err.no Git - linux-2.6/blob - drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <asm/system.h>
  37 #include <linux/poll.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/mutex.h>
  40 #include <linux/slab.h>
  41 #include <linux/ipmi.h>
  42 #include <linux/ipmi_smi.h>
  43 #include <linux/notifier.h>
  44 #include <linux/init.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/rcupdate.h>
  47
  48 #define PFX "IPMI message handler: "
  49
  50 #define IPMI_DRIVER_VERSION "39.2"
  51
  52 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  53 static int ipmi_init_msghandler(void);
  54
  55 static int initialized;
  56
  57 #ifdef CONFIG_PROC_FS
  58 static struct proc_dir_entry *proc_ipmi_root;
  59 #endif /* CONFIG_PROC_FS */
  60
  61 /* Remain in auto-maintenance mode for this amount of time (in ms). */
  62 #define IPMI_MAINTENANCE_MODE_TIMEOUT 30000
  63
  64 #define MAX_EVENTS_IN_QUEUE     25
  65
  66 /*
  67  * Don't let a message sit in a queue forever, always time it with at lest
  68  * the max message timer.  This is in milliseconds.
  69  */
  70 #define MAX_MSG_TIMEOUT         60000
  71
  72 /*
  73  * The main "user" data structure.
  74  */
  75 struct ipmi_user {
  76         struct list_head link;
  77
  78         /* Set to "0" when the user is destroyed. */
  79         int valid;
  80
  81         struct kref refcount;
  82
  83         /* The upper layer that handles receive messages. */
  84         struct ipmi_user_hndl *handler;
  85         void             *handler_data;
  86
  87         /* The interface this user is bound to. */
  88         ipmi_smi_t intf;
  89
  90         /* Does this interface receive IPMI events? */
  91         int gets_events;
  92 };
  93
  94 struct cmd_rcvr {
  95         struct list_head link;
  96
  97         ipmi_user_t   user;
  98         unsigned char netfn;
  99         unsigned char cmd;
 100         unsigned int  chans;
 101
 102         /*
 103          * This is used to form a linked lised during mass deletion.
 104          * Since this is in an RCU list, we cannot use the link above
 105          * or change any data until the RCU period completes.  So we
 106          * use this next variable during mass deletion so we can have
 107          * a list and don't have to wait and restart the search on
 108          * every individual deletion of a command.
 109          */
 110         struct cmd_rcvr *next;
 111 };
 112
 113 struct seq_table {
 114         unsigned int         inuse : 1;
 115         unsigned int         broadcast : 1;
 116
 117         unsigned long        timeout;
 118         unsigned long        orig_timeout;
 119         unsigned int         retries_left;
 120
 121         /*
 122          * To verify on an incoming send message response that this is
 123          * the message that the response is for, we keep a sequence id
 124          * and increment it every time we send a message.
 125          */
 126         long                 seqid;
 127
 128         /*
 129          * This is held so we can properly respond to the message on a
 130          * timeout, and it is used to hold the temporary data for
 131          * retransmission, too.
 132          */
 133         struct ipmi_recv_msg *recv_msg;
 134 };
 135
 136 /*
 137  * Store the information in a msgid (long) to allow us to find a
 138  * sequence table entry from the msgid.
 139  */
 140 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 141
 142 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 143         do {                                                            \
 144                 seq = ((msgid >> 26) & 0x3f);                           \
 145                 seqid = (msgid & 0x3fffff);                             \
 146         } while (0)
 147
 148 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 149
 150 struct ipmi_channel {
 151         unsigned char medium;
 152         unsigned char protocol;
 153
 154         /*
 155          * My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 156          * but may be changed by the user.
 157          */
 158         unsigned char address;
 159
 160         /*
 161          * My LUN.  This should generally stay the SMS LUN, but just in
 162          * case...
 163          */
 164         unsigned char lun;
 165 };
 166
 167 #ifdef CONFIG_PROC_FS
 168 struct ipmi_proc_entry {
 169         char                   *name;
 170         struct ipmi_proc_entry *next;
 171 };
 172 #endif
 173
 174 struct bmc_device {
 175         struct platform_device *dev;
 176         struct ipmi_device_id  id;
 177         unsigned char          guid[16];
 178         int                    guid_set;
 179
 180         struct kref            refcount;
 181
 182         /* bmc device attributes */
 183         struct device_attribute device_id_attr;
 184         struct device_attribute provides_dev_sdrs_attr;
 185         struct device_attribute revision_attr;
 186         struct device_attribute firmware_rev_attr;
 187         struct device_attribute version_attr;
 188         struct device_attribute add_dev_support_attr;
 189         struct device_attribute manufacturer_id_attr;
 190         struct device_attribute product_id_attr;
 191         struct device_attribute guid_attr;
 192         struct device_attribute aux_firmware_rev_attr;
 193 };
 194
 195 /*
 196  * Various statistics for IPMI, these index stats[] in the ipmi_smi
 197  * structure.
 198  */
 199 enum ipmi_stat_indexes {
 200         /* Commands we got from the user that were invalid. */
 201         IPMI_STAT_sent_invalid_commands = 0,
 202
 203         /* Commands we sent to the MC. */
 204         IPMI_STAT_sent_local_commands,
 205
 206         /* Responses from the MC that were delivered to a user. */
 207         IPMI_STAT_handled_local_responses,
 208
 209         /* Responses from the MC that were not delivered to a user. */
 210         IPMI_STAT_unhandled_local_responses,
 211
 212         /* Commands we sent out to the IPMB bus. */
 213         IPMI_STAT_sent_ipmb_commands,
 214
 215         /* Commands sent on the IPMB that had errors on the SEND CMD */
 216         IPMI_STAT_sent_ipmb_command_errs,
 217
 218         /* Each retransmit increments this count. */
 219         IPMI_STAT_retransmitted_ipmb_commands,
 220
 221         /*
 222          * When a message times out (runs out of retransmits) this is
 223          * incremented.
 224          */
 225         IPMI_STAT_timed_out_ipmb_commands,
 226
 227         /*
 228          * This is like above, but for broadcasts.  Broadcasts are
 229          * *not* included in the above count (they are expected to
 230          * time out).
 231          */
 232         IPMI_STAT_timed_out_ipmb_broadcasts,
 233
 234         /* Responses I have sent to the IPMB bus. */
 235         IPMI_STAT_sent_ipmb_responses,
 236
 237         /* The response was delivered to the user. */
 238         IPMI_STAT_handled_ipmb_responses,
 239
 240         /* The response had invalid data in it. */
 241         IPMI_STAT_invalid_ipmb_responses,
 242
 243         /* The response didn't have anyone waiting for it. */
 244         IPMI_STAT_unhandled_ipmb_responses,
 245
 246         /* Commands we sent out to the IPMB bus. */
 247         IPMI_STAT_sent_lan_commands,
 248
 249         /* Commands sent on the IPMB that had errors on the SEND CMD */
 250         IPMI_STAT_sent_lan_command_errs,
 251
 252         /* Each retransmit increments this count. */
 253         IPMI_STAT_retransmitted_lan_commands,
 254
 255         /*
 256          * When a message times out (runs out of retransmits) this is
 257          * incremented.
 258          */
 259         IPMI_STAT_timed_out_lan_commands,
 260
 261         /* Responses I have sent to the IPMB bus. */
 262         IPMI_STAT_sent_lan_responses,
 263
 264         /* The response was delivered to the user. */
 265         IPMI_STAT_handled_lan_responses,
 266
 267         /* The response had invalid data in it. */
 268         IPMI_STAT_invalid_lan_responses,
 269
 270         /* The response didn't have anyone waiting for it. */
 271         IPMI_STAT_unhandled_lan_responses,
 272
 273         /* The command was delivered to the user. */
 274         IPMI_STAT_handled_commands,
 275
 276         /* The command had invalid data in it. */
 277         IPMI_STAT_invalid_commands,
 278
 279         /* The command didn't have anyone waiting for it. */
 280         IPMI_STAT_unhandled_commands,
 281
 282         /* Invalid data in an event. */
 283         IPMI_STAT_invalid_events,
 284
 285         /* Events that were received with the proper format. */
 286         IPMI_STAT_events,
 287
 288
 289         /* This *must* remain last, add new values above this. */
 290         IPMI_NUM_STATS
 291 };
 292
 293
 294 #define IPMI_IPMB_NUM_SEQ       64
 295 #define IPMI_MAX_CHANNELS       16
 296 struct ipmi_smi {
 297         /* What interface number are we? */
 298         int intf_num;
 299
 300         struct kref refcount;
 301
 302         /* Used for a list of interfaces. */
 303         struct list_head link;
 304
 305         /*
 306          * The list of upper layers that are using me.  seq_lock
 307          * protects this.
 308          */
 309         struct list_head users;
 310
 311         /* Information to supply to users. */
 312         unsigned char ipmi_version_major;
 313         unsigned char ipmi_version_minor;
 314
 315         /* Used for wake ups at startup. */
 316         wait_queue_head_t waitq;
 317
 318         struct bmc_device *bmc;
 319         char *my_dev_name;
 320         char *sysfs_name;
 321
 322         /*
 323          * This is the lower-layer's sender routine.  Note that you
 324          * must either be holding the ipmi_interfaces_mutex or be in
 325          * an umpreemptible region to use this.  You must fetch the
 326          * value into a local variable and make sure it is not NULL.
 327          */
 328         struct ipmi_smi_handlers *handlers;
 329         void                     *send_info;
 330
 331 #ifdef CONFIG_PROC_FS
 332         /* A list of proc entries for this interface. */
 333         struct mutex           proc_entry_lock;
 334         struct ipmi_proc_entry *proc_entries;
 335 #endif
 336
 337         /* Driver-model device for the system interface. */
 338         struct device          *si_dev;
 339
 340         /*
 341          * A table of sequence numbers for this interface.  We use the
 342          * sequence numbers for IPMB messages that go out of the
 343          * interface to match them up with their responses.  A routine
 344          * is called periodically to time the items in this list.
 345          */
 346         spinlock_t       seq_lock;
 347         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 348         int curr_seq;
 349
 350         /*
 351          * Messages that were delayed for some reason (out of memory,
 352          * for instance), will go in here to be processed later in a
 353          * periodic timer interrupt.
 354          */
 355         spinlock_t       waiting_msgs_lock;
 356         struct list_head waiting_msgs;
 357
 358         /*
 359          * The list of command receivers that are registered for commands
 360          * on this interface.
 361          */
 362         struct mutex     cmd_rcvrs_mutex;
 363         struct list_head cmd_rcvrs;
 364
 365         /*
 366          * Events that were queues because no one was there to receive
 367          * them.
 368          */
 369         spinlock_t       events_lock; /* For dealing with event stuff. */
 370         struct list_head waiting_events;
 371         unsigned int     waiting_events_count; /* How many events in queue? */
 372         char             delivering_events;
 373         char             event_msg_printed;
 374
 375         /*
 376          * The event receiver for my BMC, only really used at panic
 377          * shutdown as a place to store this.
 378          */
 379         unsigned char event_receiver;
 380         unsigned char event_receiver_lun;
 381         unsigned char local_sel_device;
 382         unsigned char local_event_generator;
 383
 384         /* For handling of maintenance mode. */
 385         int maintenance_mode;
 386         int maintenance_mode_enable;
 387         int auto_maintenance_timeout;
 388         spinlock_t maintenance_mode_lock; /* Used in a timer... */
 389
 390         /*
 391          * A cheap hack, if this is non-null and a message to an
 392          * interface comes in with a NULL user, call this routine with
 393          * it.  Note that the message will still be freed by the
 394          * caller.  This only works on the system interface.
 395          */
 396         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_recv_msg *msg);
 397
 398         /*
 399          * When we are scanning the channels for an SMI, this will
 400          * tell which channel we are scanning.
 401          */
 402         int curr_channel;
 403
 404         /* Channel information */
 405         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 406
 407         /* Proc FS stuff. */
 408         struct proc_dir_entry *proc_dir;
 409         char                  proc_dir_name[10];
 410
 411         atomic_t stats[IPMI_NUM_STATS];
 412
 413         /*
 414          * run_to_completion duplicate of smb_info, smi_info
 415          * and ipmi_serial_info structures. Used to decrease numbers of
 416          * parameters passed by "low" level IPMI code.
 417          */
 418         int run_to_completion;
 419 };
 420 #define to_si_intf_from_dev(device) container_of(device, struct ipmi_smi, dev)
 421
 422 /**
 423  * The driver model view of the IPMI messaging driver.
 424  */
 425 static struct device_driver ipmidriver = {
 426         .name = "ipmi",
 427         .bus = &platform_bus_type
 428 };
 429 static DEFINE_MUTEX(ipmidriver_mutex);
 430
 431 static LIST_HEAD(ipmi_interfaces);
 432 static DEFINE_MUTEX(ipmi_interfaces_mutex);
 433
 434 /*
 435  * List of watchers that want to know when smi's are added and deleted.
 436  */
 437 static LIST_HEAD(smi_watchers);
 438 static DEFINE_MUTEX(smi_watchers_mutex);
 439
 440
 441 #define ipmi_inc_stat(intf, stat) \
 442         atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 443 #define ipmi_get_stat(intf, stat) \
 444         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 445
 446
 447 static void free_recv_msg_list(struct list_head *q)
 448 {
 449         struct ipmi_recv_msg *msg, *msg2;
 450
 451         list_for_each_entry_safe(msg, msg2, q, link) {
 452                 list_del(&msg->link);
 453                 ipmi_free_recv_msg(msg);
 454         }
 455 }
 456
 457 static void free_smi_msg_list(struct list_head *q)
 458 {
 459         struct ipmi_smi_msg *msg, *msg2;
 460
 461         list_for_each_entry_safe(msg, msg2, q, link) {
 462                 list_del(&msg->link);
 463                 ipmi_free_smi_msg(msg);
 464         }
 465 }
 466
 467 static void clean_up_interface_data(ipmi_smi_t intf)
 468 {
 469         int              i;
 470         struct cmd_rcvr  *rcvr, *rcvr2;
 471         struct list_head list;
 472
 473         free_smi_msg_list(&intf->waiting_msgs);
 474         free_recv_msg_list(&intf->waiting_events);
 475
 476         /*
 477          * Wholesale remove all the entries from the list in the
 478          * interface and wait for RCU to know that none are in use.
 479          */
 480         mutex_lock(&intf->cmd_rcvrs_mutex);
 481         INIT_LIST_HEAD(&list);
 482         list_splice_init_rcu(&intf->cmd_rcvrs, &list, synchronize_rcu);
 483         mutex_unlock(&intf->cmd_rcvrs_mutex);
 484
 485         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
 486                 kfree(rcvr);
 487
 488         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 489                 if ((intf->seq_table[i].inuse)
 490                                         && (intf->seq_table[i].recv_msg))
 491                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 492         }
 493 }
 494
 495 static void intf_free(struct kref *ref)
 496 {
 497         ipmi_smi_t intf = container_of(ref, struct ipmi_smi, refcount);
 498
 499         clean_up_interface_data(intf);
 500         kfree(intf);
 501 }
 502
 503 struct watcher_entry {
 504         int              intf_num;
 505         ipmi_smi_t       intf;
 506         struct list_head link;
 507 };
 508
 509 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 510 {
 511         ipmi_smi_t intf;
 512         LIST_HEAD(to_deliver);
 513         struct watcher_entry *e, *e2;
 514
 515         mutex_lock(&smi_watchers_mutex);
 516
 517         mutex_lock(&ipmi_interfaces_mutex);
 518
 519         /* Build a list of things to deliver. */
 520         list_for_each_entry(intf, &ipmi_interfaces, link) {
 521                 if (intf->intf_num == -1)
 522                         continue;
 523                 e = kmalloc(sizeof(*e), GFP_KERNEL);
 524                 if (!e)
 525                         goto out_err;
 526                 kref_get(&intf->refcount);
 527                 e->intf = intf;
 528                 e->intf_num = intf->intf_num;
 529                 list_add_tail(&e->link, &to_deliver);
 530         }
 531
 532         /* We will succeed, so add it to the list. */
 533         list_add(&watcher->link, &smi_watchers);
 534
 535         mutex_unlock(&ipmi_interfaces_mutex);
 536
 537         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 538                 list_del(&e->link);
 539                 watcher->new_smi(e->intf_num, e->intf->si_dev);
 540                 kref_put(&e->intf->refcount, intf_free);
 541                 kfree(e);
 542         }
 543
 544         mutex_unlock(&smi_watchers_mutex);
 545
 546         return 0;
 547
 548  out_err:
 549         mutex_unlock(&ipmi_interfaces_mutex);
 550         mutex_unlock(&smi_watchers_mutex);
 551         list_for_each_entry_safe(e, e2, &to_deliver, link) {
 552                 list_del(&e->link);
 553                 kref_put(&e->intf->refcount, intf_free);
 554                 kfree(e);
 555         }
 556         return -ENOMEM;
 557 }
 558 EXPORT_SYMBOL(ipmi_smi_watcher_register);
 559
 560 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 561 {
 562         mutex_lock(&smi_watchers_mutex);
 563         list_del(&(watcher->link));
 564         mutex_unlock(&smi_watchers_mutex);
 565         return 0;
 566 }
 567 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
 568
 569 /*
 570  * Must be called with smi_watchers_mutex held.
