 int ipmi_request_settime(ipmi_user_t      user,
1791                          struct ipmi_addr *addr,
1792                          long             msgid,
1793                          struct kernel_ipmi_msg  *msg,
1794                          void             *user_msg_data,
1795                          int              priority,
1796                          int              retries,
1797                          unsigned int     retry_time_ms)
1798 {
1799         unsigned char saddr, lun;
1800         int           rv;
1801
1802         if (!user)
1803                 return -EINVAL;
1804         rv = check_addr(user->intf, addr, &saddr, &lun);
1805         if (rv)
1806                 return rv;
1807         return i_ipmi_request(user,
1808                               user->intf,
1809                               addr,
1810                               msgid,
1811                               msg,
1812                               user_msg_data,
1813                               NULL, NULL,
1814                               priority,
1815                               saddr,
1816                               lun,
1817                               retries,
1818                               retry_time_ms);
1819 }
1820 EXPORT_SYMBOL(ipmi_request_settime);
1821
1822 int ipmi_request_supply_msgs(ipmi_user_t          user,
1823                              struct ipmi_addr     *addr,
1824                              long                 msgid,
1825                              struct kernel_ipmi_msg *msg,
1826                              void                 *user_msg_data,
1827                              void                 *supplied_smi,
1828                              struct ipmi_recv_msg *supplied_recv,
1829                              int                  priority)
1830 {
1831         unsigned char saddr, lun;
1832         int           rv;
1833
1834         if (!user)
1835                 return -EINVAL;
1836         rv = check_addr(user->intf, addr, &saddr, &lun);
1837         if (rv)
1838                 return rv;
1839         return i_ipmi_request(user,
1840                               user->intf,
1841                               addr,
1842                               msgid,
1843                               msg,
1844                               user_msg_data,
1845                               supplied_smi,
1846                               supplied_recv,
1847                               priority,
1848                               saddr,
1849                               lun,
1850                               -1, 0);
1851 }
1852 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1853
1854 #ifdef CONFIG_PROC_FS
1855 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1856                                int count, int *eof, void *data)
1857 {
1858         char       *out = (char *) page;
1859         ipmi_smi_t intf = data;
1860         int        i;
1861         int        rv = 0;
1862
1863         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
1864                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
1865         out[rv-1] = '\n'; /* Replace the final space with a newline */
1866         out[rv] = '\0';
1867         rv++;
1868         return rv;
1869 }
1870
1871 static int version_file_read_proc(char *page, char **start, off_t off,
1872                                   int count, int *eof, void *data)
1873 {
1874         char       *out = (char *) page;
1875         ipmi_smi_t intf = data;
1876
1877         return sprintf(out, "%u.%u\n",
1878                        ipmi_version_major(&intf->bmc->id),
1879                        ipmi_version_minor(&intf->bmc->id));
1880 }
1881
1882 static int stat_file_read_proc(char *page, char **start, off_t off,
1883                                int count, int *eof, void *data)
1884 {
1885         char       *out = (char *) page;
1886         ipmi_smi_t intf = data;
1887
1888         out += sprintf(out, "sent_invalid_commands:       %u\n",
1889                        ipmi_get_stat(intf, sent_invalid_commands));
1890         out += sprintf(out, "sent_local_commands:         %u\n",
1891                        ipmi_get_stat(intf, sent_local_commands));
1892         out += sprintf(out, "handled_local_responses:     %u\n",
1893                        ipmi_get_stat(intf, handled_local_responses));
1894         out += sprintf(out, "unhandled_local_responses:   %u\n",
1895                        ipmi_get_stat(intf, unhandled_local_responses));
1896         out += sprintf(out, "sent_ipmb_commands:          %u\n",
1897                        ipmi_get_stat(intf, sent_ipmb_commands));
1898         out += sprintf(out, "sent_ipmb_command_errs:      %u\n",
1899                        ipmi_get_stat(intf, sent_ipmb_command_errs));
1900         out += sprintf(out, "retransmitted_ipmb_commands: %u\n",
1901                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
1902         out += sprintf(out, "timed_out_ipmb_commands:     %u\n",
1903                        ipmi_get_stat(intf, timed_out_ipmb_commands));
1904         out += sprintf(out, "timed_out_ipmb_broadcasts:   %u\n",
1905                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
1906         out += sprintf(out, "sent_ipmb_responses:         %u\n",
1907                        ipmi_get_stat(intf, sent_ipmb_responses));
1908         out += sprintf(out, "handled_ipmb_responses:      %u\n",
1909                        ipmi_get_stat(intf, handled_ipmb_responses));
1910         out += sprintf(out, "invalid_ipmb_responses:      %u\n",
1911                        ipmi_get_stat(intf, invalid_ipmb_responses));
1912         out += sprintf(out, "unhandled_ipmb_responses:    %u\n",
1913                        ipmi_get_stat(intf, unhandled_ipmb_responses));
1914         out += sprintf(out, "sent_lan_commands:           %u\n",
1915                        ipmi_get_stat(intf, sent_lan_commands));
1916         out += sprintf(out, "sent_lan_command_errs:       %u\n",
1917                        ipmi_get_stat(intf, sent_lan_command_errs));
1918         out += sprintf(out, "retransmitted_lan_commands:  %u\n",
1919                        ipmi_get_stat(intf, retransmitted_lan_commands));
1920         out += sprintf(out, "timed_out_lan_commands:      %u\n",
1921                        ipmi_get_stat(intf, timed_out_lan_commands));
1922         out += sprintf(out, "sent_lan_responses:          %u\n",
1923                        ipmi_get_stat(intf, sent_lan_responses));
1924         out += sprintf(out, "handled_lan_responses:       %u\n",
1925                        ipmi_get_stat(intf, handled_lan_responses));
1926         out += sprintf(out, "invalid_lan_responses:       %u\n",
1927                        ipmi_get_stat(intf, invalid_lan_responses));
1928         out += sprintf(out, "unhandled_lan_responses:     %u\n",
1929                        ipmi_get_stat(intf, unhandled_lan_responses));
1930         out += sprintf(out, "handled_commands:            %u\n",
1931                        ipmi_get_stat(intf, handled_commands));
1932         out += sprintf(out, "invalid_commands:            %u\n",
1933                        ipmi_get_stat(intf, invalid_commands));
1934         out += sprintf(out, "unhandled_commands:          %u\n",
1935                        ipmi_get_stat(intf, unhandled_commands));
1936         out += sprintf(out, "invalid_events:              %u\n",
1937                        ipmi_get_stat(intf, invalid_events));
1938         out += sprintf(out, "events:                      %u\n",
1939                        ipmi_get_stat(intf, events));
1940
1941         return (out - ((char *) page));
1942 }
1943 #endif /* CONFIG_PROC_FS */
1944
1945 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1946                             read_proc_t *read_proc,
1947                             void *data, struct module *owner)
1948 {
1949         int                    rv = 0;
1950 #ifdef CONFIG_PROC_FS
1951         struct proc_dir_entry  *file;
1952         struct ipmi_proc_entry *entry;
1953
1954         /* Create a list element. */
1955         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1956         if (!entry)
1957                 return -ENOMEM;
1958         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1959         if (!entry->name) {
1960                 kfree(entry);
1961                 return -ENOMEM;
1962         }
1963         strcpy(entry->name, name);
1964
1965         file = create_proc_entry(name, 0, smi->proc_dir);
1966         if (!file) {
1967                 kfree(entry->name);
1968                 kfree(entry);
1969                 rv = -ENOMEM;
1970         } else {
1971                 file->data = data;
1972                 file->read_proc = read_proc;
1973                 file->owner = owner;
1974
1975                 mutex_lock(&smi->proc_entry_lock);
1976                 /* Stick it on the list. */
1977                 entry->next = smi->proc_entries;
1978                 smi->proc_entries = entry;
1979                 mutex_unlock(&smi->proc_entry_lock);
1980         }
1981 #endif /* CONFIG_PROC_FS */
1982
1983         return rv;
1984 }
1985 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
1986
1987 static int add_proc_entries(ipmi_smi_t smi, int num)
1988 {
1989         int rv = 0;
1990
1991 #ifdef CONFIG_PROC_FS
1992         sprintf(smi->proc_dir_name, "%d", num);
1993         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1994         if (!smi->proc_dir)
1995                 rv = -ENOMEM;
1996         else
1997                 smi->proc_dir->owner = THIS_MODULE;
1998
1999         if (rv == 0)
2000                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2001                                              stat_file_read_proc,
2002                                              smi, THIS_MODULE);
2003
2004         if (rv == 0)
2005                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2006                                              ipmb_file_read_proc,
2007                                              smi, THIS_MODULE);
2008
2009         if (rv == 0)
2010                 rv = ipmi_smi_add_proc_entry(smi, "version",
2011                                              version_file_read_proc,
2012                                              smi, THIS_MODULE);
2013 #endif /* CONFIG_PROC_FS */
2014
2015         return rv;
2016 }
2017
2018 static void remove_proc_entries(ipmi_smi_t smi)
2019 {
2020 #ifdef CONFIG_PROC_FS
2021         struct ipmi_proc_entry *entry;
2022
2023         mutex_lock(&smi->proc_entry_lock);
2024         while (smi->proc_entries) {
2025                 entry = smi->proc_entries;
2026                 smi->proc_entries = entry->next;
2027
2028                 remove_proc_entry(entry->name, smi->proc_dir);
2029                 kfree(entry->name);
2030                 kfree(entry);
2031         }
2032         mutex_unlock(&smi->proc_entry_lock);
2033         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2034 #endif /* CONFIG_PROC_FS */
2035 }
2036
2037 static int __find_bmc_guid(struct device *dev, void *data)
2038 {
2039         unsigned char *id = data;
2040         struct bmc_device *bmc = dev_get_drvdata(dev);
2041         return memcmp(bmc->guid, id, 16) == 0;
2042 }
2043
2044 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2045                                              unsigned char *guid)
2046 {
2047         struct device *dev;
2048
2049         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2050         if (dev)
2051                 return dev_get_drvdata(dev);
2052         else
2053                 return NULL;
2054 }
2055
2056 struct prod_dev_id {
2057         unsigned int  product_id;
2058         unsigned char device_id;
2059 };
2060
2061 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2062 {
2063         struct prod_dev_id *id = data;
2064         struct bmc_device *bmc = dev_get_drvdata(dev);
2065
2066         return (bmc->id.product_id == id->product_id
2067                 && bmc->id.device_id == id->device_id);
2068 }
2069
2070 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2071         struct device_driver *drv,
2072         unsigned int product_id, unsigned char device_id)
2073 {
2074         struct prod_dev_id id = {
2075                 .product_id = product_id,
2076                 .device_id = device_id,
2077         };
2078         struct device *dev;
2079
2080         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2081         if (dev)
2082                 return dev_get_drvdata(dev);
2083         else
2084                 return NULL;
2085 }
2086
2087 static ssize_t device_id_show(struct device *dev,
2088                               struct device_attribute *attr,
2089                               char *buf)
2090 {
2091         struct bmc_device *bmc = dev_get_drvdata(dev);
2092
2093         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2094 }
2095
2096 static ssize_t provides_dev_sdrs_show(struct device *dev,
2097                                       struct device_attribute *attr,
2098                                       char *buf)
2099 {
2100         struct bmc_device *bmc = dev_get_drvdata(dev);
2101
2102         return snprintf(buf, 10, "%u\n",
