err.no Git - linux-2.6/blob - drivers/char/ipmi/ipmi_msghandler.c

   1 /*
   2  * ipmi_msghandler.c
   3  *
   4  * Incoming and outgoing message routing for an IPMI interface.
   5  *
   6  * Author: MontaVista Software, Inc.
   7  *         Corey Minyard <minyard@mvista.com>
   8  *         source@mvista.com
   9  *
  10  * Copyright 2002 MontaVista Software Inc.
  11  *
  12  *  This program is free software; you can redistribute it and/or modify it
  13  *  under the terms of the GNU General Public License as published by the
  14  *  Free Software Foundation; either version 2 of the License, or (at your
  15  *  option) any later version.
  16  *
  17  *
  18  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  19  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  20  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23  *  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
  24  *  OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  26  *  TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  27  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *  You should have received a copy of the GNU General Public License along
  30  *  with this program; if not, write to the Free Software Foundation, Inc.,
  31  *  675 Mass Ave, Cambridge, MA 02139, USA.
  32  */
  33
  34 #include <linux/config.h>
  35 #include <linux/module.h>
  36 #include <linux/errno.h>
  37 #include <asm/system.h>
  38 #include <linux/sched.h>
  39 #include <linux/poll.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/rwsem.h>
  42 #include <linux/slab.h>
  43 #include <linux/ipmi.h>
  44 #include <linux/ipmi_smi.h>
  45 #include <linux/notifier.h>
  46 #include <linux/init.h>
  47 #include <linux/proc_fs.h>
  48
  49 #define PFX "IPMI message handler: "
  50
  51 #define IPMI_DRIVER_VERSION "36.0"
  52
  53 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
  54 static int ipmi_init_msghandler(void);
  55
  56 static int initialized = 0;
  57
  58 #ifdef CONFIG_PROC_FS
  59 struct proc_dir_entry *proc_ipmi_root = NULL;
  60 #endif /* CONFIG_PROC_FS */
  61
  62 #define MAX_EVENTS_IN_QUEUE     25
  63
  64 /* Don't let a message sit in a queue forever, always time it with at lest
  65    the max message timer.  This is in milliseconds. */
  66 #define MAX_MSG_TIMEOUT         60000
  67
  68 struct ipmi_user
  69 {
  70         struct list_head link;
  71
  72         /* The upper layer that handles receive messages. */
  73         struct ipmi_user_hndl *handler;
  74         void             *handler_data;
  75
  76         /* The interface this user is bound to. */
  77         ipmi_smi_t intf;
  78
  79         /* Does this interface receive IPMI events? */
  80         int gets_events;
  81 };
  82
  83 struct cmd_rcvr
  84 {
  85         struct list_head link;
  86
  87         ipmi_user_t   user;
  88         unsigned char netfn;
  89         unsigned char cmd;
  90 };
  91
  92 struct seq_table
  93 {
  94         unsigned int         inuse : 1;
  95         unsigned int         broadcast : 1;
  96
  97         unsigned long        timeout;
  98         unsigned long        orig_timeout;
  99         unsigned int         retries_left;
 100
 101         /* To verify on an incoming send message response that this is
 102            the message that the response is for, we keep a sequence id
 103            and increment it every time we send a message. */
 104         long                 seqid;
 105
 106         /* This is held so we can properly respond to the message on a
 107            timeout, and it is used to hold the temporary data for
 108            retransmission, too. */
 109         struct ipmi_recv_msg *recv_msg;
 110 };
 111
 112 /* Store the information in a msgid (long) to allow us to find a
 113    sequence table entry from the msgid. */
 114 #define STORE_SEQ_IN_MSGID(seq, seqid) (((seq&0xff)<<26) | (seqid&0x3ffffff))
 115
 116 #define GET_SEQ_FROM_MSGID(msgid, seq, seqid) \
 117         do {                                                            \
 118                 seq = ((msgid >> 26) & 0x3f);                           \
 119                 seqid = (msgid & 0x3fffff);                             \
 120         } while(0)
 121
 122 #define NEXT_SEQID(seqid) (((seqid) + 1) & 0x3fffff)
 123
 124 struct ipmi_channel
 125 {
 126         unsigned char medium;
 127         unsigned char protocol;
 128
 129         /* My slave address.  This is initialized to IPMI_BMC_SLAVE_ADDR,