 571  */
 572 static void
 573 call_smi_watchers(int i, struct device *dev)
 574 {
 575         struct ipmi_smi_watcher *w;
 576
 577         list_for_each_entry(w, &smi_watchers, link) {
 578                 if (try_module_get(w->owner)) {
 579                         w->new_smi(i, dev);
 580                         module_put(w->owner);
 581                 }
 582         }
 583 }
 584
 585 static int
 586 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 587 {
 588         if (addr1->addr_type != addr2->addr_type)
 589                 return 0;
 590
 591         if (addr1->channel != addr2->channel)
 592                 return 0;
 593
 594         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 595                 struct ipmi_system_interface_addr *smi_addr1
 596                     = (struct ipmi_system_interface_addr *) addr1;
 597                 struct ipmi_system_interface_addr *smi_addr2
 598                     = (struct ipmi_system_interface_addr *) addr2;
 599                 return (smi_addr1->lun == smi_addr2->lun);
 600         }
 601
 602         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 603             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 604                 struct ipmi_ipmb_addr *ipmb_addr1
 605                     = (struct ipmi_ipmb_addr *) addr1;
 606                 struct ipmi_ipmb_addr *ipmb_addr2
 607                     = (struct ipmi_ipmb_addr *) addr2;
 608
 609                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 610                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 611         }
 612
 613         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 614                 struct ipmi_lan_addr *lan_addr1
 615                         = (struct ipmi_lan_addr *) addr1;
 616                 struct ipmi_lan_addr *lan_addr2
 617                     = (struct ipmi_lan_addr *) addr2;
 618
 619                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 620                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 621                         && (lan_addr1->session_handle
 622                             == lan_addr2->session_handle)
 623                         && (lan_addr1->lun == lan_addr2->lun));
 624         }
 625
 626         return 1;
 627 }
 628
 629 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 630 {
 631         if (len < sizeof(struct ipmi_system_interface_addr))
 632                 return -EINVAL;
 633
 634         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 635                 if (addr->channel != IPMI_BMC_CHANNEL)
 636                         return -EINVAL;
 637                 return 0;
 638         }
 639
 640         if ((addr->channel == IPMI_BMC_CHANNEL)
 641             || (addr->channel >= IPMI_MAX_CHANNELS)
 642             || (addr->channel < 0))
 643                 return -EINVAL;
 644
 645         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 646             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
 647                 if (len < sizeof(struct ipmi_ipmb_addr))
 648                         return -EINVAL;
 649                 return 0;
 650         }
 651
 652         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 653                 if (len < sizeof(struct ipmi_lan_addr))
 654                         return -EINVAL;
 655                 return 0;
 656         }
 657
 658         return -EINVAL;
 659 }
 660 EXPORT_SYMBOL(ipmi_validate_addr);
 661
 662 unsigned int ipmi_addr_length(int addr_type)
 663 {
 664         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 665                 return sizeof(struct ipmi_system_interface_addr);
 666
 667         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 668                         || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 669                 return sizeof(struct ipmi_ipmb_addr);
 670
 671         if (addr_type == IPMI_LAN_ADDR_TYPE)
 672                 return sizeof(struct ipmi_lan_addr);
 673
 674         return 0;
 675 }
 676 EXPORT_SYMBOL(ipmi_addr_length);
 677
 678 static void deliver_response(struct ipmi_recv_msg *msg)
 679 {
 680         if (!msg->user) {
 681                 ipmi_smi_t    intf = msg->user_msg_data;
 682
 683                 /* Special handling for NULL users. */
 684                 if (intf->null_user_handler) {
 685                         intf->null_user_handler(intf, msg);
 686                         ipmi_inc_stat(intf, handled_local_responses);
 687                 } else {
 688                         /* No handler, so give up. */
 689                         ipmi_inc_stat(intf, unhandled_local_responses);
 690                 }
 691                 ipmi_free_recv_msg(msg);
 692         } else {
 693                 ipmi_user_t user = msg->user;
 694                 user->handler->ipmi_recv_hndl(msg, user->handler_data);
 695         }
 696 }
 697
 698 static void
 699 deliver_err_response(struct ipmi_recv_msg *msg, int err)
 700 {
 701         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 702         msg->msg_data[0] = err;
 703         msg->msg.netfn |= 1; /* Convert to a response. */
 704         msg->msg.data_len = 1;
 705         msg->msg.data = msg->msg_data;
 706         deliver_response(msg);
 707 }
 708
 709 /*
 710  * Find the next sequence number not being used and add the given
 711  * message with the given timeout to the sequence table.  This must be
 712  * called with the interface's seq_lock held.
 713  */
 714 static int intf_next_seq(ipmi_smi_t           intf,
 715                          struct ipmi_recv_msg *recv_msg,
 716                          unsigned long        timeout,
 717                          int                  retries,
 718                          int                  broadcast,
 719                          unsigned char        *seq,
 720                          long                 *seqid)
 721 {
 722         int          rv = 0;
 723         unsigned int i;
 724
 725         for (i = intf->curr_seq; (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 726                                         i = (i+1)%IPMI_IPMB_NUM_SEQ) {
 727                 if (!intf->seq_table[i].inuse)
 728                         break;
 729         }
 730
 731         if (!intf->seq_table[i].inuse) {
 732                 intf->seq_table[i].recv_msg = recv_msg;
 733
 734                 /*
 735                  * Start with the maximum timeout, when the send response
 736                  * comes in we will start the real timer.
 737                  */
 738                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 739                 intf->seq_table[i].orig_timeout = timeout;
 740                 intf->seq_table[i].retries_left = retries;
 741                 intf->seq_table[i].broadcast = broadcast;
 742                 intf->seq_table[i].inuse = 1;
 743                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 744                 *seq = i;
 745                 *seqid = intf->seq_table[i].seqid;
 746                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 747         } else {
 748                 rv = -EAGAIN;
 749         }
 750
 751         return rv;
 752 }
 753
 754 /*
 755  * Return the receive message for the given sequence number and
 756  * release the sequence number so it can be reused.  Some other data
 757  * is passed in to be sure the message matches up correctly (to help
 758  * guard against message coming in after their timeout and the
 759  * sequence number being reused).
 760  */
 761 static int intf_find_seq(ipmi_smi_t           intf,
 762                          unsigned char        seq,
 763                          short                channel,
 764                          unsigned char        cmd,
 765                          unsigned char        netfn,
 766                          struct ipmi_addr     *addr,
 767                          struct ipmi_recv_msg **recv_msg)
 768 {
 769         int           rv = -ENODEV;
 770         unsigned long flags;
 771
 772         if (seq >= IPMI_IPMB_NUM_SEQ)
 773                 return -EINVAL;
 774
 775         spin_lock_irqsave(&(intf->seq_lock), flags);
 776         if (intf->seq_table[seq].inuse) {
 777                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 778
 779                 if ((msg->addr.channel == channel) && (msg->msg.cmd == cmd)
 780                                 && (msg->msg.netfn == netfn)
 781                                 && (ipmi_addr_equal(addr, &(msg->addr)))) {
 782                         *recv_msg = msg;
 783                         intf->seq_table[seq].inuse = 0;
 784                         rv = 0;
 785                 }
 786         }
 787         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 788
 789         return rv;
 790 }
 791
 792
 793 /* Start the timer for a specific sequence table entry. */
 794 static int intf_start_seq_timer(ipmi_smi_t intf,
 795                                 long       msgid)
 796 {
 797         int           rv = -ENODEV;
 798         unsigned long flags;
 799         unsigned char seq;
 800         unsigned long seqid;
 801
 802
 803         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 804
 805         spin_lock_irqsave(&(intf->seq_lock), flags);
 806         /*
 807          * We do this verification because the user can be deleted
 808          * while a message is outstanding.
 809          */
 810         if ((intf->seq_table[seq].inuse)
 811                                 && (intf->seq_table[seq].seqid == seqid)) {
 812                 struct seq_table *ent = &(intf->seq_table[seq]);
 813                 ent->timeout = ent->orig_timeout;
 814                 rv = 0;
 815         }
 816         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 817
 818         return rv;
 819 }
 820
 821 /* Got an error for the send message for a specific sequence number. */
 822 static int intf_err_seq(ipmi_smi_t   intf,
 823                         long         msgid,
 824                         unsigned int err)
 825 {
 826         int                  rv = -ENODEV;
 827         unsigned long        flags;
 828         unsigned char        seq;
 829         unsigned long        seqid;
 830         struct ipmi_recv_msg *msg = NULL;
 831
 832
 833         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 834
 835         spin_lock_irqsave(&(intf->seq_lock), flags);
 836         /*
 837          * We do this verification because the user can be deleted
 838          * while a message is outstanding.
 839          */
 840         if ((intf->seq_table[seq].inuse)
 841                                 && (intf->seq_table[seq].seqid == seqid)) {
 842                 struct seq_table *ent = &(intf->seq_table[seq]);
 843
 844                 ent->inuse = 0;
 845                 msg = ent->recv_msg;
 846                 rv = 0;
 847         }
 848         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 849
 850         if (msg)
 851                 deliver_err_response(msg, err);
 852
 853         return rv;
 854 }
 855
 856
 857 int ipmi_create_user(unsigned int          if_num,
 858                      struct ipmi_user_hndl *handler,
 859                      void                  *handler_data,
 860                      ipmi_user_t           *user)
 861 {
 862         unsigned long flags;
 863         ipmi_user_t   new_user;
 864         int           rv = 0;
 865         ipmi_smi_t    intf;
 866
 867         /*
 868          * There is no module usecount here, because it's not
 869          * required.  Since this can only be used by and called from
 870          * other modules, they will implicitly use this module, and
 871          * thus this can't be removed unless the other modules are
 872          * removed.
 873          */
 874
 875         if (handler == NULL)
 876                 return -EINVAL;
 877
 878         /*
 879          * Make sure the driver is actually initialized, this handles
 880          * problems with initialization order.
 881          */
 882         if (!initialized) {
 883                 rv = ipmi_init_msghandler();
 884                 if (rv)
 885                         return rv;
 886
 887                 /*
 888                  * The init code doesn't return an error if it was turned
 889                  * off, but it won't initialize.  Check that.
 890                  */
 891                 if (!initialized)
 892                         return -ENODEV;
 893         }
 894
 895         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 896         if (!new_user)
 897                 return -ENOMEM;
 898
 899         mutex_lock(&ipmi_interfaces_mutex);
 900         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
 901                 if (intf->intf_num == if_num)
 902                         goto found;
 903         }
 904         /* Not found, return an error */
 905         rv = -EINVAL;
 906         goto out_kfree;
 907
 908  found:
 909         /* Note that each existing user holds a refcount to the interface. */
 910         kref_get(&intf->refcount);
 911
 912         kref_init(&new_user->refcount);
 913         new_user->handler = handler;
 914         new_user->handler_data = handler_data;
 915         new_user->intf = intf;
 916         new_user->gets_events = 0;
 917
 918         if (!try_module_get(intf->handlers->owner)) {
 919                 rv = -ENODEV;
 920                 goto out_kref;
 921         }
 922
 923         if (intf->handlers->inc_usecount) {
 924                 rv = intf->handlers->inc_usecount(intf->send_info);
 925                 if (rv) {
 926                         module_put(intf->handlers->owner);
 927                         goto out_kref;
 928                 }
 929         }
 930
 931         /*
 932          * Hold the lock so intf->handlers is guaranteed to be good
 933          * until now
 934          */
 935         mutex_unlock(&ipmi_interfaces_mutex);
 936
 937         new_user->valid = 1;
 938         spin_lock_irqsave(&intf->seq_lock, flags);
 939         list_add_rcu(&new_user->link, &intf->users);
 940         spin_unlock_irqrestore(&intf->seq_lock, flags);
 941         *user = new_user;
 942         return 0;
 943
 944 out_kref:
 945         kref_put(&intf->refcount, intf_free);
 946 out_kfree:
 947         mutex_unlock(&ipmi_interfaces_mutex);
 948         kfree(new_user);
 949         return rv;
 950 }
 951 EXPORT_SYMBOL(ipmi_create_user);
 952
 953 static void free_user(struct kref *ref)
 954 {
 955         ipmi_user_t user = container_of(ref, struct ipmi_user, refcount);
 956         kfree(user);
 957 }
 958
 959 int ipmi_destroy_user(ipmi_user_t user)
 960 {
 961         ipmi_smi_t       intf = user->intf;
 962         int              i;
 963         unsigned long    flags;
 964         struct cmd_rcvr  *rcvr;
 965         struct cmd_rcvr  *rcvrs = NULL;
 966
 967         user->valid = 0;
 968
 969         /* Remove the user from the interface's sequence table. */
 970         spin_lock_irqsave(&intf->seq_lock, flags);
 971         list_del_rcu(&user->link);
 972
 973         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
 974                 if (intf->seq_table[i].inuse
 975                     && (intf->seq_table[i].recv_msg->user == user)) {
 976                         intf->seq_table[i].inuse = 0;
 977                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
 978                 }
 979         }
 980         spin_unlock_irqrestore(&intf->seq_lock, flags);
 981
 982         /*
 983          * Remove the user from the command receiver's table.  First
 984          * we build a list of everything (not using the standard link,
 985          * since other things may be using it till we do
 986          * synchronize_rcu()) then free everything in that list.
 987          */
 988         mutex_lock(&intf->cmd_rcvrs_mutex);
 989         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
 990                 if (rcvr->user == user) {
 991                         list_del_rcu(&rcvr->link);
 992                         rcvr->next = rcvrs;
 993                         rcvrs = rcvr;
 994                 }
 995         }
 996         mutex_unlock(&intf->cmd_rcvrs_mutex);
 997         synchronize_rcu();
 998         while (rcvrs) {
 999                 rcvr = rcvrs;
1000                 rcvrs = rcvr->next;
1001                 kfree(rcvr);
1002         }
1003
1004         mutex_lock(&ipmi_interfaces_mutex);
1005         if (intf->handlers) {
1006                 module_put(intf->handlers->owner);
1007                 if (intf->handlers->dec_usecount)
1008                         intf->handlers->dec_usecount(intf->send_info);
1009         }
1010         mutex_unlock(&ipmi_interfaces_mutex);
1011
1012         kref_put(&intf->refcount, intf_free);
1013
1014         kref_put(&user->refcount, free_user);
1015
1016         return 0;
1017 }
1018 EXPORT_SYMBOL(ipmi_destroy_user);
1019
1020 void ipmi_get_version(ipmi_user_t   user,
1021                       unsigned char *major,
1022                       unsigned char *minor)
1023 {
1024         *major = user->intf->ipmi_version_major;
1025         *minor = user->intf->ipmi_version_minor;
1026 }
1027 EXPORT_SYMBOL(ipmi_get_version);
1028
1029 int ipmi_set_my_address(ipmi_user_t   user,
1030                         unsigned int  channel,
1031                         unsigned char address)
1032 {
1033         if (channel >= IPMI_MAX_CHANNELS)
1034                 return -EINVAL;
1035         user->intf->channels[channel].address = address;
1036         return 0;
1037 }
1038 EXPORT_SYMBOL(ipmi_set_my_address);
1039
1040 int ipmi_get_my_address(ipmi_user_t   user,
1041                         unsigned int  channel,
1042                         unsigned char *address)
1043 {
1044         if (channel >= IPMI_MAX_CHANNELS)
1045                 return -EINVAL;
1046         *address = user->intf->channels[channel].address;
1047         return 0;
1048 }
1049 EXPORT_SYMBOL(ipmi_get_my_address);
1050
1051 int ipmi_set_my_LUN(ipmi_user_t   user,
1052                     unsigned int  channel,
1053                     unsigned char LUN)
1054 {
1055         if (channel >= IPMI_MAX_CHANNELS)
1056                 return -EINVAL;
1057         user->intf->channels[channel].lun = LUN & 0x3;
1058         return 0;
1059 }
1060 EXPORT_SYMBOL(ipmi_set_my_LUN);
1061
1062 int ipmi_get_my_LUN(ipmi_user_t   user,
1063                     unsigned int  channel,
1064                     unsigned char *address)
1065 {
1066         if (channel >= IPMI_MAX_CHANNELS)
1067                 return -EINVAL;
1068         *address = user->intf->channels[channel].lun;
1069         return 0;
1070 }
1071 EXPORT_SYMBOL(ipmi_get_my_LUN);
1072
1073 int ipmi_get_maintenance_mode(ipmi_user_t user)
1074 {
1075         int           mode;
1076         unsigned long flags;
1077
1078         spin_lock_irqsave(&user->intf->maintenance_mode_lock, flags);
1079         mode = user->intf->maintenance_mode;
1080         spin_unlock_irqrestore(&user->intf->maintenance_mode_lock, flags);
1081
1082         return mode;
1083 }
1084 EXPORT_SYMBOL(ipmi_get_maintenance_mode);
1085
1086 static void maintenance_mode_update(ipmi_smi_t intf)
1087 {
1088         if (intf->handlers->set_maintenance_mode)
1089                 intf->handlers->set_maintenance_mode(
1090                         intf->send_info, intf->maintenance_mode_enable);
1091 }
1092
1093 int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
1094 {
1095         int           rv = 0;
1096         unsigned long flags;
1097         ipmi_smi_t    intf = user->intf;
1098
1099         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1100         if (intf->maintenance_mode != mode) {
1101                 switch (mode) {
1102                 case IPMI_MAINTENANCE_MODE_AUTO:
1103                         intf->maintenance_mode = mode;
1104                         intf->maintenance_mode_enable
1105                                 = (intf->auto_maintenance_timeout > 0);
1106                         break;
1107
1108                 case IPMI_MAINTENANCE_MODE_OFF:
1109                         intf->maintenance_mode = mode;
1110                         intf->maintenance_mode_enable = 0;
1111                         break;
1112
1113                 case IPMI_MAINTENANCE_MODE_ON:
1114                         intf->maintenance_mode = mode;
1115                         intf->maintenance_mode_enable = 1;
1116                         break;
1117
1118                 default:
1119                         rv = -EINVAL;
1120                         goto out_unlock;
1121                 }
1122
1123                 maintenance_mode_update(intf);
1124         }
1125  out_unlock:
1126         spin_unlock_irqrestore(&intf->maintenance_mode_lock, flags);
1127
1128         return rv;
1129 }
1130 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
1131
1132 int ipmi_set_gets_events(ipmi_user_t user, int val)
1133 {
1134         unsigned long        flags;
1135         ipmi_smi_t           intf = user->intf;
1136         struct ipmi_recv_msg *msg, *msg2;
1137         struct list_head     msgs;
1138
1139         INIT_LIST_HEAD(&msgs);
1140
1141         spin_lock_irqsave(&intf->events_lock, flags);
1142         user->gets_events = val;
1143
1144         if (intf->delivering_events)
1145                 /*
1146                  * Another thread is delivering events for this, so
1147                  * let it handle any new events.