2103                         (bmc->id.device_revision & 0x80) >> 7);
2104 }
2105
2106 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2107                              char *buf)
2108 {
2109         struct bmc_device *bmc = dev_get_drvdata(dev);
2110
2111         return snprintf(buf, 20, "%u\n",
2112                         bmc->id.device_revision & 0x0F);
2113 }
2114
2115 static ssize_t firmware_rev_show(struct device *dev,
2116                                  struct device_attribute *attr,
2117                                  char *buf)
2118 {
2119         struct bmc_device *bmc = dev_get_drvdata(dev);
2120
2121         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2122                         bmc->id.firmware_revision_2);
2123 }
2124
2125 static ssize_t ipmi_version_show(struct device *dev,
2126                                  struct device_attribute *attr,
2127                                  char *buf)
2128 {
2129         struct bmc_device *bmc = dev_get_drvdata(dev);
2130
2131         return snprintf(buf, 20, "%u.%u\n",
2132                         ipmi_version_major(&bmc->id),
2133                         ipmi_version_minor(&bmc->id));
2134 }
2135
2136 static ssize_t add_dev_support_show(struct device *dev,
2137                                     struct device_attribute *attr,
2138                                     char *buf)
2139 {
2140         struct bmc_device *bmc = dev_get_drvdata(dev);
2141
2142         return snprintf(buf, 10, "0x%02x\n",
2143                         bmc->id.additional_device_support);
2144 }
2145
2146 static ssize_t manufacturer_id_show(struct device *dev,
2147                                     struct device_attribute *attr,
2148                                     char *buf)
2149 {
2150         struct bmc_device *bmc = dev_get_drvdata(dev);
2151
2152         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2153 }
2154
2155 static ssize_t product_id_show(struct device *dev,
2156                                struct device_attribute *attr,
2157                                char *buf)
2158 {
2159         struct bmc_device *bmc = dev_get_drvdata(dev);
2160
2161         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2162 }
2163
2164 static ssize_t aux_firmware_rev_show(struct device *dev,
2165                                      struct device_attribute *attr,
2166                                      char *buf)
2167 {
2168         struct bmc_device *bmc = dev_get_drvdata(dev);
2169
2170         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2171                         bmc->id.aux_firmware_revision[3],
2172                         bmc->id.aux_firmware_revision[2],
2173                         bmc->id.aux_firmware_revision[1],
2174                         bmc->id.aux_firmware_revision[0]);
2175 }
2176
2177 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2178                          char *buf)
2179 {
2180         struct bmc_device *bmc = dev_get_drvdata(dev);
2181
2182         return snprintf(buf, 100, "%Lx%Lx\n",
2183                         (long long) bmc->guid[0],
2184                         (long long) bmc->guid[8]);
2185 }
2186
2187 static void remove_files(struct bmc_device *bmc)
2188 {
2189         if (!bmc->dev)
2190                 return;
2191
2192         device_remove_file(&bmc->dev->dev,
2193                            &bmc->device_id_attr);
2194         device_remove_file(&bmc->dev->dev,
2195                            &bmc->provides_dev_sdrs_attr);
2196         device_remove_file(&bmc->dev->dev,
2197                            &bmc->revision_attr);
2198         device_remove_file(&bmc->dev->dev,
2199                            &bmc->firmware_rev_attr);
2200         device_remove_file(&bmc->dev->dev,
2201                            &bmc->version_attr);
2202         device_remove_file(&bmc->dev->dev,
2203                            &bmc->add_dev_support_attr);
2204         device_remove_file(&bmc->dev->dev,
2205                            &bmc->manufacturer_id_attr);
2206         device_remove_file(&bmc->dev->dev,
2207                            &bmc->product_id_attr);
2208
2209         if (bmc->id.aux_firmware_revision_set)
2210                 device_remove_file(&bmc->dev->dev,
2211                                    &bmc->aux_firmware_rev_attr);
2212         if (bmc->guid_set)
2213                 device_remove_file(&bmc->dev->dev,
2214                                    &bmc->guid_attr);
2215 }
2216
2217 static void
2218 cleanup_bmc_device(struct kref *ref)
2219 {
2220         struct bmc_device *bmc;
2221
2222         bmc = container_of(ref, struct bmc_device, refcount);
2223
2224         remove_files(bmc);
2225         platform_device_unregister(bmc->dev);
2226         kfree(bmc);
2227 }
2228
2229 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2230 {
2231         struct bmc_device *bmc = intf->bmc;
2232
2233         if (intf->sysfs_name) {
2234                 sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
2235                 kfree(intf->sysfs_name);
2236                 intf->sysfs_name = NULL;
2237         }
2238         if (intf->my_dev_name) {
2239                 sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
2240                 kfree(intf->my_dev_name);
2241                 intf->my_dev_name = NULL;
2242         }
2243
2244         mutex_lock(&ipmidriver_mutex);
2245         kref_put(&bmc->refcount, cleanup_bmc_device);
2246         intf->bmc = NULL;
2247         mutex_unlock(&ipmidriver_mutex);
2248 }
2249
2250 static int create_files(struct bmc_device *bmc)
2251 {
2252         int err;
2253
2254         bmc->device_id_attr.attr.name = "device_id";
2255         bmc->device_id_attr.attr.mode = S_IRUGO;
2256         bmc->device_id_attr.show = device_id_show;
2257
2258         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
2259         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
2260         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
2261
2262         bmc->revision_attr.attr.name = "revision";
2263         bmc->revision_attr.attr.mode = S_IRUGO;
2264         bmc->revision_attr.show = revision_show;
2265
2266         bmc->firmware_rev_attr.attr.name = "firmware_revision";
2267         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
2268         bmc->firmware_rev_attr.show = firmware_rev_show;
2269
2270         bmc->version_attr.attr.name = "ipmi_version";
2271         bmc->version_attr.attr.mode = S_IRUGO;
2272         bmc->version_attr.show = ipmi_version_show;
2273
2274         bmc->add_dev_support_attr.attr.name = "additional_device_support";
2275         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
2276         bmc->add_dev_support_attr.show = add_dev_support_show;
2277
2278         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
2279         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
2280         bmc->manufacturer_id_attr.show = manufacturer_id_show;
2281
2282         bmc->product_id_attr.attr.name = "product_id";
2283         bmc->product_id_attr.attr.mode = S_IRUGO;
2284         bmc->product_id_attr.show = product_id_show;
2285
2286         bmc->guid_attr.attr.name = "guid";
2287         bmc->guid_attr.attr.mode = S_IRUGO;
2288         bmc->guid_attr.show = guid_show;
2289
2290         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2291         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
2292         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
2293
2294         err = device_create_file(&bmc->dev->dev,
2295                            &bmc->device_id_attr);
2296         if (err)
2297                 goto out;
2298         err = device_create_file(&bmc->dev->dev,
2299                            &bmc->provides_dev_sdrs_attr);
2300         if (err)
2301                 goto out_devid;
2302         err = device_create_file(&bmc->dev->dev,
2303                            &bmc->revision_attr);
2304         if (err)
2305                 goto out_sdrs;
2306         err = device_create_file(&bmc->dev->dev,
2307                            &bmc->firmware_rev_attr);
2308         if (err)
2309                 goto out_rev;
2310         err = device_create_file(&bmc->dev->dev,
2311                            &bmc->version_attr);
2312         if (err)
2313                 goto out_firm;
2314         err = device_create_file(&bmc->dev->dev,
2315                            &bmc->add_dev_support_attr);
2316         if (err)
2317                 goto out_version;
2318         err = device_create_file(&bmc->dev->dev,
2319                            &bmc->manufacturer_id_attr);
2320         if (err)
2321                 goto out_add_dev;
2322         err = device_create_file(&bmc->dev->dev,
2323                            &bmc->product_id_attr);
2324         if (err)
2325                 goto out_manu;
2326         if (bmc->id.aux_firmware_revision_set) {
2327                 err = device_create_file(&bmc->dev->dev,
2328                                    &bmc->aux_firmware_rev_attr);
2329                 if (err)
2330                         goto out_prod_id;
2331         }
2332         if (bmc->guid_set) {
2333                 err = device_create_file(&bmc->dev->dev,
2334                                    &bmc->guid_attr);
2335                 if (err)
2336                         goto out_aux_firm;
2337         }
2338
2339         return 0;
2340
2341 out_aux_firm:
2342         if (bmc->id.aux_firmware_revision_set)
2343                 device_remove_file(&bmc->dev->dev,
2344                                    &bmc->aux_firmware_rev_attr);
2345 out_prod_id:
2346         device_remove_file(&bmc->dev->dev,
2347                            &bmc->product_id_attr);
2348 out_manu:
2349         device_remove_file(&bmc->dev->dev,
2350                            &bmc->manufacturer_id_attr);
2351 out_add_dev:
2352         device_remove_file(&bmc->dev->dev,
2353                            &bmc->add_dev_support_attr);
2354 out_version:
2355         device_remove_file(&bmc->dev->dev,
2356                            &bmc->version_attr);
2357 out_firm:
2358         device_remove_file(&bmc->dev->dev,
2359                            &bmc->firmware_rev_attr);
2360 out_rev:
2361         device_remove_file(&bmc->dev->dev,
2362                            &bmc->revision_attr);
2363 out_sdrs:
2364         device_remove_file(&bmc->dev->dev,
2365                            &bmc->provides_dev_sdrs_attr);
2366 out_devid:
2367         device_remove_file(&bmc->dev->dev,
2368                            &bmc->device_id_attr);
2369 out:
2370         return err;
2371 }
2372
2373 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
2374                              const char *sysfs_name)
2375 {
2376         int               rv;
2377         struct bmc_device *bmc = intf->bmc;
2378         struct bmc_device *old_bmc;
2379         int               size;
2380         char              dummy[1];
2381
2382         mutex_lock(&ipmidriver_mutex);
2383
2384         /*
2385          * Try to find if there is an bmc_device struct
2386          * representing the interfaced BMC already
2387          */
2388         if (bmc->guid_set)
2389                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2390         else
2391                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2392                                                     bmc->id.product_id,
2393                                                     bmc->id.device_id);
2394
2395         /*
2396          * If there is already an bmc_device, free the new one,
2397          * otherwise register the new BMC device
2398          */
2399         if (old_bmc) {
2400                 kfree(bmc);
2401                 intf->bmc = old_bmc;
2402                 bmc = old_bmc;
2403
2404                 kref_get(&bmc->refcount);
2405                 mutex_unlock(&ipmidriver_mutex);
2406
2407                 printk(KERN_INFO
2408                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2409                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2410                        bmc->id.manufacturer_id,
2411                        bmc->id.product_id,
2412                        bmc->id.device_id);
2413         } else {
2414                 char name[14];
2415                 unsigned char orig_dev_id = bmc->id.device_id;
2416                 int warn_printed = 0;
2417
2418                 snprintf(name, sizeof(name),
2419                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2420
2421                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2422                                                  bmc->id.product_id,
2423                                                  bmc->id.device_id)) {
2424                         if (!warn_printed) {
2425                                 printk(KERN_WARNING PFX
2426                                        "This machine has two different BMCs"
2427                                        " with the same product id and device"
2428                                        " id.  This is an error in the"
2429                                        " firmware, but incrementing the"
2430                                        " device id to work around the problem."
