kernel/drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/poll.h>
  37 #include <linux/sched.h>
  38 #include <linux/seq_file.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/mutex.h>
  41 #include <linux/slab.h>
  42 #include <linux/ipmi.h>
  43 #include <linux/ipmi_smi.h>
  44 #include <linux/notifier.h>
  45 #include <linux/init.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/rcupdate.h>
  48 #include <linux/interrupt.h>
  49
  50 #define PFX "IPMI message handler: "
  51
  52 #define IPMI_DRIVER_VERSION "39.2"
  53
  54 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  55 static int ipmi_init_msghandler(void);
  56 static void smi_recv_tasklet(unsigned long);
  57 static void handle_new_recv_msgs(ipmi_smi_t intf);
  58 static void need_waiter(ipmi_smi_t intf);
  59 static int handle_one_recv_msg(ipmi_smi_t          intf,
  60                                struct ipmi_smi_msg *msg);
  61
  62 static int initialized;
  63
  64 #ifdef CONFIG_PROC_FS
  65 static struct proc_dir_entry *proc_ipmi_root;
  66 #endif /* CONFIG_PROC_FS */
  67
  68 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  69 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  70
  71 #define MAX_EVENTS_IN_QUEUE     25
  72
  73 /*
  74  * Don't let a message sit in a queue forever, always time it with at lest
  75  * the max message timer.  This is in milliseconds.
  76  */
  77 #define MAX_MSG_TIMEOUT         60000
  78
  79 /* Call every ~1000 ms. */
  80 #define IPMI_TIMEOUT_TIME       1000
  81
  82 /* How many jiffies does it take to get to the timeout time. */
  83 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
  84
  85 /*
  86  * Request events from the queue every second (this is the number of
  87  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
  88  * future, IPMI will add a way to know immediately if an event is in
  89  * the queue and this silliness can go away.
  90  */
  91 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
  92
  93 /*
  94  * The main "user" data structure.
  95  */
  96 struct ipmi_user {
  97         struct list_head link;
  98
  99         /* Set to false when the user is destroyed. */
 100         bool valid;
 101
 102         struct kref refcount;
 103
 104         /* The upper layer that handles receive messages. */
 105         struct ipmi_user_hndl *handler;
 106         void             *handler_data;
 107
 108         /* The interface this user is bound to. */
 109         ipmi_smi_t intf;
 110
 111         /* Does this interface receive IPMI events? */
 112         bool gets_events;
 113 };
 114
 115 struct cmd_rcvr {
 116         struct list_head link;
 117
 118         ipmi_user_t   user;
 119         unsigned char netfn;
 120         unsigned char cmd;
 121         unsigned int  chans;
 122
 123         /*
 124          * This is used to form a linked lised during mass deletion.
 125          * Since this is in an RCU list, we cannot use the link above
 126          * or change any data until the RCU period completes.  So we
 127          * use this next variable during mass deletion so we can have
 128          * a list and don't have to wait and restart the search on
 129          * every individual deletion of a command.
 130          */
 131         struct cmd_rcvr *next;
 132 };
 133
 134 struct seq_table {
 135         unsigned int         inuse : 1;
 136         unsigned int         broadcast : 1;
 137
 138         unsigned long        timeout;
 139         unsigned long        orig_timeout;
 140         unsigned int         retries_left;
 141
 142         /*
 143          * To verify on an incoming send message response that this is
 144          * the message that the response is for, we keep a sequence id
 145          * and increment it every time we send a message.
 146          */
 147         long                 seqid;
 148
 149         /*
 150          * This is held so we can properly respond to the message on a
 151          * timeout, and it is used to hold the temporary data for
 152          * retransmission, too.
 153          */
 154         struct ipmi_recv_msg *recv_msg;
 155 };
 156
 157 /*
 158  * Store the information in a msgid (long) to allow us to find a
 159  * sequence table entry from the msgid.
 160  */
 161 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 162
 163 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 164         do {                                                            \
 165                 seq = ((msgid >> 26) & 0x3f);                           \
 166                 seqid = (msgid & 0x3fffff);                             \
 167         } while (0)
 168
 169 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 170
 171 struct ipmi_channel {
 172         unsigned char medium;
 173         unsigned char protocol;
 174
 175         /*
 176          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 177          * but may be changed by the user.
 178          */
 179         unsigned char address;
 180
 181         /*
 182          * My LUN.  This should generally stay the SMS LUN, but just in
 183          * case...
 184          */
 185         unsigned char lun;
 186 };
 187
 188 #ifdef CONFIG_PROC_FS
 189 struct ipmi_proc_entry {
 190         char                   *name;
 191         struct ipmi_proc_entry *next;
 192 };
 193 #endif
 194
 195 struct bmc_device {
 196         struct platform_device pdev;
 197         struct ipmi_device_id  id;
 198         unsigned char          guid[16];
 199         int                    guid_set;
 200         char                   name[16];
 201         struct kref            usecount;
 202 };
 203 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
 204
 205 /*
 206  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 207  * structure.
 208  */
 209 enum ipmi_stat_indexes {
 210         /* Commands we got from the user that were invalid. */
 211         IPMI_STAT_sent_invalid_commands = 0,
 212
 213         /* Commands we sent to the MC. */
 214         IPMI_STAT_sent_local_commands,
 215
 216         /* Responses from the MC that were delivered to a user. */
 217         IPMI_STAT_handled_local_responses,
 218
 219         /* Responses from the MC that were not delivered to a user. */
 220         IPMI_STAT_unhandled_local_responses,
 221
 222         /* Commands we sent out to the IPMB bus. */
 223         IPMI_STAT_sent_ipmb_commands,
 224
 225         /* Commands sent on the IPMB that had errors on the SEND CMD */
 226         IPMI_STAT_sent_ipmb_command_errs,
 227
 228         /* Each retransmit increments this count. */
 229         IPMI_STAT_retransmitted_ipmb_commands,
 230
 231         /*
 232          * When a message times out (runs out of retransmits) this is
 233          * incremented.
 234          */
 235         IPMI_STAT_timed_out_ipmb_commands,
 236
 237         /*
 238          * This is like above, but for broadcasts.  Broadcasts are
 239          * *not* included in the above count (they are expected to
 240          * time out).
 241          */
 242         IPMI_STAT_timed_out_ipmb_broadcasts,
 243
 244         /* Responses I have sent to the IPMB bus. */
 245         IPMI_STAT_sent_ipmb_responses,
 246
 247         /* The response was delivered to the user. */
 248         IPMI_STAT_handled_ipmb_responses,
 249
 250         /* The response had invalid data in it. */
 251         IPMI_STAT_invalid_ipmb_responses,
 252
 253         /* The response didn't have anyone waiting for it. */
 254         IPMI_STAT_unhandled_ipmb_responses,
 255
 256         /* Commands we sent out to the IPMB bus. */
 257         IPMI_STAT_sent_lan_commands,
 258
 259         /* Commands sent on the IPMB that had errors on the SEND CMD */
 260         IPMI_STAT_sent_lan_command_errs,
 261
 262         /* Each retransmit increments this count. */
 263         IPMI_STAT_retransmitted_lan_commands,
 264
 265         /*
 266          * When a message times out (runs out of retransmits) this is
 267          * incremented.
 268          */
 269         IPMI_STAT_timed_out_lan_commands,
 270
 271         /* Responses I have sent to the IPMB bus. */
 272         IPMI_STAT_sent_lan_responses,
 273
 274         /* The response was delivered to the user. */
 275         IPMI_STAT_handled_lan_responses,
 276
 277         /* The response had invalid data in it. */
 278         IPMI_STAT_invalid_lan_responses,
 279
 280         /* The response didn't have anyone waiting for it. */
 281         IPMI_STAT_unhandled_lan_responses,
 282
 283         /* The command was delivered to the user. */
 284         IPMI_STAT_handled_commands,
 285
 286         /* The command had invalid data in it. */
 287         IPMI_STAT_invalid_commands,
 288
 289         /* The command didn't have anyone waiting for it. */
 290         IPMI_STAT_unhandled_commands,
 291
 292         /* Invalid data in an event. */
 293         IPMI_STAT_invalid_events,
 294
 295         /* Events that were received with the proper format. */
 296         IPMI_STAT_events,
 297
 298         /* Retransmissions on IPMB that failed. */
 299         IPMI_STAT_dropped_rexmit_ipmb_commands,
 300
 301         /* Retransmissions on LAN that failed. */
 302         IPMI_STAT_dropped_rexmit_lan_commands,
 303
 304         /* This *must* remain last, add new values above this. */
 305         IPMI_NUM_STATS
 306 };
 307
 308
 309 #define IPMI_IPMB_NUM_SEQ       64
 310 #define IPMI_MAX_CHANNELS       16
 311 struct ipmi_smi {
 312         /* What interface number are we? */
 313         int intf_num;
 314
 315         struct kref refcount;
 316
 317         /* Set when the interface is being unregistered. */
 318         bool in_shutdown;
 319
 320         /* Used for a list of interfaces. */
 321         struct list_head link;
 322
 323         /*
 324          * The list of upper layers that are using me.  seq_lock
 325          * protects this.
 326          */
 327         struct list_head users;
 328
 329         /* Information to supply to users. */
 330         unsigned char ipmi_version_major;
 331         unsigned char ipmi_version_minor;
 332
 333         /* Used for wake ups at startup. */
 334         wait_queue_head_t waitq;
 335
 336         struct bmc_device *bmc;
 337         char *my_dev_name;
 338
 339         /*
 340          * This is the lower-layer's sender routine.  Note that you
 341          * must either be holding the ipmi_interfaces_mutex or be in
 342          * an umpreemptible region to use this.  You must fetch the
 343          * value into a local variable and make sure it is not NULL.
 344          */
 345         const struct ipmi_smi_handlers *handlers;
 346         void                     *send_info;
 347
 348 #ifdef CONFIG_PROC_FS
 349         /* A list of proc entries for this interface. */
 350         struct mutex           proc_entry_lock;
 351         struct ipmi_proc_entry *proc_entries;
 352 #endif
 353
 354         /* Driver-model device for the system interface. */
 355         struct device          *si_dev;
 356
 357         /*
 358          * A table of sequence numbers for this interface.  We use the
 359          * sequence numbers for IPMB messages that go out of the
 360          * interface to match them up with their responses.  A routine
 361          * is called periodically to time the items in this list.
 362          */
 363         spinlock_t       seq_lock;
 364         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 365         int curr_seq;
 366
 367         /*
 368          * Messages queued for delivery.  If delivery fails (out of memory
 369          * for instance), They will stay in here to be processed later in a
 370          * periodic timer interrupt.  The tasklet is for handling received
 371          * messages directly from the handler.
 372          */
 373         spinlock_t       waiting_rcv_msgs_lock;
 374         struct list_head waiting_rcv_msgs;
 375         atomic_t         watchdog_pretimeouts_to_deliver;
 376         struct tasklet_struct recv_tasklet;
 377
 378         spinlock_t             xmit_msgs_lock;
 379         struct list_head       xmit_msgs;
 380         struct ipmi_smi_msg    *curr_msg;
 381         struct list_head       hp_xmit_msgs;
 382
 383         /*
 384          * The list of command receivers that are registered for commands
 385          * on this interface.
 386          */
 387         struct mutex     cmd_rcvrs_mutex;
 388         struct list_head cmd_rcvrs;
 389
 390         /*
 391          * Events that were queues because no one was there to receive
 392          * them.
 393          */
 394         spinlock_t       events_lock; /* For dealing with event stuff. */
 395         struct list_head waiting_events;
 396         unsigned int     waiting_events_count; /* How many events in queue? */
 397         char             delivering_events;
 398         char             event_msg_printed;
 399         atomic_t         event_waiters;
 400         unsigned int     ticks_to_req_ev;
 401         int              last_needs_timer;
 402
 403         /*
 404          * The event receiver for my BMC, only really used at panic
 405          * shutdown as a place to store this.
 406          */
 407         unsigned char event_receiver;
 408         unsigned char event_receiver_lun;
 409         unsigned char local_sel_device;
 410         unsigned char local_event_generator;
 411
 412         /* For handling of maintenance mode. */
 413         int maintenance_mode;
 414         bool maintenance_mode_enable;
 415         int auto_maintenance_timeout;
 416         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 417
 418         /*
 419          * A cheap hack, if this is non-null and a message to an
 420          * interface comes in with a NULL user, call this routine with
 421          * it.  Note that the message will still be freed by the
 422          * caller.  This only works on the system interface.
 423          */
 424         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 425
 426         /*
 427          * When we are scanning the channels for an SMI, this will
 428          * tell which channel we are scanning.
 429          */
 430         int curr_channel;
 431
 432         /* Channel information */
 433         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 434
 435         /* Proc FS stuff. */
 436         struct proc_dir_entry *proc_dir;
 437         char                  proc_dir_name[10];
 438
 439         atomic_t stats[IPMI_NUM_STATS];
 440
 441         /*
 442          * run_to_completion duplicate of smb_info, smi_info
 443          * and ipmi_serial_info structures. Used to decrease numbers of
 444          * parameters passed by "low" level IPMI code.
 445          */
 446         int run_to_completion;
 447 };
 448 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 449
 450 /**
 451  * The driver model view of the IPMI messaging driver.
 452  */
 453 static struct platform_driver ipmidriver = {
 454         .driver = {
 455                 .name = "ipmi",
 456                 .bus = &platform_bus_type
 457         }
 458 };
 459 static DEFINE_MUTEX(ipmidriver_mutex);
 460
 461 static LIST_HEAD(ipmi_interfaces);
 462 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 463
 464 /*
 465  * List of watchers that want to know when smi's are added and deleted.
 466  */
 467 static LIST_HEAD(smi_watchers);
 468 static DEFINE_MUTEX(smi_watchers_mutex);
 469
 470 #define ipmi_inc_stat(intf, stat) \
 471         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 472 #define ipmi_get_stat(intf, stat) \
 473         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 474
 475 static char *addr_src_to_str[] = { "invalid", "hotmod", "hardcoded", "SPMI",
 476                                    "ACPI", "SMBIOS", "PCI",
 477                                    "device-tree", "default" };
 478
 479 const char *ipmi_addr_src_to_str(enum ipmi_addr_src src)
 480 {
 481         if (src > SI_DEFAULT)
 482                 src = 0; /* Invalid */
 483         return addr_src_to_str[src];
 484 }
 485 EXPORT_SYMBOL(ipmi_addr_src_to_str);
 486
 487 static int is_lan_addr(struct ipmi_addr *addr)
 488 {
 489         return addr->addr_type == IPMI_LAN_ADDR_TYPE;
 490 }
 491
 492 static int is_ipmb_addr(struct ipmi_addr *addr)
 493 {
 494         return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
 495 }
 496
 497 static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
 498 {
 499         return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
 500 }
 501
 502 static void free_recv_msg_list(struct list_head *q)
 503 {
 504         struct ipmi_recv_msg *msg, *msg2;
 505
 506         list_for_each_entry_safe(msg, msg2, q, link) {
 507                 list_del(&msg->link);
 508                 ipmi_free_recv_msg(msg);
 509         }
 510 }
 511
 512 static void free_smi_msg_list(struct list_head *q)
 513 {
 514         struct ipmi_smi_msg *msg, *msg2;
 515
 516         list_for_each_entry_safe(msg, msg2, q, link) {
 517                 list_del(&msg->link);
 518                 ipmi_free_smi_msg(msg);
 519         }
 520 }
 521
 522 static void clean_up_interface_data(ipmi_smi_t intf)
 523 {
 524         int              i;
 525         struct cmd_rcvr  *rcvr, *rcvr2;
 526         struct list_head list;
 527
 528         tasklet_kill(&intf->recv_tasklet);
 529
 530         free_smi_msg_list(&intf->waiting_rcv_msgs);
 531         free_recv_msg_list(&intf->waiting_events);
 532
 533         /*
 534          * Wholesale remove all the entries from the list in the
 535          * interface and wait for RCU to know that none are in use.
 536          */
 537         mutex_lock(&intf->cmd_rcvrs_mutex);
 538         INIT_LIST_HEAD(&list);
 539         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 540         mutex_unlock(&intf->cmd_rcvrs_mutex);
 541
 542         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 543                 kfree(rcvr);
 544
 545         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 546                 if ((intf->seq_table[i].inuse)
 547                                         && (intf->seq_table[i].recv_msg))
 548                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 549         }
 550 }
 551
 552 static void intf_free(struct kref *ref)
 553 {
 554         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 555
 556         clean_up_interface_data(intf);
 557         kfree(intf);
 558 }
 559
 560 struct watcher_entry {
 561         int              intf_num;
 562         ipmi_smi_t       intf;
 563         struct list_head link;
 564 };
 565
 566 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 567 {
 568         ipmi_smi_t intf;
 569         LIST_HEAD(to_deliver);
 570         struct watcher_entry *e, *e2;
 571
 572         mutex_lock(&smi_watchers_mutex);
 573
 574         mutex_lock(&ipmi_interfaces_mutex);
 575
 576         /* Build a list of things to deliver. */
 577         list_for_each_entry(intf, &ipmi_interfaces, link) {
 578                 if (intf->intf_num == -1)
 579                         continue;
 580                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 581                 if (!e)
 582                         goto out_err;
 583                 kref_get(&intf->refcount);
 584                 e->intf = intf;
 585                 e->intf_num = intf->intf_num;
 586                 list_add_tail(&e->link, &to_deliver);
 587         }
 588
 589         /* We will succeed, so add it to the list. */
 590         list_add(&watcher->link, &smi_watchers);
 591
 592         mutex_unlock(&ipmi_interfaces_mutex);
 593
 594         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 595                 list_del(&e->link);
 596                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 597                 kref_put(&e->intf->refcount, intf_free);
 598                 kfree(e);
 599         }
 600
 601         mutex_unlock(&smi_watchers_mutex);
 602
 603         return 0;
 604
 605  out_err:
 606         mutex_unlock(&ipmi_interfaces_mutex);
 607         mutex_unlock(&smi_watchers_mutex);
 608         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 609                 list_del(&e->link);
 610                 kref_put(&e->intf->refcount, intf_free);
 611                 kfree(e);
 612         }
 613         return -ENOMEM;
 614 }
 615 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 616
 617 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 618 {
 619         mutex_lock(&smi_watchers_mutex);
 620         list_del(&(watcher->link));
 621         mutex_unlock(&smi_watchers_mutex);
 622         return 0;
 623 }
 624 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 625
 626 /*
 627  * Must be called with smi_watchers_mutex held.