1148                  */
1149                 goto out;
1150
1151         /* Deliver any queued events. */
1152         while (user->gets_events && !list_empty(&intf->waiting_events)) {
1153                 list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link)
1154                         list_move_tail(&msg->link, &msgs);
1155                 intf->waiting_events_count = 0;
1156                 if (intf->event_msg_printed) {
1157                         printk(KERN_WARNING PFX "Event queue no longer"
1158                                " full\n");
1159                         intf->event_msg_printed = 0;
1160                 }
1161
1162                 intf->delivering_events = 1;
1163                 spin_unlock_irqrestore(&intf->events_lock, flags);
1164
1165                 list_for_each_entry_safe(msg, msg2, &msgs, link) {
1166                         msg->user = user;
1167                         kref_get(&user->refcount);
1168                         deliver_response(msg);
1169                 }
1170
1171                 spin_lock_irqsave(&intf->events_lock, flags);
1172                 intf->delivering_events = 0;
1173         }
1174
1175  out:
1176         spin_unlock_irqrestore(&intf->events_lock, flags);
1177
1178         return 0;
1179 }
1180 EXPORT_SYMBOL(ipmi_set_gets_events);
1181
1182 static struct cmd_rcvr *find_cmd_rcvr(ipmi_smi_t    intf,
1183                                       unsigned char netfn,
1184                                       unsigned char cmd,
1185                                       unsigned char chan)
1186 {
1187         struct cmd_rcvr *rcvr;
1188
1189         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1190                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1191                                         && (rcvr->chans & (1 << chan)))
1192                         return rcvr;
1193         }
1194         return NULL;
1195 }
1196
1197 static int is_cmd_rcvr_exclusive(ipmi_smi_t    intf,
1198                                  unsigned char netfn,
1199                                  unsigned char cmd,
1200                                  unsigned int  chans)
1201 {
1202         struct cmd_rcvr *rcvr;
1203
1204         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
1205                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)
1206                                         && (rcvr->chans & chans))
1207                         return 0;
1208         }
1209         return 1;
1210 }
1211
1212 int ipmi_register_for_cmd(ipmi_user_t   user,
1213                           unsigned char netfn,
1214                           unsigned char cmd,
1215                           unsigned int  chans)
1216 {
1217         ipmi_smi_t      intf = user->intf;
1218         struct cmd_rcvr *rcvr;
1219         int             rv = 0;
1220
1221
1222         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
1223         if (!rcvr)
1224                 return -ENOMEM;
1225         rcvr->cmd = cmd;
1226         rcvr->netfn = netfn;
1227         rcvr->chans = chans;
1228         rcvr->user = user;
1229
1230         mutex_lock(&intf->cmd_rcvrs_mutex);
1231         /* Make sure the command/netfn is not already registered. */
1232         if (!is_cmd_rcvr_exclusive(intf, netfn, cmd, chans)) {
1233                 rv = -EBUSY;
1234                 goto out_unlock;
1235         }
1236
1237         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
1238
1239  out_unlock:
1240         mutex_unlock(&intf->cmd_rcvrs_mutex);
1241         if (rv)
1242                 kfree(rcvr);
1243
1244         return rv;
1245 }
1246 EXPORT_SYMBOL(ipmi_register_for_cmd);
1247
1248 int ipmi_unregister_for_cmd(ipmi_user_t   user,
1249                             unsigned char netfn,
1250                             unsigned char cmd,
1251                             unsigned int  chans)
1252 {
1253         ipmi_smi_t      intf = user->intf;
1254         struct cmd_rcvr *rcvr;
1255         struct cmd_rcvr *rcvrs = NULL;
1256         int i, rv = -ENOENT;
1257
1258         mutex_lock(&intf->cmd_rcvrs_mutex);
1259         for (i = 0; i < IPMI_NUM_CHANNELS; i++) {
1260                 if (((1 << i) & chans) == 0)
1261                         continue;
1262                 rcvr = find_cmd_rcvr(intf, netfn, cmd, i);
1263                 if (rcvr == NULL)
1264                         continue;
1265                 if (rcvr->user == user) {
1266                         rv = 0;
1267                         rcvr->chans &= ~chans;
1268                         if (rcvr->chans == 0) {
1269                                 list_del_rcu(&rcvr->link);
1270                                 rcvr->next = rcvrs;
1271                                 rcvrs = rcvr;
1272                         }
1273                 }
1274         }
1275         mutex_unlock(&intf->cmd_rcvrs_mutex);
1276         synchronize_rcu();
1277         while (rcvrs) {
1278                 rcvr = rcvrs;
1279                 rcvrs = rcvr->next;
1280                 kfree(rcvr);
1281         }
1282         return rv;
1283 }
1284 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
1285
1286 static unsigned char
1287 ipmb_checksum(unsigned char *data, int size)
1288 {
1289         unsigned char csum = 0;
1290
1291         for (; size > 0; size--, data++)
1292                 csum += *data;
1293
1294         return -csum;
1295 }
1296
1297 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
1298                                    struct kernel_ipmi_msg *msg,
1299                                    struct ipmi_ipmb_addr *ipmb_addr,
1300                                    long                  msgid,
1301                                    unsigned char         ipmb_seq,
1302                                    int                   broadcast,
1303                                    unsigned char         source_address,
1304                                    unsigned char         source_lun)
1305 {
1306         int i = broadcast;
1307
1308         /* Format the IPMB header data. */
1309         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1310         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1311         smi_msg->data[2] = ipmb_addr->channel;
1312         if (broadcast)
1313                 smi_msg->data[3] = 0;
1314         smi_msg->data[i+3] = ipmb_addr->slave_addr;
1315         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
1316         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
1317         smi_msg->data[i+6] = source_address;
1318         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
1319         smi_msg->data[i+8] = msg->cmd;
1320
1321         /* Now tack on the data to the message. */
1322         if (msg->data_len > 0)
1323                 memcpy(&(smi_msg->data[i+9]), msg->data,
1324                        msg->data_len);
1325         smi_msg->data_size = msg->data_len + 9;
1326
1327         /* Now calculate the checksum and tack it on. */
1328         smi_msg->data[i+smi_msg->data_size]
1329                 = ipmb_checksum(&(smi_msg->data[i+6]),
1330                                 smi_msg->data_size-6);
1331
1332         /*
1333          * Add on the checksum size and the offset from the
1334          * broadcast.
1335          */
1336         smi_msg->data_size += 1 + i;
1337
1338         smi_msg->msgid = msgid;
1339 }
1340
1341 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
1342                                   struct kernel_ipmi_msg *msg,
1343                                   struct ipmi_lan_addr  *lan_addr,
1344                                   long                  msgid,
1345                                   unsigned char         ipmb_seq,
1346                                   unsigned char         source_lun)
1347 {
1348         /* Format the IPMB header data. */
1349         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
1350         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
1351         smi_msg->data[2] = lan_addr->channel;
1352         smi_msg->data[3] = lan_addr->session_handle;
1353         smi_msg->data[4] = lan_addr->remote_SWID;
1354         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
1355         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
1356         smi_msg->data[7] = lan_addr->local_SWID;
1357         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
1358         smi_msg->data[9] = msg->cmd;
1359
1360         /* Now tack on the data to the message. */
1361         if (msg->data_len > 0)
1362                 memcpy(&(smi_msg->data[10]), msg->data,
1363                        msg->data_len);
1364         smi_msg->data_size = msg->data_len + 10;
1365
1366         /* Now calculate the checksum and tack it on. */
1367         smi_msg->data[smi_msg->data_size]
1368                 = ipmb_checksum(&(smi_msg->data[7]),
1369                                 smi_msg->data_size-7);
1370
1371         /*
1372          * Add on the checksum size and the offset from the
1373          * broadcast.
1374          */
1375         smi_msg->data_size += 1;
1376
1377         smi_msg->msgid = msgid;
1378 }
1379
1380 /*
1381  * Separate from ipmi_request so that the user does not have to be
1382  * supplied in certain circumstances (mainly at panic time).  If
1383  * messages are supplied, they will be freed, even if an error
1384  * occurs.
1385  */
1386 static int i_ipmi_request(ipmi_user_t          user,
1387                           ipmi_smi_t           intf,
1388                           struct ipmi_addr     *addr,
1389                           long                 msgid,
1390                           struct kernel_ipmi_msg *msg,
1391                           void                 *user_msg_data,
1392                           void                 *supplied_smi,
1393                           struct ipmi_recv_msg *supplied_recv,
1394                           int                  priority,
1395                           unsigned char        source_address,
1396                           unsigned char        source_lun,
1397                           int                  retries,
1398                           unsigned int         retry_time_ms)
1399 {
1400         int                      rv = 0;
1401         struct ipmi_smi_msg      *smi_msg;
1402         struct ipmi_recv_msg     *recv_msg;
1403         unsigned long            flags;
1404         struct ipmi_smi_handlers *handlers;
1405
1406
1407         if (supplied_recv)
1408                 recv_msg = supplied_recv;
1409         else {
1410                 recv_msg = ipmi_alloc_recv_msg();
1411                 if (recv_msg == NULL)
1412                         return -ENOMEM;
1413         }
1414         recv_msg->user_msg_data = user_msg_data;
1415
1416         if (supplied_smi)
1417                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1418         else {
1419                 smi_msg = ipmi_alloc_smi_msg();
1420                 if (smi_msg == NULL) {
1421                         ipmi_free_recv_msg(recv_msg);
1422                         return -ENOMEM;
1423                 }
1424         }
1425
1426         rcu_read_lock();
1427         handlers = intf->handlers;
1428         if (!handlers) {
1429                 rv = -ENODEV;
1430                 goto out_err;
1431         }
1432
1433         recv_msg->user = user;
1434         if (user)
1435                 kref_get(&user->refcount);
1436         recv_msg->msgid = msgid;
1437         /*
1438          * Store the message to send in the receive message so timeout
1439          * responses can get the proper response data.
1440          */
1441         recv_msg->msg = *msg;
1442
1443         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1444                 struct ipmi_system_interface_addr *smi_addr;
1445
1446                 if (msg->netfn & 1) {
1447                         /* Responses are not allowed to the SMI. */
1448                         rv = -EINVAL;
1449                         goto out_err;
1450                 }
1451
1452                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1453                 if (smi_addr->lun > 3) {
1454                         ipmi_inc_stat(intf, sent_invalid_commands);
1455                         rv = -EINVAL;
1456                         goto out_err;
1457                 }
1458
1459                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1460
1461                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1462                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1463                         || (msg->cmd == IPMI_GET_MSG_CMD)
1464                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD))) {
1465                         /*
1466                          * We don't let the user do these, since we manage
1467                          * the sequence numbers.
1468                          */
1469                         ipmi_inc_stat(intf, sent_invalid_commands);
1470                         rv = -EINVAL;
1471                         goto out_err;
1472                 }
1473
1474                 if (((msg->netfn == IPMI_NETFN_APP_REQUEST)
1475                       && ((msg->cmd == IPMI_COLD_RESET_CMD)
1476                           || (msg->cmd == IPMI_WARM_RESET_CMD)))
1477                      || (msg->netfn == IPMI_NETFN_FIRMWARE_REQUEST)) {
1478                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
1479                         intf->auto_maintenance_timeout
1480                                 = IPMI_MAINTENANCE_MODE_TIMEOUT;
1481                         if (!intf->maintenance_mode
1482                             && !intf->maintenance_mode_enable) {
1483                                 intf->maintenance_mode_enable = 1;
1484                                 maintenance_mode_update(intf);
1485                         }
1486                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
1487                                                flags);
1488                 }
1489
1490                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1491                         ipmi_inc_stat(intf, sent_invalid_commands);
1492                         rv = -EMSGSIZE;
1493                         goto out_err;
1494                 }
1495
1496                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1497                 smi_msg->data[1] = msg->cmd;
1498                 smi_msg->msgid = msgid;
1499                 smi_msg->user_data = recv_msg;
1500                 if (msg->data_len > 0)
1501                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1502                 smi_msg->data_size = msg->data_len + 2;
1503                 ipmi_inc_stat(intf, sent_local_commands);
1504         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1505                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
1506                 struct ipmi_ipmb_addr *ipmb_addr;
1507                 unsigned char         ipmb_seq;
1508                 long                  seqid;
1509                 int                   broadcast = 0;
1510
1511                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1512                         ipmi_inc_stat(intf, sent_invalid_commands);
1513                         rv = -EINVAL;
1514                         goto out_err;
1515                 }
1516
1517                 if (intf->channels[addr->channel].medium
1518                                         != IPMI_CHANNEL_MEDIUM_IPMB) {
1519                         ipmi_inc_stat(intf, sent_invalid_commands);
1520                         rv = -EINVAL;
1521                         goto out_err;
1522                 }
1523
1524                 if (retries < 0) {
1525                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1526                         retries = 0; /* Don't retry broadcasts. */
1527                     else
1528                         retries = 4;
1529                 }
1530                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1531                     /*
1532                      * Broadcasts add a zero at the beginning of the
1533                      * message, but otherwise is the same as an IPMB
1534                      * address.
1535                      */
1536                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1537                     broadcast = 1;
1538                 }
1539
1540
1541                 /* Default to 1 second retries. */
1542                 if (retry_time_ms == 0)
1543                     retry_time_ms = 1000;
1544
1545                 /*
1546                  * 9 for the header and 1 for the checksum, plus
1547                  * possibly one for the broadcast.
1548                  */
1549                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1550                         ipmi_inc_stat(intf, sent_invalid_commands);
1551                         rv = -EMSGSIZE;
1552                         goto out_err;
1553                 }
1554
1555                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1556                 if (ipmb_addr->lun > 3) {
1557                         ipmi_inc_stat(intf, sent_invalid_commands);
1558                         rv = -EINVAL;
1559                         goto out_err;
1560                 }
1561
1562                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1563
1564                 if (recv_msg->msg.netfn & 0x1) {
1565                         /*
1566                          * It's a response, so use the user's sequence
1567                          * from msgid.
1568                          */
1569                         ipmi_inc_stat(intf, sent_ipmb_responses);
1570                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1571                                         msgid, broadcast,
1572                                         source_address, source_lun);
1573
1574                         /*
1575                          * Save the receive message so we can use it
1576                          * to deliver the response.
1577                          */
1578                         smi_msg->user_data = recv_msg;
1579                 } else {
1580                         /* It's a command, so get a sequence for it. */
1581
1582                         spin_lock_irqsave(&(intf->seq_lock), flags);
1583
1584                         ipmi_inc_stat(intf, sent_ipmb_commands);
1585
1586                         /*
1587                          * Create a sequence number with a 1 second
1588                          * timeout and 4 retries.
1589                          */
1590                         rv = intf_next_seq(intf,
1591                                            recv_msg,
1592                                            retry_time_ms,
1593                                            retries,
1594                                            broadcast,
1595                                            &ipmb_seq,
1596                                            &seqid);
1597                         if (rv) {
1598                                 /*
1599                                  * We have used up all the sequence numbers,
1600                                  * probably, so abort.
1601                                  */
1602                                 spin_unlock_irqrestore(&(intf->seq_lock),
1603                                                        flags);
1604                                 goto out_err;
1605                         }
1606
1607                         /*
1608                          * Store the sequence number in the message,
1609                          * so that when the send message response
1610                          * comes back we can start the timer.
1611                          */
1612                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1613                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1614                                         ipmb_seq, broadcast,
1615                                         source_address, source_lun);
1616
1617                         /*
1618                          * Copy the message into the recv message data, so we
1619                          * can retransmit it later if necessary.
1620                          */
1621                         memcpy(recv_msg->msg_data, smi_msg->data,
1622                                smi_msg->data_size);
1623                         recv_msg->msg.data = recv_msg->msg_data;
1624                         recv_msg->msg.data_len = smi_msg->data_size;
1625
1626                         /*
1627                          * We don't unlock until here, because we need
1628                          * to copy the completed message into the
1629                          * recv_msg before we release the lock.
1630                          * Otherwise, race conditions may bite us.  I
1631                          * know that's pretty paranoid, but I prefer
1632                          * to be correct.
1633                          */
1634                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1635                 }
1636         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1637                 struct ipmi_lan_addr  *lan_addr;
1638                 unsigned char         ipmb_seq;
1639                 long                  seqid;
1640
1641                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1642                         ipmi_inc_stat(intf, sent_invalid_commands);
1643                         rv = -EINVAL;
1644                         goto out_err;
1645                 }
1646
1647                 if ((intf->channels[addr->channel].medium
1648                                 != IPMI_CHANNEL_MEDIUM_8023LAN)
1649                     && (intf->channels[addr->channel].medium
1650                                 != IPMI_CHANNEL_MEDIUM_ASYNC)) {
1651                         ipmi_inc_stat(intf, sent_invalid_commands);
1652                         rv = -EINVAL;
1653                         goto out_err;
1654                 }
1655
1656                 retries = 4;
1657
1658                 /* Default to 1 second retries. */
1659                 if (retry_time_ms == 0)
1660                     retry_time_ms = 1000;
1661
1662                 /* 11 for the header and 1 for the checksum. */
1663                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1664                         ipmi_inc_stat(intf, sent_invalid_commands);
1665                         rv = -EMSGSIZE;
1666                         goto out_err;
1667                 }
1668
1669                 lan_addr = (struct ipmi_lan_addr *) addr;
1670                 if (lan_addr->lun > 3) {
1671                         ipmi_inc_stat(intf, sent_invalid_commands);
1672                         rv = -EINVAL;
1673                         goto out_err;
1674                 }
1675
1676                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1677
1678                 if (recv_msg->msg.netfn & 0x1) {
1679                         /*
1680                          * It's a response, so use the user's sequence
1681                          * from msgid.
1682                          */
1683                         ipmi_inc_stat(intf, sent_lan_responses);
1684                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1685                                        msgid, source_lun);
1686
1687                         /*
1688                          * Save the receive message so we can use it
1689                          * to deliver the response.