2431                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2432                                        bmc->id.product_id, bmc->id.device_id);
2433                                 warn_printed = 1;
2434                         }
2435                         bmc->id.device_id++; /* Wraps at 255 */
2436                         if (bmc->id.device_id == orig_dev_id) {
2437                                 printk(KERN_ERR PFX
2438                                        "Out of device ids!\n");
2439                                 break;
2440                         }
2441                 }
2442
2443                 bmc->dev = platform_device_alloc(name, bmc->id.device_id);
2444                 if (!bmc->dev) {
2445                         mutex_unlock(&ipmidriver_mutex);
2446                         printk(KERN_ERR
2447                                "ipmi_msghandler:"
2448                                " Unable to allocate platform device\n");
2449                         return -ENOMEM;
2450                 }
2451                 bmc->dev->dev.driver = &ipmidriver.driver;
2452                 dev_set_drvdata(&bmc->dev->dev, bmc);
2453                 kref_init(&bmc->refcount);
2454
2455                 rv = platform_device_add(bmc->dev);
2456                 mutex_unlock(&ipmidriver_mutex);
2457                 if (rv) {
2458                         platform_device_put(bmc->dev);
2459                         bmc->dev = NULL;
2460                         printk(KERN_ERR
2461                                "ipmi_msghandler:"
2462                                " Unable to register bmc device: %d\n",
2463                                rv);
2464                         /*
2465                          * Don't go to out_err, you can only do that if
2466                          * the device is registered already.
2467                          */
2468                         return rv;
2469                 }
2470
2471                 rv = create_files(bmc);
2472                 if (rv) {
2473                         mutex_lock(&ipmidriver_mutex);
2474                         platform_device_unregister(bmc->dev);
2475                         mutex_unlock(&ipmidriver_mutex);
2476
2477                         return rv;
2478                 }
2479
2480                 printk(KERN_INFO
2481                        "ipmi: Found new BMC (man_id: 0x%6.6x, "
2482                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2483                        bmc->id.manufacturer_id,
2484                        bmc->id.product_id,
2485                        bmc->id.device_id);
2486         }
2487
2488         /*
2489          * create symlink from system interface device to bmc device
2490          * and back.
2491          */
2492         intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
2493         if (!intf->sysfs_name) {
2494                 rv = -ENOMEM;
2495                 printk(KERN_ERR
2496                        "ipmi_msghandler: allocate link to BMC: %d\n",
2497                        rv);
2498                 goto out_err;
2499         }
2500
2501         rv = sysfs_create_link(&intf->si_dev->kobj,
2502                                &bmc->dev->dev.kobj, intf->sysfs_name);
2503         if (rv) {
2504                 kfree(intf->sysfs_name);
2505                 intf->sysfs_name = NULL;
2506                 printk(KERN_ERR
2507                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2508                        rv);
2509                 goto out_err;
2510         }
2511
2512         size = snprintf(dummy, 0, "ipmi%d", ifnum);
2513         intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
2514         if (!intf->my_dev_name) {
2515                 kfree(intf->sysfs_name);
2516                 intf->sysfs_name = NULL;
2517                 rv = -ENOMEM;
2518                 printk(KERN_ERR
2519                        "ipmi_msghandler: allocate link from BMC: %d\n",
2520                        rv);
2521                 goto out_err;
2522         }
2523         snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
2524
2525         rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
2526                                intf->my_dev_name);
2527         if (rv) {
2528                 kfree(intf->sysfs_name);
2529                 intf->sysfs_name = NULL;
2530                 kfree(intf->my_dev_name);
2531                 intf->my_dev_name = NULL;
2532                 printk(KERN_ERR
2533                        "ipmi_msghandler:"
2534                        " Unable to create symlink to bmc: %d\n",
2535                        rv);
2536                 goto out_err;
2537         }
2538
2539         return 0;
2540
2541 out_err:
2542         ipmi_bmc_unregister(intf);
2543         return rv;
2544 }
2545
2546 static int
2547 send_guid_cmd(ipmi_smi_t intf, int chan)
2548 {
2549         struct kernel_ipmi_msg            msg;
2550         struct ipmi_system_interface_addr si;
2551
2552         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2553         si.channel = IPMI_BMC_CHANNEL;
2554         si.lun = 0;
2555
2556         msg.netfn = IPMI_NETFN_APP_REQUEST;
2557         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2558         msg.data = NULL;
2559         msg.data_len = 0;
2560         return i_ipmi_request(NULL,
2561                               intf,
2562                               (struct ipmi_addr *) &si,
2563                               0,
2564                               &msg,
2565                               intf,
2566                               NULL,
2567                               NULL,
2568                               0,
2569                               intf->channels[0].address,
2570                               intf->channels[0].lun,
2571                               -1, 0);
2572 }
2573
2574 static void
2575 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2576 {
2577         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2578             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2579             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2580                 /* Not for me */
2581                 return;
2582
2583         if (msg->msg.data[0] != 0) {
2584                 /* Error from getting the GUID, the BMC doesn't have one. */
2585                 intf->bmc->guid_set = 0;
2586                 goto out;
2587         }
2588
2589         if (msg->msg.data_len < 17) {
2590                 intf->bmc->guid_set = 0;
2591                 printk(KERN_WARNING PFX
2592                        "guid_handler: The GUID response from the BMC was too"
2593                        " short, it was %d but should have been 17.  Assuming"
2594                        " GUID is not available.\n",
2595                        msg->msg.data_len);
2596                 goto out;
2597         }
2598
2599         memcpy(intf->bmc->guid, msg->msg.data, 16);
2600         intf->bmc->guid_set = 1;
2601  out:
2602         wake_up(&intf->waitq);
2603 }
2604
2605 static void
2606 get_guid(ipmi_smi_t intf)
2607 {
2608         int rv;
2609
2610         intf->bmc->guid_set = 0x2;
2611         intf->null_user_handler = guid_handler;
2612         rv = send_guid_cmd(intf, 0);
2613         if (rv)
2614                 /* Send failed, no GUID available. */
2615                 intf->bmc->guid_set = 0;
2616         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2617         intf->null_user_handler = NULL;
2618 }
2619
2620 static int
2621 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2622 {
2623         struct kernel_ipmi_msg            msg;
2624         unsigned char                     data[1];
2625         struct ipmi_system_interface_addr si;
2626
2627         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2628         si.channel = IPMI_BMC_CHANNEL;
2629         si.lun = 0;
2630
2631         msg.netfn = IPMI_NETFN_APP_REQUEST;
2632         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2633         msg.data = data;
2634         msg.data_len = 1;
2635         data[0] = chan;
2636         return i_ipmi_request(NULL,
2637                               intf,
2638                               (struct ipmi_addr *) &si,
2639                               0,
2640                               &msg,
2641                               intf,
2642                               NULL,
2643                               NULL,
2644                               0,
2645                               intf->channels[0].address,
2646                               intf->channels[0].lun,
2647                               -1, 0);
2648 }
2649
2650 static void
2651 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2652 {
2653         int rv = 0;
2654         int chan;
2655
2656         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2657             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2658             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2659                 /* It's the one we want */
2660                 if (msg->msg.data[0] != 0) {
2661                         /* Got an error from the channel, just go on. */
2662
2663                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2664                                 /*
2665                                  * If the MC does not support this
2666                                  * command, that is legal.  We just
2667                                  * assume it has one IPMB at channel
2668                                  * zero.