 628  */
 629 static void
 630 call_smi_watchers(int i, struct device *dev)
 631 {
 632         struct ipmi_smi_watcher *w;
 633
 634         list_for_each_entry(w, &smi_watchers, link) {
 635                 if (try_module_get(w->owner)) {
 636                         w->new_smi(i, dev);
 637                         module_put(w->owner);
 638                 }
 639         }
 640 }
 641
 642 static int
 643 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 644 {
 645         if (addr1->addr_type != addr2->addr_type)
 646                 return 0;
 647
 648         if (addr1->channel != addr2->channel)
 649                 return 0;
 650
 651         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 652                 struct ipmi_system_interface_addr *smi_addr1
 653                     = (struct ipmi_system_interface_addr *) addr1;
 654                 struct ipmi_system_interface_addr *smi_addr2
 655                     = (struct ipmi_system_interface_addr *) addr2;
 656                 return (smi_addr1->lun == smi_addr2->lun);
 657         }
 658
 659         if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
 660                 struct ipmi_ipmb_addr *ipmb_addr1
 661                     = (struct ipmi_ipmb_addr *) addr1;
 662                 struct ipmi_ipmb_addr *ipmb_addr2
 663                     = (struct ipmi_ipmb_addr *) addr2;
 664
 665                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 666                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 667         }
 668
 669         if (is_lan_addr(addr1)) {
 670                 struct ipmi_lan_addr *lan_addr1
 671                         = (struct ipmi_lan_addr *) addr1;
 672                 struct ipmi_lan_addr *lan_addr2
 673                     = (struct ipmi_lan_addr *) addr2;
 674
 675                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 676                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 677                         && (lan_addr1->session_handle
 678                             == lan_addr2->session_handle)
 679                         && (lan_addr1->lun == lan_addr2->lun));
 680         }
 681
 682         return 1;
 683 }
 684
 685 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 686 {
 687         if (len < sizeof(struct ipmi_system_interface_addr))
 688                 return -EINVAL;
 689
 690         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 691                 if (addr->channel != IPMI_BMC_CHANNEL)
 692                         return -EINVAL;
 693                 return 0;
 694         }
 695
 696         if ((addr->channel == IPMI_BMC_CHANNEL)
 697             || (addr->channel >= IPMI_MAX_CHANNELS)
 698             || (addr->channel < 0))
 699                 return -EINVAL;
 700
 701         if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
 702                 if (len < sizeof(struct ipmi_ipmb_addr))
 703                         return -EINVAL;
 704                 return 0;
 705         }
 706
 707         if (is_lan_addr(addr)) {
 708                 if (len < sizeof(struct ipmi_lan_addr))
 709                         return -EINVAL;
 710                 return 0;
 711         }
 712
 713         return -EINVAL;
 714 }
 715 EXPORT_SYMBOL(ipmi_validate_addr);
 716
 717 unsigned int ipmi_addr_length(int addr_type)
 718 {
 719         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 720                 return sizeof(struct ipmi_system_interface_addr);
 721
 722         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 723                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 724                 return sizeof(struct ipmi_ipmb_addr);
 725
 726         if (addr_type == IPMI_LAN_ADDR_TYPE)
 727                 return sizeof(struct ipmi_lan_addr);
 728
 729         return 0;
 730 }
 731 EXPORT_SYMBOL(ipmi_addr_length);
 732
 733 static void deliver_response(struct ipmi_recv_msg *msg)
 734 {
 735         if (!msg->user) {
 736                 ipmi_smi_t    intf = msg->user_msg_data;
 737
 738                 /* Special handling for NULL users. */
 739                 if (intf->null_user_handler) {
 740                         intf->null_user_handler(intf, msg);
 741                         ipmi_inc_stat(intf, handled_local_responses);
 742                 } else {
 743                         /* No handler, so give up. */
 744                         ipmi_inc_stat(intf, unhandled_local_responses);
 745                 }
 746                 ipmi_free_recv_msg(msg);
 747         } else if (!oops_in_progress) {
 748                 /*
 749                  * If we are running in the panic context, calling the
 750                  * receive handler doesn't much meaning and has a deadlock
 751                  * risk.  At this moment, simply skip it in that case.
 752                  */
 753
 754                 ipmi_user_t user = msg->user;
 755                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 756         }
 757 }
 758
 759 static void
 760 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 761 {
 762         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 763         msg->msg_data[0] = err;
 764         msg->msg.netfn |= 1; /* Convert to a response. */
 765         msg->msg.data_len = 1;
 766         msg->msg.data = msg->msg_data;
 767         deliver_response(msg);
 768 }
 769
 770 /*
 771  * Find the next sequence number not being used and add the given
 772  * message with the given timeout to the sequence table.  This must be
 773  * called with the interface's seq_lock held.
 774  */
 775 static int intf_next_seq(ipmi_smi_t           intf,
 776                          struct ipmi_recv_msg *recv_msg,
 777                          unsigned long        timeout,
 778                          int                  retries,
 779                          int                  broadcast,
 780                          unsigned char        *seq,
 781                          long                 *seqid)
 782 {
 783         int          rv = 0;
 784         unsigned int i;
 785
 786         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 787                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 788                 if (!intf->seq_table[i].inuse)
 789                         break;
 790         }
 791
 792         if (!intf->seq_table[i].inuse) {
 793                 intf->seq_table[i].recv_msg = recv_msg;
 794
 795                 /*
 796                  * Start with the maximum timeout, when the send response
 797                  * comes in we will start the real timer.
 798                  */
 799                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 800                 intf->seq_table[i].orig_timeout = timeout;
 801                 intf->seq_table[i].retries_left = retries;
 802                 intf->seq_table[i].broadcast = broadcast;
 803                 intf->seq_table[i].inuse = 1;
 804                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 805                 *seq = i;
 806                 *seqid = intf->seq_table[i].seqid;
 807                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 808                 need_waiter(intf);
 809         } else {
 810                 rv = -EAGAIN;
 811         }
 812
 813         return rv;
 814 }
 815
 816 /*
 817  * Return the receive message for the given sequence number and
 818  * release the sequence number so it can be reused.  Some other data
 819  * is passed in to be sure the message matches up correctly (to help
 820  * guard against message coming in after their timeout and the
 821  * sequence number being reused).
 822  */
 823 static int intf_find_seq(ipmi_smi_t           intf,
 824                          unsigned char        seq,
 825                          short                channel,
 826                          unsigned char        cmd,
 827                          unsigned char        netfn,
 828                          struct ipmi_addr     *addr,
 829                          struct ipmi_recv_msg **recv_msg)
 830 {
 831         int           rv = -ENODEV;
 832         unsigned long flags;
 833
 834         if (seq >= IPMI_IPMB_NUM_SEQ)
 835                 return -EINVAL;
 836
 837         spin_lock_irqsave(&(intf->seq_lock), flags);
 838         if (intf->seq_table[seq].inuse) {
 839                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 840
 841                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 842                                 && (msg->msg.netfn == netfn)
 843                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 844                         *recv_msg = msg;
 845                         intf->seq_table[seq].inuse = 0;
 846                         rv = 0;
 847                 }
 848         }
 849         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 850
 851         return rv;
 852 }
 853
 854
 855 /* Start the timer for a specific sequence table entry. */
 856 static int intf_start_seq_timer(ipmi_smi_t intf,
 857                                 long       msgid)
 858 {
 859         int           rv = -ENODEV;
 860         unsigned long flags;
 861         unsigned char seq;
 862         unsigned long seqid;
 863
 864
 865         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 866
 867         spin_lock_irqsave(&(intf->seq_lock), flags);
 868         /*
 869          * We do this verification because the user can be deleted
 870          * while a message is outstanding.
 871          */
 872         if ((intf->seq_table[seq].inuse)
 873                                 && (intf->seq_table[seq].seqid == seqid)) {
 874                 struct seq_table *ent = &(intf->seq_table[seq]);
 875                 ent->timeout = ent->orig_timeout;
 876                 rv = 0;
 877         }
 878         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 879
 880         return rv;
 881 }
 882
 883 /* Got an error for the send message for a specific sequence number. */
 884 static int intf_err_seq(ipmi_smi_t   intf,
 885                         long         msgid,
 886                         unsigned int err)
 887 {
 888         int                  rv = -ENODEV;
 889         unsigned long        flags;
 890         unsigned char        seq;
 891         unsigned long        seqid;
 892         struct ipmi_recv_msg *msg = NULL;
 893
 894
 895         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 896
 897         spin_lock_irqsave(&(intf->seq_lock), flags);
 898         /*
 899          * We do this verification because the user can be deleted
 900          * while a message is outstanding.
 901          */
 902         if ((intf->seq_table[seq].inuse)
 903                                 && (intf->seq_table[seq].seqid == seqid)) {
 904                 struct seq_table *ent = &(intf->seq_table[seq]);
 905
 906                 ent->inuse = 0;
 907                 msg = ent->recv_msg;
 908                 rv = 0;
 909         }
 910         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 911
 912         if (msg)
 913                 deliver_err_response(msg, err);
 914
 915         return rv;
 916 }
 917
 918
 919 int ipmi_create_user(unsigned int          if_num,
 920                      struct ipmi_user_hndl *handler,
 921                      void                  *handler_data,
 922                      ipmi_user_t           *user)
 923 {
 924         unsigned long flags;
 925         ipmi_user_t   new_user;
 926         int           rv = 0;
 927         ipmi_smi_t    intf;
 928
 929         /*
 930          * There is no module usecount here, because it's not
 931          * required.  Since this can only be used by and called from
 932          * other modules, they will implicitly use this module, and
 933          * thus this can't be removed unless the other modules are
 934          * removed.
 935          */
 936
 937         if (handler == NULL)
 938                 return -EINVAL;
 939
 940         /*
 941          * Make sure the driver is actually initialized, this handles
 942          * problems with initialization order.
 943          */
 944         if (!initialized) {
 945                 rv = ipmi_init_msghandler();
 946                 if (rv)
 947                         return rv;
 948
 949                 /*
 950                  * The init code doesn't return an error if it was turned
 951                  * off, but it won't initialize.  Check that.
 952                  */
 953                 if (!initialized)
 954                         return -ENODEV;
 955         }
 956
 957         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 958         if (!new_user)
 959                 return -ENOMEM;
 960
 961         mutex_lock(&ipmi_interfaces_mutex);
 962         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 963                 if (intf->intf_num == if_num)
 964                         goto found;
 965         }
 966         /* Not found, return an error */
 967         rv = -EINVAL;
 968         goto out_kfree;
 969
 970  found:
 971         /* Note that each existing user holds a refcount to the interface. */
 972         kref_get(&intf->refcount);
 973
 974         kref_init(&new_user->refcount);
 975         new_user->handler = handler;
 976         new_user->handler_data = handler_data;
 977         new_user->intf = intf;
 978         new_user->gets_events = false;
 979
 980         if (!try_module_get(intf->handlers->owner)) {
 981                 rv = -ENODEV;
 982                 goto out_kref;
 983         }
 984
 985         if (intf->handlers->inc_usecount) {
 986                 rv = intf->handlers->inc_usecount(intf->send_info);
 987                 if (rv) {
 988                         module_put(intf->handlers->owner);
 989                         goto out_kref;
 990                 }
 991         }
 992
 993         /*
 994          * Hold the lock so intf->handlers is guaranteed to be good
 995          * until now
 996          */
 997         mutex_unlock(&ipmi_interfaces_mutex);
 998
 999         new_user->valid = true;
1000         spin_lock_irqsave(&intf->seq_lock, flags);
1001         list_add_rcu(&new_user->link, &intf->users);
1002         spin_unlock_irqrestore(&intf->seq_lock, flags);
1003         if (handler->ipmi_watchdog_pretimeout) {
1004                 /* User wants pretimeouts, so make sure to watch for them. */
1005                 if (atomic_inc_return(&intf->event_waiters) == 1)
1006                         need_waiter(intf);
1007         }
1008         *user = new_user;
1009         return 0;
1010
1011 out_kref:
1012         kref_put(&intf->refcount, intf_free);
1013 out_kfree:
1014         mutex_unlock(&ipmi_interfaces_mutex);
1015         kfree(new_user);
1016         return rv;
1017 }
1018 EXPORT_SYMBOL(ipmi_create_user);
1019
1020 int ipmi_get_smi_info(int if_num, struct ipmi_smi_info *data)
1021 {
1022         int           rv = 0;
1023         ipmi_smi_t    intf;
1024         const struct ipmi_smi_handlers *handlers;
1025
1026         mutex_lock(&ipmi_interfaces_mutex);
1027         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
1028                 if (intf->intf_num == if_num)
1029                         goto found;
1030         }
1031         /* Not found, return an error */
1032         rv = -EINVAL;
1033         mutex_unlock(&ipmi_interfaces_mutex);
1034         return rv;
1035
1036 found:
1037         handlers = intf->handlers;
1038         rv = -ENOSYS;
1039         if (handlers->get_smi_info)
1040                 rv = handlers->get_smi_info(intf->send_info, data);
1041         mutex_unlock(&ipmi_interfaces_mutex);
1042
1043         return rv;
1044 }
1045 EXPORT_SYMBOL(ipmi_get_smi_info);
1046
1047 static void free_user(struct kref *ref)
1048 {
1049         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
1050         kfree(user);
1051 }
1052
1053 int ipmi_destroy_user(ipmi_user_t user)
1054 {
1055         ipmi_smi_t       intf = user->intf;
1056         int              i;
1057         unsigned long    flags;
1058         struct cmd_rcvr  *rcvr;
1059         struct cmd_rcvr  *rcvrs = NULL;
1060
1061         user->valid = false;
1062
1063         if (user->handler->ipmi_watchdog_pretimeout)
1064                 atomic_dec(&intf->event_waiters);
1065
1066         if (user->gets_events)
1067                 atomic_dec(&intf->event_waiters);
1068
1069         /* Remove the user from the interface's sequence table. */
1070         spin_lock_irqsave(&intf->seq_lock, flags);
1071         list_del_rcu(&user->link);
1072
1073         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
1074                 if (intf->seq_table[i].inuse
1075                     && (intf->seq_table[i].recv_msg->user == user)) {
1076                         intf->seq_table[i].inuse = 0;
1077                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1078                 }
1079         }
1080         spin_unlock_irqrestore(&intf->seq_lock, flags);
1081
1082         /*
1083          * Remove the user from the command receiver's table.  First
1084          * we build a list of everything (not using the standard link,
1085          * since other things may be using it till we do
1086          * synchronize_rcu()) then free everything in that list.
1087          */
1088         mutex_lock(&intf->cmd_rcvrs_mutex);
1089         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1090                 if (rcvr->user == user) {
1091                         list_del_rcu(&rcvr->link);
1092                         rcvr->next = rcvrs;
1093                         rcvrs = rcvr;
1094                 }
1095         }
1096         mutex_unlock(&intf->cmd_rcvrs_mutex);
1097         synchronize_rcu();
1098         while (rcvrs) {
1099                 rcvr = rcvrs;
1100                 rcvrs = rcvr->next;
1101                 kfree(rcvr);
1102         }
1103
1104         mutex_lock(&ipmi_interfaces_mutex);
1105         if (intf->handlers) {
1106                 module_put(intf->handlers->owner);
1107                 if (intf->handlers->dec_usecount)
1108                         intf->handlers->dec_usecount(intf->send_info);
1109         }
1110         mutex_unlock(&ipmi_interfaces_mutex);
1111
1112         kref_put(&intf->refcount, intf_free);
1113
1114         kref_put(&user->refcount, free_user);
1115
1116         return 0;
1117 }
1118 EXPORT_SYMBOL(ipmi_destroy_user);
1119
1120 void ipmi_get_version(ipmi_user_t   user,
1121                       unsigned char *major,
1122                       unsigned char *minor)
1123 {
1124         *major = user->intf->ipmi_version_major;
1125         *minor = user->intf->ipmi_version_minor;
1126 }
1127 EXPORT_SYMBOL(ipmi_get_version);
1128
1129 int ipmi_set_my_address(ipmi_user_t   user,
1130                         unsigned int  channel,
1131                         unsigned char address)
1132 {
1133         if (channel >= IPMI_MAX_CHANNELS)
1134                 return -EINVAL;
1135         user->intf->channels[channel].address = address;
1136         return 0;
1137 }
1138 EXPORT_SYMBOL(ipmi_set_my_address);
1139
1140 int ipmi_get_my_address(ipmi_user_t   user,
1141                         unsigned int  channel,
1142                         unsigned char *address)
1143 {
1144         if (channel >= IPMI_MAX_CHANNELS)
1145                 return -EINVAL;
1146         *address = user->intf->channels[channel].address;
1147         return 0;
1148 }
1149 EXPORT_SYMBOL(ipmi_get_my_address);
1150
1151 int ipmi_set_my_LUN(ipmi_user_t   user,
1152                     unsigned int  channel,
1153                     unsigned char LUN)
1154 {
1155         if (channel >= IPMI_MAX_CHANNELS)
1156                 return -EINVAL;
1157         user->intf->channels[channel].lun = LUN & 0x3;
1158         return 0;
1159 }
1160 EXPORT_SYMBOL(ipmi_set_my_LUN);
1161
1162 int ipmi_get_my_LUN(ipmi_user_t   user,
1163                     unsigned int  channel,
1164                     unsigned char *address)
1165 {
1166         if (channel >= IPMI_MAX_CHANNELS)
1167                 return -EINVAL;
1168         *address = user->intf->channels[channel].lun;
1169         return 0;
1170 }
1171 EXPORT_SYMBOL(ipmi_get_my_LUN);
1172
1173 int ipmi_get_maintenance_mode(ipmi_user_t user)
1174 {
1175         int           mode;
1176         unsigned long flags;
1177
1178         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1179         mode = user->intf->maintenance_mode;
1180         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1181
1182         return mode;
1183 }
1184 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1185
1186 static void maintenance_mode_update(ipmi_smi_t intf)
1187 {
1188         if (intf->handlers->set_maintenance_mode)
1189                 intf->handlers->set_maintenance_mode(
1190                         intf->send_info, intf->maintenance_mode_enable);
1191 }
1192
1193 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1194 {
1195         int           rv = 0;
1196         unsigned long flags;
1197         ipmi_smi_t    intf = user->intf;
1198
1199         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1200         if (intf->maintenance_mode != mode) {
1201                 switch (mode) {
1202                 case IPMI_MAINTENANCE_MODE_AUTO:
1203                         intf->maintenance_mode_enable
1204                                 = (intf->auto_maintenance_timeout > 0);
1205                         break;
1206
1207                 case IPMI_MAINTENANCE_MODE_OFF:
1208                         intf->maintenance_mode_enable = false;
1209                         break;
1210
1211                 case IPMI_MAINTENANCE_MODE_ON:
1212                         intf->maintenance_mode_enable = true;
1213                         break;
1214
1215                 default:
1216                         rv = -EINVAL;
1217                         goto out_unlock;
1218                 }
1219                 intf->maintenance_mode = mode;
1220
1221                 maintenance_mode_update(intf);
1222         }
1223  out_unlock:
1224         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1225
1226         return rv;
1227 }
1228 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1229
1230 int ipmi_set_gets_events(ipmi_user_t user, bool val)
1231 {
1232         unsigned long        flags;
1233         ipmi_smi_t           intf = user->intf;
1234         struct ipmi_recv_msg *msg, *msg2;
1235         struct list_head     msgs;
1236
1237         INIT_LIST_HEAD(&msgs);
1238
1239         spin_lock_irqsave(&intf->events_lock, flags);
1240         if (user->gets_events == val)
1241                 goto out;
1242
1243         user->gets_events = val;
1244
1245         if (val) {
1246                 if (atomic_inc_return(&intf->event_waiters) == 1)
1247                         need_waiter(intf);
1248         } else {
1249                 atomic_dec(&intf->event_waiters);
1250         }
1251
1252         if (intf->delivering_events)
1253                 /*
1254                  * Another thread is delivering events for this, so
1255                  * let it handle any new events.