1690                          */
1691                         smi_msg->user_data = recv_msg;
1692                 } else {
1693                         /* It's a command, so get a sequence for it. */
1694
1695                         spin_lock_irqsave(&(intf->seq_lock), flags);
1696
1697                         ipmi_inc_stat(intf, sent_lan_commands);
1698
1699                         /*
1700                          * Create a sequence number with a 1 second
1701                          * timeout and 4 retries.
1702                          */
1703                         rv = intf_next_seq(intf,
1704                                            recv_msg,
1705                                            retry_time_ms,
1706                                            retries,
1707                                            0,
1708                                            &ipmb_seq,
1709                                            &seqid);
1710                         if (rv) {
1711                                 /*
1712                                  * We have used up all the sequence numbers,
1713                                  * probably, so abort.
1714                                  */
1715                                 spin_unlock_irqrestore(&(intf->seq_lock),
1716                                                        flags);
1717                                 goto out_err;
1718                         }
1719
1720                         /*
1721                          * Store the sequence number in the message,
1722                          * so that when the send message response
1723                          * comes back we can start the timer.
1724                          */
1725                         format_lan_msg(smi_msg, msg, lan_addr,
1726                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1727                                        ipmb_seq, source_lun);
1728
1729                         /*
1730                          * Copy the message into the recv message data, so we
1731                          * can retransmit it later if necessary.
1732                          */
1733                         memcpy(recv_msg->msg_data, smi_msg->data,
1734                                smi_msg->data_size);
1735                         recv_msg->msg.data = recv_msg->msg_data;
1736                         recv_msg->msg.data_len = smi_msg->data_size;
1737
1738                         /*
1739                          * We don't unlock until here, because we need
1740                          * to copy the completed message into the
1741                          * recv_msg before we release the lock.
1742                          * Otherwise, race conditions may bite us.  I
1743                          * know that's pretty paranoid, but I prefer
1744                          * to be correct.
1745                          */
1746                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1747                 }
1748         } else {
1749             /* Unknown address type. */
1750                 ipmi_inc_stat(intf, sent_invalid_commands);
1751                 rv = -EINVAL;
1752                 goto out_err;
1753         }
1754
1755 #ifdef DEBUG_MSGING
1756         {
1757                 int m;
1758                 for (m = 0; m < smi_msg->data_size; m++)
1759                         printk(" %2.2x", smi_msg->data[m]);
1760                 printk("\n");
1761         }
1762 #endif
1763
1764         handlers->sender(intf->send_info, smi_msg, priority);
1765         rcu_read_unlock();
1766
1767         return 0;
1768
1769  out_err:
1770         rcu_read_unlock();
1771         ipmi_free_smi_msg(smi_msg);
1772         ipmi_free_recv_msg(recv_msg);
1773         return rv;
1774 }
1775
1776 static int check_addr(ipmi_smi_t       intf,
1777                       struct ipmi_addr *addr,
1778                       unsigned char    *saddr,
1779                       unsigned char    *lun)
1780 {
1781         if (addr->channel >= IPMI_MAX_CHANNELS)
1782                 return -EINVAL;
1783         *lun = intf->channels[addr->channel].lun;
1784         *saddr = intf->channels[addr->channel].address;
1785         return 0;
1786 }
1787
1788 int ipmi_request_settime(ipmi_user_t      user,
1789                          struct ipmi_addr *addr,
1790                          long             msgid,
1791                          struct kernel_ipmi_msg  *msg,
1792                          void             *user_msg_data,
1793                          int              priority,
1794                          int              retries,
1795                          unsigned int     retry_time_ms)
1796 {
1797         unsigned char saddr, lun;
1798         int           rv;
1799
1800         if (!user)
1801                 return -EINVAL;
1802         rv = check_addr(user->intf, addr, &saddr, &lun);
1803         if (rv)
1804                 return rv;
1805         return i_ipmi_request(user,
1806                               user->intf,
1807                               addr,
1808                               msgid,
1809                               msg,
1810                               user_msg_data,
1811                               NULL, NULL,
1812                               priority,
1813                               saddr,
1814                               lun,
1815                               retries,
1816                               retry_time_ms);
1817 }
1818 EXPORT_SYMBOL(ipmi_request_settime);
1819
1820 int ipmi_request_supply_msgs(ipmi_user_t          user,
1821                              struct ipmi_addr     *addr,
1822                              long                 msgid,
1823                              struct kernel_ipmi_msg *msg,
1824                              void                 *user_msg_data,
1825                              void                 *supplied_smi,
1826                              struct ipmi_recv_msg *supplied_recv,
1827                              int                  priority)
1828 {
1829         unsigned char saddr, lun;
1830         int           rv;
1831
1832         if (!user)
1833                 return -EINVAL;
1834         rv = check_addr(user->intf, addr, &saddr, &lun);
1835         if (rv)
1836                 return rv;
1837         return i_ipmi_request(user,
1838                               user->intf,
1839                               addr,
1840                               msgid,
1841                               msg,
1842                               user_msg_data,
1843                               supplied_smi,
1844                               supplied_recv,
1845                               priority,
1846                               saddr,
1847                               lun,
1848                               -1, 0);
1849 }
1850 EXPORT_SYMBOL(ipmi_request_supply_msgs);
1851
1852 #ifdef CONFIG_PROC_FS
1853 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1854                                int count, int *eof, void *data)
1855 {
1856         char       *out = (char *) page;
1857         ipmi_smi_t intf = data;
1858         int        i;
1859         int        rv = 0;
1860
1861         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
1862                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
1863         out[rv-1] = '\n'; /* Replace the final space with a newline */
1864         out[rv] = '\0';
1865         rv++;
1866         return rv;
1867 }
1868
1869 static int version_file_read_proc(char *page, char **start, off_t off,
1870                                   int count, int *eof, void *data)
1871 {
1872         char       *out = (char *) page;
1873         ipmi_smi_t intf = data;
1874
1875         return sprintf(out, "%u.%u\n",
1876                        ipmi_version_major(&intf->bmc->id),
1877                        ipmi_version_minor(&intf->bmc->id));
1878 }
1879
1880 static int stat_file_read_proc(char *page, char **start, off_t off,
1881                                int count, int *eof, void *data)
1882 {
1883         char       *out = (char *) page;
1884         ipmi_smi_t intf = data;
1885
1886         out += sprintf(out, "sent_invalid_commands:       %u\n",
1887                        ipmi_get_stat(intf, sent_invalid_commands));
1888         out += sprintf(out, "sent_local_commands:         %u\n",
1889                        ipmi_get_stat(intf, sent_local_commands));
1890         out += sprintf(out, "handled_local_responses:     %u\n",
1891                        ipmi_get_stat(intf, handled_local_responses));
1892         out += sprintf(out, "unhandled_local_responses:   %u\n",
1893                        ipmi_get_stat(intf, unhandled_local_responses));
1894         out += sprintf(out, "sent_ipmb_commands:          %u\n",
1895                        ipmi_get_stat(intf, sent_ipmb_commands));
1896         out += sprintf(out, "sent_ipmb_command_errs:      %u\n",
1897                        ipmi_get_stat(intf, sent_ipmb_command_errs));
1898         out += sprintf(out, "retransmitted_ipmb_commands: %u\n",
1899                        ipmi_get_stat(intf, retransmitted_ipmb_commands));
1900         out += sprintf(out, "timed_out_ipmb_commands:     %u\n",
1901                        ipmi_get_stat(intf, timed_out_ipmb_commands));
1902         out += sprintf(out, "timed_out_ipmb_broadcasts:   %u\n",
1903                        ipmi_get_stat(intf, timed_out_ipmb_broadcasts));
1904         out += sprintf(out, "sent_ipmb_responses:         %u\n",
1905                        ipmi_get_stat(intf, sent_ipmb_responses));
1906         out += sprintf(out, "handled_ipmb_responses:      %u\n",
1907                        ipmi_get_stat(intf, handled_ipmb_responses));
1908         out += sprintf(out, "invalid_ipmb_responses:      %u\n",
1909                        ipmi_get_stat(intf, invalid_ipmb_responses));
1910         out += sprintf(out, "unhandled_ipmb_responses:    %u\n",
1911                        ipmi_get_stat(intf, unhandled_ipmb_responses));
1912         out += sprintf(out, "sent_lan_commands:           %u\n",
1913                        ipmi_get_stat(intf, sent_lan_commands));
1914         out += sprintf(out, "sent_lan_command_errs:       %u\n",
1915                        ipmi_get_stat(intf, sent_lan_command_errs));
1916         out += sprintf(out, "retransmitted_lan_commands:  %u\n",
1917                        ipmi_get_stat(intf, retransmitted_lan_commands));
1918         out += sprintf(out, "timed_out_lan_commands:      %u\n",
1919                        ipmi_get_stat(intf, timed_out_lan_commands));
1920         out += sprintf(out, "sent_lan_responses:          %u\n",
1921                        ipmi_get_stat(intf, sent_lan_responses));
1922         out += sprintf(out, "handled_lan_responses:       %u\n",
1923                        ipmi_get_stat(intf, handled_lan_responses));
1924         out += sprintf(out, "invalid_lan_responses:       %u\n",
1925                        ipmi_get_stat(intf, invalid_lan_responses));
1926         out += sprintf(out, "unhandled_lan_responses:     %u\n",
1927                        ipmi_get_stat(intf, unhandled_lan_responses));
1928         out += sprintf(out, "handled_commands:            %u\n",
1929                        ipmi_get_stat(intf, handled_commands));
1930         out += sprintf(out, "invalid_commands:            %u\n",
1931                        ipmi_get_stat(intf, invalid_commands));
1932         out += sprintf(out, "unhandled_commands:          %u\n",
1933                        ipmi_get_stat(intf, unhandled_commands));
1934         out += sprintf(out, "invalid_events:              %u\n",
1935                        ipmi_get_stat(intf, invalid_events));
1936         out += sprintf(out, "events:                      %u\n",
1937                        ipmi_get_stat(intf, events));
1938
1939         return (out - ((char *) page));
1940 }
1941 #endif /* CONFIG_PROC_FS */
1942
1943 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1944                             read_proc_t *read_proc, write_proc_t *write_proc,
1945                             void *data, struct module *owner)
1946 {
1947         int                    rv = 0;
1948 #ifdef CONFIG_PROC_FS
1949         struct proc_dir_entry  *file;
1950         struct ipmi_proc_entry *entry;
1951
1952         /* Create a list element. */
1953         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1954         if (!entry)
1955                 return -ENOMEM;
1956         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1957         if (!entry->name) {
1958                 kfree(entry);
1959                 return -ENOMEM;
1960         }
1961         strcpy(entry->name, name);
1962
1963         file = create_proc_entry(name, 0, smi->proc_dir);
1964         if (!file) {
1965                 kfree(entry->name);
1966                 kfree(entry);
1967                 rv = -ENOMEM;
1968         } else {
1969                 file->data = data;
1970                 file->read_proc = read_proc;
1971                 file->write_proc = write_proc;
1972                 file->owner = owner;
1973
1974                 mutex_lock(&smi->proc_entry_lock);
1975                 /* Stick it on the list. */
1976                 entry->next = smi->proc_entries;
1977                 smi->proc_entries = entry;
1978                 mutex_unlock(&smi->proc_entry_lock);
1979         }
1980 #endif /* CONFIG_PROC_FS */
1981
1982         return rv;
1983 }
1984 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
1985
1986 static int add_proc_entries(ipmi_smi_t smi, int num)
1987 {
1988         int rv = 0;
1989
1990 #ifdef CONFIG_PROC_FS
1991         sprintf(smi->proc_dir_name, "%d", num);
1992         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1993         if (!smi->proc_dir)
1994                 rv = -ENOMEM;
1995         else
1996                 smi->proc_dir->owner = THIS_MODULE;
1997
1998         if (rv == 0)
1999                 rv = ipmi_smi_add_proc_entry(smi, "stats",
2000                                              stat_file_read_proc, NULL,
2001                                              smi, THIS_MODULE);
2002
2003         if (rv == 0)
2004                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
2005                                              ipmb_file_read_proc, NULL,
2006                                              smi, THIS_MODULE);
2007
2008         if (rv == 0)
2009                 rv = ipmi_smi_add_proc_entry(smi, "version",
2010                                              version_file_read_proc, NULL,
2011                                              smi, THIS_MODULE);
2012 #endif /* CONFIG_PROC_FS */
2013
2014         return rv;
2015 }
2016
2017 static void remove_proc_entries(ipmi_smi_t smi)
2018 {
2019 #ifdef CONFIG_PROC_FS
2020         struct ipmi_proc_entry *entry;
2021
2022         mutex_lock(&smi->proc_entry_lock);
2023         while (smi->proc_entries) {
2024                 entry = smi->proc_entries;
2025                 smi->proc_entries = entry->next;
2026
2027                 remove_proc_entry(entry->name, smi->proc_dir);
2028                 kfree(entry->name);
2029                 kfree(entry);
2030         }
2031         mutex_unlock(&smi->proc_entry_lock);
2032         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
2033 #endif /* CONFIG_PROC_FS */
2034 }
2035
2036 static int __find_bmc_guid(struct device *dev, void *data)
2037 {
2038         unsigned char *id = data;
2039         struct bmc_device *bmc = dev_get_drvdata(dev);
2040         return memcmp(bmc->guid, id, 16) == 0;
2041 }
2042
2043 static struct bmc_device *ipmi_find_bmc_guid(struct device_driver *drv,
2044                                              unsigned char *guid)
2045 {
2046         struct device *dev;
2047
2048         dev = driver_find_device(drv, NULL, guid, __find_bmc_guid);
2049         if (dev)
2050                 return dev_get_drvdata(dev);
2051         else
2052                 return NULL;
2053 }
2054
2055 struct prod_dev_id {
2056         unsigned int  product_id;
2057         unsigned char device_id;
2058 };
2059
2060 static int __find_bmc_prod_dev_id(struct device *dev, void *data)
2061 {
2062         struct prod_dev_id *id = data;
2063         struct bmc_device *bmc = dev_get_drvdata(dev);
2064
2065         return (bmc->id.product_id == id->product_id
2066                 && bmc->id.device_id == id->device_id);
2067 }
2068
2069 static struct bmc_device *ipmi_find_bmc_prod_dev_id(
2070         struct device_driver *drv,
2071         unsigned int product_id, unsigned char device_id)
2072 {
2073         struct prod_dev_id id = {
2074                 .product_id = product_id,
2075                 .device_id = device_id,
2076         };
2077         struct device *dev;
2078
2079         dev = driver_find_device(drv, NULL, &id, __find_bmc_prod_dev_id);
2080         if (dev)
2081                 return dev_get_drvdata(dev);
2082         else
2083                 return NULL;
2084 }
2085
2086 static ssize_t device_id_show(struct device *dev,
2087                               struct device_attribute *attr,
2088                               char *buf)
2089 {
2090         struct bmc_device *bmc = dev_get_drvdata(dev);
2091
2092         return snprintf(buf, 10, "%u\n", bmc->id.device_id);
2093 }
2094
2095 static ssize_t provides_dev_sdrs_show(struct device *dev,
2096                                       struct device_attribute *attr,
2097                                       char *buf)
2098 {
2099         struct bmc_device *bmc = dev_get_drvdata(dev);
2100
2101         return snprintf(buf, 10, "%u\n",
2102                         (bmc->id.device_revision & 0x80) >> 7);
2103 }
2104
2105 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
2106                              char *buf)
2107 {
2108         struct bmc_device *bmc = dev_get_drvdata(dev);
2109
2110         return snprintf(buf, 20, "%u\n",
2111                         bmc->id.device_revision & 0x0F);
2112 }
2113
2114 static ssize_t firmware_rev_show(struct device *dev,
2115                                  struct device_attribute *attr,
2116                                  char *buf)
2117 {
2118         struct bmc_device *bmc = dev_get_drvdata(dev);
2119
2120         return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
2121                         bmc->id.firmware_revision_2);
2122 }
2123
2124 static ssize_t ipmi_version_show(struct device *dev,
2125                                  struct device_attribute *attr,
2126                                  char *buf)
2127 {
2128         struct bmc_device *bmc = dev_get_drvdata(dev);
2129
2130         return snprintf(buf, 20, "%u.%u\n",
2131                         ipmi_version_major(&bmc->id),
2132                         ipmi_version_minor(&bmc->id));
2133 }
2134
2135 static ssize_t add_dev_support_show(struct device *dev,
2136                                     struct device_attribute *attr,
2137                                     char *buf)
2138 {
2139         struct bmc_device *bmc = dev_get_drvdata(dev);
2140
2141         return snprintf(buf, 10, "0x%02x\n",
2142                         bmc->id.additional_device_support);
2143 }
2144
2145 static ssize_t manufacturer_id_show(struct device *dev,
2146                                     struct device_attribute *attr,
2147                                     char *buf)
2148 {
2149         struct bmc_device *bmc = dev_get_drvdata(dev);
2150
2151         return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
2152 }
2153
2154 static ssize_t product_id_show(struct device *dev,
2155                                struct device_attribute *attr,
2156                                char *buf)
2157 {
2158         struct bmc_device *bmc = dev_get_drvdata(dev);
2159
2160         return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
2161 }
2162
2163 static ssize_t aux_firmware_rev_show(struct device *dev,
2164                                      struct device_attribute *attr,
2165                                      char *buf)
2166 {
2167         struct bmc_device *bmc = dev_get_drvdata(dev);
2168
2169         return snprintf(buf, 21, "0x%02x 0x%02x 0x%02x 0x%02x\n",
2170                         bmc->id.aux_firmware_revision[3],