2669                                  */
2670                                 intf->channels[0].medium
2671                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2672                                 intf->channels[0].protocol
2673                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2674                                 rv = -ENOSYS;
2675
2676                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2677                                 wake_up(&intf->waitq);
2678                                 goto out;
2679                         }
2680                         goto next_channel;
2681                 }
2682                 if (msg->msg.data_len < 4) {
2683                         /* Message not big enough, just go on. */
2684                         goto next_channel;
2685                 }
2686                 chan = intf->curr_channel;
2687                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2688                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2689
2690  next_channel:
2691                 intf->curr_channel++;
2692                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2693                         wake_up(&intf->waitq);
2694                 else
2695                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2696
2697                 if (rv) {
2698                         /* Got an error somehow, just give up. */
2699                         intf->curr_channel = IPMI_MAX_CHANNELS;
2700                         wake_up(&intf->waitq);
2701
2702                         printk(KERN_WARNING PFX
2703                                "Error sending channel information: %d\n",
2704                                rv);
2705                 }
2706         }
2707  out:
2708         return;
2709 }
2710
2711 void ipmi_poll_interface(ipmi_user_t user)
2712 {
2713         ipmi_smi_t intf = user->intf;
2714
2715         if (intf->handlers->poll)
2716                 intf->handlers->poll(intf->send_info);
2717 }
2718 EXPORT_SYMBOL(ipmi_poll_interface);
2719
2720 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2721                       void                     *send_info,
2722                       struct ipmi_device_id    *device_id,
2723                       struct device            *si_dev,
2724                       const char               *sysfs_name,
2725                       unsigned char            slave_addr)
2726 {
2727         int              i, j;
2728         int              rv;
2729         ipmi_smi_t       intf;
2730         ipmi_smi_t       tintf;
2731         struct list_head *link;
2732
2733         /*
2734          * Make sure the driver is actually initialized, this handles
2735          * problems with initialization order.
2736          */
2737         if (!initialized) {
2738                 rv = ipmi_init_msghandler();
2739                 if (rv)
2740                         return rv;
2741                 /*
2742                  * The init code doesn't return an error if it was turned
2743                  * off, but it won't initialize.  Check that.
2744                  */
2745                 if (!initialized)
2746                         return -ENODEV;
2747         }
2748
2749         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2750         if (!intf)
2751                 return -ENOMEM;
2752
2753         intf->ipmi_version_major = ipmi_version_major(device_id);
2754         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2755
2756         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2757         if (!intf->bmc) {
2758                 kfree(intf);
2759                 return -ENOMEM;
2760         }
2761         intf->intf_num = -1; /* Mark it invalid for now. */
2762         kref_init(&intf->refcount);
2763         intf->bmc->id = *device_id;
2764         intf->si_dev = si_dev;
2765         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2766                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2767                 intf->channels[j].lun = 2;
2768         }
2769         if (slave_addr != 0)
2770                 intf->channels[0].address = slave_addr;
2771         INIT_LIST_HEAD(&intf->users);
2772         intf->handlers = handlers;
2773         intf->send_info = send_info;
2774         spin_lock_init(&intf->seq_lock);
2775         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2776                 intf->seq_table[j].inuse = 0;
2777                 intf->seq_table[j].seqid = 0;
2778         }
2779         intf->curr_seq = 0;
2780 #ifdef CONFIG_PROC_FS
2781         mutex_init(&intf->proc_entry_lock);
2782 #endif
2783         spin_lock_init(&intf->waiting_msgs_lock);
2784         INIT_LIST_HEAD(&intf->waiting_msgs);
2785         spin_lock_init(&intf->events_lock);
2786         INIT_LIST_HEAD(&intf->waiting_events);
2787         intf->waiting_events_count = 0;
2788         mutex_init(&intf->cmd_rcvrs_mutex);
2789         spin_lock_init(&intf->maintenance_mode_lock);
2790         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2791         init_waitqueue_head(&intf->waitq);
2792         for (i = 0; i < IPMI_NUM_STATS; i++)
2793                 atomic_set(&intf->stats[i], 0);
2794
2795         intf->proc_dir = NULL;
2796
2797         mutex_lock(&smi_watchers_mutex);
2798         mutex_lock(&ipmi_interfaces_mutex);
2799         /* Look for a hole in the numbers. */
2800         i = 0;
2801         link = &ipmi_interfaces;
2802         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2803                 if (tintf->intf_num != i) {
2804                         link = &tintf->link;
2805                         break;
2806                 }
2807                 i++;
2808         }
2809         /* Add the new interface in numeric order. */
2810         if (i == 0)
2811                 list_add_rcu(&intf->link, &ipmi_interfaces);
2812         else
2813                 list_add_tail_rcu(&intf->link, link);
2814
2815         rv = handlers->start_processing(send_info, intf);
2816         if (rv)
2817                 goto out;
2818
2819         get_guid(intf);
2820
2821         if ((intf->ipmi_version_major > 1)
2822                         || ((intf->ipmi_version_major == 1)
2823                             && (intf->ipmi_version_minor >= 5))) {
2824                 /*
2825                  * Start scanning the channels to see what is
2826                  * available.
2827                  */
2828                 intf->null_user_handler = channel_handler;
2829                 intf->curr_channel = 0;
2830                 rv = send_channel_info_cmd(intf, 0);
2831                 if (rv)
2832                         goto out;
2833
2834                 /* Wait for the channel info to be read. */
2835                 wait_event(intf->waitq,
2836                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2837                 intf->null_user_handler = NULL;
2838         } else {
2839                 /* Assume a single IPMB channel at zero. */
2840                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2841                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2842         }
2843
2844         if (rv == 0)
2845                 rv = add_proc_entries(intf, i);
2846
2847         rv = ipmi_bmc_register(intf, i, sysfs_name);
2848
2849  out:
2850         if (rv) {
2851                 if (intf->proc_dir)
2852                         remove_proc_entries(intf);
2853                 intf->handlers = NULL;
2854                 list_del_rcu(&intf->link);
2855                 mutex_unlock(&ipmi_interfaces_mutex);
2856                 mutex_unlock(&smi_watchers_mutex);
2857                 synchronize_rcu();
2858                 kref_put(&intf->refcount, intf_free);
2859         } else {
2860                 /*
2861                  * Keep memory order straight for RCU readers.  Make
2862                  * sure everything else is committed to memory before
2863                  * setting intf_num to mark the interface valid.
2864                  */
2865                 smp_wmb();
2866                 intf->intf_num = i;
2867                 mutex_unlock(&ipmi_interfaces_mutex);
2868                 /* After this point the interface is legal to use. */
2869                 call_smi_watchers(i, intf->si_dev);
2870                 mutex_unlock(&smi_watchers_mutex);
2871         }
2872
2873         return rv;
2874 }
2875 EXPORT_SYMBOL(ipmi_register_smi);
2876
2877 static void cleanup_smi_msgs(ipmi_smi_t intf)
2878 {
2879         int              i;
2880         struct seq_table *ent;
2881
2882         /* No need for locks, the interface is down. */
2883         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2884                 ent = &(intf->seq_table[i]);
2885                 if (!ent->inuse)
2886                         continue;
2887                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2888         }
2889 }
2890
2891 int ipmi_unregister_smi(ipmi_smi_t intf)
2892 {
2893         struct ipmi_smi_watcher *w;
2894         int    intf_num = intf->intf_num;
2895
2896         ipmi_bmc_unregister(intf);
2897
2898         mutex_lock(&smi_watchers_mutex);
2899         mutex_lock(&ipmi_interfaces_mutex);
2900         intf->intf_num = -1;
2901         intf->handlers = NULL;
2902         list_del_rcu(&intf->link);
2903         mutex_unlock(&ipmi_interfaces_mutex);
2904         synchronize_rcu();
2905
2906         cleanup_smi_msgs(intf);
2907
2908         remove_proc_entries(intf);
2909
2910         /*
2911          * Call all the watcher interfaces to tell them that
2912          * an interface is gone.
2913          */
2914         list_for_each_entry(w, &smi_watchers, link)
2915                 w->smi_gone(intf_num);
2916         mutex_unlock(&smi_watchers_mutex);
2917
2918         kref_put(&intf->refcount, intf_free);
2919         return 0;
2920 }
2921 EXPORT_SYMBOL(ipmi_unregister_smi);
2922
2923 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
2924                                    struct ipmi_smi_msg *msg)
2925 {
2926         struct ipmi_ipmb_addr ipmb_addr;
2927         struct ipmi_recv_msg  *recv_msg;
2928
2929         /*
2930          * This is 11, not 10, because the response must contain a
2931          * completion code.
2932          */
2933         if (msg->rsp_size < 11) {
2934                 /* Message not big enough, just ignore it. */
2935                 ipmi_inc_stat(intf, invalid_ipmb_responses);
2936                 return 0;
2937         }
2938
2939         if (msg->rsp[2] != 0) {
2940                 /* An error getting the response, just ignore it. */
2941                 return 0;
2942         }
2943
2944         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
2945         ipmb_addr.slave_addr = msg->rsp[6];
2946         ipmb_addr.channel = msg->rsp[3] & 0x0f;
2947         ipmb_addr.lun = msg->rsp[7] & 3;
2948
2949         /*
2950          * It's a response from a remote entity.  Look up the sequence
2951          * number and handle the response.
2952          */
2953         if (intf_find_seq(intf,
2954                           msg->rsp[7] >> 2,
2955                           msg->rsp[3] & 0x0f,
2956                           msg->rsp[8],
2957                           (msg->rsp[4] >> 2) & (~1),
2958                           (struct ipmi_addr *) &(ipmb_addr),
2959                           &recv_msg)) {
2960                 /*
2961                  * We were unable to find the sequence number,
2962                  * so just nuke the message.
2963                  */
2964                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
2965                 return 0;
2966         }
2967
2968         memcpy(recv_msg->msg_data,
2969                &(msg->rsp[9]),
2970                msg->rsp_size - 9);
2971         /*
2972          * The other fields matched, so no need to set them, except
2973          * for netfn, which needs to be the response that was
2974          * returned, not the request value.