1256                  */
1257                 goto out;
1258
1259         /* Deliver any queued events. */
1260         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1261                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1262                         list_move_tail(&msg->link, &msgs);
1263                 intf->waiting_events_count = 0;
1264                 if (intf->event_msg_printed) {
1265                         printk(KERN_WARNING PFX "Event queue no longer"
1266                                " full\n");
1267                         intf->event_msg_printed = 0;
1268                 }
1269
1270                 intf->delivering_events = 1;
1271                 spin_unlock_irqrestore(&intf->events_lock, flags);
1272
1273                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1274                         msg->user = user;
1275                         kref_get(&user->refcount);
1276                         deliver_response(msg);
1277                 }
1278
1279                 spin_lock_irqsave(&intf->events_lock, flags);
1280                 intf->delivering_events = 0;
1281         }
1282
1283  out:
1284         spin_unlock_irqrestore(&intf->events_lock, flags);
1285
1286         return 0;
1287 }
1288 EXPORT_SYMBOL(ipmi_set_gets_events);
1289
1290 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1291                                       unsigned char netfn,
1292                                       unsigned char cmd,
1293                                       unsigned char chan)
1294 {
1295         struct cmd_rcvr *rcvr;
1296
1297         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1298                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1299                                         && (rcvr->chans & (1 << chan)))
1300                         return rcvr;
1301         }
1302         return NULL;
1303 }
1304
1305 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1306                                  unsigned char netfn,
1307                                  unsigned char cmd,
1308                                  unsigned int  chans)
1309 {
1310         struct cmd_rcvr *rcvr;
1311
1312         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1313                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1314                                         && (rcvr->chans & chans))
1315                         return 0;
1316         }
1317         return 1;
1318 }
1319
1320 int ipmi_register_for_cmd(ipmi_user_t   user,
1321                           unsigned char netfn,
1322                           unsigned char cmd,
1323                           unsigned int  chans)
1324 {
1325         ipmi_smi_t      intf = user->intf;
1326         struct cmd_rcvr *rcvr;
1327         int             rv = 0;
1328
1329
1330         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1331         if (!rcvr)
1332                 return -ENOMEM;
1333         rcvr->cmd = cmd;
1334         rcvr->netfn = netfn;
1335         rcvr->chans = chans;
1336         rcvr->user = user;
1337
1338         mutex_lock(&intf->cmd_rcvrs_mutex);
1339         /* Make sure the command/netfn is not already registered. */
1340         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1341                 rv = -EBUSY;
1342                 goto out_unlock;
1343         }
1344
1345         if (atomic_inc_return(&intf->event_waiters) == 1)
1346                 need_waiter(intf);
1347
1348         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1349
1350  out_unlock:
1351         mutex_unlock(&intf->cmd_rcvrs_mutex);
1352         if (rv)
1353                 kfree(rcvr);
1354
1355         return rv;
1356 }
1357 EXPORT_SYMBOL(ipmi_register_for_cmd);
1358
1359 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1360                             unsigned char netfn,
1361                             unsigned char cmd,
1362                             unsigned int  chans)
1363 {
1364         ipmi_smi_t      intf = user->intf;
1365         struct cmd_rcvr *rcvr;
1366         struct cmd_rcvr *rcvrs = NULL;
1367         int i, rv = -ENOENT;
1368
1369         mutex_lock(&intf->cmd_rcvrs_mutex);
1370         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1371                 if (((1 << i) & chans) == 0)
1372                         continue;
1373                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1374                 if (rcvr == NULL)
1375                         continue;
1376                 if (rcvr->user == user) {
1377                         rv = 0;
1378                         rcvr->chans &= ~chans;
1379                         if (rcvr->chans == 0) {
1380                                 list_del_rcu(&rcvr->link);
1381                                 rcvr->next = rcvrs;
1382                                 rcvrs = rcvr;
1383                         }
1384                 }
1385         }
1386         mutex_unlock(&intf->cmd_rcvrs_mutex);
1387         synchronize_rcu();
1388         while (rcvrs) {
1389                 atomic_dec(&intf->event_waiters);
1390                 rcvr = rcvrs;
1391                 rcvrs = rcvr->next;
1392                 kfree(rcvr);
1393         }
1394         return rv;
1395 }
1396 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1397
1398 static unsigned char
1399 ipmb_checksum(unsigned char *data, int size)
1400 {
1401         unsigned char csum = 0;
1402
1403         for (; size > 0; size--, data++)
1404                 csum += *data;
1405
1406         return -csum;
1407 }
1408
1409 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1410                                    struct kernel_ipmi_msg *msg,
1411                                    struct ipmi_ipmb_addr *ipmb_addr,
1412                                    long                  msgid,
1413                                    unsigned char         ipmb_seq,
1414                                    int                   broadcast,
1415                                    unsigned char         source_address,
1416                                    unsigned char         source_lun)
1417 {
1418         int i = broadcast;
1419
1420         /* Format the IPMB header data. */
1421         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1422         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1423         smi_msg->data[2] = ipmb_addr->channel;
1424         if (broadcast)
1425                 smi_msg->data[3] = 0;
1426         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1427         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1428         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1429         smi_msg->data[i+6] = source_address;
1430         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1431         smi_msg->data[i+8] = msg->cmd;
1432
1433         /* Now tack on the data to the message. */
1434         if (msg->data_len > 0)
1435                 memcpy(&(smi_msg->data[i+9]), msg->data,
1436                        msg->data_len);
1437         smi_msg->data_size = msg->data_len + 9;
1438
1439         /* Now calculate the checksum and tack it on. */
1440         smi_msg->data[i+smi_msg->data_size]
1441                 = ipmb_checksum(&(smi_msg->data[i+6]),
1442                                 smi_msg->data_size-6);
1443
1444         /*
1445          * Add on the checksum size and the offset from the
1446          * broadcast.
1447          */
1448         smi_msg->data_size += 1 + i;
1449
1450         smi_msg->msgid = msgid;
1451 }
1452
1453 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1454                                   struct kernel_ipmi_msg *msg,
1455                                   struct ipmi_lan_addr  *lan_addr,
1456                                   long                  msgid,
1457                                   unsigned char         ipmb_seq,
1458                                   unsigned char         source_lun)
1459 {
1460         /* Format the IPMB header data. */
1461         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1462         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1463         smi_msg->data[2] = lan_addr->channel;
1464         smi_msg->data[3] = lan_addr->session_handle;
1465         smi_msg->data[4] = lan_addr->remote_SWID;
1466         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1467         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1468         smi_msg->data[7] = lan_addr->local_SWID;
1469         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1470         smi_msg->data[9] = msg->cmd;
1471
1472         /* Now tack on the data to the message. */
1473         if (msg->data_len > 0)
1474                 memcpy(&(smi_msg->data[10]), msg->data,
1475                        msg->data_len);
1476         smi_msg->data_size = msg->data_len + 10;
1477
1478         /* Now calculate the checksum and tack it on. */
1479         smi_msg->data[smi_msg->data_size]
1480                 = ipmb_checksum(&(smi_msg->data[7]),
1481                                 smi_msg->data_size-7);
1482
1483         /*
1484          * Add on the checksum size and the offset from the
1485          * broadcast.
1486          */
1487         smi_msg->data_size += 1;
1488
1489         smi_msg->msgid = msgid;
1490 }
1491
1492 static struct ipmi_smi_msg *smi_add_send_msg(ipmi_smi_t intf,
1493                                              struct ipmi_smi_msg *smi_msg,
1494                                              int priority)
1495 {
1496         if (intf->curr_msg) {
1497                 if (priority > 0)
1498                         list_add_tail(&smi_msg->link, &intf->hp_xmit_msgs);
1499                 else
1500                         list_add_tail(&smi_msg->link, &intf->xmit_msgs);
1501                 smi_msg = NULL;
1502         } else {
1503                 intf->curr_msg = smi_msg;
1504         }
1505
1506         return smi_msg;
1507 }
1508
1509
1510 static void smi_send(ipmi_smi_t intf, const struct ipmi_smi_handlers *handlers,
1511                      struct ipmi_smi_msg *smi_msg, int priority)
1512 {
1513         int run_to_completion = intf->run_to_completion;
1514
1515         if (run_to_completion) {
1516                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1517         } else {
1518                 unsigned long flags;
1519
1520                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1521                 smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1522                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1523         }
1524
1525         if (smi_msg)
1526                 handlers->sender(intf->send_info, smi_msg);
1527 }
1528
1529 /*
1530  * Separate from ipmi_request so that the user does not have to be
1531  * supplied in certain circumstances (mainly at panic time).  If
1532  * messages are supplied, they will be freed, even if an error
1533  * occurs.
1534  */
1535 static int i_ipmi_request(ipmi_user_t          user,
1536                           ipmi_smi_t           intf,
1537                           struct ipmi_addr     *addr,
1538                           long                 msgid,
1539                           struct kernel_ipmi_msg *msg,
1540                           void                 *user_msg_data,
1541                           void                 *supplied_smi,
1542                           struct ipmi_recv_msg *supplied_recv,
1543                           int                  priority,
1544                           unsigned char        source_address,
1545                           unsigned char        source_lun,
1546                           int                  retries,
1547                           unsigned int         retry_time_ms)
1548 {
1549         int                      rv = 0;
1550         struct ipmi_smi_msg      *smi_msg;
1551         struct ipmi_recv_msg     *recv_msg;
1552         unsigned long            flags;
1553
1554
1555         if (supplied_recv)
1556                 recv_msg = supplied_recv;
1557         else {
1558                 recv_msg = ipmi_alloc_recv_msg();
1559                 if (recv_msg == NULL)
1560                         return -ENOMEM;
1561         }
1562         recv_msg->user_msg_data = user_msg_data;
1563
1564         if (supplied_smi)
1565                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1566         else {
1567                 smi_msg = ipmi_alloc_smi_msg();
1568                 if (smi_msg == NULL) {
1569                         ipmi_free_recv_msg(recv_msg);
1570                         return -ENOMEM;
1571                 }
1572         }
1573
1574         rcu_read_lock();
1575         if (intf->in_shutdown) {
1576                 rv = -ENODEV;
1577                 goto out_err;
1578         }
1579
1580         recv_msg->user = user;
1581         if (user)
1582                 kref_get(&user->refcount);
1583         recv_msg->msgid = msgid;
1584         /*
1585          * Store the message to send in the receive message so timeout
1586          * responses can get the proper response data.
1587          */
1588         recv_msg->msg = *msg;
1589
1590         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1591                 struct ipmi_system_interface_addr *smi_addr;
1592
1593                 if (msg->netfn & 1) {
1594                         /* Responses are not allowed to the SMI. */
1595                         rv = -EINVAL;
1596                         goto out_err;
1597                 }
1598
1599                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1600                 if (smi_addr->lun > 3) {
1601                         ipmi_inc_stat(intf, sent_invalid_commands);
1602                         rv = -EINVAL;
1603                         goto out_err;
1604                 }
1605
1606                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1607
1608                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1609                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1610                         || (msg->cmd == IPMI_GET_MSG_CMD)
1611                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1612                         /*
1613                          * We don't let the user do these, since we manage
1614                          * the sequence numbers.
1615                          */
1616                         ipmi_inc_stat(intf, sent_invalid_commands);
1617                         rv = -EINVAL;
1618                         goto out_err;
1619                 }
1620
1621                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1622                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1623                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1624                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1625                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1626                         intf->auto_maintenance_timeout
1627                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1628                         if (!intf->maintenance_mode
1629                             && !intf->maintenance_mode_enable) {
1630                                 intf->maintenance_mode_enable = true;
1631                                 maintenance_mode_update(intf);
1632                         }
1633                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1634                                                flags);
1635                 }
1636
1637                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1638                         ipmi_inc_stat(intf, sent_invalid_commands);
1639                         rv = -EMSGSIZE;
1640                         goto out_err;
1641                 }
1642
1643                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1644                 smi_msg->data[1] = msg->cmd;
1645                 smi_msg->msgid = msgid;
1646                 smi_msg->user_data = recv_msg;
1647                 if (msg->data_len > 0)
1648                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1649                 smi_msg->data_size = msg->data_len + 2;
1650                 ipmi_inc_stat(intf, sent_local_commands);
1651         } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
1652                 struct ipmi_ipmb_addr *ipmb_addr;
1653                 unsigned char         ipmb_seq;
1654                 long                  seqid;
1655                 int                   broadcast = 0;
1656
1657                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1658                         ipmi_inc_stat(intf, sent_invalid_commands);
1659                         rv = -EINVAL;
1660                         goto out_err;
1661                 }
1662
1663                 if (intf->channels[addr->channel].medium
1664                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1665                         ipmi_inc_stat(intf, sent_invalid_commands);
1666                         rv = -EINVAL;
1667                         goto out_err;
1668                 }
1669
1670                 if (retries < 0) {
1671                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1672                         retries = 0; /* Don't retry broadcasts. */
1673                     else
1674                         retries = 4;
1675                 }
1676                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1677                     /*
1678                      * Broadcasts add a zero at the beginning of the
1679                      * message, but otherwise is the same as an IPMB
1680                      * address.
1681                      */
1682                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1683                     broadcast = 1;
1684                 }
1685
1686
1687                 /* Default to 1 second retries. */
1688                 if (retry_time_ms == 0)
1689                     retry_time_ms = 1000;
1690
1691                 /*
1692                  * 9 for the header and 1 for the checksum, plus
1693                  * possibly one for the broadcast.
1694                  */
1695                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1696                         ipmi_inc_stat(intf, sent_invalid_commands);
1697                         rv = -EMSGSIZE;
1698                         goto out_err;
1699                 }
1700
1701                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1702                 if (ipmb_addr->lun > 3) {
1703                         ipmi_inc_stat(intf, sent_invalid_commands);
1704                         rv = -EINVAL;
1705                         goto out_err;
1706                 }
1707
1708                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1709
1710                 if (recv_msg->msg.netfn & 0x1) {
1711                         /*
1712                          * It's a response, so use the user's sequence
1713                          * from msgid.
1714                          */
1715                         ipmi_inc_stat(intf, sent_ipmb_responses);
1716                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1717                                         msgid, broadcast,
1718                                         source_address, source_lun);
1719
1720                         /*
1721                          * Save the receive message so we can use it
1722                          * to deliver the response.
1723                          */
1724                         smi_msg->user_data = recv_msg;
1725                 } else {
1726                         /* It's a command, so get a sequence for it. */
1727
1728                         spin_lock_irqsave(&(intf->seq_lock), flags);
1729
1730                         /*
1731                          * Create a sequence number with a 1 second
1732                          * timeout and 4 retries.
1733                          */
1734                         rv = intf_next_seq(intf,
1735                                            recv_msg,
1736                                            retry_time_ms,
1737                                            retries,
1738                                            broadcast,
1739                                            &ipmb_seq,
1740                                            &seqid);
1741                         if (rv) {
1742                                 /*
1743                                  * We have used up all the sequence numbers,
1744                                  * probably, so abort.
1745                                  */
1746                                 spin_unlock_irqrestore(&(intf->seq_lock),
1747                                                        flags);
1748                                 goto out_err;
1749                         }
1750
1751                         ipmi_inc_stat(intf, sent_ipmb_commands);
1752
1753                         /*
1754                          * Store the sequence number in the message,
1755                          * so that when the send message response
1756                          * comes back we can start the timer.
1757                          */
1758                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1759                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1760                                         ipmb_seq, broadcast,
1761                                         source_address, source_lun);
1762
1763                         /*
1764                          * Copy the message into the recv message data, so we
1765                          * can retransmit it later if necessary.
1766                          */
1767                         memcpy(recv_msg->msg_data, smi_msg->data,
1768                                smi_msg->data_size);
1769                         recv_msg->msg.data = recv_msg->msg_data;
1770                         recv_msg->msg.data_len = smi_msg->data_size;
1771
1772                         /*
1773                          * We don't unlock until here, because we need
1774                          * to copy the completed message into the
1775                          * recv_msg before we release the lock.
1776                          * Otherwise, race conditions may bite us.  I
1777                          * know that's pretty paranoid, but I prefer
1778                          * to be correct.
1779                          */
1780                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1781                 }
1782         } else if (is_lan_addr(addr)) {
1783                 struct ipmi_lan_addr  *lan_addr;
1784                 unsigned char         ipmb_seq;
1785                 long                  seqid;
1786
1787                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1788                         ipmi_inc_stat(intf, sent_invalid_commands);
1789                         rv = -EINVAL;
1790                         goto out_err;
1791                 }
1792
1793                 if ((intf->channels[addr->channel].medium
1794                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1795                     && (intf->channels[addr->channel].medium
1796                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1797                         ipmi_inc_stat(intf, sent_invalid_commands);
1798                         rv = -EINVAL;
1799                         goto out_err;
1800                 }
1801
1802                 retries = 4;
1803
1804                 /* Default to 1 second retries. */
1805                 if (retry_time_ms == 0)
1806                     retry_time_ms = 1000;
1807
1808                 /* 11 for the header and 1 for the checksum. */
1809                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1810                         ipmi_inc_stat(intf, sent_invalid_commands);
1811                         rv = -EMSGSIZE;
1812                         goto out_err;
1813                 }
1814
1815                 lan_addr = (struct ipmi_lan_addr *) addr;
1816                 if (lan_addr->lun > 3) {
1817                         ipmi_inc_stat(intf, sent_invalid_commands);
1818                         rv = -EINVAL;
1819                         goto out_err;
1820                 }
1821
1822                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1823
1824                 if (recv_msg->msg.netfn & 0x1) {
1825                         /*
1826                          * It's a response, so use the user's sequence
1827                          * from msgid.