2171                         bmc->id.aux_firmware_revision[2],
2172                         bmc->id.aux_firmware_revision[1],
2173                         bmc->id.aux_firmware_revision[0]);
2174 }
2175
2176 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
2177                          char *buf)
2178 {
2179         struct bmc_device *bmc = dev_get_drvdata(dev);
2180
2181         return snprintf(buf, 100, "%Lx%Lx\n",
2182                         (long long) bmc->guid[0],
2183                         (long long) bmc->guid[8]);
2184 }
2185
2186 static void remove_files(struct bmc_device *bmc)
2187 {
2188         if (!bmc->dev)
2189                 return;
2190
2191         device_remove_file(&bmc->dev->dev,
2192                            &bmc->device_id_attr);
2193         device_remove_file(&bmc->dev->dev,
2194                            &bmc->provides_dev_sdrs_attr);
2195         device_remove_file(&bmc->dev->dev,
2196                            &bmc->revision_attr);
2197         device_remove_file(&bmc->dev->dev,
2198                            &bmc->firmware_rev_attr);
2199         device_remove_file(&bmc->dev->dev,
2200                            &bmc->version_attr);
2201         device_remove_file(&bmc->dev->dev,
2202                            &bmc->add_dev_support_attr);
2203         device_remove_file(&bmc->dev->dev,
2204                            &bmc->manufacturer_id_attr);
2205         device_remove_file(&bmc->dev->dev,
2206                            &bmc->product_id_attr);
2207
2208         if (bmc->id.aux_firmware_revision_set)
2209                 device_remove_file(&bmc->dev->dev,
2210                                    &bmc->aux_firmware_rev_attr);
2211         if (bmc->guid_set)
2212                 device_remove_file(&bmc->dev->dev,
2213                                    &bmc->guid_attr);
2214 }
2215
2216 static void
2217 cleanup_bmc_device(struct kref *ref)
2218 {
2219         struct bmc_device *bmc;
2220
2221         bmc = container_of(ref, struct bmc_device, refcount);
2222
2223         remove_files(bmc);
2224         platform_device_unregister(bmc->dev);
2225         kfree(bmc);
2226 }
2227
2228 static void ipmi_bmc_unregister(ipmi_smi_t intf)
2229 {
2230         struct bmc_device *bmc = intf->bmc;
2231
2232         if (intf->sysfs_name) {
2233                 sysfs_remove_link(&intf->si_dev->kobj, intf->sysfs_name);
2234                 kfree(intf->sysfs_name);
2235                 intf->sysfs_name = NULL;
2236         }
2237         if (intf->my_dev_name) {
2238                 sysfs_remove_link(&bmc->dev->dev.kobj, intf->my_dev_name);
2239                 kfree(intf->my_dev_name);
2240                 intf->my_dev_name = NULL;
2241         }
2242
2243         mutex_lock(&ipmidriver_mutex);
2244         kref_put(&bmc->refcount, cleanup_bmc_device);
2245         intf->bmc = NULL;
2246         mutex_unlock(&ipmidriver_mutex);
2247 }
2248
2249 static int create_files(struct bmc_device *bmc)
2250 {
2251         int err;
2252
2253         bmc->device_id_attr.attr.name = "device_id";
2254         bmc->device_id_attr.attr.mode = S_IRUGO;
2255         bmc->device_id_attr.show = device_id_show;
2256
2257         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
2258         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
2259         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
2260
2261         bmc->revision_attr.attr.name = "revision";
2262         bmc->revision_attr.attr.mode = S_IRUGO;
2263         bmc->revision_attr.show = revision_show;
2264
2265         bmc->firmware_rev_attr.attr.name = "firmware_revision";
2266         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
2267         bmc->firmware_rev_attr.show = firmware_rev_show;
2268
2269         bmc->version_attr.attr.name = "ipmi_version";
2270         bmc->version_attr.attr.mode = S_IRUGO;
2271         bmc->version_attr.show = ipmi_version_show;
2272
2273         bmc->add_dev_support_attr.attr.name = "additional_device_support";
2274         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
2275         bmc->add_dev_support_attr.show = add_dev_support_show;
2276
2277         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
2278         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
2279         bmc->manufacturer_id_attr.show = manufacturer_id_show;
2280
2281         bmc->product_id_attr.attr.name = "product_id";
2282         bmc->product_id_attr.attr.mode = S_IRUGO;
2283         bmc->product_id_attr.show = product_id_show;
2284
2285         bmc->guid_attr.attr.name = "guid";
2286         bmc->guid_attr.attr.mode = S_IRUGO;
2287         bmc->guid_attr.show = guid_show;
2288
2289         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
2290         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
2291         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
2292
2293         err = device_create_file(&bmc->dev->dev,
2294                            &bmc->device_id_attr);
2295         if (err)
2296                 goto out;
2297         err = device_create_file(&bmc->dev->dev,
2298                            &bmc->provides_dev_sdrs_attr);
2299         if (err)
2300                 goto out_devid;
2301         err = device_create_file(&bmc->dev->dev,
2302                            &bmc->revision_attr);
2303         if (err)
2304                 goto out_sdrs;
2305         err = device_create_file(&bmc->dev->dev,
2306                            &bmc->firmware_rev_attr);
2307         if (err)
2308                 goto out_rev;
2309         err = device_create_file(&bmc->dev->dev,
2310                            &bmc->version_attr);
2311         if (err)
2312                 goto out_firm;
2313         err = device_create_file(&bmc->dev->dev,
2314                            &bmc->add_dev_support_attr);
2315         if (err)
2316                 goto out_version;
2317         err = device_create_file(&bmc->dev->dev,
2318                            &bmc->manufacturer_id_attr);
2319         if (err)
2320                 goto out_add_dev;
2321         err = device_create_file(&bmc->dev->dev,
2322                            &bmc->product_id_attr);
2323         if (err)
2324                 goto out_manu;
2325         if (bmc->id.aux_firmware_revision_set) {
2326                 err = device_create_file(&bmc->dev->dev,
2327                                    &bmc->aux_firmware_rev_attr);
2328                 if (err)
2329                         goto out_prod_id;
2330         }
2331         if (bmc->guid_set) {
2332                 err = device_create_file(&bmc->dev->dev,
2333                                    &bmc->guid_attr);
2334                 if (err)
2335                         goto out_aux_firm;
2336         }
2337
2338         return 0;
2339
2340 out_aux_firm:
2341         if (bmc->id.aux_firmware_revision_set)
2342                 device_remove_file(&bmc->dev->dev,
2343                                    &bmc->aux_firmware_rev_attr);
2344 out_prod_id:
2345         device_remove_file(&bmc->dev->dev,
2346                            &bmc->product_id_attr);
2347 out_manu:
2348         device_remove_file(&bmc->dev->dev,
2349                            &bmc->manufacturer_id_attr);
2350 out_add_dev:
2351         device_remove_file(&bmc->dev->dev,
2352                            &bmc->add_dev_support_attr);
2353 out_version:
2354         device_remove_file(&bmc->dev->dev,
2355                            &bmc->version_attr);
2356 out_firm:
2357         device_remove_file(&bmc->dev->dev,
2358                            &bmc->firmware_rev_attr);
2359 out_rev:
2360         device_remove_file(&bmc->dev->dev,
2361                            &bmc->revision_attr);
2362 out_sdrs:
2363         device_remove_file(&bmc->dev->dev,
2364                            &bmc->provides_dev_sdrs_attr);
2365 out_devid:
2366         device_remove_file(&bmc->dev->dev,
2367                            &bmc->device_id_attr);
2368 out:
2369         return err;
2370 }
2371
2372 static int ipmi_bmc_register(ipmi_smi_t intf, int ifnum,
2373                              const char *sysfs_name)
2374 {
2375         int               rv;
2376         struct bmc_device *bmc = intf->bmc;
2377         struct bmc_device *old_bmc;
2378         int               size;
2379         char              dummy[1];
2380
2381         mutex_lock(&ipmidriver_mutex);
2382
2383         /*
2384          * Try to find if there is an bmc_device struct
2385          * representing the interfaced BMC already
2386          */
2387         if (bmc->guid_set)
2388                 old_bmc = ipmi_find_bmc_guid(&ipmidriver, bmc->guid);
2389         else
2390                 old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver,
2391                                                     bmc->id.product_id,
2392                                                     bmc->id.device_id);
2393
2394         /*
2395          * If there is already an bmc_device, free the new one,
2396          * otherwise register the new BMC device
2397          */
2398         if (old_bmc) {
2399                 kfree(bmc);
2400                 intf->bmc = old_bmc;
2401                 bmc = old_bmc;
2402
2403                 kref_get(&bmc->refcount);
2404                 mutex_unlock(&ipmidriver_mutex);
2405
2406                 printk(KERN_INFO
2407                        "ipmi: interfacing existing BMC (man_id: 0x%6.6x,"
2408                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2409                        bmc->id.manufacturer_id,
2410                        bmc->id.product_id,
2411                        bmc->id.device_id);
2412         } else {
2413                 char name[14];
2414                 unsigned char orig_dev_id = bmc->id.device_id;
2415                 int warn_printed = 0;
2416
2417                 snprintf(name, sizeof(name),
2418                          "ipmi_bmc.%4.4x", bmc->id.product_id);
2419
2420                 while (ipmi_find_bmc_prod_dev_id(&ipmidriver,
2421                                                  bmc->id.product_id,
2422                                                  bmc->id.device_id)) {
2423                         if (!warn_printed) {
2424                                 printk(KERN_WARNING PFX
2425                                        "This machine has two different BMCs"
2426                                        " with the same product id and device"
2427                                        " id.  This is an error in the"
2428                                        " firmware, but incrementing the"
2429                                        " device id to work around the problem."
2430                                        " Prod ID = 0x%x, Dev ID = 0x%x\n",
2431                                        bmc->id.product_id, bmc->id.device_id);
2432                                 warn_printed = 1;
2433                         }
2434                         bmc->id.device_id++; /* Wraps at 255 */
2435                         if (bmc->id.device_id == orig_dev_id) {
2436                                 printk(KERN_ERR PFX
2437                                        "Out of device ids!\n");
2438                                 break;
2439                         }
2440                 }
2441
2442                 bmc->dev = platform_device_alloc(name, bmc->id.device_id);
2443                 if (!bmc->dev) {
2444                         mutex_unlock(&ipmidriver_mutex);
2445                         printk(KERN_ERR
2446                                "ipmi_msghandler:"
2447                                " Unable to allocate platform device\n");
2448                         return -ENOMEM;
2449                 }
2450                 bmc->dev->dev.driver = &ipmidriver;
2451                 dev_set_drvdata(&bmc->dev->dev, bmc);
2452                 kref_init(&bmc->refcount);
2453
2454                 rv = platform_device_add(bmc->dev);
2455                 mutex_unlock(&ipmidriver_mutex);
2456                 if (rv) {
2457                         platform_device_put(bmc->dev);
2458                         bmc->dev = NULL;
2459                         printk(KERN_ERR
2460                                "ipmi_msghandler:"
2461                                " Unable to register bmc device: %d\n",
2462                                rv);
2463                         /*
2464                          * Don't go to out_err, you can only do that if
2465                          * the device is registered already.
2466                          */
2467                         return rv;
2468                 }
2469
2470                 rv = create_files(bmc);
2471                 if (rv) {
2472                         mutex_lock(&ipmidriver_mutex);
2473                         platform_device_unregister(bmc->dev);
2474                         mutex_unlock(&ipmidriver_mutex);
2475
2476                         return rv;
2477                 }
2478
2479                 printk(KERN_INFO
2480                        "ipmi: Found new BMC (man_id: 0x%6.6x, "
2481                        " prod_id: 0x%4.4x, dev_id: 0x%2.2x)\n",
2482                        bmc->id.manufacturer_id,
2483                        bmc->id.product_id,
2484                        bmc->id.device_id);
2485         }
2486
2487         /*
2488          * create symlink from system interface device to bmc device
2489          * and back.
2490          */
2491         intf->sysfs_name = kstrdup(sysfs_name, GFP_KERNEL);
2492         if (!intf->sysfs_name) {
2493                 rv = -ENOMEM;
2494                 printk(KERN_ERR
2495                        "ipmi_msghandler: allocate link to BMC: %d\n",
2496                        rv);
2497                 goto out_err;
2498         }
2499
2500         rv = sysfs_create_link(&intf->si_dev->kobj,
2501                                &bmc->dev->dev.kobj, intf->sysfs_name);
2502         if (rv) {
2503                 kfree(intf->sysfs_name);
2504                 intf->sysfs_name = NULL;
2505                 printk(KERN_ERR
2506                        "ipmi_msghandler: Unable to create bmc symlink: %d\n",
2507                        rv);
2508                 goto out_err;
2509         }
2510
2511         size = snprintf(dummy, 0, "ipmi%d", ifnum);
2512         intf->my_dev_name = kmalloc(size+1, GFP_KERNEL);
2513         if (!intf->my_dev_name) {
2514                 kfree(intf->sysfs_name);
2515                 intf->sysfs_name = NULL;
2516                 rv = -ENOMEM;
2517                 printk(KERN_ERR
2518                        "ipmi_msghandler: allocate link from BMC: %d\n",
2519                        rv);
2520                 goto out_err;
2521         }
2522         snprintf(intf->my_dev_name, size+1, "ipmi%d", ifnum);
2523
2524         rv = sysfs_create_link(&bmc->dev->dev.kobj, &intf->si_dev->kobj,
2525                                intf->my_dev_name);
2526         if (rv) {
2527                 kfree(intf->sysfs_name);
2528                 intf->sysfs_name = NULL;
2529                 kfree(intf->my_dev_name);
2530                 intf->my_dev_name = NULL;
2531                 printk(KERN_ERR
2532                        "ipmi_msghandler:"
2533                        " Unable to create symlink to bmc: %d\n",
2534                        rv);
2535                 goto out_err;
2536         }
2537
2538         return 0;
2539
2540 out_err:
2541         ipmi_bmc_unregister(intf);
2542         return rv;
2543 }
2544
2545 static int
2546 send_guid_cmd(ipmi_smi_t intf, int chan)
2547 {
2548         struct kernel_ipmi_msg            msg;
2549         struct ipmi_system_interface_addr si;
2550
2551         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2552         si.channel = IPMI_BMC_CHANNEL;
2553         si.lun = 0;
2554
2555         msg.netfn = IPMI_NETFN_APP_REQUEST;
2556         msg.cmd = IPMI_GET_DEVICE_GUID_CMD;
2557         msg.data = NULL;
2558         msg.data_len = 0;
2559         return i_ipmi_request(NULL,
2560                               intf,
2561                               (struct ipmi_addr *) &si,
2562                               0,
2563                               &msg,
2564                               intf,
2565                               NULL,
2566                               NULL,
2567                               0,
2568                               intf->channels[0].address,
2569                               intf->channels[0].lun,
2570                               -1, 0);
2571 }
2572
2573 static void
2574 guid_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2575 {
2576         if ((msg->addr.addr_type != IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2577             || (msg->msg.netfn != IPMI_NETFN_APP_RESPONSE)
2578             || (msg->msg.cmd != IPMI_GET_DEVICE_GUID_CMD))
2579                 /* Not for me */
2580                 return;
2581
2582         if (msg->msg.data[0] != 0) {
2583                 /* Error from getting the GUID, the BMC doesn't have one. */
2584                 intf->bmc->guid_set = 0;
2585                 goto out;
2586         }
2587
2588         if (msg->msg.data_len < 17) {
2589                 intf->bmc->guid_set = 0;
2590                 printk(KERN_WARNING PFX
2591                        "guid_handler: The GUID response from the BMC was too"
2592                        " short, it was %d but should have been 17.  Assuming"
2593                        " GUID is not available.\n",
2594                        msg->msg.data_len);
2595                 goto out;
2596         }
2597
2598         memcpy(intf->bmc->guid, msg->msg.data, 16);
2599         intf->bmc->guid_set = 1;
2600  out:
2601         wake_up(&intf->waitq);
2602 }
2603
2604 static void
2605 get_guid(ipmi_smi_t intf)
2606 {
2607         int rv;
2608
2609         intf->bmc->guid_set = 0x2;
2610         intf->null_user_handler = guid_handler;
2611         rv = send_guid_cmd(intf, 0);
2612         if (rv)
2613                 /* Send failed, no GUID available. */
2614                 intf->bmc->guid_set = 0;
2615         wait_event(intf->waitq, intf->bmc->guid_set != 2);
2616         intf->null_user_handler = NULL;
2617 }
2618
2619 static int
2620 send_channel_info_cmd(ipmi_smi_t intf, int chan)
2621 {
2622         struct kernel_ipmi_msg            msg;
2623         unsigned char                     data[1];
2624         struct ipmi_system_interface_addr si;
2625
2626         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2627         si.channel = IPMI_BMC_CHANNEL;
2628         si.lun = 0;
2629
2630         msg.netfn = IPMI_NETFN_APP_REQUEST;
2631         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
2632         msg.data = data;
2633         msg.data_len = 1;
2634         data[0] = chan;
2635         return i_ipmi_request(NULL,
2636                               intf,
2637                               (struct ipmi_addr *) &si,
2638                               0,
2639                               &msg,
2640                               intf,
2641                               NULL,
2642                               NULL,
2643                               0,
2644                               intf->channels[0].address,
2645                               intf->channels[0].lun,
2646                               -1, 0);
2647 }
2648
2649 static void
2650 channel_handler(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
2651 {
2652         int rv = 0;
2653         int chan;
2654
2655         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
2656             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
2657             && (msg->msg.cmd == IPMI_GET_CHANNEL_INFO_CMD)) {
2658                 /* It's the one we want */
2659                 if (msg->msg.data[0] != 0) {
2660                         /* Got an error from the channel, just go on. */
2661
2662                         if (msg->msg.data[0] == IPMI_INVALID_COMMAND_ERR) {
2663                                 /*
2664                                  * If the MC does not support this
2665                                  * command, that is legal.  We just
2666                                  * assume it has one IPMB at channel
2667                                  * zero.