2975          */
2976         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2977         recv_msg->msg.data = recv_msg->msg_data;
2978         recv_msg->msg.data_len = msg->rsp_size - 10;
2979         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2980         ipmi_inc_stat(intf, handled_ipmb_responses);
2981         deliver_response(recv_msg);
2982
2983         return 0;
2984 }
2985
2986 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
2987                                    struct ipmi_smi_msg *msg)
2988 {
2989         struct cmd_rcvr          *rcvr;
2990         int                      rv = 0;
2991         unsigned char            netfn;
2992         unsigned char            cmd;
2993         unsigned char            chan;
2994         ipmi_user_t              user = NULL;
2995         struct ipmi_ipmb_addr    *ipmb_addr;
2996         struct ipmi_recv_msg     *recv_msg;
2997         struct ipmi_smi_handlers *handlers;
2998
2999         if (msg->rsp_size < 10) {
3000                 /* Message not big enough, just ignore it. */
3001                 ipmi_inc_stat(intf, invalid_commands);
3002                 return 0;
3003         }
3004
3005         if (msg->rsp[2] != 0) {
3006                 /* An error getting the response, just ignore it. */
3007                 return 0;
3008         }
3009
3010         netfn = msg->rsp[4] >> 2;
3011         cmd = msg->rsp[8];
3012         chan = msg->rsp[3] & 0xf;
3013
3014         rcu_read_lock();
3015         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3016         if (rcvr) {
3017                 user = rcvr->user;
3018                 kref_get(&user->refcount);
3019         } else
3020                 user = NULL;
3021         rcu_read_unlock();
3022
3023         if (user == NULL) {
3024                 /* We didn't find a user, deliver an error response. */
3025                 ipmi_inc_stat(intf, unhandled_commands);
3026
3027                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3028                 msg->data[1] = IPMI_SEND_MSG_CMD;
3029                 msg->data[2] = msg->rsp[3];
3030                 msg->data[3] = msg->rsp[6];
3031                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3032                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3033                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3034                 /* rqseq/lun */
3035                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3036                 msg->data[8] = msg->rsp[8]; /* cmd */
3037                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3038                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3039                 msg->data_size = 11;
3040
3041 #ifdef DEBUG_MSGING
3042         {
3043                 int m;
3044                 printk("Invalid command:");
3045                 for (m = 0; m < msg->data_size; m++)
3046                         printk(" %2.2x", msg->data[m]);
3047                 printk("\n");
3048         }
3049 #endif
3050                 rcu_read_lock();
3051                 handlers = intf->handlers;
3052                 if (handlers) {
3053                         handlers->sender(intf->send_info, msg, 0);
3054                         /*
3055                          * We used the message, so return the value
3056                          * that causes it to not be freed or
3057                          * queued.
3058                          */
3059                         rv = -1;
3060                 }
3061                 rcu_read_unlock();
3062         } else {
3063                 /* Deliver the message to the user. */
3064                 ipmi_inc_stat(intf, handled_commands);
3065
3066                 recv_msg = ipmi_alloc_recv_msg();
3067                 if (!recv_msg) {
3068                         /*
3069                          * We couldn't allocate memory for the
3070                          * message, so requeue it for handling
3071                          * later.
3072                          */
3073                         rv = 1;
3074                         kref_put(&user->refcount, free_user);
3075                 } else {
3076                         /* Extract the source address from the data. */
3077                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3078                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3079                         ipmb_addr->slave_addr = msg->rsp[6];
3080                         ipmb_addr->lun = msg->rsp[7] & 3;
3081                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3082
3083                         /*
3084                          * Extract the rest of the message information
3085                          * from the IPMB header.
3086                          */
3087                         recv_msg->user = user;
3088                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3089                         recv_msg->msgid = msg->rsp[7] >> 2;
3090                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3091                         recv_msg->msg.cmd = msg->rsp[8];
3092                         recv_msg->msg.data = recv_msg->msg_data;
3093
3094                         /*
3095                          * We chop off 10, not 9 bytes because the checksum
3096                          * at the end also needs to be removed.
3097                          */
3098                         recv_msg->msg.data_len = msg->rsp_size - 10;
3099                         memcpy(recv_msg->msg_data,
3100                                &(msg->rsp[9]),
3101                                msg->rsp_size - 10);
3102                         deliver_response(recv_msg);
3103                 }
3104         }
3105
3106         return rv;
3107 }
3108
3109 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3110                                   struct ipmi_smi_msg *msg)
3111 {
3112         struct ipmi_lan_addr  lan_addr;
3113         struct ipmi_recv_msg  *recv_msg;
3114
3115
3116         /*
3117          * This is 13, not 12, because the response must contain a
3118          * completion code.
3119          */
3120         if (msg->rsp_size < 13) {
3121                 /* Message not big enough, just ignore it. */
3122                 ipmi_inc_stat(intf, invalid_lan_responses);
3123                 return 0;
3124         }
3125
3126         if (msg->rsp[2] != 0) {
3127                 /* An error getting the response, just ignore it. */
3128                 return 0;
3129         }
3130
3131         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3132         lan_addr.session_handle = msg->rsp[4];
3133         lan_addr.remote_SWID = msg->rsp[8];
3134         lan_addr.local_SWID = msg->rsp[5];
3135         lan_addr.channel = msg->rsp[3] & 0x0f;
3136         lan_addr.privilege = msg->rsp[3] >> 4;
3137         lan_addr.lun = msg->rsp[9] & 3;
3138
3139         /*
3140          * It's a response from a remote entity.  Look up the sequence
3141          * number and handle the response.
3142          */
3143         if (intf_find_seq(intf,
3144                           msg->rsp[9] >> 2,
3145                           msg->rsp[3] & 0x0f,
3146                           msg->rsp[10],
3147                           (msg->rsp[6] >> 2) & (~1),
3148                           (struct ipmi_addr *) &(lan_addr),
3149                           &recv_msg)) {
3150                 /*
3151                  * We were unable to find the sequence number,
3152                  * so just nuke the message.
3153                  */
3154                 ipmi_inc_stat(intf, unhandled_lan_responses);
3155                 return 0;
3156         }
3157
3158         memcpy(recv_msg->msg_data,
3159                &(msg->rsp[11]),
3160                msg->rsp_size - 11);
3161         /*
3162          * The other fields matched, so no need to set them, except
3163          * for netfn, which needs to be the response that was
3164          * returned, not the request value.
3165          */
3166         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3167         recv_msg->msg.data = recv_msg->msg_data;
3168         recv_msg->msg.data_len = msg->rsp_size - 12;
3169         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3170         ipmi_inc_stat(intf, handled_lan_responses);
3171         deliver_response(recv_msg);
3172
3173         return 0;
3174 }
3175
3176 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3177                                   struct ipmi_smi_msg *msg)
3178 {
3179         struct cmd_rcvr          *rcvr;
3180         int                      rv = 0;
3181         unsigned char            netfn;
3182         unsigned char            cmd;
3183         unsigned char            chan;
3184         ipmi_user_t              user = NULL;
3185         struct ipmi_lan_addr     *lan_addr;
3186         struct ipmi_recv_msg     *recv_msg;
3187
3188         if (msg->rsp_size < 12) {
3189                 /* Message not big enough, just ignore it. */
3190                 ipmi_inc_stat(intf, invalid_commands);
3191                 return 0;
3192         }
3193
3194         if (msg->rsp[2] != 0) {
3195                 /* An error getting the response, just ignore it. */
3196                 return 0;
3197         }
3198
3199         netfn = msg->rsp[6] >> 2;
3200         cmd = msg->rsp[10];
3201         chan = msg->rsp[3] & 0xf;
3202
3203         rcu_read_lock();
3204         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3205         if (rcvr) {
3206                 user = rcvr->user;
3207                 kref_get(&user->refcount);
3208         } else
3209                 user = NULL;
3210         rcu_read_unlock();
3211
3212         if (user == NULL) {
3213                 /* We didn't find a user, just give up. */
3214                 ipmi_inc_stat(intf, unhandled_commands);
3215
3216                 /*
3217                  * Don't do anything with these messages, just allow
3218                  * them to be freed.
3219                  */
3220                 rv = 0;
3221         } else {
3222                 /* Deliver the message to the user. */
3223                 ipmi_inc_stat(intf, handled_commands);
3224
3225                 recv_msg = ipmi_alloc_recv_msg();
3226                 if (!recv_msg) {
3227                         /*
3228                          * We couldn't allocate memory for the
3229                          * message, so requeue it for handling later.
3230                          */
3231                         rv = 1;
3232                         kref_put(&user->refcount, free_user);
3233                 } else {
3234                         /* Extract the source address from the data. */
3235                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3236                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3237                         lan_addr->session_handle = msg->rsp[4];
3238                         lan_addr->remote_SWID = msg->rsp[8];
3239                         lan_addr->local_SWID = msg->rsp[5];
3240                         lan_addr->lun = msg->rsp[9] & 3;
3241                         lan_addr->channel = msg->rsp[3] & 0xf;
3242                         lan_addr->privilege = msg->rsp[3] >> 4;
3243
3244                         /*
3245                          * Extract the rest of the message information
3246                          * from the IPMB header.
3247                          */
3248                         recv_msg->user = user;
3249                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3250                         recv_msg->msgid = msg->rsp[9] >> 2;
3251                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3252                         recv_msg->msg.cmd = msg->rsp[10];
3253                         recv_msg->msg.data = recv_msg->msg_data;
3254
3255                         /*
3256                          * We chop off 12, not 11 bytes because the checksum
3257                          * at the end also needs to be removed.
3258                          */
3259                         recv_msg->msg.data_len = msg->rsp_size - 12;
3260                         memcpy(recv_msg->msg_data,
3261                                &(msg->rsp[11]),
3262                                msg->rsp_size - 12);
3263                         deliver_response(recv_msg);
3264                 }
3265         }
3266
3267         return rv;
3268 }
3269
3270 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3271                                      struct ipmi_smi_msg  *msg)
3272 {
3273         struct ipmi_system_interface_addr *smi_addr;
3274
3275         recv_msg->msgid = 0;
3276         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3277         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3278         smi_addr->channel = IPMI_BMC_CHANNEL;
3279         smi_addr->lun = msg->rsp[0] & 3;
3280         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3281         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3282         recv_msg->msg.cmd = msg->rsp[1];
3283         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3284         recv_msg->msg.data = recv_msg->msg_data;
3285         recv_msg->msg.data_len = msg->rsp_size - 3;
3286 }
3287
3288 static int handle_read_event_rsp(ipmi_smi_t          intf,
3289                                  struct ipmi_smi_msg *msg)
3290 {
3291         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3292         struct list_head     msgs;
3293         ipmi_user_t          user;
3294         int                  rv = 0;
3295         int                  deliver_count = 0;
3296         unsigned long        flags;
3297
3298         if (msg->rsp_size < 19) {
3299                 /* Message is too small to be an IPMB event. */
3300                 ipmi_inc_stat(intf, invalid_events);
3301                 return 0;
3302         }
3303
3304         if (msg->rsp[2] != 0) {
3305                 /* An error getting the event, just ignore it. */
3306                 return 0;
3307         }
3308
3309         INIT_LIST_HEAD(&msgs);
3310
3311         spin_lock_irqsave(&intf->events_lock, flags);
3312
3313         ipmi_inc_stat(intf, events);
3314
3315         /*
3316          * Allocate and fill in one message for every user that is
3317          * getting events.