 130            but may be changed by the user. */
 131         unsigned char address;
 132
 133         /* My LUN.  This should generally stay the SMS LUN, but just in
 134            case... */
 135         unsigned char lun;
 136 };
 137
 138 #ifdef CONFIG_PROC_FS
 139 struct ipmi_proc_entry
 140 {
 141         char                   *name;
 142         struct ipmi_proc_entry *next;
 143 };
 144 #endif
 145
 146 #define IPMI_IPMB_NUM_SEQ       64
 147 #define IPMI_MAX_CHANNELS       16
 148 struct ipmi_smi
 149 {
 150         /* What interface number are we? */
 151         int intf_num;
 152
 153         /* The list of upper layers that are using me.  We read-lock
 154            this when delivering messages to the upper layer to keep
 155            the user from going away while we are processing the
 156            message.  This means that you cannot add or delete a user
 157            from the receive callback. */
 158         rwlock_t                users_lock;
 159         struct list_head        users;
 160
 161         /* Used for wake ups at startup. */
 162         wait_queue_head_t waitq;
 163
 164         /* The IPMI version of the BMC on the other end. */
 165         unsigned char       version_major;
 166         unsigned char       version_minor;
 167
 168         /* This is the lower-layer's sender routine. */
 169         struct ipmi_smi_handlers *handlers;
 170         void                     *send_info;
 171
 172 #ifdef CONFIG_PROC_FS
 173         /* A list of proc entries for this interface.  This does not
 174            need a lock, only one thread creates it and only one thread
 175            destroys it. */
 176         spinlock_t             proc_entry_lock;
 177         struct ipmi_proc_entry *proc_entries;
 178 #endif
 179
 180         /* A table of sequence numbers for this interface.  We use the
 181            sequence numbers for IPMB messages that go out of the
 182            interface to match them up with their responses.  A routine
 183            is called periodically to time the items in this list. */
 184         spinlock_t       seq_lock;
 185         struct seq_table seq_table[IPMI_IPMB_NUM_SEQ];
 186         int curr_seq;
 187
 188         /* Messages that were delayed for some reason (out of memory,
 189            for instance), will go in here to be processed later in a
 190            periodic timer interrupt. */
 191         spinlock_t       waiting_msgs_lock;
 192         struct list_head waiting_msgs;
 193
 194         /* The list of command receivers that are registered for commands
 195            on this interface. */
 196         rwlock_t         cmd_rcvr_lock;
 197         struct list_head cmd_rcvrs;
 198
 199         /* Events that were queues because no one was there to receive
 200            them. */
 201         spinlock_t       events_lock; /* For dealing with event stuff. */
 202         struct list_head waiting_events;
 203         unsigned int     waiting_events_count; /* How many events in queue? */
 204
 205         /* This will be non-null if someone registers to receive all
 206            IPMI commands (this is for interface emulation).  There
 207            may not be any things in the cmd_rcvrs list above when
 208            this is registered. */
 209         ipmi_user_t all_cmd_rcvr;
 210
 211         /* The event receiver for my BMC, only really used at panic
 212            shutdown as a place to store this. */
 213         unsigned char event_receiver;
 214         unsigned char event_receiver_lun;
 215         unsigned char local_sel_device;
 216         unsigned char local_event_generator;
 217
 218         /* A cheap hack, if this is non-null and a message to an
 219            interface comes in with a NULL user, call this routine with
 220            it.  Note that the message will still be freed by the
 221            caller.  This only works on the system interface. */
 222         void (*null_user_handler)(ipmi_smi_t intf, struct ipmi_smi_msg *msg);
 223
 224         /* When we are scanning the channels for an SMI, this will
 225            tell which channel we are scanning. */
 226         int curr_channel;
 227
 228         /* Channel information */
 229         struct ipmi_channel channels[IPMI_MAX_CHANNELS];
 230
 231         /* Proc FS stuff. */
 232         struct proc_dir_entry *proc_dir;
 233         char                  proc_dir_name[10];
 234
 235         spinlock_t   counter_lock; /* For making counters atomic. */
 236