1828                          */
1829                         ipmi_inc_stat(intf, sent_lan_responses);
1830                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1831                                        msgid, source_lun);
1832
1833                         /*
1834                          * Save the receive message so we can use it
1835                          * to deliver the response.
1836                          */
1837                         smi_msg->user_data = recv_msg;
1838                 } else {
1839                         /* It's a command, so get a sequence for it. */
1840
1841                         spin_lock_irqsave(&(intf->seq_lock), flags);
1842
1843                         /*
1844                          * Create a sequence number with a 1 second
1845                          * timeout and 4 retries.
1846                          */
1847                         rv = intf_next_seq(intf,
1848                                            recv_msg,
1849                                            retry_time_ms,
1850                                            retries,
1851                                            0,
1852                                            &ipmb_seq,
1853                                            &seqid);
1854                         if (rv) {
1855                                 /*
1856                                  * We have used up all the sequence numbers,
1857                                  * probably, so abort.
1858                                  */
1859                                 spin_unlock_irqrestore(&(intf->seq_lock),
1860                                                        flags);
1861                                 goto out_err;
1862                         }
1863
1864                         ipmi_inc_stat(intf, sent_lan_commands);
1865
1866                         /*
1867                          * Store the sequence number in the message,
1868                          * so that when the send message response
1869                          * comes back we can start the timer.
1870                          */
1871                         format_lan_msg(smi_msg, msg, lan_addr,
1872                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1873                                        ipmb_seq, source_lun);
1874
1875                         /*
1876                          * Copy the message into the recv message data, so we
1877                          * can retransmit it later if necessary.
1878                          */
1879                         memcpy(recv_msg->msg_data, smi_msg->data,
1880                                smi_msg->data_size);
1881                         recv_msg->msg.data = recv_msg->msg_data;
1882                         recv_msg->msg.data_len = smi_msg->data_size;
1883
1884                         /*
1885                          * We don't unlock until here, because we need
1886                          * to copy the completed message into the
1887                          * recv_msg before we release the lock.
1888                          * Otherwise, race conditions may bite us.  I
1889                          * know that's pretty paranoid, but I prefer
1890                          * to be correct.
1891                          */
1892                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1893                 }
1894         } else {
1895             /* Unknown address type. */
1896                 ipmi_inc_stat(intf, sent_invalid_commands);
1897                 rv = -EINVAL;
1898                 goto out_err;
1899         }
1900
1901 #ifdef DEBUG_MSGING
1902         {
1903                 int m;
1904                 for (m = 0; m < smi_msg->data_size; m++)
1905                         printk(" %2.2x", smi_msg->data[m]);
1906                 printk("\n");
1907         }
1908 #endif
1909
1910         smi_send(intf, intf->handlers, smi_msg, priority);
1911         rcu_read_unlock();
1912
1913         return 0;
1914
1915  out_err:
1916         rcu_read_unlock();
1917         ipmi_free_smi_msg(smi_msg);
1918         ipmi_free_recv_msg(recv_msg);
1919         return rv;
1920 }
1921
1922 static int check_addr(ipmi_smi_t       intf,
1923                       struct ipmi_addr *addr,
1924                       unsigned char    *saddr,
1925                       unsigned char    *lun)
1926 {
1927         if (addr->channel >= IPMI_MAX_CHANNELS)
1928                 return -EINVAL;
1929         *lun = intf->channels[addr->channel].lun;
1930         *saddr = intf->channels[addr->channel].address;
1931         return 0;
1932 }
1933
1934 int ipmi_request_settime(ipmi_user_t      user,
1935                          struct ipmi_addr *addr,
1936                          long             msgid,
1937                          struct kernel_ipmi_msg  *msg,
1938                          void             *user_msg_data,
1939                          int              priority,
1940                          int              retries,
1941                          unsigned int     retry_time_ms)
1942 {
1943         unsigned char saddr = 0, lun = 0;
1944         int           rv;
1945
1946         if (!user)
1947                 return -EINVAL;
1948         rv = check_addr(user->intf, addr, &saddr, &lun);
1949         if (rv)
1950                 return rv;
1951         return i_ipmi_request(user,
1952                               user->intf,
1953                               addr,
1954                               msgid,
1955                               msg,
1956                               user_msg_data,
1957                               NULL, NULL,
1958                               priority,
1959                               saddr,
1960                               lun,
1961                               retries,
1962                               retry_time_ms);
1963 }
1964 EXPORT_SYMBOL(ipmi_request_settime);
1965
1966 int ipmi_request_supply_msgs(ipmi_user_t          user,
1967                              struct ipmi_addr     *addr,
1968                              long                 msgid,
1969                              struct kernel_ipmi_msg *msg,
1970                              void                 *user_msg_data,
1971                              void                 *supplied_smi,
1972                              struct ipmi_recv_msg *supplied_recv,
1973                              int                  priority)
1974 {
1975         unsigned char saddr = 0, lun = 0;
1976         int           rv;
1977
1978         if (!user)
1979                 return -EINVAL;
1980         rv = check_addr(user->intf, addr, &saddr, &lun);
1981         if (rv)
1982                 return rv;
1983         return i_ipmi_request(user,
1984                               user->intf,
1985                               addr,
1986                               msgid,
1987                               msg,
1988                               user_msg_data,
1989                               supplied_smi,
1990                               supplied_recv,
1991                               priority,
1992                               saddr,
1993                               lun,
1994                               -1, 0);
1995 }
1996 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1997
1998 #ifdef CONFIG_PROC_FS
1999 static int smi_ipmb_proc_show(struct seq_file *m, void *v)
2000 {
2001         ipmi_smi_t intf = m->private;
2002         int        i;
2003
2004         seq_printf(m, "%x", intf->channels[0].address);
2005         for (i = 1; i < IPMI_MAX_CHANNELS; i++)
2006                 seq_printf(m, " %x", intf->channels[i].address);
2007         seq_putc(m, '\n');
2008
2009         return 0;
2010 }
2011
2012 static int smi_ipmb_proc_open(struct inode *inode, struct file *file)
2013 {
2014         return single_open(file, smi_ipmb_proc_show, PDE_DATA(inode));
2015 }
2016
2017 static const struct file_operations smi_ipmb_proc_ops = {
2018         .open           = smi_ipmb_proc_open,
2019         .read           = seq_read,
2020         .llseek         = seq_lseek,
2021         .release        = single_release,
2022 };
2023
2024 static int smi_version_proc_show(struct seq_file *m, void *v)
2025 {
2026         ipmi_smi_t intf = m->private;
2027
2028         seq_printf(m, "%u.%u\n",
2029                    ipmi_version_major(&intf->bmc->id),
2030                    ipmi_version_minor(&intf->bmc->id));
2031
2032         return 0;
2033 }
2034
2035 static int smi_version_proc_open(struct inode *inode, struct file *file)
2036 {
2037         return single_open(file, smi_version_proc_show, PDE_DATA(inode));
2038 }
2039
2040 static const struct file_operations smi_version_proc_ops = {
2041         .open           = smi_version_proc_open,
2042         .read           = seq_read,
2043         .llseek         = seq_lseek,
2044         .release        = single_release,
2045 };
2046
2047 static int smi_stats_proc_show(struct seq_file *m, void *v)
2048 {
2049         ipmi_smi_t intf = m->private;
2050
2051         seq_printf(m, "sent_invalid_commands:       %u\n",
2052                        ipmi_get_stat(intf, sent_invalid_commands));
2053         seq_printf(m, "sent_local_commands:         %u\n",
2054                        ipmi_get_stat(intf, sent_local_commands));
2055         seq_printf(m, "handled_local_responses:     %u\n",
2056                        ipmi_get_stat(intf, handled_local_responses));
2057         seq_printf(m, "unhandled_local_responses:   %u\n",
2058                        ipmi_get_stat(intf, unhandled_local_responses));
2059         seq_printf(m, "sent_ipmb_commands:          %u\n",
2060                        ipmi_get_stat(intf, sent_ipmb_commands));
2061         seq_printf(m, "sent_ipmb_command_errs:      %u\n",
2062                        ipmi_get_stat(intf, sent_ipmb_command_errs));
2063         seq_printf(m, "retransmitted_ipmb_commands: %u\n",
2064                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
2065         seq_printf(m, "timed_out_ipmb_commands:     %u\n",
2066                        ipmi_get_stat(intf, timed_out_ipmb_commands));
2067         seq_printf(m, "timed_out_ipmb_broadcasts:   %u\n",
2068                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
2069         seq_printf(m, "sent_ipmb_responses:         %u\n",
2070                        ipmi_get_stat(intf, sent_ipmb_responses));
2071         seq_printf(m, "handled_ipmb_responses:      %u\n",
2072                        ipmi_get_stat(intf, handled_ipmb_responses));
2073         seq_printf(m, "invalid_ipmb_responses:      %u\n",
2074                        ipmi_get_stat(intf, invalid_ipmb_responses));
2075         seq_printf(m, "unhandled_ipmb_responses:    %u\n",
2076                        ipmi_get_stat(intf, unhandled_ipmb_responses));
2077         seq_printf(m, "sent_lan_commands:           %u\n",
2078                        ipmi_get_stat(intf, sent_lan_commands));
2079         seq_printf(m, "sent_lan_command_errs:       %u\n",
2080                        ipmi_get_stat(intf, sent_lan_command_errs));
2081         seq_printf(m, "retransmitted_lan_commands:  %u\n",
2082                        ipmi_get_stat(intf, retransmitted_lan_commands));
2083         seq_printf(m, "timed_out_lan_commands:      %u\n",
2084                        ipmi_get_stat(intf, timed_out_lan_commands));
2085         seq_printf(m, "sent_lan_responses:          %u\n",
2086                        ipmi_get_stat(intf, sent_lan_responses));
2087         seq_printf(m, "handled_lan_responses:       %u\n",
2088                        ipmi_get_stat(intf, handled_lan_responses));
2089         seq_printf(m, "invalid_lan_responses:       %u\n",
2090                        ipmi_get_stat(intf, invalid_lan_responses));
2091         seq_printf(m, "unhandled_lan_responses:     %u\n",
2092                        ipmi_get_stat(intf, unhandled_lan_responses));
2093         seq_printf(m, "handled_commands:            %u\n",
2094                        ipmi_get_stat(intf, handled_commands));
2095         seq_printf(m, "invalid_commands:            %u\n",
2096                        ipmi_get_stat(intf, invalid_commands));
2097         seq_printf(m, "unhandled_commands:          %u\n",
2098                        ipmi_get_stat(intf, unhandled_commands));
2099         seq_printf(m, "invalid_events:              %u\n",
2100                        ipmi_get_stat(intf, invalid_events));
2101         seq_printf(m, "events:                      %u\n",
2102                        ipmi_get_stat(intf, events));
2103         seq_printf(m, "failed rexmit LAN msgs:      %u\n",
2104                        ipmi_get_stat(intf, dropped_rexmit_lan_commands));
2105         seq_printf(m, "failed rexmit IPMB msgs:     %u\n",
2106                        ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
2107         return 0;
2108 }
2109
2110 static int smi_stats_proc_open(struct inode *inode, struct file *file)
2111 {
2112         return single_open(file, smi_stats_proc_show, PDE_DATA(inode));
2113 }
2114
2115 static const struct file_operations smi_stats_proc_ops = {
2116         .open           = smi_stats_proc_open,
2117         .read           = seq_read,
2118         .llseek         = seq_lseek,
2119         .release        = single_release,
2120 };
2121 #endif /* CONFIG_PROC_FS */
2122
2123 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
2124                             const struct file_operations *proc_ops,
2125                             void *data)
2126 {
2127         int                    rv = 0;
2128 #ifdef CONFIG_PROC_FS
2129         struct proc_dir_entry  *file;
2130         struct ipmi_proc_entry *entry;
2131
2132         /* Create a list element. */
2133         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
2134         if (!entry)
2135                 return -ENOMEM;
2136         entry->name = kstrdup(name, GFP_KERNEL);
2137         if (!entry->name) {
2138                 kfree(entry);
2139                 return -ENOMEM;
2140         }
2141
2142         file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
2143         if (!file) {
2144                 kfree(entry->name);
2145                 kfree(entry);
2146                 rv = -ENOMEM;
2147         } else {
2148                 mutex_lock(&smi->proc_entry_lock);
2149                 /* Stick it on the list. */
2150                 entry->next = smi->proc_entries;
2151                 smi->proc_entries = entry;
2152                 mutex_unlock(&smi->proc_entry_lock);
2153         }
2154 #endif /* CONFIG_PROC_FS */
2155
2156         return rv;
2157 }
2158 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
2159
2160 static int add_proc_entries(ipmi_smi_t smi, int num)
2161 {
2162         int rv = 0;
2163
2164 #ifdef CONFIG_PROC_FS
2165         sprintf(smi->proc_dir_name, "%d", num);
2166         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
2167         if (!smi->proc_dir)
2168                 rv = -ENOMEM;
2169
2170         if (rv == 0)
2171                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2172                                              &smi_stats_proc_ops,
2173                                              smi);
2174
2175         if (rv == 0)
2176                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2177                                              &smi_ipmb_proc_ops,
2178                                              smi);
2179
2180         if (rv == 0)
2181                 rv = ipmi_smi_add_proc_entry(smi, "version",
2182                                              &smi_version_proc_ops,
2183                                              smi);
2184 #endif /* CONFIG_PROC_FS */
2185
2186         return rv;
2187 }
2188
2189 static void remove_proc_entries(ipmi_smi_t smi)
2190 {
2191 #ifdef CONFIG_PROC_FS
2192         struct ipmi_proc_entry *entry;
2193
2194         mutex_lock(&smi->proc_entry_lock);
2195         while (smi->proc_entries) {
2196                 entry = smi->proc_entries;
2197                 smi->proc_entries = entry->next;
2198
2199                 remove_proc_entry(entry->name, smi->proc_dir);
2200                 kfree(entry->name);
2201                 kfree(entry);
2202         }
2203         mutex_unlock(&smi->proc_entry_lock);
2204         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2205 #endif /* CONFIG_PROC_FS */
2206 }
2207
2208 static int __find_bmc_guid(struct device *dev, void *data)
2209 {
2210         unsigned char *id = data;
2211         struct bmc_device *bmc = to_bmc_device(dev);
2212         return memcmp(bmc->guid, id, 16) == 0;
2213 }
2214
2215 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2216                                              unsigned char *guid)
2217 {
2218         struct device *dev;
2219
2220         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2221         if (dev)
2222                 return to_bmc_device(dev);
2223         else
2224                 return NULL;
2225 }
2226
2227 struct prod_dev_id {
2228         unsigned int  product_id;
2229         unsigned char device_id;
2230 };
2231
2232 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2233 {
2234         struct prod_dev_id *id = data;
2235         struct bmc_device *bmc = to_bmc_device(dev);
2236
2237         return (bmc->id.product_id == id->product_id
2238                 && bmc->id.device_id == id->device_id);
2239 }
2240
2241 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2242         struct device_driver *drv,
2243         unsigned int product_id, unsigned char device_id)
2244 {
2245         struct prod_dev_id id = {
2246                 .product_id = product_id,
2247                 .device_id = device_id,
2248         };
2249         struct device *dev;
2250
2251         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2252         if (dev)
2253                 return to_bmc_device(dev);
2254         else
2255                 return NULL;
2256 }
2257
2258 static ssize_t device_id_show(struct device *dev,
2259                               struct device_attribute *attr,
2260                               char *buf)
2261 {
2262         struct bmc_device *bmc = to_bmc_device(dev);
2263
2264         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2265 }
2266 static DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
2267
2268 static ssize_t provides_device_sdrs_show(struct device *dev,
2269                                          struct device_attribute *attr,
2270                                          char *buf)
2271 {
2272         struct bmc_device *bmc = to_bmc_device(dev);
2273
2274         return snprintf(buf, 10, "%u\n",
2275                         (bmc->id.device_revision & 0x80) >> 7);
2276 }
2277 static DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show,
2278                    NULL);
2279
2280 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2281                              char *buf)
2282 {
2283         struct bmc_device *bmc = to_bmc_device(dev);
2284
2285         return snprintf(buf, 20, "%u\n",
2286                         bmc->id.device_revision & 0x0F);
2287 }
2288 static DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
2289
2290 static ssize_t firmware_revision_show(struct device *dev,
2291                                       struct device_attribute *attr,
2292                                       char *buf)
2293 {
2294         struct bmc_device *bmc = to_bmc_device(dev);
2295
2296         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2297                         bmc->id.firmware_revision_2);
2298 }
2299 static DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
2300
2301 static ssize_t ipmi_version_show(struct device *dev,
2302                                  struct device_attribute *attr,
2303                                  char *buf)
2304 {
2305         struct bmc_device *bmc = to_bmc_device(dev);
2306
2307         return snprintf(buf, 20, "%u.%u\n",
2308                         ipmi_version_major(&bmc->id),
2309                         ipmi_version_minor(&bmc->id));
2310 }
2311 static DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
2312
2313 static ssize_t add_dev_support_show(struct device *dev,
2314                                     struct device_attribute *attr,
2315                                     char *buf)
2316 {
2317         struct bmc_device *bmc = to_bmc_device(dev);
2318
2319         return snprintf(buf, 10, "0x%02x\n",
2320                         bmc->id.additional_device_support);
2321 }
2322 static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
2323                    NULL);
2324
2325 static ssize_t manufacturer_id_show(struct device *dev,
2326                                     struct device_attribute *attr,
2327                                     char *buf)
2328 {
2329         struct bmc_device *bmc = to_bmc_device(dev);
2330
2331         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2332 }
2333 static DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
2334
2335 static ssize_t product_id_show(struct device *dev,
2336                                struct device_attribute *attr,
2337                                char *buf)
2338 {
2339         struct bmc_device *bmc = to_bmc_device(dev);
2340
2341         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2342 }
2343 static DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
2344
2345 static ssize_t aux_firmware_rev_show(struct device *dev,
2346                                      struct device_attribute *attr,
2347                                      char *buf)
2348 {
2349         struct bmc_device *bmc = to_bmc_device(dev);
2350
2351         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2352                         bmc->id.aux_firmware_revision[3],
2353                         bmc->id.aux_firmware_revision[2],
2354                         bmc->id.aux_firmware_revision[1],
2355                         bmc->id.aux_firmware_revision[0]);
2356 }
2357 static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
2358
2359 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2360                          char *buf)
2361 {
2362         struct bmc_device *bmc = to_bmc_device(dev);
2363
2364         return snprintf(buf, 100, "%Lx%Lx\n",
2365                         (long long) bmc->guid[0],
2366                         (long long) bmc->guid[8]);
2367 }
2368 static DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
2369
2370 static struct attribute *bmc_dev_attrs[] = {
2371         &dev_attr_device_id.attr,
2372         &dev_attr_provides_device_sdrs.attr,
2373         &dev_attr_revision.attr,
2374         &dev_attr_firmware_revision.attr,
2375         &dev_attr_ipmi_version.attr,
2376         &dev_attr_additional_device_support.attr,
2377         &dev_attr_manufacturer_id.attr,
2378         &dev_attr_product_id.attr,
2379         &dev_attr_aux_firmware_revision.attr,
2380         &dev_attr_guid.attr,
2381         NULL
2382 };
2383
2384 static umode_t bmc_dev_attr_is_visible(struct kobject *kobj,
2385                                        struct attribute *attr, int idx)
2386 {
2387         struct device *dev = kobj_to_dev(kobj);
2388         struct bmc_device *bmc = to_bmc_device(dev);
2389         umode_t mode = attr->mode;
2390
2391         if (attr == &dev_attr_aux_firmware_revision.attr)
2392                 return bmc->id.aux_firmware_revision_set ? mode : 0;
2393         if (attr == &dev_attr_guid.attr)
2394                 return bmc->guid_set ? mode : 0;
2395         return mode;
2396 }
2397
2398 static struct attribute_group bmc_dev_attr_group = {
2399         .attrs          = bmc_dev_attrs,
2400         .is_visible     = bmc_dev_attr_is_visible,
2401 };
2402
2403 static const struct attribute_group *bmc_dev_attr_groups[] = {
2404         &bmc_dev_attr_group,
2405         NULL
2406 };
2407
2408 static struct device_type bmc_device_type = {
2409         .groups         = bmc_dev_attr_groups,
2410 };
2411
2412 static void
2413 release_bmc_device(struct device *dev)
2414 {
2415         kfree(to_bmc_device(dev));
2416 }
2417
2418 static void
2419 cleanup_bmc_device(struct kref *ref)
2420 {
2421         struct bmc_device *bmc = container_of(ref, struct bmc_device, usecount);
2422
2423         platform_device_unregister(&bmc->pdev);
2424 }
2425
2426 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2427 {
2428         struct bmc_device *bmc = intf->bmc;
2429
2430         sysfs_remove_link(&intf->si_dev->kobj, "bmc");
2431         if (intf->my_dev_name) {
2432                 sysfs_remove_link(&bmc->pdev.dev.kobj, intf->my_dev_name);
2433                 kfree(intf->my_dev_name);
2434                 intf->my_dev_name = NULL;
2435         }
2436
2437         mutex_lock(&ipmidriver_mutex);
2438         kref_put(&bmc->usecount, cleanup_bmc_device);
2439         intf->bmc = NULL;
2440         mutex_unlock(&ipmidriver_mutex);
2441 }
2442
2443 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum)
2444 {
2445         int               rv;
2446         struct bmc_device *bmc = intf->bmc;
2447         struct bmc_device *old_bmc;
2448
2449         mutex_lock(&ipmidriver_mutex);
2450
2451         /*
2452          * Try to find if there is an bmc_device struct
2453          * representing the interfaced BMC already
2454          */
2455         if (bmc->guid_set)
2456                 old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
2457         else
2458                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2459                                                     bmc->id.product_id,
2460                                                     bmc->id.device_id);
2461
2462         /*
2463          * If there is already an bmc_device, free the new one,
2464          * otherwise register the new BMC device
2465          */
2466         if (old_bmc) {
2467                 kfree(bmc);
2468                 intf->bmc = old_bmc;
2469                 bmc = old_bmc;
2470
2471                 kref_get(&bmc->usecount);
2472                 mutex_unlock(&ipmidriver_mutex);
2473
2474                 printk(KERN_INFO
2475                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2476                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2477                        bmc->id.manufacturer_id,
2478                        bmc->id.product_id,
2479                        bmc->id.device_id);
2480         } else {
2481                 unsigned char orig_dev_id = bmc->id.device_id;
2482                 int warn_printed = 0;
2483
2484                 snprintf(bmc->name, sizeof(bmc->name),
2485                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2486                 bmc->pdev.name = bmc->name;
2487
2488                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
2489                                                  bmc->id.product_id,
2490                                                  bmc->id.device_id)) {
2491                         if (!warn_printed) {
2492                                 printk(KERN_WARNING PFX
2493                                        "This machine has two different BMCs"
2494                                        " with the same product id and device"
2495                                        " id.  This is an error in the"
2496                                        " firmware, but incrementing the"
2497                                        " device id to work around the problem."