3318          */
3319         rcu_read_lock();
3320         list_for_each_entry_rcu(user, &intf->users, link) {
3321                 if (!user->gets_events)
3322                         continue;
3323
3324                 recv_msg = ipmi_alloc_recv_msg();
3325                 if (!recv_msg) {
3326                         rcu_read_unlock();
3327                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3328                                                  link) {
3329                                 list_del(&recv_msg->link);
3330                                 ipmi_free_recv_msg(recv_msg);
3331                         }
3332                         /*
3333                          * We couldn't allocate memory for the
3334                          * message, so requeue it for handling
3335                          * later.
3336                          */
3337                         rv = 1;
3338                         goto out;
3339                 }
3340
3341                 deliver_count++;
3342
3343                 copy_event_into_recv_msg(recv_msg, msg);
3344                 recv_msg->user = user;
3345                 kref_get(&user->refcount);
3346                 list_add_tail(&(recv_msg->link), &msgs);
3347         }
3348         rcu_read_unlock();
3349
3350         if (deliver_count) {
3351                 /* Now deliver all the messages. */
3352                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3353                         list_del(&recv_msg->link);
3354                         deliver_response(recv_msg);
3355                 }
3356         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3357                 /*
3358                  * No one to receive the message, put it in queue if there's
3359                  * not already too many things in the queue.
3360                  */
3361                 recv_msg = ipmi_alloc_recv_msg();
3362                 if (!recv_msg) {
3363                         /*
3364                          * We couldn't allocate memory for the
3365                          * message, so requeue it for handling
3366                          * later.
3367                          */
3368                         rv = 1;
3369                         goto out;
3370                 }
3371
3372                 copy_event_into_recv_msg(recv_msg, msg);
3373                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3374                 intf->waiting_events_count++;
3375         } else if (!intf->event_msg_printed) {
3376                 /*
3377                  * There's too many things in the queue, discard this
3378                  * message.
3379                  */
3380                 printk(KERN_WARNING PFX "Event queue full, discarding"
3381                        " incoming events\n");
3382                 intf->event_msg_printed = 1;
3383         }
3384
3385  out:
3386         spin_unlock_irqrestore(&(intf->events_lock), flags);
3387
3388         return rv;
3389 }
3390
3391 static int handle_bmc_rsp(ipmi_smi_t          intf,
3392                           struct ipmi_smi_msg *msg)
3393 {
3394         struct ipmi_recv_msg *recv_msg;
3395         struct ipmi_user     *user;
3396
3397         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3398         if (recv_msg == NULL) {
3399                 printk(KERN_WARNING
3400                        "IPMI message received with no owner. This\n"
3401                        "could be because of a malformed message, or\n"
3402                        "because of a hardware error.  Contact your\n"
3403                        "hardware vender for assistance\n");
3404                 return 0;
3405         }
3406
3407         user = recv_msg->user;
3408         /* Make sure the user still exists. */
3409         if (user && !user->valid) {
3410                 /* The user for the message went away, so give up. */
3411                 ipmi_inc_stat(intf, unhandled_local_responses);
3412                 ipmi_free_recv_msg(recv_msg);
3413         } else {
3414                 struct ipmi_system_interface_addr *smi_addr;
3415
3416                 ipmi_inc_stat(intf, handled_local_responses);
3417                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3418                 recv_msg->msgid = msg->msgid;
3419                 smi_addr = ((struct ipmi_system_interface_addr *)
3420                             &(recv_msg->addr));
3421                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3422                 smi_addr->channel = IPMI_BMC_CHANNEL;
3423                 smi_addr->lun = msg->rsp[0] & 3;
3424                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3425                 recv_msg->msg.cmd = msg->rsp[1];
3426                 memcpy(recv_msg->msg_data,
3427                        &(msg->rsp[2]),
3428                        msg->rsp_size - 2);
3429                 recv_msg->msg.data = recv_msg->msg_data;
3430                 recv_msg->msg.data_len = msg->rsp_size - 2;
3431                 deliver_response(recv_msg);
3432         }
3433
3434         return 0;
3435 }
3436
3437 /*
3438  * Handle a new message.  Return 1 if the message should be requeued,
3439  * 0 if the message should be freed, or -1 if the message should not
3440  * be freed or requeued.
3441  */
3442 static int handle_new_recv_msg(ipmi_smi_t          intf,
3443                                struct ipmi_smi_msg *msg)
3444 {
3445         int requeue;
3446         int chan;
3447
3448 #ifdef DEBUG_MSGING
3449         int m;
3450         printk("Recv:");
3451         for (m = 0; m < msg->rsp_size; m++)
3452                 printk(" %2.2x", msg->rsp[m]);
3453         printk("\n");
3454 #endif
3455         if (msg->rsp_size < 2) {
3456                 /* Message is too small to be correct. */
3457                 printk(KERN_WARNING PFX "BMC returned to small a message"
3458                        " for netfn %x cmd %x, got %d bytes\n",
3459                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3460
3461                 /* Generate an error response for the message. */
3462                 msg->rsp[0] = msg->data[0] | (1 << 2);
3463                 msg->rsp[1] = msg->data[1];
3464                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3465                 msg->rsp_size = 3;
3466         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3467                    || (msg->rsp[1] != msg->data[1])) {
3468                 /*
3469                  * The NetFN and Command in the response is not even
3470                  * marginally correct.
3471                  */
3472                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3473                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3474                        (msg->data[0] >> 2) | 1, msg->data[1],
3475                        msg->rsp[0] >> 2, msg->rsp[1]);
3476
3477                 /* Generate an error response for the message. */
3478                 msg->rsp[0] = msg->data[0] | (1 << 2);
3479                 msg->rsp[1] = msg->data[1];
3480                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3481                 msg->rsp_size = 3;
3482         }
3483
3484         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3485             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3486             && (msg->user_data != NULL)) {
3487                 /*
3488                  * It's a response to a response we sent.  For this we
3489                  * deliver a send message response to the user.
3490                  */
3491                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3492
3493                 requeue = 0;
3494                 if (msg->rsp_size < 2)
3495                         /* Message is too small to be correct. */
3496                         goto out;
3497
3498                 chan = msg->data[2] & 0x0f;
3499                 if (chan >= IPMI_MAX_CHANNELS)
3500                         /* Invalid channel number */
3501                         goto out;
3502
3503                 if (!recv_msg)
3504                         goto out;
3505
3506                 /* Make sure the user still exists. */
3507                 if (!recv_msg->user || !recv_msg->user->valid)
3508                         goto out;
3509
3510                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3511                 recv_msg->msg.data = recv_msg->msg_data;
3512                 recv_msg->msg.data_len = 1;
3513                 recv_msg->msg_data[0] = msg->rsp[2];
3514                 deliver_response(recv_msg);
3515         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3516                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3517                 /* It's from the receive queue. */
3518                 chan = msg->rsp[3] & 0xf;
3519                 if (chan >= IPMI_MAX_CHANNELS) {
3520                         /* Invalid channel number */
3521                         requeue = 0;
3522                         goto out;
3523                 }
3524
3525                 switch (intf->channels[chan].medium) {
3526                 case IPMI_CHANNEL_MEDIUM_IPMB:
3527                         if (msg->rsp[4] & 0x04) {
3528                                 /*
3529                                  * It's a response, so find the
3530                                  * requesting message and send it up.
3531                                  */
3532                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3533                         } else {
3534                                 /*
3535                                  * It's a command to the SMS from some other
3536                                  * entity.  Handle that.
3537                                  */
3538                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3539                         }
3540                         break;
3541
3542                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3543                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3544                         if (msg->rsp[6] & 0x04) {
3545                                 /*
3546                                  * It's a response, so find the
3547                                  * requesting message and send it up.
3548                                  */
3549                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3550                         } else {
3551                                 /*
3552                                  * It's a command to the SMS from some other
3553                                  * entity.  Handle that.
3554                                  */
3555                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3556                         }
3557                         break;
3558
3559                 default:
3560                         /*
3561                          * We don't handle the channel type, so just
3562                          * free the message.
3563                          */
3564                         requeue = 0;
3565                 }
3566
3567         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3568                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3569                 /* It's an asyncronous event. */
3570                 requeue = handle_read_event_rsp(intf, msg);
3571         } else {
3572                 /* It's a response from the local BMC. */
3573                 requeue = handle_bmc_rsp(intf, msg);
3574         }
3575
3576  out:
3577         return requeue;
3578 }
3579
3580 /* Handle a new message from the lower layer. */
3581 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3582                            struct ipmi_smi_msg *msg)
3583 {
3584         unsigned long flags = 0; /* keep us warning-free. */
3585         int           rv;
3586         int           run_to_completion;
3587
3588
3589         if ((msg->data_size >= 2)
3590             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3591             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3592             && (msg->user_data == NULL)) {
3593                 /*
3594                  * This is the local response to a command send, start
3595                  * the timer for these.  The user_data will not be
3596                  * NULL if this is a response send, and we will let
3597                  * response sends just go through.
3598                  */
3599
3600                 /*
3601                  * Check for errors, if we get certain errors (ones
3602                  * that mean basically we can try again later), we
3603                  * ignore them and start the timer.  Otherwise we
3604                  * report the error immediately.
3605                  */
3606                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3607                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3608                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3609                     && (msg->rsp[2] != IPMI_BUS_ERR)
3610                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3611                         int chan = msg->rsp[3] & 0xf;
3612
3613                         /* Got an error sending the message, handle it. */
3614                         if (chan >= IPMI_MAX_CHANNELS)
3615                                 ; /* This shouldn't happen */
3616                         else if ((intf->channels[chan].medium
3617                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3618                                  || (intf->channels[chan].medium
3619                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3620                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3621                         else
3622                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3623                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3624                 } else
3625                         /* The message was sent, start the timer. */
3626                         intf_start_seq_timer(intf, msg->msgid);
3627
3628                 ipmi_free_smi_msg(msg);
3629                 goto out;
3630         }
3631
3632         /*
3633          * To preserve message order, if the list is not empty, we
3634          * tack this message onto the end of the list.