2668                                  */
2669                                 intf->channels[0].medium
2670                                         = IPMI_CHANNEL_MEDIUM_IPMB;
2671                                 intf->channels[0].protocol
2672                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
2673                                 rv = -ENOSYS;
2674
2675                                 intf->curr_channel = IPMI_MAX_CHANNELS;
2676                                 wake_up(&intf->waitq);
2677                                 goto out;
2678                         }
2679                         goto next_channel;
2680                 }
2681                 if (msg->msg.data_len < 4) {
2682                         /* Message not big enough, just go on. */
2683                         goto next_channel;
2684                 }
2685                 chan = intf->curr_channel;
2686                 intf->channels[chan].medium = msg->msg.data[2] & 0x7f;
2687                 intf->channels[chan].protocol = msg->msg.data[3] & 0x1f;
2688
2689  next_channel:
2690                 intf->curr_channel++;
2691                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
2692                         wake_up(&intf->waitq);
2693                 else
2694                         rv = send_channel_info_cmd(intf, intf->curr_channel);
2695
2696                 if (rv) {
2697                         /* Got an error somehow, just give up. */
2698                         intf->curr_channel = IPMI_MAX_CHANNELS;
2699                         wake_up(&intf->waitq);
2700
2701                         printk(KERN_WARNING PFX
2702                                "Error sending channel information: %d\n",
2703                                rv);
2704                 }
2705         }
2706  out:
2707         return;
2708 }
2709
2710 void ipmi_poll_interface(ipmi_user_t user)
2711 {
2712         ipmi_smi_t intf = user->intf;
2713
2714         if (intf->handlers->poll)
2715                 intf->handlers->poll(intf->send_info);
2716 }
2717 EXPORT_SYMBOL(ipmi_poll_interface);
2718
2719 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
2720                       void                     *send_info,
2721                       struct ipmi_device_id    *device_id,
2722                       struct device            *si_dev,
2723                       const char               *sysfs_name,
2724                       unsigned char            slave_addr)
2725 {
2726         int              i, j;
2727         int              rv;
2728         ipmi_smi_t       intf;
2729         ipmi_smi_t       tintf;
2730         struct list_head *link;
2731
2732         /*
2733          * Make sure the driver is actually initialized, this handles
2734          * problems with initialization order.
2735          */
2736         if (!initialized) {
2737                 rv = ipmi_init_msghandler();
2738                 if (rv)
2739                         return rv;
2740                 /*
2741                  * The init code doesn't return an error if it was turned
2742                  * off, but it won't initialize.  Check that.
2743                  */
2744                 if (!initialized)
2745                         return -ENODEV;
2746         }
2747
2748         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
2749         if (!intf)
2750                 return -ENOMEM;
2751
2752         intf->ipmi_version_major = ipmi_version_major(device_id);
2753         intf->ipmi_version_minor = ipmi_version_minor(device_id);
2754
2755         intf->bmc = kzalloc(sizeof(*intf->bmc), GFP_KERNEL);
2756         if (!intf->bmc) {
2757                 kfree(intf);
2758                 return -ENOMEM;
2759         }
2760         intf->intf_num = -1; /* Mark it invalid for now. */
2761         kref_init(&intf->refcount);
2762         intf->bmc->id = *device_id;
2763         intf->si_dev = si_dev;
2764         for (j = 0; j < IPMI_MAX_CHANNELS; j++) {
2765                 intf->channels[j].address = IPMI_BMC_SLAVE_ADDR;
2766                 intf->channels[j].lun = 2;
2767         }
2768         if (slave_addr != 0)
2769                 intf->channels[0].address = slave_addr;
2770         INIT_LIST_HEAD(&intf->users);
2771         intf->handlers = handlers;
2772         intf->send_info = send_info;
2773         spin_lock_init(&intf->seq_lock);
2774         for (j = 0; j < IPMI_IPMB_NUM_SEQ; j++) {
2775                 intf->seq_table[j].inuse = 0;
2776                 intf->seq_table[j].seqid = 0;
2777         }
2778         intf->curr_seq = 0;
2779 #ifdef CONFIG_PROC_FS
2780         mutex_init(&intf->proc_entry_lock);
2781 #endif
2782         spin_lock_init(&intf->waiting_msgs_lock);
2783         INIT_LIST_HEAD(&intf->waiting_msgs);
2784         spin_lock_init(&intf->events_lock);
2785         INIT_LIST_HEAD(&intf->waiting_events);
2786         intf->waiting_events_count = 0;
2787         mutex_init(&intf->cmd_rcvrs_mutex);
2788         spin_lock_init(&intf->maintenance_mode_lock);
2789         INIT_LIST_HEAD(&intf->cmd_rcvrs);
2790         init_waitqueue_head(&intf->waitq);
2791         for (i = 0; i < IPMI_NUM_STATS; i++)
2792                 atomic_set(&intf->stats[i], 0);
2793
2794         intf->proc_dir = NULL;
2795
2796         mutex_lock(&smi_watchers_mutex);
2797         mutex_lock(&ipmi_interfaces_mutex);
2798         /* Look for a hole in the numbers. */
2799         i = 0;
2800         link = &ipmi_interfaces;
2801         list_for_each_entry_rcu(tintf, &ipmi_interfaces, link) {
2802                 if (tintf->intf_num != i) {
2803                         link = &tintf->link;
2804                         break;
2805                 }
2806                 i++;
2807         }
2808         /* Add the new interface in numeric order. */
2809         if (i == 0)
2810                 list_add_rcu(&intf->link, &ipmi_interfaces);
2811         else
2812                 list_add_tail_rcu(&intf->link, link);
2813
2814         rv = handlers->start_processing(send_info, intf);
2815         if (rv)
2816                 goto out;
2817
2818         get_guid(intf);
2819
2820         if ((intf->ipmi_version_major > 1)
2821                         || ((intf->ipmi_version_major == 1)
2822                             && (intf->ipmi_version_minor >= 5))) {
2823                 /*
2824                  * Start scanning the channels to see what is
2825                  * available.
2826                  */
2827                 intf->null_user_handler = channel_handler;
2828                 intf->curr_channel = 0;
2829                 rv = send_channel_info_cmd(intf, 0);
2830                 if (rv)
2831                         goto out;
2832
2833                 /* Wait for the channel info to be read. */
2834                 wait_event(intf->waitq,
2835                            intf->curr_channel >= IPMI_MAX_CHANNELS);
2836                 intf->null_user_handler = NULL;
2837         } else {
2838                 /* Assume a single IPMB channel at zero. */
2839                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
2840                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
2841         }
2842
2843         if (rv == 0)
2844                 rv = add_proc_entries(intf, i);
2845
2846         rv = ipmi_bmc_register(intf, i, sysfs_name);
2847
2848  out:
2849         if (rv) {
2850                 if (intf->proc_dir)
2851                         remove_proc_entries(intf);
2852                 intf->handlers = NULL;
2853                 list_del_rcu(&intf->link);
2854                 mutex_unlock(&ipmi_interfaces_mutex);
2855                 mutex_unlock(&smi_watchers_mutex);
2856                 synchronize_rcu();
2857                 kref_put(&intf->refcount, intf_free);
2858         } else {
2859                 /*
2860                  * Keep memory order straight for RCU readers.  Make
2861                  * sure everything else is committed to memory before
2862                  * setting intf_num to mark the interface valid.
2863                  */
2864                 smp_wmb();
2865                 intf->intf_num = i;
2866                 mutex_unlock(&ipmi_interfaces_mutex);
2867                 /* After this point the interface is legal to use. */
2868                 call_smi_watchers(i, intf->si_dev);
2869                 mutex_unlock(&smi_watchers_mutex);
2870         }
2871
2872         return rv;
2873 }
2874 EXPORT_SYMBOL(ipmi_register_smi);
2875
2876 static void cleanup_smi_msgs(ipmi_smi_t intf)
2877 {
2878         int              i;
2879         struct seq_table *ent;
2880
2881         /* No need for locks, the interface is down. */
2882         for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++) {
2883                 ent = &(intf->seq_table[i]);
2884                 if (!ent->inuse)
2885                         continue;
2886                 deliver_err_response(ent->recv_msg, IPMI_ERR_UNSPECIFIED);
2887         }
2888 }
2889
2890 int ipmi_unregister_smi(ipmi_smi_t intf)
2891 {
2892         struct ipmi_smi_watcher *w;
2893         int    intf_num = intf->intf_num;
2894
2895         ipmi_bmc_unregister(intf);
2896
2897         mutex_lock(&smi_watchers_mutex);
2898         mutex_lock(&ipmi_interfaces_mutex);
2899         intf->intf_num = -1;
2900         intf->handlers = NULL;
2901         list_del_rcu(&intf->link);
2902         mutex_unlock(&ipmi_interfaces_mutex);
2903         synchronize_rcu();
2904
2905         cleanup_smi_msgs(intf);
2906
2907         remove_proc_entries(intf);
2908
2909         /*
2910          * Call all the watcher interfaces to tell them that
2911          * an interface is gone.
2912          */
2913         list_for_each_entry(w, &smi_watchers, link)
2914                 w->smi_gone(intf_num);
2915         mutex_unlock(&smi_watchers_mutex);
2916
2917         kref_put(&intf->refcount, intf_free);
2918         return 0;
2919 }
2920 EXPORT_SYMBOL(ipmi_unregister_smi);
2921
2922 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
2923                                    struct ipmi_smi_msg *msg)
2924 {
2925         struct ipmi_ipmb_addr ipmb_addr;
2926         struct ipmi_recv_msg  *recv_msg;
2927
2928         /*
2929          * This is 11, not 10, because the response must contain a
2930          * completion code.
2931          */
2932         if (msg->rsp_size < 11) {
2933                 /* Message not big enough, just ignore it. */
2934                 ipmi_inc_stat(intf, invalid_ipmb_responses);
2935                 return 0;
2936         }
2937
2938         if (msg->rsp[2] != 0) {
2939                 /* An error getting the response, just ignore it. */
2940                 return 0;
2941         }
2942
2943         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
2944         ipmb_addr.slave_addr = msg->rsp[6];
2945         ipmb_addr.channel = msg->rsp[3] & 0x0f;
2946         ipmb_addr.lun = msg->rsp[7] & 3;
2947
2948         /*
2949          * It's a response from a remote entity.  Look up the sequence
2950          * number and handle the response.
2951          */
2952         if (intf_find_seq(intf,
2953                           msg->rsp[7] >> 2,
2954                           msg->rsp[3] & 0x0f,
2955                           msg->rsp[8],
2956                           (msg->rsp[4] >> 2) & (~1),
2957                           (struct ipmi_addr *) &(ipmb_addr),
2958                           &recv_msg)) {
2959                 /*
2960                  * We were unable to find the sequence number,
2961                  * so just nuke the message.
2962                  */
2963                 ipmi_inc_stat(intf, unhandled_ipmb_responses);
2964                 return 0;
2965         }
2966
2967         memcpy(recv_msg->msg_data,
2968                &(msg->rsp[9]),
2969                msg->rsp_size - 9);
2970         /*
2971          * The other fields matched, so no need to set them, except
2972          * for netfn, which needs to be the response that was
2973          * returned, not the request value.
2974          */
2975         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2976         recv_msg->msg.data = recv_msg->msg_data;
2977         recv_msg->msg.data_len = msg->rsp_size - 10;
2978         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2979         ipmi_inc_stat(intf, handled_ipmb_responses);
2980         deliver_response(recv_msg);
2981
2982         return 0;
2983 }
2984
2985 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
2986                                    struct ipmi_smi_msg *msg)
2987 {
2988         struct cmd_rcvr          *rcvr;
2989         int                      rv = 0;
2990         unsigned char            netfn;
2991         unsigned char            cmd;
2992         unsigned char            chan;
2993         ipmi_user_t              user = NULL;
2994         struct ipmi_ipmb_addr    *ipmb_addr;
2995         struct ipmi_recv_msg     *recv_msg;
2996         struct ipmi_smi_handlers *handlers;
2997
2998         if (msg->rsp_size < 10) {
2999                 /* Message not big enough, just ignore it. */
3000                 ipmi_inc_stat(intf, invalid_commands);
3001                 return 0;
3002         }
3003
3004         if (msg->rsp[2] != 0) {
3005                 /* An error getting the response, just ignore it. */
3006                 return 0;
3007         }
3008
3009         netfn = msg->rsp[4] >> 2;
3010         cmd = msg->rsp[8];
3011         chan = msg->rsp[3] & 0xf;
3012
3013         rcu_read_lock();
3014         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3015         if (rcvr) {
3016                 user = rcvr->user;
3017                 kref_get(&user->refcount);
3018         } else
3019                 user = NULL;
3020         rcu_read_unlock();
3021
3022         if (user == NULL) {
3023                 /* We didn't find a user, deliver an error response. */
3024                 ipmi_inc_stat(intf, unhandled_commands);
3025
3026                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
3027                 msg->data[1] = IPMI_SEND_MSG_CMD;
3028                 msg->data[2] = msg->rsp[3];
3029                 msg->data[3] = msg->rsp[6];
3030                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
3031                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
3032                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
3033                 /* rqseq/lun */
3034                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
3035                 msg->data[8] = msg->rsp[8]; /* cmd */
3036                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
3037                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
3038                 msg->data_size = 11;
3039
3040 #ifdef DEBUG_MSGING
3041         {
3042                 int m;
3043                 printk("Invalid command:");
3044                 for (m = 0; m < msg->data_size; m++)
3045                         printk(" %2.2x", msg->data[m]);
3046                 printk("\n");
3047         }
3048 #endif
3049                 rcu_read_lock();
3050                 handlers = intf->handlers;
3051                 if (handlers) {
3052                         handlers->sender(intf->send_info, msg, 0);
3053                         /*
3054                          * We used the message, so return the value
3055                          * that causes it to not be freed or
3056                          * queued.
3057                          */
3058                         rv = -1;
3059                 }
3060                 rcu_read_unlock();
3061         } else {
3062                 /* Deliver the message to the user. */
3063                 ipmi_inc_stat(intf, handled_commands);
3064
3065                 recv_msg = ipmi_alloc_recv_msg();
3066                 if (!recv_msg) {
3067                         /*
3068                          * We couldn't allocate memory for the
3069                          * message, so requeue it for handling
3070                          * later.
3071                          */
3072                         rv = 1;
3073                         kref_put(&user->refcount, free_user);
3074                 } else {
3075                         /* Extract the source address from the data. */
3076                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
3077                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
3078                         ipmb_addr->slave_addr = msg->rsp[6];
3079                         ipmb_addr->lun = msg->rsp[7] & 3;
3080                         ipmb_addr->channel = msg->rsp[3] & 0xf;
3081
3082                         /*
3083                          * Extract the rest of the message information
3084                          * from the IPMB header.
3085                          */
3086                         recv_msg->user = user;
3087                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3088                         recv_msg->msgid = msg->rsp[7] >> 2;
3089                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
3090                         recv_msg->msg.cmd = msg->rsp[8];
3091                         recv_msg->msg.data = recv_msg->msg_data;
3092
3093                         /*
3094                          * We chop off 10, not 9 bytes because the checksum
3095                          * at the end also needs to be removed.
3096                          */
3097                         recv_msg->msg.data_len = msg->rsp_size - 10;
3098                         memcpy(recv_msg->msg_data,
3099                                &(msg->rsp[9]),
3100                                msg->rsp_size - 10);
3101                         deliver_response(recv_msg);
3102                 }
3103         }
3104
3105         return rv;
3106 }
3107
3108 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
3109                                   struct ipmi_smi_msg *msg)
3110 {
3111         struct ipmi_lan_addr  lan_addr;
3112         struct ipmi_recv_msg  *recv_msg;
3113
3114
3115         /*
3116          * This is 13, not 12, because the response must contain a
3117          * completion code.
3118          */
3119         if (msg->rsp_size < 13) {
3120                 /* Message not big enough, just ignore it. */
3121                 ipmi_inc_stat(intf, invalid_lan_responses);
3122                 return 0;
3123         }
3124
3125         if (msg->rsp[2] != 0) {
3126                 /* An error getting the response, just ignore it. */
3127                 return 0;
3128         }
3129
3130         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
3131         lan_addr.session_handle = msg->rsp[4];
3132         lan_addr.remote_SWID = msg->rsp[8];
3133         lan_addr.local_SWID = msg->rsp[5];
3134         lan_addr.channel = msg->rsp[3] & 0x0f;
3135         lan_addr.privilege = msg->rsp[3] >> 4;
3136         lan_addr.lun = msg->rsp[9] & 3;
3137
3138         /*
3139          * It's a response from a remote entity.  Look up the sequence
3140          * number and handle the response.
3141          */
3142         if (intf_find_seq(intf,
3143                           msg->rsp[9] >> 2,
3144                           msg->rsp[3] & 0x0f,
3145                           msg->rsp[10],
3146                           (msg->rsp[6] >> 2) & (~1),
3147                           (struct ipmi_addr *) &(lan_addr),
3148                           &recv_msg)) {
3149                 /*
3150                  * We were unable to find the sequence number,
3151                  * so just nuke the message.
3152                  */
3153                 ipmi_inc_stat(intf, unhandled_lan_responses);
3154                 return 0;
3155         }
3156
3157         memcpy(recv_msg->msg_data,
3158                &(msg->rsp[11]),
3159                msg->rsp_size - 11);
3160         /*
3161          * The other fields matched, so no need to set them, except
3162          * for netfn, which needs to be the response that was
3163          * returned, not the request value.
3164          */
3165         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3166         recv_msg->msg.data = recv_msg->msg_data;
3167         recv_msg->msg.data_len = msg->rsp_size - 12;
3168         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3169         ipmi_inc_stat(intf, handled_lan_responses);
3170         deliver_response(recv_msg);
3171
3172         return 0;
3173 }
3174
3175 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
3176                                   struct ipmi_smi_msg *msg)
3177 {
3178         struct cmd_rcvr          *rcvr;
3179         int                      rv = 0;
3180         unsigned char            netfn;
3181         unsigned char            cmd;
3182         unsigned char            chan;
3183         ipmi_user_t              user = NULL;
3184         struct ipmi_lan_addr     *lan_addr;
3185         struct ipmi_recv_msg     *recv_msg;
3186
3187         if (msg->rsp_size < 12) {
3188                 /* Message not big enough, just ignore it. */
3189                 ipmi_inc_stat(intf, invalid_commands);
3190                 return 0;
3191         }
3192
3193         if (msg->rsp[2] != 0) {
3194                 /* An error getting the response, just ignore it. */
3195                 return 0;
3196         }
3197
3198         netfn = msg->rsp[6] >> 2;
3199         cmd = msg->rsp[10];
3200         chan = msg->rsp[3] & 0xf;
3201
3202         rcu_read_lock();
3203         rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
3204         if (rcvr) {
3205                 user = rcvr->user;
3206                 kref_get(&user->refcount);
3207         } else
3208                 user = NULL;
3209         rcu_read_unlock();
3210
3211         if (user == NULL) {
3212                 /* We didn't find a user, just give up. */
3213                 ipmi_inc_stat(intf, unhandled_commands);
3214
3215                 /*
3216                  * Don't do anything with these messages, just allow
3217                  * them to be freed.