2498                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2499                                        bmc->id.product_id, bmc->id.device_id);
2500                                 warn_printed = 1;
2501                         }
2502                         bmc->id.device_id++; /* Wraps at 255 */
2503                         if (bmc->id.device_id == orig_dev_id) {
2504                                 printk(KERN_ERR PFX
2505                                        "Out of device ids!\n");
2506                                 break;
2507                         }
2508                 }
2509
2510                 bmc->pdev.dev.driver = &ipmidriver.driver;
2511                 bmc->pdev.id = bmc->id.device_id;
2512                 bmc->pdev.dev.release = release_bmc_device;
2513                 bmc->pdev.dev.type = &bmc_device_type;
2514                 kref_init(&bmc->usecount);
2515
2516                 rv = platform_device_register(&bmc->pdev);
2517                 mutex_unlock(&ipmidriver_mutex);
2518                 if (rv) {
2519                         put_device(&bmc->pdev.dev);
2520                         printk(KERN_ERR
2521                                "ipmi_msghandler:"
2522                                " Unable to register bmc device: %d\n",
2523                                rv);
2524                         /*
2525                          * Don't go to out_err, you can only do that if
2526                          * the device is registered already.
2527                          */
2528                         return rv;
2529                 }
2530
2531                 dev_info(intf->si_dev, "Found new BMC (man_id: 0x%6.6x, "
2532                          "prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2533                          bmc->id.manufacturer_id,
2534                          bmc->id.product_id,
2535                          bmc->id.device_id);
2536         }
2537
2538         /*
2539          * create symlink from system interface device to bmc device
2540          * and back.
2541          */
2542         rv = sysfs_create_link(&intf->si_dev->kobj, &bmc->pdev.dev.kobj, "bmc");
2543         if (rv) {
2544                 printk(KERN_ERR
2545                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2546                        rv);
2547                 goto out_err;
2548         }
2549
2550         intf->my_dev_name = kasprintf(GFP_KERNEL, "ipmi%d", ifnum);
2551         if (!intf->my_dev_name) {
2552                 rv = -ENOMEM;
2553                 printk(KERN_ERR
2554                        "ipmi_msghandler: allocate link from BMC: %d\n",
2555                        rv);
2556                 goto out_err;
2557         }
2558
2559         rv = sysfs_create_link(&bmc->pdev.dev.kobj, &intf->si_dev->kobj,
2560                                intf->my_dev_name);
2561         if (rv) {
2562                 kfree(intf->my_dev_name);
2563                 intf->my_dev_name = NULL;
2564                 printk(KERN_ERR
2565                        "ipmi_msghandler:"
2566                        " Unable to create symlink to bmc: %d\n",
2567                        rv);
2568                 goto out_err;
2569         }
2570
2571         return 0;
2572
2573 out_err:
2574         ipmi_bmc_unregister(intf);
2575         return rv;
2576 }
2577
2578 static int
2579 send_guid_cmd(ipmi_smi_t intf, int chan)
2580 {
2581         struct kernel_ipmi_msg            msg;
2582         struct ipmi_system_interface_addr si;
2583
2584         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2585         si.channel = IPMI_BMC_CHANNEL;
2586         si.lun = 0;
2587
2588         msg.netfn = IPMI_NETFN_APP_REQUEST;
2589         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2590         msg.data = NULL;
2591         msg.data_len = 0;
2592         return i_ipmi_request(NULL,
2593                               intf,
2594                               (struct ipmi_addr *) &si,
2595                               0,
2596                               &msg,
2597                               intf,
2598                               NULL,
2599                               NULL,
2600                               0,
2601                               intf->channels[0].address,
2602                               intf->channels[0].lun,
2603                               -1, 0);
2604 }
2605
2606 static void
2607 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2608 {
2609         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2610             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2611             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2612                 /* Not for me */
2613                 return;
2614
2615         if (msg->msg.data[0] != 0) {
2616                 /* Error from getting the GUID, the BMC doesn't have one. */
2617                 intf->bmc->guid_set = 0;
2618                 goto out;
2619         }
2620
2621         if (msg->msg.data_len < 17) {
2622                 intf->bmc->guid_set = 0;
2623                 printk(KERN_WARNING PFX
2624                        "guid_handler: The GUID response from the BMC was too"
2625                        " short, it was %d but should have been 17.  Assuming"
2626                        " GUID is not available.\n",
2627                        msg->msg.data_len);
2628                 goto out;
2629         }
2630
2631         memcpy(intf->bmc->guid, msg->msg.data, 16);
2632         intf->bmc->guid_set = 1;
2633  out:
2634         wake_up(&intf->waitq);
2635 }
2636
2637 static void
2638 get_guid(ipmi_smi_t intf)
2639 {
2640         int rv;
2641
2642         intf->bmc->guid_set = 0x2;
2643         intf->null_user_handler = guid_handler;
2644         rv = send_guid_cmd(intf, 0);
2645         if (rv)
2646                 /* Send failed, no GUID available. */
2647                 intf->bmc->guid_set = 0;
2648         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2649         intf->null_user_handler = NULL;
2650 }
2651
2652 static int
2653 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2654 {
2655         struct kernel_ipmi_msg            msg;
2656         unsigned char                     data[1];
2657         struct ipmi_system_interface_addr si;
2658
2659         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2660         si.channel = IPMI_BMC_CHANNEL;
2661         si.lun = 0;
2662
2663         msg.netfn = IPMI_NETFN_APP_REQUEST;
2664         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2665         msg.data = data;
2666         msg.data_len = 1;
2667         data[0] = chan;
2668         return i_ipmi_request(NULL,
2669                               intf,
2670                               (struct ipmi_addr *) &si,
2671                               0,
2672                               &msg,
2673                               intf,
2674                               NULL,
2675                               NULL,
2676                               0,
2677                               intf->channels[0].address,
2678                               intf->channels[0].lun,
2679                               -1, 0);
2680 }
2681
2682 static void
2683 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2684 {
2685         int rv = 0;
2686         int chan;
2687
2688         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2689             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2690             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2691                 /* It's the one we want */
2692                 if (msg->msg.data[0] != 0) {
2693                         /* Got an error from the channel, just go on. */
2694
2695                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2696                                 /*
2697                                  * If the MC does not support this
2698                                  * command, that is legal.  We just
2699                                  * assume it has one IPMB at channel
2700                                  * zero.
2701                                  */
2702                                 intf->channels[0].medium
2703                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2704                                 intf->channels[0].protocol
2705                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2706
2707                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2708                                 wake_up(&intf->waitq);
2709                                 goto out;
2710                         }
2711                         goto next_channel;
2712                 }
2713                 if (msg->msg.data_len < 4) {
2714                         /* Message not big enough, just go on. */
2715                         goto next_channel;
2716                 }
2717                 chan = intf->curr_channel;
2718                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2719                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2720
2721  next_channel:
2722                 intf->curr_channel++;
2723                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2724                         wake_up(&intf->waitq);
2725                 else
2726                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2727
2728                 if (rv) {
2729                         /* Got an error somehow, just give up. */
2730                         printk(KERN_WARNING PFX
2731                                "Error sending channel information for channel"
2732                                " %d: %d\n", intf->curr_channel, rv);
2733
2734                         intf->curr_channel = IPMI_MAX_CHANNELS;
2735                         wake_up(&intf->waitq);
2736                 }
2737         }
2738  out:
2739         return;
2740 }
2741
2742 static void ipmi_poll(ipmi_smi_t intf)
2743 {
2744         if (intf->handlers->poll)
2745                 intf->handlers->poll(intf->send_info);
2746         /* In case something came in */
2747         handle_new_recv_msgs(intf);
2748 }
2749
2750 void ipmi_poll_interface(ipmi_user_t user)
2751 {
2752         ipmi_poll(user->intf);
2753 }
2754 EXPORT_SYMBOL(ipmi_poll_interface);
2755
2756 int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
2757                       void                     *send_info,
2758                       struct ipmi_device_id    *device_id,
2759                       struct device            *si_dev,
2760                       unsigned char            slave_addr)
2761 {
2762         int              i, j;
2763         int              rv;
2764         ipmi_smi_t       intf;
2765         ipmi_smi_t       tintf;
2766         struct list_head *link;
2767
2768         /*
2769          * Make sure the driver is actually initialized, this handles
2770          * problems with initialization order.
2771          */
2772         if (!initialized) {
2773                 rv = ipmi_init_msghandler();
2774                 if (rv)
2775                         return rv;
2776                 /*
2777                  * The init code doesn't return an error if it was turned
2778                  * off, but it won't initialize.  Check that.
2779                  */
2780                 if (!initialized)
2781                         return -ENODEV;
2782         }
2783
2784         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2785         if (!intf)
2786                 return -ENOMEM;
2787
2788         intf->ipmi_version_major = ipmi_version_major(device_id);
2789         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2790
2791         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2792         if (!intf->bmc) {
2793                 kfree(intf);
2794                 return -ENOMEM;
2795         }
2796         intf->intf_num = -1; /* Mark it invalid for now. */
2797         kref_init(&intf->refcount);
2798         intf->bmc->id = *device_id;
2799         intf->si_dev = si_dev;
2800         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2801                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2802                 intf->channels[j].lun = 2;
2803         }
2804         if (slave_addr != 0)
2805                 intf->channels[0].address = slave_addr;
2806         INIT_LIST_HEAD(&intf->users);
2807         intf->handlers = handlers;
2808         intf->send_info = send_info;
2809         spin_lock_init(&intf->seq_lock);
2810         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2811                 intf->seq_table[j].inuse = 0;
2812                 intf->seq_table[j].seqid = 0;
2813         }
2814         intf->curr_seq = 0;
2815 #ifdef CONFIG_PROC_FS
2816         mutex_init(&intf->proc_entry_lock);
2817 #endif
2818         spin_lock_init(&intf->waiting_rcv_msgs_lock);
2819         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
2820         tasklet_init(&intf->recv_tasklet,
2821                      smi_recv_tasklet,
2822                      (unsigned long) intf);
2823         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
2824         spin_lock_init(&intf->xmit_msgs_lock);
2825         INIT_LIST_HEAD(&intf->xmit_msgs);
2826         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
2827         spin_lock_init(&intf->events_lock);
2828         atomic_set(&intf->event_waiters, 0);
2829         intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2830         INIT_LIST_HEAD(&intf->waiting_events);
2831         intf->waiting_events_count = 0;
2832         mutex_init(&intf->cmd_rcvrs_mutex);
2833         spin_lock_init(&intf->maintenance_mode_lock);
2834         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2835         init_waitqueue_head(&intf->waitq);
2836         for (i = 0; i < IPMI_NUM_STATS; i++)
2837                 atomic_set(&intf->stats[i], 0);
2838
2839         intf->proc_dir = NULL;
2840
2841         mutex_lock(&smi_watchers_mutex);
2842         mutex_lock(&ipmi_interfaces_mutex);
2843         /* Look for a hole in the numbers. */
2844         i = 0;
2845         link = &ipmi_interfaces;
2846         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2847                 if (tintf->intf_num != i) {
2848                         link = &tintf->link;
2849                         break;
2850                 }
2851                 i++;
2852         }
2853         /* Add the new interface in numeric order. */
2854         if (i == 0)
2855                 list_add_rcu(&intf->link, &ipmi_interfaces);
2856         else
2857                 list_add_tail_rcu(&intf->link, link);
2858
2859         rv = handlers->start_processing(send_info, intf);
2860         if (rv)
2861                 goto out;
2862
2863         get_guid(intf);
2864
2865         if ((intf->ipmi_version_major > 1)
2866                         || ((intf->ipmi_version_major == 1)
2867                             && (intf->ipmi_version_minor >= 5))) {
2868                 /*
2869                  * Start scanning the channels to see what is
2870                  * available.
2871                  */
2872                 intf->null_user_handler = channel_handler;
2873                 intf->curr_channel = 0;
2874                 rv = send_channel_info_cmd(intf, 0);
2875                 if (rv) {
2876                         printk(KERN_WARNING PFX
2877                                "Error sending channel information for channel"
2878                                " 0, %d\n", rv);
2879                         goto out;
2880                 }
2881
2882                 /* Wait for the channel info to be read. */
2883                 wait_event(intf->waitq,
2884                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2885                 intf->null_user_handler = NULL;
2886         } else {
2887                 /* Assume a single IPMB channel at zero. */
2888                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2889                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2890                 intf->curr_channel = IPMI_MAX_CHANNELS;
2891         }
2892
2893         if (rv == 0)
2894                 rv = add_proc_entries(intf, i);
2895
2896         rv = ipmi_bmc_register(intf, i);
2897
2898  out:
2899         if (rv) {
2900                 if (intf->proc_dir)
2901                         remove_proc_entries(intf);
2902                 intf->handlers = NULL;
2903                 list_del_rcu(&intf->link);
2904                 mutex_unlock(&ipmi_interfaces_mutex);
2905                 mutex_unlock(&smi_watchers_mutex);
2906                 synchronize_rcu();
2907                 kref_put(&intf->refcount, intf_free);
2908         } else {
2909                 /*
2910                  * Keep memory order straight for RCU readers.  Make
2911                  * sure everything else is committed to memory before
2912                  * setting intf_num to mark the interface valid.