3635          */
3636         run_to_completion = intf->run_to_completion;
3637         if (!run_to_completion)
3638                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3639         if (!list_empty(&intf->waiting_msgs)) {
3640                 list_add_tail(&msg->link, &intf->waiting_msgs);
3641                 if (!run_to_completion)
3642                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3643                 goto out;
3644         }
3645         if (!run_to_completion)
3646                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3647
3648         rv = handle_new_recv_msg(intf, msg);
3649         if (rv > 0) {
3650                 /*
3651                  * Could not handle the message now, just add it to a
3652                  * list to handle later.
3653                  */
3654                 run_to_completion = intf->run_to_completion;
3655                 if (!run_to_completion)
3656                         spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3657                 list_add_tail(&msg->link, &intf->waiting_msgs);
3658                 if (!run_to_completion)
3659                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3660         } else if (rv == 0) {
3661                 ipmi_free_smi_msg(msg);
3662         }
3663
3664  out:
3665         return;
3666 }
3667 EXPORT_SYMBOL(ipmi_smi_msg_received);
3668
3669 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3670 {
3671         ipmi_user_t user;
3672
3673         rcu_read_lock();
3674         list_for_each_entry_rcu(user, &intf->users, link) {
3675                 if (!user->handler->ipmi_watchdog_pretimeout)
3676                         continue;
3677
3678                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
3679         }
3680         rcu_read_unlock();
3681 }
3682 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3683
3684 static struct ipmi_smi_msg *
3685 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3686                   unsigned char seq, long seqid)
3687 {
3688         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3689         if (!smi_msg)
3690                 /*
3691                  * If we can't allocate the message, then just return, we
3692                  * get 4 retries, so this should be ok.
3693                  */
3694                 return NULL;
3695
3696         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3697         smi_msg->data_size = recv_msg->msg.data_len;
3698         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3699
3700 #ifdef DEBUG_MSGING
3701         {
3702                 int m;
3703                 printk("Resend: ");
3704                 for (m = 0; m < smi_msg->data_size; m++)
3705                         printk(" %2.2x", smi_msg->data[m]);
3706                 printk("\n");
3707         }
3708 #endif
3709         return smi_msg;
3710 }
3711
3712 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3713                               struct list_head *timeouts, long timeout_period,
3714                               int slot, unsigned long *flags)
3715 {
3716         struct ipmi_recv_msg     *msg;
3717         struct ipmi_smi_handlers *handlers;
3718
3719         if (intf->intf_num == -1)
3720                 return;
3721
3722         if (!ent->inuse)
3723                 return;
3724
3725         ent->timeout -= timeout_period;
3726         if (ent->timeout > 0)
3727                 return;
3728
3729         if (ent->retries_left == 0) {
3730                 /* The message has used all its retries. */
3731                 ent->inuse = 0;
3732                 msg = ent->recv_msg;
3733                 list_add_tail(&msg->link, timeouts);
3734                 if (ent->broadcast)
3735                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
3736                 else if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3737                         ipmi_inc_stat(intf, timed_out_lan_commands);
3738                 else
3739                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
3740         } else {
3741                 struct ipmi_smi_msg *smi_msg;
3742                 /* More retries, send again. */
3743
3744                 /*
3745                  * Start with the max timer, set to normal timer after
3746                  * the message is sent.
3747                  */
3748                 ent->timeout = MAX_MSG_TIMEOUT;
3749                 ent->retries_left--;
3750                 if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3751                         ipmi_inc_stat(intf, retransmitted_lan_commands);
3752                 else
3753                         ipmi_inc_stat(intf, retransmitted_ipmb_commands);
3754
3755                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
3756                                             ent->seqid);
3757                 if (!smi_msg)
3758                         return;
3759
3760                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
3761
3762                 /*
3763                  * Send the new message.  We send with a zero
3764                  * priority.  It timed out, I doubt time is that
3765                  * critical now, and high priority messages are really
3766                  * only for messages to the local MC, which don't get
3767                  * resent.
3768                  */
3769                 handlers = intf->handlers;
3770                 if (handlers)
3771                         intf->handlers->sender(intf->send_info,
3772                                                smi_msg, 0);
3773                 else
3774                         ipmi_free_smi_msg(smi_msg);
3775
3776                 spin_lock_irqsave(&intf->seq_lock, *flags);
3777         }
3778 }
3779
3780 static void ipmi_timeout_handler(long timeout_period)
3781 {
3782         ipmi_smi_t           intf;
3783         struct list_head     timeouts;
3784         struct ipmi_recv_msg *msg, *msg2;
3785         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
3786         unsigned long        flags;
3787         int                  i;
3788
3789         rcu_read_lock();
3790         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3791                 /* See if any waiting messages need to be processed. */
3792                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3793                 list_for_each_entry_safe(smi_msg, smi_msg2,
3794                                          &intf->waiting_msgs, link) {
3795                         if (!handle_new_recv_msg(intf, smi_msg)) {
3796                                 list_del(&smi_msg->link);
3797                                 ipmi_free_smi_msg(smi_msg);
3798                         } else {
3799                                 /*
3800                                  * To preserve message order, quit if we
3801                                  * can't handle a message.
3802                                  */
3803                                 break;
3804                         }
3805                 }
3806                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3807
3808                 /*
3809                  * Go through the seq table and find any messages that
3810                  * have timed out, putting them in the timeouts
3811                  * list.
3812                  */
3813                 INIT_LIST_HEAD(&timeouts);
3814                 spin_lock_irqsave(&intf->seq_lock, flags);
3815                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
3816                         check_msg_timeout(intf, &(intf->seq_table[i]),
3817                                           &timeouts, timeout_period, i,
3818                                           &flags);
3819                 spin_unlock_irqrestore(&intf->seq_lock, flags);
3820
3821                 list_for_each_entry_safe(msg, msg2, &timeouts, link)
3822                         deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
3823
3824                 /*
3825                  * Maintenance mode handling.  Check the timeout
3826                  * optimistically before we claim the lock.  It may
3827                  * mean a timeout gets missed occasionally, but that
3828                  * only means the timeout gets extended by one period
3829                  * in that case.  No big deal, and it avoids the lock
3830                  * most of the time.
3831                  */
3832                 if (intf->auto_maintenance_timeout > 0) {
3833                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
3834                         if (intf->auto_maintenance_timeout > 0) {
3835                                 intf->auto_maintenance_timeout
3836                                         -= timeout_period;
3837                                 if (!intf->maintenance_mode
3838                                     && (intf->auto_maintenance_timeout <= 0)) {
3839                                         intf->maintenance_mode_enable = 0;
3840                                         maintenance_mode_update(intf);
3841                                 }
3842                         }
3843                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
3844                                                flags);
3845                 }
3846         }
3847         rcu_read_unlock();
3848 }
3849
3850 static void ipmi_request_event(void)
3851 {
3852         ipmi_smi_t               intf;
3853         struct ipmi_smi_handlers *handlers;
3854
3855         rcu_read_lock();
3856         /*
3857          * Called from the timer, no need to check if handlers is
3858          * valid.
3859          */
3860         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3861                 /* No event requests when in maintenance mode. */
3862                 if (intf->maintenance_mode_enable)
3863                         continue;
3864
3865                 handlers = intf->handlers;
3866                 if (handlers)
3867                         handlers->request_events(intf->send_info);
3868         }
3869         rcu_read_unlock();
3870 }
3871
3872 static struct timer_list ipmi_timer;
3873
3874 /* Call every ~100 ms. */
3875 #define IPMI_TIMEOUT_TIME       100
3876
3877 /* How many jiffies does it take to get to the timeout time. */
3878 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
3879
3880 /*
3881  * Request events from the queue every second (this is the number of
3882  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
3883  * future, IPMI will add a way to know immediately if an event is in
3884  * the queue and this silliness can go away.
3885  */
3886 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
3887
3888 static atomic_t stop_operation;
3889 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3890
3891 static void ipmi_timeout(unsigned long data)
3892 {
3893         if (atomic_read(&stop_operation))
3894                 return;
3895
3896         ticks_to_req_ev--;
3897         if (ticks_to_req_ev == 0) {
3898                 ipmi_request_event();
3899                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3900         }
3901
3902         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
3903
3904         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
3905 }
3906
3907
3908 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
3909 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
3910
3911 /* FIXME - convert these to slabs. */
3912 static void free_smi_msg(struct ipmi_smi_msg *msg)
3913 {
3914         atomic_dec(&smi_msg_inuse_count);
3915         kfree(msg);
3916 }
3917
3918 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
3919 {
3920         struct ipmi_smi_msg *rv;
3921         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
3922         if (rv) {
3923                 rv->done = free_smi_msg;
3924                 rv->user_data = NULL;
3925                 atomic_inc(&smi_msg_inuse_count);
3926         }
3927         return rv;
3928 }
3929 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
3930
3931 static void free_recv_msg(struct ipmi_recv_msg *msg)
3932 {
3933         atomic_dec(&recv_msg_inuse_count);
3934         kfree(msg);
3935 }
3936
3937 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
3938 {
3939         struct ipmi_recv_msg *rv;
3940
3941         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
3942         if (rv) {
3943                 rv->user = NULL;
3944                 rv->done = free_recv_msg;
3945                 atomic_inc(&recv_msg_inuse_count);
3946         }
3947         return rv;
3948 }
3949
3950 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
3951 {
3952         if (msg->user)
3953                 kref_put(&msg->user->refcount, free_user);
3954         msg->done(msg);
3955 }
3956 EXPORT_SYMBOL(ipmi_free_recv_msg);
3957
3958 #ifdef CONFIG_IPMI_PANIC_EVENT
3959
3960 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
3961 {
3962 }
3963
3964 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
3965 {
3966 }
3967
3968 #ifdef CONFIG_IPMI_PANIC_STRING
3969 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3970 {
3971         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3972             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
3973             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
3974             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3975                 /* A get event receiver command, save it. */
3976                 intf->event_receiver = msg->msg.data[1];
3977                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
3978         }
3979 }
3980
3981 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3982 {
3983         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3984             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3985             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
3986             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3987                 /*
3988                  * A get device id command, save if we are an event
3989                  * receiver or generator.