 237         /* Commands we got that were invalid. */
 238         unsigned int sent_invalid_commands;
 239
 240         /* Commands we sent to the MC. */
 241         unsigned int sent_local_commands;
 242         /* Responses from the MC that were delivered to a user. */
 243         unsigned int handled_local_responses;
 244         /* Responses from the MC that were not delivered to a user. */
 245         unsigned int unhandled_local_responses;
 246
 247         /* Commands we sent out to the IPMB bus. */
 248         unsigned int sent_ipmb_commands;
 249         /* Commands sent on the IPMB that had errors on the SEND CMD */
 250         unsigned int sent_ipmb_command_errs;
 251         /* Each retransmit increments this count. */
 252         unsigned int retransmitted_ipmb_commands;
 253         /* When a message times out (runs out of retransmits) this is
 254            incremented. */
 255         unsigned int timed_out_ipmb_commands;
 256
 257         /* This is like above, but for broadcasts.  Broadcasts are
 258            *not* included in the above count (they are expected to
 259            time out). */
 260         unsigned int timed_out_ipmb_broadcasts;
 261
 262         /* Responses I have sent to the IPMB bus. */
 263         unsigned int sent_ipmb_responses;
 264
 265         /* The response was delivered to the user. */
 266         unsigned int handled_ipmb_responses;
 267         /* The response had invalid data in it. */
 268         unsigned int invalid_ipmb_responses;
 269         /* The response didn't have anyone waiting for it. */
 270         unsigned int unhandled_ipmb_responses;
 271
 272         /* Commands we sent out to the IPMB bus. */
 273         unsigned int sent_lan_commands;
 274         /* Commands sent on the IPMB that had errors on the SEND CMD */
 275         unsigned int sent_lan_command_errs;
 276         /* Each retransmit increments this count. */
 277         unsigned int retransmitted_lan_commands;
 278         /* When a message times out (runs out of retransmits) this is
 279            incremented. */
 280         unsigned int timed_out_lan_commands;
 281
 282         /* Responses I have sent to the IPMB bus. */
 283         unsigned int sent_lan_responses;
 284
 285         /* The response was delivered to the user. */
 286         unsigned int handled_lan_responses;
 287         /* The response had invalid data in it. */
 288         unsigned int invalid_lan_responses;
 289         /* The response didn't have anyone waiting for it. */
 290         unsigned int unhandled_lan_responses;
 291
 292         /* The command was delivered to the user. */
 293         unsigned int handled_commands;
 294         /* The command had invalid data in it. */
 295         unsigned int invalid_commands;
 296         /* The command didn't have anyone waiting for it. */
 297         unsigned int unhandled_commands;
 298
 299         /* Invalid data in an event. */
 300         unsigned int invalid_events;
 301         /* Events that were received with the proper format. */
 302         unsigned int events;
 303 };
 304
 305 #define MAX_IPMI_INTERFACES 4
 306 static ipmi_smi_t ipmi_interfaces[MAX_IPMI_INTERFACES];
 307
 308 /* Used to keep interfaces from going away while operations are
 309    operating on interfaces.  Grab read if you are not modifying the
 310    interfaces, write if you are. */
 311 static DECLARE_RWSEM(interfaces_sem);
 312
 313 /* Directly protects the ipmi_interfaces data structure.  This is
 314    claimed in the timer interrupt. */
 315 static DEFINE_SPINLOCK(interfaces_lock);
 316
 317 /* List of watchers that want to know when smi's are added and
 318    deleted. */
 319 static struct list_head smi_watchers = LIST_HEAD_INIT(smi_watchers);
 320 static DECLARE_RWSEM(smi_watchers_sem);
 321
 322 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 323 {
 324         int i;
 325
 326         down_read(&interfaces_sem);
 327         down_write(&smi_watchers_sem);
 328         list_add(&(watcher->link), &smi_watchers);
 329         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
 330                 if (ipmi_interfaces[i] != NULL) {
 331                         watcher->new_smi(i);
 332                 }
 333         }
 334         up_write(&smi_watchers_sem);
 335         up_read(&interfaces_sem);
 336         return 0;
 337 }
 338
 339 int ipmi_smi_watcher_unregister(struct ipmi_smi_watcher *watcher)
 340 {
 341         down_write(&smi_watchers_sem);