2913                  */
2914                 smp_wmb();
2915                 intf->intf_num = i;
2916                 mutex_unlock(&ipmi_interfaces_mutex);
2917                 /* After this point the interface is legal to use. */
2918                 call_smi_watchers(i, intf->si_dev);
2919                 mutex_unlock(&smi_watchers_mutex);
2920         }
2921
2922         return rv;
2923 }
2924 EXPORT_SYMBOL(ipmi_register_smi);
2925
2926 static void deliver_smi_err_response(ipmi_smi_t intf,
2927                                      struct ipmi_smi_msg *msg,
2928                                      unsigned char err)
2929 {
2930         msg->rsp[0] = msg->data[0] | 4;
2931         msg->rsp[1] = msg->data[1];
2932         msg->rsp[2] = err;
2933         msg->rsp_size = 3;
2934         /* It's an error, so it will never requeue, no need to check return. */
2935         handle_one_recv_msg(intf, msg);
2936 }
2937
2938 static void cleanup_smi_msgs(ipmi_smi_t intf)
2939 {
2940         int              i;
2941         struct seq_table *ent;
2942         struct ipmi_smi_msg *msg;
2943         struct list_head *entry;
2944         struct list_head tmplist;
2945
2946         /* Clear out our transmit queues and hold the messages. */
2947         INIT_LIST_HEAD(&tmplist);
2948         list_splice_tail(&intf->hp_xmit_msgs, &tmplist);
2949         list_splice_tail(&intf->xmit_msgs, &tmplist);
2950
2951         /* Current message first, to preserve order */
2952         while (intf->curr_msg && !list_empty(&intf->waiting_rcv_msgs)) {
2953                 /* Wait for the message to clear out. */
2954                 schedule_timeout(1);
2955         }
2956
2957         /* No need for locks, the interface is down. */
2958
2959         /*
2960          * Return errors for all pending messages in queue and in the
2961          * tables waiting for remote responses.
2962          */
2963         while (!list_empty(&tmplist)) {
2964                 entry = tmplist.next;
2965                 list_del(entry);
2966                 msg = list_entry(entry, struct ipmi_smi_msg, link);
2967                 deliver_smi_err_response(intf, msg, IPMI_ERR_UNSPECIFIED);
2968         }
2969
2970         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2971                 ent = &(intf->seq_table[i]);
2972                 if (!ent->inuse)
2973                         continue;
2974                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2975         }
2976 }
2977
2978 int ipmi_unregister_smi(ipmi_smi_t intf)
2979 {
2980         struct ipmi_smi_watcher *w;
2981         int intf_num = intf->intf_num;
2982         ipmi_user_t user;
2983
2984         ipmi_bmc_unregister(intf);
2985
2986         mutex_lock(&smi_watchers_mutex);
2987         mutex_lock(&ipmi_interfaces_mutex);
2988         intf->intf_num = -1;
2989         intf->in_shutdown = true;
2990         list_del_rcu(&intf->link);
2991         mutex_unlock(&ipmi_interfaces_mutex);
2992         synchronize_rcu();
2993
2994         cleanup_smi_msgs(intf);
2995
2996         /* Clean up the effects of users on the lower-level software. */
2997         mutex_lock(&ipmi_interfaces_mutex);
2998         rcu_read_lock();
2999         list_for_each_entry_rcu(user, &intf->users, link) {
3000                 module_put(intf->handlers->owner);
3001                 if (intf->handlers->dec_usecount)
3002                         intf->handlers->dec_usecount(intf->send_info);
3003         }
3004         rcu_read_unlock();
3005         intf->handlers = NULL;
3006         mutex_unlock(&ipmi_interfaces_mutex);
3007
3008         remove_proc_entries(intf);
3009
3010         /*
3011          * Call all the watcher interfaces to tell them that
3012          * an interface is gone.
3013          */
3014         list_for_each_entry(w, &smi_watchers, link)
3015                 w->smi_gone(intf_num);
3016         mutex_unlock(&smi_watchers_mutex);
3017
3018         kref_put(&intf->refcount, intf_free);
3019         return 0;
3020 }
3021 EXPORT_SYMBOL(ipmi_unregister_smi);
3022
3023 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
3024                                    struct ipmi_smi_msg *msg)
3025 {
3026         struct ipmi_ipmb_addr ipmb_addr;
3027         struct ipmi_recv_msg  *recv_msg;
3028
3029         /*
3030          * This is 11, not 10, because the response must contain a
3031          * completion code.
3032          */
3033         if (msg->rsp_size < 11) {
3034                 /* Message not big enough, just ignore it. */
3035                 ipmi_inc_stat(intf, invalid_ipmb_responses);
3036                 return 0;
3037         }
3038
3039         if (msg->rsp[2] != 0) {
3040                 /* An error getting the response, just ignore it. */
3041                 return 0;
3042         }
3043
3044         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
3045         ipmb_addr.slave_addr = msg->rsp[6];
3046         ipmb_addr.channel = msg->rsp[3] & 0x0f;
3047         ipmb_addr.lun = msg->rsp[7] & 3;
3048
3049         /*
3050          * It's a response from a remote entity.  Look up the sequence
3051          * number and handle the response.
3052          */
3053         if (intf_find_seq(intf,
3054                           msg->rsp[7] >> 2,
3055                           msg->rsp[3] & 0x0f,
3056                           msg->rsp[8],
3057                           (msg->rsp[4] >> 2) & (~1),
3058                           (struct ipmi_addr *) &(ipmb_addr),
3059                           &recv_msg)) {
3060                 /*
3061                  * We were unable to find the sequence number,
3062                  * so just nuke the message.
3063                  */
3064                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
3065                 return 0;
3066         }
3067
3068         memcpy(recv_msg->msg_data,
3069                &(msg->rsp[9]),
3070                msg->rsp_size - 9);
3071         /*
3072          * The other fields matched, so no need to set them, except
3073          * for netfn, which needs to be the response that was
3074          * returned, not the request value.
3075          */
3076         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3077         recv_msg->msg.data = recv_msg->msg_data;
3078         recv_msg->msg.data_len = msg->rsp_size - 10;
3079         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3080         ipmi_inc_stat(intf, handled_ipmb_responses);
3081         deliver_response(recv_msg);
3082
3083         return 0;
3084 }
3085
3086 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
3087                                    struct ipmi_smi_msg *msg)
3088 {
3089         struct cmd_rcvr          *rcvr;
3090         int                      rv = 0;
3091         unsigned char            netfn;
3092         unsigned char            cmd;
3093         unsigned char            chan;
3094         ipmi_user_t              user = NULL;
3095         struct ipmi_ipmb_addr    *ipmb_addr;
3096         struct ipmi_recv_msg     *recv_msg;
3097
3098         if (msg->rsp_size < 10) {
3099                 /* Message not big enough, just ignore it. */
3100                 ipmi_inc_stat(intf, invalid_commands);
3101                 return 0;
3102         }
3103
3104         if (msg->rsp[2] != 0) {
3105                 /* An error getting the response, just ignore it. */
3106                 return 0;
3107         }
3108
3109         netfn = msg->rsp[4] >> 2;
3110         cmd = msg->rsp[8];
3111         chan = msg->rsp[3] & 0xf;
3112
3113         rcu_read_lock();
3114         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3115         if (rcvr) {
3116                 user = rcvr->user;
3117                 kref_get(&user->refcount);
3118         } else
3119                 user = NULL;
3120         rcu_read_unlock();
3121
3122         if (user == NULL) {
3123                 /* We didn't find a user, deliver an error response. */
3124                 ipmi_inc_stat(intf, unhandled_commands);
3125
3126                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3127                 msg->data[1] = IPMI_SEND_MSG_CMD;
3128                 msg->data[2] = msg->rsp[3];
3129                 msg->data[3] = msg->rsp[6];
3130                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3131                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3132                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3133                 /* rqseq/lun */
3134                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3135                 msg->data[8] = msg->rsp[8]; /* cmd */
3136                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3137                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3138                 msg->data_size = 11;
3139
3140 #ifdef DEBUG_MSGING
3141         {
3142                 int m;
3143                 printk("Invalid command:");
3144                 for (m = 0; m < msg->data_size; m++)
3145                         printk(" %2.2x", msg->data[m]);
3146                 printk("\n");
3147         }
3148 #endif
3149                 rcu_read_lock();
3150                 if (!intf->in_shutdown) {
3151                         smi_send(intf, intf->handlers, msg, 0);
3152                         /*
3153                          * We used the message, so return the value
3154                          * that causes it to not be freed or
3155                          * queued.
3156                          */
3157                         rv = -1;
3158                 }
3159                 rcu_read_unlock();
3160         } else {
3161                 /* Deliver the message to the user. */
3162                 ipmi_inc_stat(intf, handled_commands);
3163
3164                 recv_msg = ipmi_alloc_recv_msg();
3165                 if (!recv_msg) {
3166                         /*
3167                          * We couldn't allocate memory for the
3168                          * message, so requeue it for handling
3169                          * later.
3170                          */
3171                         rv = 1;
3172                         kref_put(&user->refcount, free_user);
3173                 } else {
3174                         /* Extract the source address from the data. */
3175                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3176                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3177                         ipmb_addr->slave_addr = msg->rsp[6];
3178                         ipmb_addr->lun = msg->rsp[7] & 3;
3179                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3180
3181                         /*
3182                          * Extract the rest of the message information
3183                          * from the IPMB header.
3184                          */
3185                         recv_msg->user = user;
3186                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3187                         recv_msg->msgid = msg->rsp[7] >> 2;
3188                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3189                         recv_msg->msg.cmd = msg->rsp[8];
3190                         recv_msg->msg.data = recv_msg->msg_data;
3191
3192                         /*
3193                          * We chop off 10, not 9 bytes because the checksum
3194                          * at the end also needs to be removed.
3195                          */
3196                         recv_msg->msg.data_len = msg->rsp_size - 10;
3197                         memcpy(recv_msg->msg_data,
3198                                &(msg->rsp[9]),
3199                                msg->rsp_size - 10);
3200                         deliver_response(recv_msg);
3201                 }
3202         }
3203
3204         return rv;
3205 }
3206
3207 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3208                                   struct ipmi_smi_msg *msg)
3209 {
3210         struct ipmi_lan_addr  lan_addr;
3211         struct ipmi_recv_msg  *recv_msg;
3212
3213
3214         /*
3215          * This is 13, not 12, because the response must contain a
3216          * completion code.
3217          */
3218         if (msg->rsp_size < 13) {
3219                 /* Message not big enough, just ignore it. */
3220                 ipmi_inc_stat(intf, invalid_lan_responses);
3221                 return 0;
3222         }
3223
3224         if (msg->rsp[2] != 0) {
3225                 /* An error getting the response, just ignore it. */
3226                 return 0;
3227         }
3228
3229         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3230         lan_addr.session_handle = msg->rsp[4];
3231         lan_addr.remote_SWID = msg->rsp[8];
3232         lan_addr.local_SWID = msg->rsp[5];
3233         lan_addr.channel = msg->rsp[3] & 0x0f;
3234         lan_addr.privilege = msg->rsp[3] >> 4;
3235         lan_addr.lun = msg->rsp[9] & 3;
3236
3237         /*
3238          * It's a response from a remote entity.  Look up the sequence
3239          * number and handle the response.
3240          */
3241         if (intf_find_seq(intf,
3242                           msg->rsp[9] >> 2,
3243                           msg->rsp[3] & 0x0f,
3244                           msg->rsp[10],
3245                           (msg->rsp[6] >> 2) & (~1),
3246                           (struct ipmi_addr *) &(lan_addr),
3247                           &recv_msg)) {
3248                 /*
3249                  * We were unable to find the sequence number,
3250                  * so just nuke the message.
3251                  */
3252                 ipmi_inc_stat(intf, unhandled_lan_responses);
3253                 return 0;
3254         }
3255
3256         memcpy(recv_msg->msg_data,
3257                &(msg->rsp[11]),
3258                msg->rsp_size - 11);
3259         /*
3260          * The other fields matched, so no need to set them, except
3261          * for netfn, which needs to be the response that was
3262          * returned, not the request value.
3263          */
3264         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3265         recv_msg->msg.data = recv_msg->msg_data;
3266         recv_msg->msg.data_len = msg->rsp_size - 12;
3267         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3268         ipmi_inc_stat(intf, handled_lan_responses);
3269         deliver_response(recv_msg);
3270
3271         return 0;
3272 }
3273
3274 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3275                                   struct ipmi_smi_msg *msg)
3276 {
3277         struct cmd_rcvr          *rcvr;
3278         int                      rv = 0;
3279         unsigned char            netfn;
3280         unsigned char            cmd;
3281         unsigned char            chan;
3282         ipmi_user_t              user = NULL;
3283         struct ipmi_lan_addr     *lan_addr;
3284         struct ipmi_recv_msg     *recv_msg;
3285
3286         if (msg->rsp_size < 12) {
3287                 /* Message not big enough, just ignore it. */
3288                 ipmi_inc_stat(intf, invalid_commands);
3289                 return 0;
3290         }
3291
3292         if (msg->rsp[2] != 0) {
3293                 /* An error getting the response, just ignore it. */
3294                 return 0;
3295         }
3296
3297         netfn = msg->rsp[6] >> 2;
3298         cmd = msg->rsp[10];
3299         chan = msg->rsp[3] & 0xf;
3300
3301         rcu_read_lock();
3302         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3303         if (rcvr) {
3304                 user = rcvr->user;
3305                 kref_get(&user->refcount);
3306         } else
3307                 user = NULL;
3308         rcu_read_unlock();
3309
3310         if (user == NULL) {
3311                 /* We didn't find a user, just give up. */
3312                 ipmi_inc_stat(intf, unhandled_commands);
3313
3314                 /*
3315                  * Don't do anything with these messages, just allow
3316                  * them to be freed.
3317                  */
3318                 rv = 0;
3319         } else {
3320                 /* Deliver the message to the user. */
3321                 ipmi_inc_stat(intf, handled_commands);
3322
3323                 recv_msg = ipmi_alloc_recv_msg();
3324                 if (!recv_msg) {
3325                         /*
3326                          * We couldn't allocate memory for the
3327                          * message, so requeue it for handling later.
3328                          */
3329                         rv = 1;
3330                         kref_put(&user->refcount, free_user);
3331                 } else {
3332                         /* Extract the source address from the data. */
3333                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3334                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3335                         lan_addr->session_handle = msg->rsp[4];
3336                         lan_addr->remote_SWID = msg->rsp[8];
3337                         lan_addr->local_SWID = msg->rsp[5];
3338                         lan_addr->lun = msg->rsp[9] & 3;
3339                         lan_addr->channel = msg->rsp[3] & 0xf;
3340                         lan_addr->privilege = msg->rsp[3] >> 4;
3341
3342                         /*
3343                          * Extract the rest of the message information
3344                          * from the IPMB header.
3345                          */
3346                         recv_msg->user = user;
3347                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3348                         recv_msg->msgid = msg->rsp[9] >> 2;
3349                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3350                         recv_msg->msg.cmd = msg->rsp[10];
3351                         recv_msg->msg.data = recv_msg->msg_data;
3352
3353                         /*
3354                          * We chop off 12, not 11 bytes because the checksum
3355                          * at the end also needs to be removed.
3356                          */
3357                         recv_msg->msg.data_len = msg->rsp_size - 12;
3358                         memcpy(recv_msg->msg_data,
3359                                &(msg->rsp[11]),
3360                                msg->rsp_size - 12);
3361                         deliver_response(recv_msg);
3362                 }
3363         }
3364
3365         return rv;
3366 }
3367
3368 /*
3369  * This routine will handle "Get Message" command responses with
3370  * channels that use an OEM Medium. The message format belongs to
3371  * the OEM.  See IPMI 2.0 specification, Chapter 6 and
3372  * Chapter 22, sections 22.6 and 22.24 for more details.
3373  */
3374 static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
3375                                   struct ipmi_smi_msg *msg)
3376 {
3377         struct cmd_rcvr       *rcvr;
3378         int                   rv = 0;
3379         unsigned char         netfn;
3380         unsigned char         cmd;
3381         unsigned char         chan;
3382         ipmi_user_t           user = NULL;
3383         struct ipmi_system_interface_addr *smi_addr;
3384         struct ipmi_recv_msg  *recv_msg;
3385
3386         /*
3387          * We expect the OEM SW to perform error checking
3388          * so we just do some basic sanity checks
3389          */
3390         if (msg->rsp_size < 4) {
3391                 /* Message not big enough, just ignore it. */
3392                 ipmi_inc_stat(intf, invalid_commands);
3393                 return 0;
3394         }
3395
3396         if (msg->rsp[2] != 0) {
3397                 /* An error getting the response, just ignore it. */
3398                 return 0;
3399         }
3400
3401         /*
3402          * This is an OEM Message so the OEM needs to know how
3403          * handle the message. We do no interpretation.
3404          */
3405         netfn = msg->rsp[0] >> 2;
3406         cmd = msg->rsp[1];
3407         chan = msg->rsp[3] & 0xf;
3408
3409         rcu_read_lock();
3410         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3411         if (rcvr) {
3412                 user = rcvr->user;
3413                 kref_get(&user->refcount);
3414         } else
3415                 user = NULL;
3416         rcu_read_unlock();
3417
3418         if (user == NULL) {
3419                 /* We didn't find a user, just give up. */
3420                 ipmi_inc_stat(intf, unhandled_commands);
3421
3422                 /*
3423                  * Don't do anything with these messages, just allow
3424                  * them to be freed.
3425                  */
3426
3427                 rv = 0;
3428         } else {
3429                 /* Deliver the message to the user. */
3430                 ipmi_inc_stat(intf, handled_commands);
3431
3432                 recv_msg = ipmi_alloc_recv_msg();
3433                 if (!recv_msg) {
3434                         /*
3435                          * We couldn't allocate memory for the
3436                          * message, so requeue it for handling
3437                          * later.