3990                  */
3991                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
3992                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
3993         }
3994 }
3995 #endif
3996
3997 static void send_panic_events(char *str)
3998 {
3999         struct kernel_ipmi_msg            msg;
4000         ipmi_smi_t                        intf;
4001         unsigned char                     data[16];
4002         struct ipmi_system_interface_addr *si;
4003         struct ipmi_addr                  addr;
4004         struct ipmi_smi_msg               smi_msg;
4005         struct ipmi_recv_msg              recv_msg;
4006
4007         si = (struct ipmi_system_interface_addr *) &addr;
4008         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4009         si->channel = IPMI_BMC_CHANNEL;
4010         si->lun = 0;
4011
4012         /* Fill in an event telling that we have failed. */
4013         msg.netfn = 0x04; /* Sensor or Event. */
4014         msg.cmd = 2; /* Platform event command. */
4015         msg.data = data;
4016         msg.data_len = 8;
4017         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4018         data[1] = 0x03; /* This is for IPMI 1.0. */
4019         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4020         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4021         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4022
4023         /*
4024          * Put a few breadcrumbs in.  Hopefully later we can add more things
4025          * to make the panic events more useful.
4026          */
4027         if (str) {
4028                 data[3] = str[0];
4029                 data[6] = str[1];
4030                 data[7] = str[2];
4031         }
4032
4033         smi_msg.done = dummy_smi_done_handler;
4034         recv_msg.done = dummy_recv_done_handler;
4035
4036         /* For every registered interface, send the event. */
4037         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4038                 if (!intf->handlers)
4039                         /* Interface is not ready. */
4040                         continue;
4041
4042                 intf->run_to_completion = 1;
4043                 /* Send the event announcing the panic. */
4044                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4045                 i_ipmi_request(NULL,
4046                                intf,
4047                                &addr,
4048                                0,
4049                                &msg,
4050                                intf,
4051                                &smi_msg,
4052                                &recv_msg,
4053                                0,
4054                                intf->channels[0].address,
4055                                intf->channels[0].lun,
4056                                0, 1); /* Don't retry, and don't wait. */
4057         }
4058
4059 #ifdef CONFIG_IPMI_PANIC_STRING
4060         /*
4061          * On every interface, dump a bunch of OEM event holding the
4062          * string.
4063          */
4064         if (!str)
4065                 return;
4066
4067         /* For every registered interface, send the event. */
4068         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4069                 char                  *p = str;
4070                 struct ipmi_ipmb_addr *ipmb;
4071                 int                   j;
4072
4073                 if (intf->intf_num == -1)
4074                         /* Interface was not ready yet. */
4075                         continue;
4076
4077                 /*
4078                  * intf_num is used as an marker to tell if the
4079                  * interface is valid.  Thus we need a read barrier to
4080                  * make sure data fetched before checking intf_num
4081                  * won't be used.
4082                  */
4083                 smp_rmb();
4084
4085                 /*
4086                  * First job here is to figure out where to send the
4087                  * OEM events.  There's no way in IPMI to send OEM
4088                  * events using an event send command, so we have to
4089                  * find the SEL to put them in and stick them in
4090                  * there.
4091                  */
4092
4093                 /* Get capabilities from the get device id. */
4094                 intf->local_sel_device = 0;
4095                 intf->local_event_generator = 0;
4096                 intf->event_receiver = 0;
4097
4098                 /* Request the device info from the local MC. */
4099                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4100                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4101                 msg.data = NULL;
4102                 msg.data_len = 0;
4103                 intf->null_user_handler = device_id_fetcher;
4104                 i_ipmi_request(NULL,
4105                                intf,
4106                                &addr,
4107                                0,
4108                                &msg,
4109                                intf,
4110                                &smi_msg,
4111                                &recv_msg,
4112                                0,
4113                                intf->channels[0].address,
4114                                intf->channels[0].lun,
4115                                0, 1); /* Don't retry, and don't wait. */
4116
4117                 if (intf->local_event_generator) {
4118                         /* Request the event receiver from the local MC. */
4119                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4120                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4121                         msg.data = NULL;
4122                         msg.data_len = 0;
4123                         intf->null_user_handler = event_receiver_fetcher;
4124                         i_ipmi_request(NULL,
4125                                        intf,
4126                                        &addr,
4127                                        0,
4128                                        &msg,
4129                                        intf,
4130                                        &smi_msg,
4131                                        &recv_msg,
4132                                        0,
4133                                        intf->channels[0].address,
4134                                        intf->channels[0].lun,
4135                                        0, 1); /* no retry, and no wait. */
4136                 }
4137                 intf->null_user_handler = NULL;
4138
4139                 /*
4140                  * Validate the event receiver.  The low bit must not
4141                  * be 1 (it must be a valid IPMB address), it cannot
4142                  * be zero, and it must not be my address.
4143                  */
4144                 if (((intf->event_receiver & 1) == 0)
4145                     && (intf->event_receiver != 0)
4146                     && (intf->event_receiver != intf->channels[0].address)) {
4147                         /*
4148                          * The event receiver is valid, send an IPMB
4149                          * message.
4150                          */
4151                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4152                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4153                         ipmb->channel = 0; /* FIXME - is this right? */
4154                         ipmb->lun = intf->event_receiver_lun;
4155                         ipmb->slave_addr = intf->event_receiver;
4156                 } else if (intf->local_sel_device) {
4157                         /*
4158                          * The event receiver was not valid (or was
4159                          * me), but I am an SEL device, just dump it
4160                          * in my SEL.
4161                          */
4162                         si = (struct ipmi_system_interface_addr *) &addr;
4163                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4164                         si->channel = IPMI_BMC_CHANNEL;
4165                         si->lun = 0;
4166                 } else
4167                         continue; /* No where to send the event. */
4168
4169                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4170                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4171                 msg.data = data;
4172                 msg.data_len = 16;
4173
4174                 j = 0;
4175                 while (*p) {
4176                         int size = strlen(p);
4177
4178                         if (size > 11)
4179                                 size = 11;
4180                         data[0] = 0;
4181                         data[1] = 0;
4182                         data[2] = 0xf0; /* OEM event without timestamp. */
4183                         data[3] = intf->channels[0].address;
4184                         data[4] = j++; /* sequence # */
4185                         /*
4186                          * Always give 11 bytes, so strncpy will fill
4187                          * it with zeroes for me.
4188                          */
4189                         strncpy(data+5, p, 11);
4190                         p += size;
4191
4192                         i_ipmi_request(NULL,
4193                                        intf,
4194                                        &addr,
4195                                        0,
4196                                        &msg,
4197                                        intf,
4198                                        &smi_msg,
4199                                        &recv_msg,
4200                                        0,
4201                                        intf->channels[0].address,
4202                                        intf->channels[0].lun,
4203                                        0, 1); /* no retry, and no wait. */
4204                 }
4205         }
4206 #endif /* CONFIG_IPMI_PANIC_STRING */
4207 }
4208 #endif /* CONFIG_IPMI_PANIC_EVENT */
4209
4210 static int has_panicked;
4211
4212 static int panic_event(struct notifier_block *this,
4213                        unsigned long         event,
4214                        void                  *ptr)
4215 {
4216         ipmi_smi_t intf;
4217
4218         if (has_panicked)
4219                 return NOTIFY_DONE;
4220         has_panicked = 1;
4221
4222         /* For every registered interface, set it to run to completion. */
4223         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4224                 if (!intf->handlers)
4225                         /* Interface is not ready. */
4226                         continue;
4227
4228                 intf->run_to_completion = 1;
4229                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4230         }
4231
4232 #ifdef CONFIG_IPMI_PANIC_EVENT
4233         send_panic_events(ptr);
4234 #endif
4235
4236         return NOTIFY_DONE;
4237 }
4238
4239 static struct notifier_block panic_block = {
4240         .notifier_call  = panic_event,
4241         .next           = NULL,
4242         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4243 };
4244
4245 static int ipmi_init_msghandler(void)
4246 {
4247         int rv;
4248
4249         if (initialized)
4250                 return 0;
4251
4252         rv = driver_register(&ipmidriver.driver);
4253         if (rv) {
4254                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4255                 return rv;
4256         }
4257
4258         printk(KERN_INFO "ipmi message handler version "
4259                IPMI_DRIVER_VERSION "\n");
4260
4261 #ifdef CONFIG_PROC_FS
4262         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4263         if (!proc_ipmi_root) {
4264             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4265             return -ENOMEM;
4266         }
4267
4268         proc_ipmi_root->owner = THIS_MODULE;
4269 #endif /* CONFIG_PROC_FS */
4270
4271         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4272         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4273
4274         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4275
4276         initialized = 1;
4277
4278         return 0;
4279 }
4280
4281 static __init int ipmi_init_msghandler_mod(void)
4282 {
4283         ipmi_init_msghandler();
4284         return 0;
4285 }
4286
4287 static __exit void cleanup_ipmi(void)
4288 {
4289         int count;
4290
4291         if (!initialized)
4292                 return;
4293
4294         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4295
4296         /*
4297          * This can't be called if any interfaces exist, so no worry
4298          * about shutting down the interfaces.
4299          */
4300
4301         /*
4302          * Tell the timer to stop, then wait for it to stop.  This
4303          * avoids problems with race conditions removing the timer
4304          * here.
4305          */
4306         atomic_inc(&stop_operation);
4307         del_timer_sync(&ipmi_timer);
4308
4309 #ifdef CONFIG_PROC_FS
4310         remove_proc_entry(proc_ipmi_root->name, NULL);
4311 #endif /* CONFIG_PROC_FS */
4312
4313         driver_unregister(&ipmidriver.driver);
4314
4315         initialized = 0;
4316
4317         /* Check for buffer leaks. */
4318         count = atomic_read(&smi_msg_inuse_count);
4319         if (count != 0)
4320                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4321                        count);
4322         count = atomic_read(&recv_msg_inuse_count);
4323         if (count != 0)
4324                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4325                        count);
4326 }
4327 module_exit(cleanup_ipmi);
4328
4329 module_init(ipmi_init_msghandler_mod);
4330 MODULE_LICENSE("GPL");
4331 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4332 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4333                    " interface.");
4334 MODULE_VERSION(IPMI_DRIVER_VERSION);