 342         list_del(&(watcher->link));
 343         up_write(&smi_watchers_sem);
 344         return 0;
 345 }
 346
 347 static void
 348 call_smi_watchers(int i)
 349 {
 350         struct ipmi_smi_watcher *w;
 351
 352         down_read(&smi_watchers_sem);
 353         list_for_each_entry(w, &smi_watchers, link) {
 354                 if (try_module_get(w->owner)) {
 355                         w->new_smi(i);
 356                         module_put(w->owner);
 357                 }
 358         }
 359         up_read(&smi_watchers_sem);
 360 }
 361
 362 static int
 363 ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
 364 {
 365         if (addr1->addr_type != addr2->addr_type)
 366                 return 0;
 367
 368         if (addr1->channel != addr2->channel)
 369                 return 0;
 370
 371         if (addr1->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 372                 struct ipmi_system_interface_addr *smi_addr1
 373                     = (struct ipmi_system_interface_addr *) addr1;
 374                 struct ipmi_system_interface_addr *smi_addr2
 375                     = (struct ipmi_system_interface_addr *) addr2;
 376                 return (smi_addr1->lun == smi_addr2->lun);
 377         }
 378
 379         if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
 380             || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 381         {
 382                 struct ipmi_ipmb_addr *ipmb_addr1
 383                     = (struct ipmi_ipmb_addr *) addr1;
 384                 struct ipmi_ipmb_addr *ipmb_addr2
 385                     = (struct ipmi_ipmb_addr *) addr2;
 386
 387                 return ((ipmb_addr1->slave_addr == ipmb_addr2->slave_addr)
 388                         && (ipmb_addr1->lun == ipmb_addr2->lun));
 389         }
 390
 391         if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
 392                 struct ipmi_lan_addr *lan_addr1
 393                         = (struct ipmi_lan_addr *) addr1;
 394                 struct ipmi_lan_addr *lan_addr2
 395                     = (struct ipmi_lan_addr *) addr2;
 396
 397                 return ((lan_addr1->remote_SWID == lan_addr2->remote_SWID)
 398                         && (lan_addr1->local_SWID == lan_addr2->local_SWID)
 399                         && (lan_addr1->session_handle
 400                             == lan_addr2->session_handle)
 401                         && (lan_addr1->lun == lan_addr2->lun));
 402         }
 403
 404         return 1;
 405 }
 406
 407 int ipmi_validate_addr(struct ipmi_addr *addr, int len)
 408 {
 409         if (len < sizeof(struct ipmi_system_interface_addr)) {
 410                 return -EINVAL;
 411         }
 412
 413         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
 414                 if (addr->channel != IPMI_BMC_CHANNEL)
 415                         return -EINVAL;
 416                 return 0;
 417         }
 418
 419         if ((addr->channel == IPMI_BMC_CHANNEL)
 420             || (addr->channel >= IPMI_NUM_CHANNELS)
 421             || (addr->channel < 0))
 422                 return -EINVAL;
 423
 424         if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
 425             || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 426         {
 427                 if (len < sizeof(struct ipmi_ipmb_addr)) {
 428                         return -EINVAL;
 429                 }
 430                 return 0;
 431         }
 432
 433         if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
 434                 if (len < sizeof(struct ipmi_lan_addr)) {
 435                         return -EINVAL;
 436                 }
 437                 return 0;
 438         }
 439
 440         return -EINVAL;
 441 }
 442
 443 unsigned int ipmi_addr_length(int addr_type)
 444 {
 445         if (addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE)
 446                 return sizeof(struct ipmi_system_interface_addr);
 447
 448         if ((addr_type == IPMI_IPMB_ADDR_TYPE)
 449             || (addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
 450         {
 451                 return sizeof(struct ipmi_ipmb_addr);
 452         }
 453
 454         if (addr_type == IPMI_LAN_ADDR_TYPE)
 455                 return sizeof(struct ipmi_lan_addr);
 456
 457         return 0;
 458 }
 459
 460 static void deliver_response(struct ipmi_recv_msg *msg)
 461 {
 462         msg->user->handler->ipmi_recv_hndl(msg, msg->user->handler_data);
 463 }
 464