3438                          */
3439                         rv = 1;
3440                         kref_put(&user->refcount, free_user);
3441                 } else {
3442                         /*
3443                          * OEM Messages are expected to be delivered via
3444                          * the system interface to SMS software.  We might
3445                          * need to visit this again depending on OEM
3446                          * requirements
3447                          */
3448                         smi_addr = ((struct ipmi_system_interface_addr *)
3449                                     &(recv_msg->addr));
3450                         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3451                         smi_addr->channel = IPMI_BMC_CHANNEL;
3452                         smi_addr->lun = msg->rsp[0] & 3;
3453
3454                         recv_msg->user = user;
3455                         recv_msg->user_msg_data = NULL;
3456                         recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
3457                         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3458                         recv_msg->msg.cmd = msg->rsp[1];
3459                         recv_msg->msg.data = recv_msg->msg_data;
3460
3461                         /*
3462                          * The message starts at byte 4 which follows the
3463                          * the Channel Byte in the "GET MESSAGE" command
3464                          */
3465                         recv_msg->msg.data_len = msg->rsp_size - 4;
3466                         memcpy(recv_msg->msg_data,
3467                                &(msg->rsp[4]),
3468                                msg->rsp_size - 4);
3469                         deliver_response(recv_msg);
3470                 }
3471         }
3472
3473         return rv;
3474 }
3475
3476 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3477                                      struct ipmi_smi_msg  *msg)
3478 {
3479         struct ipmi_system_interface_addr *smi_addr;
3480
3481         recv_msg->msgid = 0;
3482         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3483         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3484         smi_addr->channel = IPMI_BMC_CHANNEL;
3485         smi_addr->lun = msg->rsp[0] & 3;
3486         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3487         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3488         recv_msg->msg.cmd = msg->rsp[1];
3489         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3490         recv_msg->msg.data = recv_msg->msg_data;
3491         recv_msg->msg.data_len = msg->rsp_size - 3;
3492 }
3493
3494 static int handle_read_event_rsp(ipmi_smi_t          intf,
3495                                  struct ipmi_smi_msg *msg)
3496 {
3497         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3498         struct list_head     msgs;
3499         ipmi_user_t          user;
3500         int                  rv = 0;
3501         int                  deliver_count = 0;
3502         unsigned long        flags;
3503
3504         if (msg->rsp_size < 19) {
3505                 /* Message is too small to be an IPMB event. */
3506                 ipmi_inc_stat(intf, invalid_events);
3507                 return 0;
3508         }
3509
3510         if (msg->rsp[2] != 0) {
3511                 /* An error getting the event, just ignore it. */
3512                 return 0;
3513         }
3514
3515         INIT_LIST_HEAD(&msgs);
3516
3517         spin_lock_irqsave(&intf->events_lock, flags);
3518
3519         ipmi_inc_stat(intf, events);
3520
3521         /*
3522          * Allocate and fill in one message for every user that is
3523          * getting events.
3524          */
3525         rcu_read_lock();
3526         list_for_each_entry_rcu(user, &intf->users, link) {
3527                 if (!user->gets_events)
3528                         continue;
3529
3530                 recv_msg = ipmi_alloc_recv_msg();
3531                 if (!recv_msg) {
3532                         rcu_read_unlock();
3533                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3534                                                  link) {
3535                                 list_del(&recv_msg->link);
3536                                 ipmi_free_recv_msg(recv_msg);
3537                         }
3538                         /*
3539                          * We couldn't allocate memory for the
3540                          * message, so requeue it for handling
3541                          * later.
3542                          */
3543                         rv = 1;
3544                         goto out;
3545                 }
3546
3547                 deliver_count++;
3548
3549                 copy_event_into_recv_msg(recv_msg, msg);
3550                 recv_msg->user = user;
3551                 kref_get(&user->refcount);
3552                 list_add_tail(&(recv_msg->link), &msgs);
3553         }
3554         rcu_read_unlock();
3555
3556         if (deliver_count) {
3557                 /* Now deliver all the messages. */
3558                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3559                         list_del(&recv_msg->link);
3560                         deliver_response(recv_msg);
3561                 }
3562         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3563                 /*
3564                  * No one to receive the message, put it in queue if there's
3565                  * not already too many things in the queue.
3566                  */
3567                 recv_msg = ipmi_alloc_recv_msg();
3568                 if (!recv_msg) {
3569                         /*
3570                          * We couldn't allocate memory for the
3571                          * message, so requeue it for handling
3572                          * later.
3573                          */
3574                         rv = 1;
3575                         goto out;
3576                 }
3577
3578                 copy_event_into_recv_msg(recv_msg, msg);
3579                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3580                 intf->waiting_events_count++;
3581         } else if (!intf->event_msg_printed) {
3582                 /*
3583                  * There's too many things in the queue, discard this
3584                  * message.
3585                  */
3586                 printk(KERN_WARNING PFX "Event queue full, discarding"
3587                        " incoming events\n");
3588                 intf->event_msg_printed = 1;
3589         }
3590
3591  out:
3592         spin_unlock_irqrestore(&(intf->events_lock), flags);
3593
3594         return rv;
3595 }
3596
3597 static int handle_bmc_rsp(ipmi_smi_t          intf,
3598                           struct ipmi_smi_msg *msg)
3599 {
3600         struct ipmi_recv_msg *recv_msg;
3601         struct ipmi_user     *user;
3602
3603         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3604         if (recv_msg == NULL) {
3605                 printk(KERN_WARNING
3606                        "IPMI message received with no owner. This\n"
3607                        "could be because of a malformed message, or\n"
3608                        "because of a hardware error.  Contact your\n"
3609                        "hardware vender for assistance\n");
3610                 return 0;
3611         }
3612
3613         user = recv_msg->user;
3614         /* Make sure the user still exists. */
3615         if (user && !user->valid) {
3616                 /* The user for the message went away, so give up. */
3617                 ipmi_inc_stat(intf, unhandled_local_responses);
3618                 ipmi_free_recv_msg(recv_msg);
3619         } else {
3620                 struct ipmi_system_interface_addr *smi_addr;
3621
3622                 ipmi_inc_stat(intf, handled_local_responses);
3623                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3624                 recv_msg->msgid = msg->msgid;
3625                 smi_addr = ((struct ipmi_system_interface_addr *)
3626                             &(recv_msg->addr));
3627                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3628                 smi_addr->channel = IPMI_BMC_CHANNEL;
3629                 smi_addr->lun = msg->rsp[0] & 3;
3630                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3631                 recv_msg->msg.cmd = msg->rsp[1];
3632                 memcpy(recv_msg->msg_data,
3633                        &(msg->rsp[2]),
3634                        msg->rsp_size - 2);
3635                 recv_msg->msg.data = recv_msg->msg_data;
3636                 recv_msg->msg.data_len = msg->rsp_size - 2;
3637                 deliver_response(recv_msg);
3638         }
3639
3640         return 0;
3641 }
3642
3643 /*
3644  * Handle a received message.  Return 1 if the message should be requeued,
3645  * 0 if the message should be freed, or -1 if the message should not
3646  * be freed or requeued.
3647  */
3648 static int handle_one_recv_msg(ipmi_smi_t          intf,
3649                                struct ipmi_smi_msg *msg)
3650 {
3651         int requeue;
3652         int chan;
3653
3654 #ifdef DEBUG_MSGING
3655         int m;
3656         printk("Recv:");
3657         for (m = 0; m < msg->rsp_size; m++)
3658                 printk(" %2.2x", msg->rsp[m]);
3659         printk("\n");
3660 #endif
3661         if (msg->rsp_size < 2) {
3662                 /* Message is too small to be correct. */
3663                 printk(KERN_WARNING PFX "BMC returned to small a message"
3664                        " for netfn %x cmd %x, got %d bytes\n",
3665                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3666
3667                 /* Generate an error response for the message. */
3668                 msg->rsp[0] = msg->data[0] | (1 << 2);
3669                 msg->rsp[1] = msg->data[1];
3670                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3671                 msg->rsp_size = 3;
3672         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3673                    || (msg->rsp[1] != msg->data[1])) {
3674                 /*
3675                  * The NetFN and Command in the response is not even
3676                  * marginally correct.
3677                  */
3678                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3679                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3680                        (msg->data[0] >> 2) | 1, msg->data[1],
3681                        msg->rsp[0] >> 2, msg->rsp[1]);
3682
3683                 /* Generate an error response for the message. */
3684                 msg->rsp[0] = msg->data[0] | (1 << 2);
3685                 msg->rsp[1] = msg->data[1];
3686                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3687                 msg->rsp_size = 3;
3688         }
3689
3690         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3691             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3692             && (msg->user_data != NULL)) {
3693                 /*
3694                  * It's a response to a response we sent.  For this we
3695                  * deliver a send message response to the user.
3696                  */
3697                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3698
3699                 requeue = 0;
3700                 if (msg->rsp_size < 2)
3701                         /* Message is too small to be correct. */
3702                         goto out;
3703
3704                 chan = msg->data[2] & 0x0f;
3705                 if (chan >= IPMI_MAX_CHANNELS)
3706                         /* Invalid channel number */
3707                         goto out;
3708
3709                 if (!recv_msg)
3710                         goto out;
3711
3712                 /* Make sure the user still exists. */
3713                 if (!recv_msg->user || !recv_msg->user->valid)
3714                         goto out;
3715
3716                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3717                 recv_msg->msg.data = recv_msg->msg_data;
3718                 recv_msg->msg.data_len = 1;
3719                 recv_msg->msg_data[0] = msg->rsp[2];
3720                 deliver_response(recv_msg);
3721         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3722                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3723                 /* It's from the receive queue. */
3724                 chan = msg->rsp[3] & 0xf;
3725                 if (chan >= IPMI_MAX_CHANNELS) {
3726                         /* Invalid channel number */
3727                         requeue = 0;
3728                         goto out;
3729                 }
3730
3731                 /*
3732                  * We need to make sure the channels have been initialized.
3733                  * The channel_handler routine will set the "curr_channel"
3734                  * equal to or greater than IPMI_MAX_CHANNELS when all the
3735                  * channels for this interface have been initialized.
3736                  */
3737                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
3738                         requeue = 0; /* Throw the message away */
3739                         goto out;
3740                 }
3741
3742                 switch (intf->channels[chan].medium) {
3743                 case IPMI_CHANNEL_MEDIUM_IPMB:
3744                         if (msg->rsp[4] & 0x04) {
3745                                 /*
3746                                  * It's a response, so find the
3747                                  * requesting message and send it up.
3748                                  */
3749                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3750                         } else {
3751                                 /*
3752                                  * It's a command to the SMS from some other
3753                                  * entity.  Handle that.
3754                                  */
3755                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3756                         }
3757                         break;
3758
3759                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3760                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3761                         if (msg->rsp[6] & 0x04) {
3762                                 /*
3763                                  * It's a response, so find the
3764                                  * requesting message and send it up.
3765                                  */
3766                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3767                         } else {
3768                                 /*
3769                                  * It's a command to the SMS from some other
3770                                  * entity.  Handle that.
3771                                  */
3772                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3773                         }
3774                         break;
3775
3776                 default:
3777                         /* Check for OEM Channels.  Clients had better
3778                            register for these commands. */
3779                         if ((intf->channels[chan].medium
3780                              >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
3781                             && (intf->channels[chan].medium
3782                                 <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
3783                                 requeue = handle_oem_get_msg_cmd(intf, msg);
3784                         } else {
3785                                 /*
3786                                  * We don't handle the channel type, so just
3787                                  * free the message.
3788                                  */
3789                                 requeue = 0;
3790                         }
3791                 }
3792
3793         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3794                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3795                 /* It's an asynchronous event. */
3796                 requeue = handle_read_event_rsp(intf, msg);
3797         } else {
3798                 /* It's a response from the local BMC. */
3799                 requeue = handle_bmc_rsp(intf, msg);
3800         }
3801
3802  out:
3803         return requeue;
3804 }
3805
3806 /*
3807  * If there are messages in the queue or pretimeouts, handle them.
3808  */
3809 static void handle_new_recv_msgs(ipmi_smi_t intf)
3810 {
3811         struct ipmi_smi_msg  *smi_msg;
3812         unsigned long        flags = 0;
3813         int                  rv;
3814         int                  run_to_completion = intf->run_to_completion;
3815
3816         /* See if any waiting messages need to be processed. */
3817         if (!run_to_completion)
3818                 spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3819         while (!list_empty(&intf->waiting_rcv_msgs)) {
3820                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
3821                                      struct ipmi_smi_msg, link);
3822                 list_del(&smi_msg->link);
3823                 if (!run_to_completion)
3824                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3825                                                flags);
3826                 rv = handle_one_recv_msg(intf, smi_msg);
3827                 if (!run_to_completion)
3828                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3829                 if (rv > 0) {
3830                         /*
3831                          * To preserve message order, quit if we
3832                          * can't handle a message.  Add the message
3833                          * back at the head, this is safe because this
3834                          * tasklet is the only thing that pulls the
3835                          * messages.
3836                          */
3837                         list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
3838                         break;
3839                 } else {
3840                         if (rv == 0)
3841                                 /* Message handled */
3842                                 ipmi_free_smi_msg(smi_msg);
3843                         /* If rv < 0, fatal error, del but don't free. */
3844                 }
3845         }
3846         if (!run_to_completion)
3847                 spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, flags);
3848
3849         /*
3850          * If the pretimout count is non-zero, decrement one from it and
3851          * deliver pretimeouts to all the users.
3852          */
3853         if (atomic_add_unless(&intf->watchdog_pretimeouts_to_deliver, -1, 0)) {
3854                 ipmi_user_t user;
3855
3856                 rcu_read_lock();
3857                 list_for_each_entry_rcu(user, &intf->users, link) {
3858                         if (user->handler->ipmi_watchdog_pretimeout)
3859                                 user->handler->ipmi_watchdog_pretimeout(
3860                                         user->handler_data);
3861                 }
3862                 rcu_read_unlock();
3863         }
3864 }
3865
3866 static void smi_recv_tasklet(unsigned long val)
3867 {
3868         unsigned long flags = 0; /* keep us warning-free. */
3869         ipmi_smi_t intf = (ipmi_smi_t) val;
3870         int run_to_completion = intf->run_to_completion;
3871         struct ipmi_smi_msg *newmsg = NULL;
3872
3873         /*
3874          * Start the next message if available.
3875          *
3876          * Do this here, not in the actual receiver, because we may deadlock
3877          * because the lower layer is allowed to hold locks while calling
3878          * message delivery.
3879          */
3880         if (!run_to_completion)
3881                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3882         if (intf->curr_msg == NULL && !intf->in_shutdown) {
3883                 struct list_head *entry = NULL;
3884
3885                 /* Pick the high priority queue first. */
3886                 if (!list_empty(&intf->hp_xmit_msgs))
3887                         entry = intf->hp_xmit_msgs.next;
3888                 else if (!list_empty(&intf->xmit_msgs))
3889                         entry = intf->xmit_msgs.next;
3890
3891                 if (entry) {
3892                         list_del(entry);
3893                         newmsg = list_entry(entry, struct ipmi_smi_msg, link);
3894                         intf->curr_msg = newmsg;
3895                 }
3896         }
3897         if (!run_to_completion)
3898                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3899         if (newmsg)
3900                 intf->handlers->sender(intf->send_info, newmsg);
3901
3902         handle_new_recv_msgs(intf);
3903 }
3904
3905 /* Handle a new message from the lower layer. */
3906 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3907                            struct ipmi_smi_msg *msg)
3908 {
3909         unsigned long flags = 0; /* keep us warning-free. */
3910         int run_to_completion = intf->run_to_completion;
3911
3912         if ((msg->data_size >= 2)
3913             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3914             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3915             && (msg->user_data == NULL)) {
3916
3917                 if (intf->in_shutdown)
3918                         goto free_msg;
3919
3920                 /*
3921                  * This is the local response to a command send, start
3922                  * the timer for these.  The user_data will not be
3923                  * NULL if this is a response send, and we will let
3924                  * response sends just go through.
3925                  */
3926
3927                 /*
3928                  * Check for errors, if we get certain errors (ones
3929                  * that mean basically we can try again later), we
3930                  * ignore them and start the timer.  Otherwise we
3931                  * report the error immediately.
3932                  */
3933                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3934                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3935                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3936                     && (msg->rsp[2] != IPMI_BUS_ERR)
3937                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3938                         int chan = msg->rsp[3] & 0xf;
3939
3940                         /* Got an error sending the message, handle it. */
3941                         if (chan >= IPMI_MAX_CHANNELS)
3942                                 ; /* This shouldn't happen */
3943                         else if ((intf->channels[chan].medium
3944                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3945                                  || (intf->channels[chan].medium
3946                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3947                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3948                         else
3949                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3950                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3951                 } else
3952                         /* The message was sent, start the timer. */
3953                         intf_start_seq_timer(intf, msg->msgid);
3954
3955 free_msg:
3956                 ipmi_free_smi_msg(msg);
3957         } else {
3958                 /*
3959                  * To preserve message order, we keep a queue and deliver from
3960                  * a tasklet.
3961                  */
3962                 if (!run_to_completion)
3963                         spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
3964                 list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
3965                 if (!run_to_completion)
3966                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
3967                                                flags);
3968         }
3969
3970         if (!run_to_completion)
3971                 spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
3972         /*
3973          * We can get an asynchronous event or receive message in addition
3974          * to commands we send.
3975          */
3976         if (msg == intf->curr_msg)
3977                 intf->curr_msg = NULL;
3978         if (!run_to_completion)
3979                 spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
3980
3981         if (run_to_completion)
3982                 smi_recv_tasklet((unsigned long) intf);
3983         else
3984                 tasklet_schedule(&intf->recv_tasklet);
3985 }
3986 EXPORT_SYMBOL(ipmi_smi_msg_received);
3987
3988 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3989 {
3990         if (intf->in_shutdown)
3991                 return;
3992
3993         atomic_set(&intf->watchdog_pretimeouts_to_deliver, 1);
3994         tasklet_schedule(&intf->recv_tasklet);
3995 }
3996 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3997
3998 static struct ipmi_smi_msg *
3999 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
4000                   unsigned char seq, long seqid)
4001 {
4002         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
4003         if (!smi_msg)
4004                 /*
4005                  * If we can't allocate the message, then just return, we
4006                  * get 4 retries, so this should be ok.