3218                  */
3219                 rv = 0;
3220         } else {
3221                 /* Deliver the message to the user. */
3222                 ipmi_inc_stat(intf, handled_commands);
3223
3224                 recv_msg = ipmi_alloc_recv_msg();
3225                 if (!recv_msg) {
3226                         /*
3227                          * We couldn't allocate memory for the
3228                          * message, so requeue it for handling later.
3229                          */
3230                         rv = 1;
3231                         kref_put(&user->refcount, free_user);
3232                 } else {
3233                         /* Extract the source address from the data. */
3234                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
3235                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
3236                         lan_addr->session_handle = msg->rsp[4];
3237                         lan_addr->remote_SWID = msg->rsp[8];
3238                         lan_addr->local_SWID = msg->rsp[5];
3239                         lan_addr->lun = msg->rsp[9] & 3;
3240                         lan_addr->channel = msg->rsp[3] & 0xf;
3241                         lan_addr->privilege = msg->rsp[3] >> 4;
3242
3243                         /*
3244                          * Extract the rest of the message information
3245                          * from the IPMB header.
3246                          */
3247                         recv_msg->user = user;
3248                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
3249                         recv_msg->msgid = msg->rsp[9] >> 2;
3250                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
3251                         recv_msg->msg.cmd = msg->rsp[10];
3252                         recv_msg->msg.data = recv_msg->msg_data;
3253
3254                         /*
3255                          * We chop off 12, not 11 bytes because the checksum
3256                          * at the end also needs to be removed.
3257                          */
3258                         recv_msg->msg.data_len = msg->rsp_size - 12;
3259                         memcpy(recv_msg->msg_data,
3260                                &(msg->rsp[11]),
3261                                msg->rsp_size - 12);
3262                         deliver_response(recv_msg);
3263                 }
3264         }
3265
3266         return rv;
3267 }
3268
3269 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
3270                                      struct ipmi_smi_msg  *msg)
3271 {
3272         struct ipmi_system_interface_addr *smi_addr;
3273
3274         recv_msg->msgid = 0;
3275         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
3276         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3277         smi_addr->channel = IPMI_BMC_CHANNEL;
3278         smi_addr->lun = msg->rsp[0] & 3;
3279         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
3280         recv_msg->msg.netfn = msg->rsp[0] >> 2;
3281         recv_msg->msg.cmd = msg->rsp[1];
3282         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
3283         recv_msg->msg.data = recv_msg->msg_data;
3284         recv_msg->msg.data_len = msg->rsp_size - 3;
3285 }
3286
3287 static int handle_read_event_rsp(ipmi_smi_t          intf,
3288                                  struct ipmi_smi_msg *msg)
3289 {
3290         struct ipmi_recv_msg *recv_msg, *recv_msg2;
3291         struct list_head     msgs;
3292         ipmi_user_t          user;
3293         int                  rv = 0;
3294         int                  deliver_count = 0;
3295         unsigned long        flags;
3296
3297         if (msg->rsp_size < 19) {
3298                 /* Message is too small to be an IPMB event. */
3299                 ipmi_inc_stat(intf, invalid_events);
3300                 return 0;
3301         }
3302
3303         if (msg->rsp[2] != 0) {
3304                 /* An error getting the event, just ignore it. */
3305                 return 0;
3306         }
3307
3308         INIT_LIST_HEAD(&msgs);
3309
3310         spin_lock_irqsave(&intf->events_lock, flags);
3311
3312         ipmi_inc_stat(intf, events);
3313
3314         /*
3315          * Allocate and fill in one message for every user that is
3316          * getting events.
3317          */
3318         rcu_read_lock();
3319         list_for_each_entry_rcu(user, &intf->users, link) {
3320                 if (!user->gets_events)
3321                         continue;
3322
3323                 recv_msg = ipmi_alloc_recv_msg();
3324                 if (!recv_msg) {
3325                         rcu_read_unlock();
3326                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
3327                                                  link) {
3328                                 list_del(&recv_msg->link);
3329                                 ipmi_free_recv_msg(recv_msg);
3330                         }
3331                         /*
3332                          * We couldn't allocate memory for the
3333                          * message, so requeue it for handling
3334                          * later.
3335                          */
3336                         rv = 1;
3337                         goto out;
3338                 }
3339
3340                 deliver_count++;
3341
3342                 copy_event_into_recv_msg(recv_msg, msg);
3343                 recv_msg->user = user;
3344                 kref_get(&user->refcount);
3345                 list_add_tail(&(recv_msg->link), &msgs);
3346         }
3347         rcu_read_unlock();
3348
3349         if (deliver_count) {
3350                 /* Now deliver all the messages. */
3351                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
3352                         list_del(&recv_msg->link);
3353                         deliver_response(recv_msg);
3354                 }
3355         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
3356                 /*
3357                  * No one to receive the message, put it in queue if there's
3358                  * not already too many things in the queue.
3359                  */
3360                 recv_msg = ipmi_alloc_recv_msg();
3361                 if (!recv_msg) {
3362                         /*
3363                          * We couldn't allocate memory for the
3364                          * message, so requeue it for handling
3365                          * later.
3366                          */
3367                         rv = 1;
3368                         goto out;
3369                 }
3370
3371                 copy_event_into_recv_msg(recv_msg, msg);
3372                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
3373                 intf->waiting_events_count++;
3374         } else if (!intf->event_msg_printed) {
3375                 /*
3376                  * There's too many things in the queue, discard this
3377                  * message.
3378                  */
3379                 printk(KERN_WARNING PFX "Event queue full, discarding"
3380                        " incoming events\n");
3381                 intf->event_msg_printed = 1;
3382         }
3383
3384  out:
3385         spin_unlock_irqrestore(&(intf->events_lock), flags);
3386
3387         return rv;
3388 }
3389
3390 static int handle_bmc_rsp(ipmi_smi_t          intf,
3391                           struct ipmi_smi_msg *msg)
3392 {
3393         struct ipmi_recv_msg *recv_msg;
3394         struct ipmi_user     *user;
3395
3396         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
3397         if (recv_msg == NULL) {
3398                 printk(KERN_WARNING
3399                        "IPMI message received with no owner. This\n"
3400                        "could be because of a malformed message, or\n"
3401                        "because of a hardware error.  Contact your\n"
3402                        "hardware vender for assistance\n");
3403                 return 0;
3404         }
3405
3406         user = recv_msg->user;
3407         /* Make sure the user still exists. */
3408         if (user && !user->valid) {
3409                 /* The user for the message went away, so give up. */
3410                 ipmi_inc_stat(intf, unhandled_local_responses);
3411                 ipmi_free_recv_msg(recv_msg);
3412         } else {
3413                 struct ipmi_system_interface_addr *smi_addr;
3414
3415                 ipmi_inc_stat(intf, handled_local_responses);
3416                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
3417                 recv_msg->msgid = msg->msgid;
3418                 smi_addr = ((struct ipmi_system_interface_addr *)
3419                             &(recv_msg->addr));
3420                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3421                 smi_addr->channel = IPMI_BMC_CHANNEL;
3422                 smi_addr->lun = msg->rsp[0] & 3;
3423                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
3424                 recv_msg->msg.cmd = msg->rsp[1];
3425                 memcpy(recv_msg->msg_data,
3426                        &(msg->rsp[2]),
3427                        msg->rsp_size - 2);
3428                 recv_msg->msg.data = recv_msg->msg_data;
3429                 recv_msg->msg.data_len = msg->rsp_size - 2;
3430                 deliver_response(recv_msg);
3431         }
3432
3433         return 0;
3434 }
3435
3436 /*
3437  * Handle a new message.  Return 1 if the message should be requeued,
3438  * 0 if the message should be freed, or -1 if the message should not
3439  * be freed or requeued.
3440  */
3441 static int handle_new_recv_msg(ipmi_smi_t          intf,
3442                                struct ipmi_smi_msg *msg)
3443 {
3444         int requeue;
3445         int chan;
3446
3447 #ifdef DEBUG_MSGING
3448         int m;
3449         printk("Recv:");
3450         for (m = 0; m < msg->rsp_size; m++)
3451                 printk(" %2.2x", msg->rsp[m]);
3452         printk("\n");
3453 #endif
3454         if (msg->rsp_size < 2) {
3455                 /* Message is too small to be correct. */
3456                 printk(KERN_WARNING PFX "BMC returned to small a message"
3457                        " for netfn %x cmd %x, got %d bytes\n",
3458                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
3459
3460                 /* Generate an error response for the message. */
3461                 msg->rsp[0] = msg->data[0] | (1 << 2);
3462                 msg->rsp[1] = msg->data[1];
3463                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3464                 msg->rsp_size = 3;
3465         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))
3466                    || (msg->rsp[1] != msg->data[1])) {
3467                 /*
3468                  * The NetFN and Command in the response is not even
3469                  * marginally correct.
3470                  */
3471                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
3472                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
3473                        (msg->data[0] >> 2) | 1, msg->data[1],
3474                        msg->rsp[0] >> 2, msg->rsp[1]);
3475
3476                 /* Generate an error response for the message. */
3477                 msg->rsp[0] = msg->data[0] | (1 << 2);
3478                 msg->rsp[1] = msg->data[1];
3479                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
3480                 msg->rsp_size = 3;
3481         }
3482
3483         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3484             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
3485             && (msg->user_data != NULL)) {
3486                 /*
3487                  * It's a response to a response we sent.  For this we
3488                  * deliver a send message response to the user.
3489                  */
3490                 struct ipmi_recv_msg     *recv_msg = msg->user_data;
3491
3492                 requeue = 0;
3493                 if (msg->rsp_size < 2)
3494                         /* Message is too small to be correct. */
3495                         goto out;
3496
3497                 chan = msg->data[2] & 0x0f;
3498                 if (chan >= IPMI_MAX_CHANNELS)
3499                         /* Invalid channel number */
3500                         goto out;
3501
3502                 if (!recv_msg)
3503                         goto out;
3504
3505                 /* Make sure the user still exists. */
3506                 if (!recv_msg->user || !recv_msg->user->valid)
3507                         goto out;
3508
3509                 recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
3510                 recv_msg->msg.data = recv_msg->msg_data;
3511                 recv_msg->msg.data_len = 1;
3512                 recv_msg->msg_data[0] = msg->rsp[2];
3513                 deliver_response(recv_msg);
3514         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3515                    && (msg->rsp[1] == IPMI_GET_MSG_CMD)) {
3516                 /* It's from the receive queue. */
3517                 chan = msg->rsp[3] & 0xf;
3518                 if (chan >= IPMI_MAX_CHANNELS) {
3519                         /* Invalid channel number */
3520                         requeue = 0;
3521                         goto out;
3522                 }
3523
3524                 switch (intf->channels[chan].medium) {
3525                 case IPMI_CHANNEL_MEDIUM_IPMB:
3526                         if (msg->rsp[4] & 0x04) {
3527                                 /*
3528                                  * It's a response, so find the
3529                                  * requesting message and send it up.
3530                                  */
3531                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
3532                         } else {
3533                                 /*
3534                                  * It's a command to the SMS from some other
3535                                  * entity.  Handle that.
3536                                  */
3537                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
3538                         }
3539                         break;
3540
3541                 case IPMI_CHANNEL_MEDIUM_8023LAN:
3542                 case IPMI_CHANNEL_MEDIUM_ASYNC:
3543                         if (msg->rsp[6] & 0x04) {
3544                                 /*
3545                                  * It's a response, so find the
3546                                  * requesting message and send it up.
3547                                  */
3548                                 requeue = handle_lan_get_msg_rsp(intf, msg);
3549                         } else {
3550                                 /*
3551                                  * It's a command to the SMS from some other
3552                                  * entity.  Handle that.
3553                                  */
3554                                 requeue = handle_lan_get_msg_cmd(intf, msg);
3555                         }
3556                         break;
3557
3558                 default:
3559                         /*
3560                          * We don't handle the channel type, so just
3561                          * free the message.
3562                          */
3563                         requeue = 0;
3564                 }
3565
3566         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
3567                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD)) {
3568                 /* It's an asyncronous event. */
3569                 requeue = handle_read_event_rsp(intf, msg);
3570         } else {
3571                 /* It's a response from the local BMC. */
3572                 requeue = handle_bmc_rsp(intf, msg);
3573         }
3574
3575  out:
3576         return requeue;
3577 }
3578
3579 /* Handle a new message from the lower layer. */
3580 void ipmi_smi_msg_received(ipmi_smi_t          intf,
3581                            struct ipmi_smi_msg *msg)
3582 {
3583         unsigned long flags = 0; /* keep us warning-free. */
3584         int           rv;
3585         int           run_to_completion;
3586
3587
3588         if ((msg->data_size >= 2)
3589             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
3590             && (msg->data[1] == IPMI_SEND_MSG_CMD)
3591             && (msg->user_data == NULL)) {
3592                 /*
3593                  * This is the local response to a command send, start
3594                  * the timer for these.  The user_data will not be
3595                  * NULL if this is a response send, and we will let
3596                  * response sends just go through.
3597                  */
3598
3599                 /*
3600                  * Check for errors, if we get certain errors (ones
3601                  * that mean basically we can try again later), we
3602                  * ignore them and start the timer.  Otherwise we
3603                  * report the error immediately.
3604                  */
3605                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
3606                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
3607                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
3608                     && (msg->rsp[2] != IPMI_BUS_ERR)
3609                     && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
3610                         int chan = msg->rsp[3] & 0xf;
3611
3612                         /* Got an error sending the message, handle it. */
3613                         if (chan >= IPMI_MAX_CHANNELS)
3614                                 ; /* This shouldn't happen */
3615                         else if ((intf->channels[chan].medium
3616                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
3617                                  || (intf->channels[chan].medium
3618                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
3619                                 ipmi_inc_stat(intf, sent_lan_command_errs);
3620                         else
3621                                 ipmi_inc_stat(intf, sent_ipmb_command_errs);
3622                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
3623                 } else
3624                         /* The message was sent, start the timer. */
3625                         intf_start_seq_timer(intf, msg->msgid);
3626
3627                 ipmi_free_smi_msg(msg);
3628                 goto out;
3629         }
3630
3631         /*
3632          * To preserve message order, if the list is not empty, we
3633          * tack this message onto the end of the list.
3634          */
3635         run_to_completion = intf->run_to_completion;
3636         if (!run_to_completion)
3637                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3638         if (!list_empty(&intf->waiting_msgs)) {
3639                 list_add_tail(&msg->link, &intf->waiting_msgs);
3640                 if (!run_to_completion)
3641                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3642                 goto out;
3643         }
3644         if (!run_to_completion)
3645                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3646
3647         rv = handle_new_recv_msg(intf, msg);
3648         if (rv > 0) {
3649                 /*
3650                  * Could not handle the message now, just add it to a
3651                  * list to handle later.
3652                  */
3653                 run_to_completion = intf->run_to_completion;
3654                 if (!run_to_completion)
3655                         spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3656                 list_add_tail(&msg->link, &intf->waiting_msgs);
3657                 if (!run_to_completion)
3658                         spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3659         } else if (rv == 0) {
3660                 ipmi_free_smi_msg(msg);
3661         }
3662
3663  out:
3664         return;
3665 }
3666 EXPORT_SYMBOL(ipmi_smi_msg_received);
3667
3668 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
3669 {
3670         ipmi_user_t user;
3671
3672         rcu_read_lock();
3673         list_for_each_entry_rcu(user, &intf->users, link) {
3674                 if (!user->handler->ipmi_watchdog_pretimeout)
3675                         continue;
3676
3677                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
3678         }
3679         rcu_read_unlock();
3680 }
3681 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3682
3683 static struct ipmi_smi_msg *
3684 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
3685                   unsigned char seq, long seqid)
3686 {
3687         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
3688         if (!smi_msg)
3689                 /*
3690                  * If we can't allocate the message, then just return, we
3691                  * get 4 retries, so this should be ok.
3692                  */
3693                 return NULL;
3694
3695         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
3696         smi_msg->data_size = recv_msg->msg.data_len;
3697         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
3698
3699 #ifdef DEBUG_MSGING
3700         {
3701                 int m;
3702                 printk("Resend: ");
3703                 for (m = 0; m < smi_msg->data_size; m++)
3704                         printk(" %2.2x", smi_msg->data[m]);
3705                 printk("\n");
3706         }
3707 #endif
3708         return smi_msg;
3709 }
3710
3711 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
3712                               struct list_head *timeouts, long timeout_period,
3713                               int slot, unsigned long *flags)
3714 {
3715         struct ipmi_recv_msg     *msg;
3716         struct ipmi_smi_handlers *handlers;
3717
3718         if (intf->intf_num == -1)
3719                 return;
3720
3721         if (!ent->inuse)
3722                 return;
3723
3724         ent->timeout -= timeout_period;
3725         if (ent->timeout > 0)
3726                 return;
3727
3728         if (ent->retries_left == 0) {
3729                 /* The message has used all its retries. */
3730                 ent->inuse = 0;
3731                 msg = ent->recv_msg;
3732                 list_add_tail(&msg->link, timeouts);
3733                 if (ent->broadcast)
3734                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
3735                 else if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3736                         ipmi_inc_stat(intf, timed_out_lan_commands);
3737                 else
3738                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
3739         } else {
3740                 struct ipmi_smi_msg *smi_msg;
3741                 /* More retries, send again. */
3742
3743                 /*
3744                  * Start with the max timer, set to normal timer after
3745                  * the message is sent.