 465 /* Find the next sequence number not being used and add the given
 466    message with the given timeout to the sequence table.  This must be
 467    called with the interface's seq_lock held. */
 468 static int intf_next_seq(ipmi_smi_t           intf,
 469                          struct ipmi_recv_msg *recv_msg,
 470                          unsigned long        timeout,
 471                          int                  retries,
 472                          int                  broadcast,
 473                          unsigned char        *seq,
 474                          long                 *seqid)
 475 {
 476         int          rv = 0;
 477         unsigned int i;
 478
 479         for (i=intf->curr_seq;
 480              (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
 481              i=(i+1)%IPMI_IPMB_NUM_SEQ)
 482         {
 483                 if (! intf->seq_table[i].inuse)
 484                         break;
 485         }
 486
 487         if (! intf->seq_table[i].inuse) {
 488                 intf->seq_table[i].recv_msg = recv_msg;
 489
 490                 /* Start with the maximum timeout, when the send response
 491                    comes in we will start the real timer. */
 492                 intf->seq_table[i].timeout = MAX_MSG_TIMEOUT;
 493                 intf->seq_table[i].orig_timeout = timeout;
 494                 intf->seq_table[i].retries_left = retries;
 495                 intf->seq_table[i].broadcast = broadcast;
 496                 intf->seq_table[i].inuse = 1;
 497                 intf->seq_table[i].seqid = NEXT_SEQID(intf->seq_table[i].seqid);
 498                 *seq = i;
 499                 *seqid = intf->seq_table[i].seqid;
 500                 intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
 501         } else {
 502                 rv = -EAGAIN;
 503         }
 504
 505         return rv;
 506 }
 507
 508 /* Return the receive message for the given sequence number and
 509    release the sequence number so it can be reused.  Some other data
 510    is passed in to be sure the message matches up correctly (to help
 511    guard against message coming in after their timeout and the
 512    sequence number being reused). */
 513 static int intf_find_seq(ipmi_smi_t           intf,
 514                          unsigned char        seq,
 515                          short                channel,
 516                          unsigned char        cmd,
 517                          unsigned char        netfn,
 518                          struct ipmi_addr     *addr,
 519                          struct ipmi_recv_msg **recv_msg)
 520 {
 521         int           rv = -ENODEV;
 522         unsigned long flags;
 523
 524         if (seq >= IPMI_IPMB_NUM_SEQ)
 525                 return -EINVAL;
 526
 527         spin_lock_irqsave(&(intf->seq_lock), flags);
 528         if (intf->seq_table[seq].inuse) {
 529                 struct ipmi_recv_msg *msg = intf->seq_table[seq].recv_msg;
 530
 531                 if ((msg->addr.channel == channel)
 532                     && (msg->msg.cmd == cmd)
 533                     && (msg->msg.netfn == netfn)
 534                     && (ipmi_addr_equal(addr, &(msg->addr))))
 535                 {
 536                         *recv_msg = msg;
 537                         intf->seq_table[seq].inuse = 0;
 538                         rv = 0;
 539                 }
 540         }
 541         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 542
 543         return rv;
 544 }
 545
 546
 547 /* Start the timer for a specific sequence table entry. */
 548 static int intf_start_seq_timer(ipmi_smi_t intf,
 549                                 long       msgid)
 550 {
 551         int           rv = -ENODEV;
 552         unsigned long flags;
 553         unsigned char seq;
 554         unsigned long seqid;
 555
 556
 557         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 558
 559         spin_lock_irqsave(&(intf->seq_lock), flags);
 560         /* We do this verification because the user can be deleted
 561            while a message is outstanding. */
 562         if ((intf->seq_table[seq].inuse)
 563             && (intf->seq_table[seq].seqid == seqid))
 564         {
 565                 struct seq_table *ent = &(intf->seq_table[seq]);
 566                 ent->timeout = ent->orig_timeout;
 567                 rv = 0;
 568         }
 569         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 570
 571         return rv;
 572 }
 573