4007                  */
4008                 return NULL;
4009
4010         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
4011         smi_msg->data_size = recv_msg->msg.data_len;
4012         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
4013
4014 #ifdef DEBUG_MSGING
4015         {
4016                 int m;
4017                 printk("Resend: ");
4018                 for (m = 0; m < smi_msg->data_size; m++)
4019                         printk(" %2.2x", smi_msg->data[m]);
4020                 printk("\n");
4021         }
4022 #endif
4023         return smi_msg;
4024 }
4025
4026 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
4027                               struct list_head *timeouts, long timeout_period,
4028                               int slot, unsigned long *flags,
4029                               unsigned int *waiting_msgs)
4030 {
4031         struct ipmi_recv_msg     *msg;
4032         const struct ipmi_smi_handlers *handlers;
4033
4034         if (intf->in_shutdown)
4035                 return;
4036
4037         if (!ent->inuse)
4038                 return;
4039
4040         ent->timeout -= timeout_period;
4041         if (ent->timeout > 0) {
4042                 (*waiting_msgs)++;
4043                 return;
4044         }
4045
4046         if (ent->retries_left == 0) {
4047                 /* The message has used all its retries. */
4048                 ent->inuse = 0;
4049                 msg = ent->recv_msg;
4050                 list_add_tail(&msg->link, timeouts);
4051                 if (ent->broadcast)
4052                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
4053                 else if (is_lan_addr(&ent->recv_msg->addr))
4054                         ipmi_inc_stat(intf, timed_out_lan_commands);
4055                 else
4056                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
4057         } else {
4058                 struct ipmi_smi_msg *smi_msg;
4059                 /* More retries, send again. */
4060
4061                 (*waiting_msgs)++;
4062
4063                 /*
4064                  * Start with the max timer, set to normal timer after
4065                  * the message is sent.
4066                  */
4067                 ent->timeout = MAX_MSG_TIMEOUT;
4068                 ent->retries_left--;
4069                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
4070                                             ent->seqid);
4071                 if (!smi_msg) {
4072                         if (is_lan_addr(&ent->recv_msg->addr))
4073                                 ipmi_inc_stat(intf,
4074                                               dropped_rexmit_lan_commands);
4075                         else
4076                                 ipmi_inc_stat(intf,
4077                                               dropped_rexmit_ipmb_commands);
4078                         return;
4079                 }
4080
4081                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
4082
4083                 /*
4084                  * Send the new message.  We send with a zero
4085                  * priority.  It timed out, I doubt time is that
4086                  * critical now, and high priority messages are really
4087                  * only for messages to the local MC, which don't get
4088                  * resent.
4089                  */
4090                 handlers = intf->handlers;
4091                 if (handlers) {
4092                         if (is_lan_addr(&ent->recv_msg->addr))
4093                                 ipmi_inc_stat(intf,
4094                                               retransmitted_lan_commands);
4095                         else
4096                                 ipmi_inc_stat(intf,
4097                                               retransmitted_ipmb_commands);
4098
4099                         smi_send(intf, handlers, smi_msg, 0);
4100                 } else
4101                         ipmi_free_smi_msg(smi_msg);
4102
4103                 spin_lock_irqsave(&intf->seq_lock, *flags);
4104         }
4105 }
4106
4107 static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
4108 {
4109         struct list_head     timeouts;
4110         struct ipmi_recv_msg *msg, *msg2;
4111         unsigned long        flags;
4112         int                  i;
4113         unsigned int         waiting_msgs = 0;
4114
4115         /*
4116          * Go through the seq table and find any messages that
4117          * have timed out, putting them in the timeouts
4118          * list.
4119          */
4120         INIT_LIST_HEAD(&timeouts);
4121         spin_lock_irqsave(&intf->seq_lock, flags);
4122         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
4123                 check_msg_timeout(intf, &(intf->seq_table[i]),
4124                                   &timeouts, timeout_period, i,
4125                                   &flags, &waiting_msgs);
4126         spin_unlock_irqrestore(&intf->seq_lock, flags);
4127
4128         list_for_each_entry_safe(msg, msg2, &timeouts, link)
4129                 deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
4130
4131         /*
4132          * Maintenance mode handling.  Check the timeout
4133          * optimistically before we claim the lock.  It may
4134          * mean a timeout gets missed occasionally, but that
4135          * only means the timeout gets extended by one period
4136          * in that case.  No big deal, and it avoids the lock
4137          * most of the time.
4138          */
4139         if (intf->auto_maintenance_timeout > 0) {
4140                 spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
4141                 if (intf->auto_maintenance_timeout > 0) {
4142                         intf->auto_maintenance_timeout
4143                                 -= timeout_period;
4144                         if (!intf->maintenance_mode
4145                             && (intf->auto_maintenance_timeout <= 0)) {
4146                                 intf->maintenance_mode_enable = false;
4147                                 maintenance_mode_update(intf);
4148                         }
4149                 }
4150                 spin_unlock_irqrestore(&intf->maintenance_mode_lock,
4151                                        flags);
4152         }
4153
4154         tasklet_schedule(&intf->recv_tasklet);
4155
4156         return waiting_msgs;
4157 }
4158
4159 static void ipmi_request_event(ipmi_smi_t intf)
4160 {
4161         /* No event requests when in maintenance mode. */
4162         if (intf->maintenance_mode_enable)
4163                 return;
4164
4165         if (!intf->in_shutdown)
4166                 intf->handlers->request_events(intf->send_info);
4167 }
4168
4169 static struct timer_list ipmi_timer;
4170
4171 static atomic_t stop_operation;
4172
4173 static void ipmi_timeout(unsigned long data)
4174 {
4175         ipmi_smi_t intf;
4176         int nt = 0;
4177
4178         if (atomic_read(&stop_operation))
4179                 return;
4180
4181         rcu_read_lock();
4182         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4183                 int lnt = 0;
4184
4185                 if (atomic_read(&intf->event_waiters)) {
4186                         intf->ticks_to_req_ev--;
4187                         if (intf->ticks_to_req_ev == 0) {
4188                                 ipmi_request_event(intf);
4189                                 intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
4190                         }
4191                         lnt++;
4192                 }
4193
4194                 lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
4195
4196                 lnt = !!lnt;
4197                 if (lnt != intf->last_needs_timer &&
4198                                         intf->handlers->set_need_watch)
4199                         intf->handlers->set_need_watch(intf->send_info, lnt);
4200                 intf->last_needs_timer = lnt;
4201
4202                 nt += lnt;
4203         }
4204         rcu_read_unlock();
4205
4206         if (nt)
4207                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4208 }
4209
4210 static void need_waiter(ipmi_smi_t intf)
4211 {
4212         /* Racy, but worst case we start the timer twice. */
4213         if (!timer_pending(&ipmi_timer))
4214                 mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4215 }
4216
4217 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
4218 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
4219
4220 static void free_smi_msg(struct ipmi_smi_msg *msg)
4221 {
4222         atomic_dec(&smi_msg_inuse_count);
4223         kfree(msg);
4224 }
4225
4226 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
4227 {
4228         struct ipmi_smi_msg *rv;
4229         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
4230         if (rv) {
4231                 rv->done = free_smi_msg;
4232                 rv->user_data = NULL;
4233                 atomic_inc(&smi_msg_inuse_count);
4234         }
4235         return rv;
4236 }
4237 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
4238
4239 static void free_recv_msg(struct ipmi_recv_msg *msg)
4240 {
4241         atomic_dec(&recv_msg_inuse_count);
4242         kfree(msg);
4243 }
4244
4245 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
4246 {
4247         struct ipmi_recv_msg *rv;
4248
4249         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
4250         if (rv) {
4251                 rv->user = NULL;
4252                 rv->done = free_recv_msg;
4253                 atomic_inc(&recv_msg_inuse_count);
4254         }
4255         return rv;
4256 }
4257
4258 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
4259 {
4260         if (msg->user)
4261                 kref_put(&msg->user->refcount, free_user);
4262         msg->done(msg);
4263 }
4264 EXPORT_SYMBOL(ipmi_free_recv_msg);
4265
4266 #ifdef CONFIG_IPMI_PANIC_EVENT
4267
4268 static atomic_t panic_done_count = ATOMIC_INIT(0);
4269
4270 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
4271 {
4272         atomic_dec(&panic_done_count);
4273 }
4274
4275 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
4276 {
4277         atomic_dec(&panic_done_count);
4278 }
4279
4280 /*
4281  * Inside a panic, send a message and wait for a response.
4282  */
4283 static void ipmi_panic_request_and_wait(ipmi_smi_t           intf,
4284                                         struct ipmi_addr     *addr,
4285                                         struct kernel_ipmi_msg *msg)
4286 {
4287         struct ipmi_smi_msg  smi_msg;
4288         struct ipmi_recv_msg recv_msg;
4289         int rv;
4290
4291         smi_msg.done = dummy_smi_done_handler;
4292         recv_msg.done = dummy_recv_done_handler;
4293         atomic_add(2, &panic_done_count);
4294         rv = i_ipmi_request(NULL,
4295                             intf,
4296                             addr,
4297                             0,
4298                             msg,
4299                             intf,
4300                             &smi_msg,
4301                             &recv_msg,
4302                             0,
4303                             intf->channels[0].address,
4304                             intf->channels[0].lun,
4305                             0, 1); /* Don't retry, and don't wait. */
4306         if (rv)
4307                 atomic_sub(2, &panic_done_count);
4308         else if (intf->handlers->flush_messages)
4309                 intf->handlers->flush_messages(intf->send_info);
4310
4311         while (atomic_read(&panic_done_count) != 0)
4312                 ipmi_poll(intf);
4313 }
4314
4315 #ifdef CONFIG_IPMI_PANIC_STRING
4316 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4317 {
4318         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4319             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
4320             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
4321             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4322                 /* A get event receiver command, save it. */
4323                 intf->event_receiver = msg->msg.data[1];
4324                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
4325         }
4326 }
4327
4328 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
4329 {
4330         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
4331             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
4332             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
4333             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
4334                 /*
4335                  * A get device id command, save if we are an event
4336                  * receiver or generator.
4337                  */
4338                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
4339                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
4340         }
4341 }
4342 #endif
4343
4344 static void send_panic_events(char *str)
4345 {
4346         struct kernel_ipmi_msg            msg;
4347         ipmi_smi_t                        intf;
4348         unsigned char                     data[16];
4349         struct ipmi_system_interface_addr *si;
4350         struct ipmi_addr                  addr;
4351
4352         si = (struct ipmi_system_interface_addr *) &addr;
4353         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4354         si->channel = IPMI_BMC_CHANNEL;
4355         si->lun = 0;
4356
4357         /* Fill in an event telling that we have failed. */
4358         msg.netfn = 0x04; /* Sensor or Event. */
4359         msg.cmd = 2; /* Platform event command. */
4360         msg.data = data;
4361         msg.data_len = 8;
4362         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4363         data[1] = 0x03; /* This is for IPMI 1.0. */
4364         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4365         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4366         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4367
4368         /*
4369          * Put a few breadcrumbs in.  Hopefully later we can add more things
4370          * to make the panic events more useful.
4371          */
4372         if (str) {
4373                 data[3] = str[0];
4374                 data[6] = str[1];
4375                 data[7] = str[2];
4376         }
4377
4378         /* For every registered interface, send the event. */
4379         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4380                 if (!intf->handlers)
4381                         /* Interface is not ready. */
4382                         continue;
4383
4384                 /* Send the event announcing the panic. */
4385                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4386         }
4387
4388 #ifdef CONFIG_IPMI_PANIC_STRING
4389         /*
4390          * On every interface, dump a bunch of OEM event holding the
4391          * string.
4392          */
4393         if (!str)
4394                 return;
4395
4396         /* For every registered interface, send the event. */
4397         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4398                 char                  *p = str;
4399                 struct ipmi_ipmb_addr *ipmb;
4400                 int                   j;
4401
4402                 if (intf->intf_num == -1)
4403                         /* Interface was not ready yet. */
4404                         continue;
4405
4406                 /*
4407                  * intf_num is used as an marker to tell if the
4408                  * interface is valid.  Thus we need a read barrier to
4409                  * make sure data fetched before checking intf_num
4410                  * won't be used.
4411                  */
4412                 smp_rmb();
4413
4414                 /*
4415                  * First job here is to figure out where to send the
4416                  * OEM events.  There's no way in IPMI to send OEM
4417                  * events using an event send command, so we have to
4418                  * find the SEL to put them in and stick them in
4419                  * there.
4420                  */
4421
4422                 /* Get capabilities from the get device id. */
4423                 intf->local_sel_device = 0;
4424                 intf->local_event_generator = 0;
4425                 intf->event_receiver = 0;
4426
4427                 /* Request the device info from the local MC. */
4428                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4429                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4430                 msg.data = NULL;
4431                 msg.data_len = 0;
4432                 intf->null_user_handler = device_id_fetcher;
4433                 ipmi_panic_request_and_wait(intf, &addr, &msg);
4434
4435                 if (intf->local_event_generator) {
4436                         /* Request the event receiver from the local MC. */
4437                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4438                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4439                         msg.data = NULL;
4440                         msg.data_len = 0;
4441                         intf->null_user_handler = event_receiver_fetcher;
4442                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4443                 }
4444                 intf->null_user_handler = NULL;
4445
4446                 /*
4447                  * Validate the event receiver.  The low bit must not
4448                  * be 1 (it must be a valid IPMB address), it cannot
4449                  * be zero, and it must not be my address.
4450                  */
4451                 if (((intf->event_receiver & 1) == 0)
4452                     && (intf->event_receiver != 0)
4453                     && (intf->event_receiver != intf->channels[0].address)) {
4454                         /*
4455                          * The event receiver is valid, send an IPMB
4456                          * message.
4457                          */
4458                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4459                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4460                         ipmb->channel = 0; /* FIXME - is this right? */
4461                         ipmb->lun = intf->event_receiver_lun;
4462                         ipmb->slave_addr = intf->event_receiver;
4463                 } else if (intf->local_sel_device) {
4464                         /*
4465                          * The event receiver was not valid (or was
4466                          * me), but I am an SEL device, just dump it
4467                          * in my SEL.
4468                          */
4469                         si = (struct ipmi_system_interface_addr *) &addr;
4470                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4471                         si->channel = IPMI_BMC_CHANNEL;
4472                         si->lun = 0;
4473                 } else
4474                         continue; /* No where to send the event. */
4475
4476                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4477                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4478                 msg.data = data;
4479                 msg.data_len = 16;
4480
4481                 j = 0;
4482                 while (*p) {
4483                         int size = strlen(p);
4484
4485                         if (size > 11)
4486                                 size = 11;
4487                         data[0] = 0;
4488                         data[1] = 0;
4489                         data[2] = 0xf0; /* OEM event without timestamp. */
4490                         data[3] = intf->channels[0].address;
4491                         data[4] = j++; /* sequence # */
4492                         /*
4493                          * Always give 11 bytes, so strncpy will fill
4494                          * it with zeroes for me.
4495                          */
4496                         strncpy(data+5, p, 11);
4497                         p += size;
4498
4499                         ipmi_panic_request_and_wait(intf, &addr, &msg);
4500                 }
4501         }
4502 #endif /* CONFIG_IPMI_PANIC_STRING */
4503 }
4504 #endif /* CONFIG_IPMI_PANIC_EVENT */
4505
4506 static int has_panicked;
4507
4508 static int panic_event(struct notifier_block *this,
4509                        unsigned long         event,
4510                        void                  *ptr)
4511 {
4512         ipmi_smi_t intf;
4513
4514         if (has_panicked)
4515                 return NOTIFY_DONE;
4516         has_panicked = 1;
4517
4518         /* For every registered interface, set it to run to completion. */
4519         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4520                 if (!intf->handlers)
4521                         /* Interface is not ready. */
4522                         continue;
4523
4524                 /*
4525                  * If we were interrupted while locking xmit_msgs_lock or
4526                  * waiting_rcv_msgs_lock, the corresponding list may be
4527                  * corrupted.  In this case, drop items on the list for
4528                  * the safety.
4529                  */
4530                 if (!spin_trylock(&intf->xmit_msgs_lock)) {
4531                         INIT_LIST_HEAD(&intf->xmit_msgs);
4532                         INIT_LIST_HEAD(&intf->hp_xmit_msgs);
4533                 } else
4534                         spin_unlock(&intf->xmit_msgs_lock);
4535
4536                 if (!spin_trylock(&intf->waiting_rcv_msgs_lock))
4537                         INIT_LIST_HEAD(&intf->waiting_rcv_msgs);
4538                 else
4539                         spin_unlock(&intf->waiting_rcv_msgs_lock);
4540
4541                 intf->run_to_completion = 1;
4542                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4543         }
4544
4545 #ifdef CONFIG_IPMI_PANIC_EVENT
4546         send_panic_events(ptr);
4547 #endif
4548
4549         return NOTIFY_DONE;
4550 }
4551
4552 static struct notifier_block panic_block = {
4553         .notifier_call  = panic_event,
4554         .next           = NULL,
4555         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4556 };
4557
4558 static int ipmi_init_msghandler(void)
4559 {
4560         int rv;
4561
4562         if (initialized)
4563                 return 0;
4564
4565         rv = driver_register(&ipmidriver.driver);
4566         if (rv) {
4567                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4568                 return rv;
4569         }
4570
4571         printk(KERN_INFO "ipmi message handler version "
4572                IPMI_DRIVER_VERSION "\n");
4573
4574 #ifdef CONFIG_PROC_FS
4575         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4576         if (!proc_ipmi_root) {
4577             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4578             driver_unregister(&ipmidriver.driver);
4579             return -ENOMEM;
4580         }
4581
4582 #endif /* CONFIG_PROC_FS */
4583
4584         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4585         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4586
4587         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4588
4589         initialized = 1;
4590
4591         return 0;
4592 }
4593
4594 static int __init ipmi_init_msghandler_mod(void)
4595 {
4596         ipmi_init_msghandler();
4597         return 0;
4598 }
4599
4600 static void __exit cleanup_ipmi(void)
4601 {
4602         int count;
4603
4604         if (!initialized)
4605                 return;
4606
4607         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4608
4609         /*
4610          * This can't be called if any interfaces exist, so no worry
4611          * about shutting down the interfaces.
4612          */
4613
4614         /*
4615          * Tell the timer to stop, then wait for it to stop.  This
4616          * avoids problems with race conditions removing the timer
4617          * here.
4618          */
4619         atomic_inc(&stop_operation);
4620         del_timer_sync(&ipmi_timer);
4621
4622 #ifdef CONFIG_PROC_FS
4623         proc_remove(proc_ipmi_root);
4624 #endif /* CONFIG_PROC_FS */
4625
4626         driver_unregister(&ipmidriver.driver);
4627
4628         initialized = 0;
4629
4630         /* Check for buffer leaks. */
4631         count = atomic_read(&smi_msg_inuse_count);
4632         if (count != 0)
4633                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4634                        count);
4635         count = atomic_read(&recv_msg_inuse_count);
4636         if (count != 0)
4637                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4638                        count);
4639 }
4640 module_exit(cleanup_ipmi);
4641
4642 module_init(ipmi_init_msghandler_mod);
4643 MODULE_LICENSE("GPL");
4644 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4645 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4646                    " interface.");
4647 MODULE_VERSION(IPMI_DRIVER_VERSION);