3746                  */
3747                 ent->timeout = MAX_MSG_TIMEOUT;
3748                 ent->retries_left--;
3749                 if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
3750                         ipmi_inc_stat(intf, retransmitted_lan_commands);
3751                 else
3752                         ipmi_inc_stat(intf, retransmitted_ipmb_commands);
3753
3754                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
3755                                             ent->seqid);
3756                 if (!smi_msg)
3757                         return;
3758
3759                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
3760
3761                 /*
3762                  * Send the new message.  We send with a zero
3763                  * priority.  It timed out, I doubt time is that
3764                  * critical now, and high priority messages are really
3765                  * only for messages to the local MC, which don't get
3766                  * resent.
3767                  */
3768                 handlers = intf->handlers;
3769                 if (handlers)
3770                         intf->handlers->sender(intf->send_info,
3771                                                smi_msg, 0);
3772                 else
3773                         ipmi_free_smi_msg(smi_msg);
3774
3775                 spin_lock_irqsave(&intf->seq_lock, *flags);
3776         }
3777 }
3778
3779 static void ipmi_timeout_handler(long timeout_period)
3780 {
3781         ipmi_smi_t           intf;
3782         struct list_head     timeouts;
3783         struct ipmi_recv_msg *msg, *msg2;
3784         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
3785         unsigned long        flags;
3786         int                  i;
3787
3788         rcu_read_lock();
3789         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3790                 /* See if any waiting messages need to be processed. */
3791                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
3792                 list_for_each_entry_safe(smi_msg, smi_msg2,
3793                                          &intf->waiting_msgs, link) {
3794                         if (!handle_new_recv_msg(intf, smi_msg)) {
3795                                 list_del(&smi_msg->link);
3796                                 ipmi_free_smi_msg(smi_msg);
3797                         } else {
3798                                 /*
3799                                  * To preserve message order, quit if we
3800                                  * can't handle a message.
3801                                  */
3802                                 break;
3803                         }
3804                 }
3805                 spin_unlock_irqrestore(&intf->waiting_msgs_lock, flags);
3806
3807                 /*
3808                  * Go through the seq table and find any messages that
3809                  * have timed out, putting them in the timeouts
3810                  * list.
3811                  */
3812                 INIT_LIST_HEAD(&timeouts);
3813                 spin_lock_irqsave(&intf->seq_lock, flags);
3814                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
3815                         check_msg_timeout(intf, &(intf->seq_table[i]),
3816                                           &timeouts, timeout_period, i,
3817                                           &flags);
3818                 spin_unlock_irqrestore(&intf->seq_lock, flags);
3819
3820                 list_for_each_entry_safe(msg, msg2, &timeouts, link)
3821                         deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
3822
3823                 /*
3824                  * Maintenance mode handling.  Check the timeout
3825                  * optimistically before we claim the lock.  It may
3826                  * mean a timeout gets missed occasionally, but that
3827                  * only means the timeout gets extended by one period
3828                  * in that case.  No big deal, and it avoids the lock
3829                  * most of the time.
3830                  */
3831                 if (intf->auto_maintenance_timeout > 0) {
3832                         spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
3833                         if (intf->auto_maintenance_timeout > 0) {
3834                                 intf->auto_maintenance_timeout
3835                                         -= timeout_period;
3836                                 if (!intf->maintenance_mode
3837                                     && (intf->auto_maintenance_timeout <= 0)) {
3838                                         intf->maintenance_mode_enable = 0;
3839                                         maintenance_mode_update(intf);
3840                                 }
3841                         }
3842                         spin_unlock_irqrestore(&intf->maintenance_mode_lock,
3843                                                flags);
3844                 }
3845         }
3846         rcu_read_unlock();
3847 }
3848
3849 static void ipmi_request_event(void)
3850 {
3851         ipmi_smi_t               intf;
3852         struct ipmi_smi_handlers *handlers;
3853
3854         rcu_read_lock();
3855         /*
3856          * Called from the timer, no need to check if handlers is
3857          * valid.
3858          */
3859         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
3860                 /* No event requests when in maintenance mode. */
3861                 if (intf->maintenance_mode_enable)
3862                         continue;
3863
3864                 handlers = intf->handlers;
3865                 if (handlers)
3866                         handlers->request_events(intf->send_info);
3867         }
3868         rcu_read_unlock();
3869 }
3870
3871 static struct timer_list ipmi_timer;
3872
3873 /* Call every ~100 ms. */
3874 #define IPMI_TIMEOUT_TIME       100
3875
3876 /* How many jiffies does it take to get to the timeout time. */
3877 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
3878
3879 /*
3880  * Request events from the queue every second (this is the number of
3881  * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
3882  * future, IPMI will add a way to know immediately if an event is in
3883  * the queue and this silliness can go away.
3884  */
3885 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
3886
3887 static atomic_t stop_operation;
3888 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3889
3890 static void ipmi_timeout(unsigned long data)
3891 {
3892         if (atomic_read(&stop_operation))
3893                 return;
3894
3895         ticks_to_req_ev--;
3896         if (ticks_to_req_ev == 0) {
3897                 ipmi_request_event();
3898                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
3899         }
3900
3901         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
3902
3903         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
3904 }
3905
3906
3907 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
3908 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
3909
3910 /* FIXME - convert these to slabs. */
3911 static void free_smi_msg(struct ipmi_smi_msg *msg)
3912 {
3913         atomic_dec(&smi_msg_inuse_count);
3914         kfree(msg);
3915 }
3916
3917 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
3918 {
3919         struct ipmi_smi_msg *rv;
3920         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
3921         if (rv) {
3922                 rv->done = free_smi_msg;
3923                 rv->user_data = NULL;
3924                 atomic_inc(&smi_msg_inuse_count);
3925         }
3926         return rv;
3927 }
3928 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
3929
3930 static void free_recv_msg(struct ipmi_recv_msg *msg)
3931 {
3932         atomic_dec(&recv_msg_inuse_count);
3933         kfree(msg);
3934 }
3935
3936 struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
3937 {
3938         struct ipmi_recv_msg *rv;
3939
3940         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
3941         if (rv) {
3942                 rv->user = NULL;
3943                 rv->done = free_recv_msg;
3944                 atomic_inc(&recv_msg_inuse_count);
3945         }
3946         return rv;
3947 }
3948
3949 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
3950 {
3951         if (msg->user)
3952                 kref_put(&msg->user->refcount, free_user);
3953         msg->done(msg);
3954 }
3955 EXPORT_SYMBOL(ipmi_free_recv_msg);
3956
3957 #ifdef CONFIG_IPMI_PANIC_EVENT
3958
3959 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
3960 {
3961 }
3962
3963 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
3964 {
3965 }
3966
3967 #ifdef CONFIG_IPMI_PANIC_STRING
3968 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3969 {
3970         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3971             && (msg->msg.netfn == IPMI_NETFN_SENSOR_EVENT_RESPONSE)
3972             && (msg->msg.cmd == IPMI_GET_EVENT_RECEIVER_CMD)
3973             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3974                 /* A get event receiver command, save it. */
3975                 intf->event_receiver = msg->msg.data[1];
3976                 intf->event_receiver_lun = msg->msg.data[2] & 0x3;
3977         }
3978 }
3979
3980 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_recv_msg *msg)
3981 {
3982         if ((msg->addr.addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
3983             && (msg->msg.netfn == IPMI_NETFN_APP_RESPONSE)
3984             && (msg->msg.cmd == IPMI_GET_DEVICE_ID_CMD)
3985             && (msg->msg.data[0] == IPMI_CC_NO_ERROR)) {
3986                 /*
3987                  * A get device id command, save if we are an event
3988                  * receiver or generator.
3989                  */
3990                 intf->local_sel_device = (msg->msg.data[6] >> 2) & 1;
3991                 intf->local_event_generator = (msg->msg.data[6] >> 5) & 1;
3992         }
3993 }
3994 #endif
3995
3996 static void send_panic_events(char *str)
3997 {
3998         struct kernel_ipmi_msg            msg;
3999         ipmi_smi_t                        intf;
4000         unsigned char                     data[16];
4001         struct ipmi_system_interface_addr *si;
4002         struct ipmi_addr                  addr;
4003         struct ipmi_smi_msg               smi_msg;
4004         struct ipmi_recv_msg              recv_msg;
4005
4006         si = (struct ipmi_system_interface_addr *) &addr;
4007         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4008         si->channel = IPMI_BMC_CHANNEL;
4009         si->lun = 0;
4010
4011         /* Fill in an event telling that we have failed. */
4012         msg.netfn = 0x04; /* Sensor or Event. */
4013         msg.cmd = 2; /* Platform event command. */
4014         msg.data = data;
4015         msg.data_len = 8;
4016         data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
4017         data[1] = 0x03; /* This is for IPMI 1.0. */
4018         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
4019         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
4020         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
4021
4022         /*
4023          * Put a few breadcrumbs in.  Hopefully later we can add more things
4024          * to make the panic events more useful.
4025          */
4026         if (str) {
4027                 data[3] = str[0];
4028                 data[6] = str[1];
4029                 data[7] = str[2];
4030         }
4031
4032         smi_msg.done = dummy_smi_done_handler;
4033         recv_msg.done = dummy_recv_done_handler;
4034
4035         /* For every registered interface, send the event. */
4036         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4037                 if (!intf->handlers)
4038                         /* Interface is not ready. */
4039                         continue;
4040
4041                 intf->run_to_completion = 1;
4042                 /* Send the event announcing the panic. */
4043                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4044                 i_ipmi_request(NULL,
4045                                intf,
4046                                &addr,
4047                                0,
4048                                &msg,
4049                                intf,
4050                                &smi_msg,
4051                                &recv_msg,
4052                                0,
4053                                intf->channels[0].address,
4054                                intf->channels[0].lun,
4055                                0, 1); /* Don't retry, and don't wait. */
4056         }
4057
4058 #ifdef CONFIG_IPMI_PANIC_STRING
4059         /*
4060          * On every interface, dump a bunch of OEM event holding the
4061          * string.
4062          */
4063         if (!str)
4064                 return;
4065
4066         /* For every registered interface, send the event. */
4067         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4068                 char                  *p = str;
4069                 struct ipmi_ipmb_addr *ipmb;
4070                 int                   j;
4071
4072                 if (intf->intf_num == -1)
4073                         /* Interface was not ready yet. */
4074                         continue;
4075
4076                 /*
4077                  * intf_num is used as an marker to tell if the
4078                  * interface is valid.  Thus we need a read barrier to
4079                  * make sure data fetched before checking intf_num
4080                  * won't be used.
4081                  */
4082                 smp_rmb();
4083
4084                 /*
4085                  * First job here is to figure out where to send the
4086                  * OEM events.  There's no way in IPMI to send OEM
4087                  * events using an event send command, so we have to
4088                  * find the SEL to put them in and stick them in
4089                  * there.
4090                  */
4091
4092                 /* Get capabilities from the get device id. */
4093                 intf->local_sel_device = 0;
4094                 intf->local_event_generator = 0;
4095                 intf->event_receiver = 0;
4096
4097                 /* Request the device info from the local MC. */
4098                 msg.netfn = IPMI_NETFN_APP_REQUEST;
4099                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
4100                 msg.data = NULL;
4101                 msg.data_len = 0;
4102                 intf->null_user_handler = device_id_fetcher;
4103                 i_ipmi_request(NULL,
4104                                intf,
4105                                &addr,
4106                                0,
4107                                &msg,
4108                                intf,
4109                                &smi_msg,
4110                                &recv_msg,
4111                                0,
4112                                intf->channels[0].address,
4113                                intf->channels[0].lun,
4114                                0, 1); /* Don't retry, and don't wait. */
4115
4116                 if (intf->local_event_generator) {
4117                         /* Request the event receiver from the local MC. */
4118                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
4119                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
4120                         msg.data = NULL;
4121                         msg.data_len = 0;
4122                         intf->null_user_handler = event_receiver_fetcher;
4123                         i_ipmi_request(NULL,
4124                                        intf,
4125                                        &addr,
4126                                        0,
4127                                        &msg,
4128                                        intf,
4129                                        &smi_msg,
4130                                        &recv_msg,
4131                                        0,
4132                                        intf->channels[0].address,
4133                                        intf->channels[0].lun,
4134                                        0, 1); /* no retry, and no wait. */
4135                 }
4136                 intf->null_user_handler = NULL;
4137
4138                 /*
4139                  * Validate the event receiver.  The low bit must not
4140                  * be 1 (it must be a valid IPMB address), it cannot
4141                  * be zero, and it must not be my address.
4142                  */
4143                 if (((intf->event_receiver & 1) == 0)
4144                     && (intf->event_receiver != 0)
4145                     && (intf->event_receiver != intf->channels[0].address)) {
4146                         /*
4147                          * The event receiver is valid, send an IPMB
4148                          * message.
4149                          */
4150                         ipmb = (struct ipmi_ipmb_addr *) &addr;
4151                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
4152                         ipmb->channel = 0; /* FIXME - is this right? */
4153                         ipmb->lun = intf->event_receiver_lun;
4154                         ipmb->slave_addr = intf->event_receiver;
4155                 } else if (intf->local_sel_device) {
4156                         /*
4157                          * The event receiver was not valid (or was
4158                          * me), but I am an SEL device, just dump it
4159                          * in my SEL.
4160                          */
4161                         si = (struct ipmi_system_interface_addr *) &addr;
4162                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
4163                         si->channel = IPMI_BMC_CHANNEL;
4164                         si->lun = 0;
4165                 } else
4166                         continue; /* No where to send the event. */
4167
4168                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
4169                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
4170                 msg.data = data;
4171                 msg.data_len = 16;
4172
4173                 j = 0;
4174                 while (*p) {
4175                         int size = strlen(p);
4176
4177                         if (size > 11)
4178                                 size = 11;
4179                         data[0] = 0;
4180                         data[1] = 0;
4181                         data[2] = 0xf0; /* OEM event without timestamp. */
4182                         data[3] = intf->channels[0].address;
4183                         data[4] = j++; /* sequence # */
4184                         /*
4185                          * Always give 11 bytes, so strncpy will fill
4186                          * it with zeroes for me.
4187                          */
4188                         strncpy(data+5, p, 11);
4189                         p += size;
4190
4191                         i_ipmi_request(NULL,
4192                                        intf,
4193                                        &addr,
4194                                        0,
4195                                        &msg,
4196                                        intf,
4197                                        &smi_msg,
4198                                        &recv_msg,
4199                                        0,
4200                                        intf->channels[0].address,
4201                                        intf->channels[0].lun,
4202                                        0, 1); /* no retry, and no wait. */
4203                 }
4204         }
4205 #endif /* CONFIG_IPMI_PANIC_STRING */
4206 }
4207 #endif /* CONFIG_IPMI_PANIC_EVENT */
4208
4209 static int has_panicked;
4210
4211 static int panic_event(struct notifier_block *this,
4212                        unsigned long         event,
4213                        void                  *ptr)
4214 {
4215         ipmi_smi_t intf;
4216
4217         if (has_panicked)
4218                 return NOTIFY_DONE;
4219         has_panicked = 1;
4220
4221         /* For every registered interface, set it to run to completion. */
4222         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
4223                 if (!intf->handlers)
4224                         /* Interface is not ready. */
4225                         continue;
4226
4227                 intf->run_to_completion = 1;
4228                 intf->handlers->set_run_to_completion(intf->send_info, 1);
4229         }
4230
4231 #ifdef CONFIG_IPMI_PANIC_EVENT
4232         send_panic_events(ptr);
4233 #endif
4234
4235         return NOTIFY_DONE;
4236 }
4237
4238 static struct notifier_block panic_block = {
4239         .notifier_call  = panic_event,
4240         .next           = NULL,
4241         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
4242 };
4243
4244 static int ipmi_init_msghandler(void)
4245 {
4246         int rv;
4247
4248         if (initialized)
4249                 return 0;
4250
4251         rv = driver_register(&ipmidriver);
4252         if (rv) {
4253                 printk(KERN_ERR PFX "Could not register IPMI driver\n");
4254                 return rv;
4255         }
4256
4257         printk(KERN_INFO "ipmi message handler version "
4258                IPMI_DRIVER_VERSION "\n");
4259
4260 #ifdef CONFIG_PROC_FS
4261         proc_ipmi_root = proc_mkdir("ipmi", NULL);
4262         if (!proc_ipmi_root) {
4263             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
4264             return -ENOMEM;
4265         }
4266
4267         proc_ipmi_root->owner = THIS_MODULE;
4268 #endif /* CONFIG_PROC_FS */
4269
4270         setup_timer(&ipmi_timer, ipmi_timeout, 0);
4271         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
4272
4273         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
4274
4275         initialized = 1;
4276
4277         return 0;
4278 }
4279
4280 static __init int ipmi_init_msghandler_mod(void)
4281 {
4282         ipmi_init_msghandler();
4283         return 0;
4284 }
4285
4286 static __exit void cleanup_ipmi(void)
4287 {
4288         int count;
4289
4290         if (!initialized)
4291                 return;
4292
4293         atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
4294
4295         /*
4296          * This can't be called if any interfaces exist, so no worry
4297          * about shutting down the interfaces.
4298          */
4299
4300         /*
4301          * Tell the timer to stop, then wait for it to stop.  This
4302          * avoids problems with race conditions removing the timer
4303          * here.
4304          */
4305         atomic_inc(&stop_operation);
4306         del_timer_sync(&ipmi_timer);
4307
4308 #ifdef CONFIG_PROC_FS
4309         remove_proc_entry(proc_ipmi_root->name, NULL);
4310 #endif /* CONFIG_PROC_FS */
4311
4312         driver_unregister(&ipmidriver);
4313
4314         initialized = 0;
4315
4316         /* Check for buffer leaks. */
4317         count = atomic_read(&smi_msg_inuse_count);
4318         if (count != 0)
4319                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
4320                        count);
4321         count = atomic_read(&recv_msg_inuse_count);
4322         if (count != 0)
4323                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
4324                        count);
4325 }
4326 module_exit(cleanup_ipmi);
4327
4328 module_init(ipmi_init_msghandler_mod);
4329 MODULE_LICENSE("GPL");
4330 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
4331 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI"
4332                    " interface.");
4333 MODULE_VERSION(IPMI_DRIVER_VERSION);