 574 /* Got an error for the send message for a specific sequence number. */
 575 static int intf_err_seq(ipmi_smi_t   intf,
 576                         long         msgid,
 577                         unsigned int err)
 578 {
 579         int                  rv = -ENODEV;
 580         unsigned long        flags;
 581         unsigned char        seq;
 582         unsigned long        seqid;
 583         struct ipmi_recv_msg *msg = NULL;
 584
 585
 586         GET_SEQ_FROM_MSGID(msgid, seq, seqid);
 587
 588         spin_lock_irqsave(&(intf->seq_lock), flags);
 589         /* We do this verification because the user can be deleted
 590            while a message is outstanding. */
 591         if ((intf->seq_table[seq].inuse)
 592             && (intf->seq_table[seq].seqid == seqid))
 593         {
 594                 struct seq_table *ent = &(intf->seq_table[seq]);
 595
 596                 ent->inuse = 0;
 597                 msg = ent->recv_msg;
 598                 rv = 0;
 599         }
 600         spin_unlock_irqrestore(&(intf->seq_lock), flags);
 601
 602         if (msg) {
 603                 msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
 604                 msg->msg_data[0] = err;
 605                 msg->msg.netfn |= 1; /* Convert to a response. */
 606                 msg->msg.data_len = 1;
 607                 msg->msg.data = msg->msg_data;
 608                 deliver_response(msg);
 609         }
 610
 611         return rv;
 612 }
 613
 614
 615 int ipmi_create_user(unsigned int          if_num,
 616                      struct ipmi_user_hndl *handler,
 617                      void                  *handler_data,
 618                      ipmi_user_t           *user)
 619 {
 620         unsigned long flags;
 621         ipmi_user_t   new_user;
 622         int           rv = 0;
 623         ipmi_smi_t    intf;
 624
 625         /* There is no module usecount here, because it's not
 626            required.  Since this can only be used by and called from
 627            other modules, they will implicitly use this module, and
 628            thus this can't be removed unless the other modules are
 629            removed. */
 630
 631         if (handler == NULL)
 632                 return -EINVAL;
 633
 634         /* Make sure the driver is actually initialized, this handles
 635            problems with initialization order. */
 636         if (!initialized) {
 637                 rv = ipmi_init_msghandler();
 638                 if (rv)
 639                         return rv;
 640
 641                 /* The init code doesn't return an error if it was turned
 642                    off, but it won't initialize.  Check that. */
 643                 if (!initialized)
 644                         return -ENODEV;
 645         }
 646
 647         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
 648         if (! new_user)
 649                 return -ENOMEM;
 650
 651         down_read(&interfaces_sem);
 652         if ((if_num >= MAX_IPMI_INTERFACES) || ipmi_interfaces[if_num] == NULL)
 653         {
 654                 rv = -EINVAL;
 655                 goto out_unlock;
 656         }
 657
 658         intf = ipmi_interfaces[if_num];
 659
 660         new_user->handler = handler;
 661         new_user->handler_data = handler_data;
 662         new_user->intf = intf;
 663         new_user->gets_events = 0;
 664
 665         if (!try_module_get(intf->handlers->owner)) {
 666                 rv = -ENODEV;
 667                 goto out_unlock;
 668         }
 669
 670         if (intf->handlers->inc_usecount) {
 671                 rv = intf->handlers->inc_usecount(intf->send_info);
 672                 if (rv) {
 673                         module_put(intf->handlers->owner);
 674                         goto out_unlock;
 675                 }
 676         }
 677
 678         write_lock_irqsave(&intf->users_lock, flags);
 679         list_add_tail(&new_user->link, &intf->users);
 680         write_unlock_irqrestore(&intf->users_lock, flags);
 681
 682  out_unlock:
 683         if (rv) {
 684                 kfree(new_user);
 685         } else {
 686                 *user = new_user;
 687         }
 688
 689         up_read(&interfaces_sem);
 690         return rv;
 691 }
 692
 693 static int ipmi_destroy_user_nolock(ipmi_user_t user)
 694 {
 695         int              rv = -ENODEV;
 696         ipmi_user_t      t_user;
 697         struct cmd_rcvr  *rcvr, *rcvr2;
 698         int              i;
 699         unsigned long    flags;
 700
 701         /* Find the user and delete them from the list. */
 702         list_for_each_entry(t_user, &(user->intf->users), link) {
 703                 if (t_user == user) {
 704                         list_del(&t_user->link);
 705                         rv = 0;
 706                         break;
 707                 }
 708         }
 709
 710         if (rv) {
 711                 goto out_unlock;
 712         }
 713
 714         /* Remove the user from the interfaces sequence table. */
 715         spin_lock_irqsave(&(user->intf->seq_lock), flags);
 716         for (i=0; i<IPMI_IPMB_NUM_SEQ; i++) {
 717                 if (user->intf->seq_table[i].inuse
 718                     && (user->intf->seq_table[i].recv_msg->user == user))
 719                 {
 720                         user->intf->seq_table[i].inuse = 0;
 721                 }
 722         }
 723         spin_unlock_irqrestore(&(user->intf->seq_lock), flags);
 724
 725         /* Remove the user from the command receiver's table. */
 726         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 727         list_for_each_entry_safe(rcvr, rcvr2, &(user->intf->cmd_rcvrs), link) {
 728                 if (rcvr->user == user) {
 729                         list_del(&rcvr->link);
 730                         kfree(rcvr);
 731                 }
 732         }
 733         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 734
 735         kfree(user);
 736
 737  out_unlock:
 738
 739         return rv;
 740 }
 741
 742 int ipmi_destroy_user(ipmi_user_t user)
 743 {
 744         int           rv;
 745         ipmi_smi_t    intf = user->intf;
 746         unsigned long flags;
 747
 748         down_read(&interfaces_sem);
 749         write_lock_irqsave(&intf->users_lock, flags);
 750         rv = ipmi_destroy_user_nolock(user);
 751         if (!rv) {
 752                 module_put(intf->handlers->owner);
 753                 if (intf->handlers->dec_usecount)
 754                         intf->handlers->dec_usecount(intf->send_info);
 755         }
 756
 757         write_unlock_irqrestore(&intf->users_lock, flags);
 758         up_read(&interfaces_sem);
 759         return rv;
 760 }
 761
 762 void ipmi_get_version(ipmi_user_t   user,
 763                       unsigned char *major,
 764                       unsigned char *minor)
 765 {
 766         *major = user->intf->version_major;
 767         *minor = user->intf->version_minor;
 768 }
 769
 770 int ipmi_set_my_address(ipmi_user_t   user,
 771                         unsigned int  channel,
 772                         unsigned char address)
 773 {
 774         if (channel >= IPMI_MAX_CHANNELS)
 775                 return -EINVAL;
 776         user->intf->channels[channel].address = address;
 777         return 0;
 778 }
 779
 780 int ipmi_get_my_address(ipmi_user_t   user,
 781                         unsigned int  channel,
 782                         unsigned char *address)
 783 {
 784         if (channel >= IPMI_MAX_CHANNELS)
 785                 return -EINVAL;
 786         *address = user->intf->channels[channel].address;
 787         return 0;
 788 }
 789
 790 int ipmi_set_my_LUN(ipmi_user_t   user,
 791                     unsigned int  channel,
 792                     unsigned char LUN)
 793 {
 794         if (channel >= IPMI_MAX_CHANNELS)
 795                 return -EINVAL;
 796         user->intf->channels[channel].lun = LUN & 0x3;
 797         return 0;
 798 }
 799
 800 int ipmi_get_my_LUN(ipmi_user_t   user,
 801                     unsigned int  channel,
 802                     unsigned char *address)
 803 {
 804         if (channel >= IPMI_MAX_CHANNELS)
 805                 return -EINVAL;
 806         *address = user->intf->channels[channel].lun;
 807         return 0;
 808 }
 809
 810 int ipmi_set_gets_events(ipmi_user_t user, int val)
 811 {
 812         unsigned long         flags;
 813         struct ipmi_recv_msg  *msg, *msg2;
 814
 815         read_lock(&(user->intf->users_lock));
 816         spin_lock_irqsave(&(user->intf->events_lock), flags);
 817         user->gets_events = val;
 818
 819         if (val) {
 820                 /* Deliver any queued events. */
 821                 list_for_each_entry_safe(msg, msg2, &(user->intf->waiting_events), link) {
 822                         list_del(&msg->link);
 823                         msg->user = user;
 824                         deliver_response(msg);
 825                 }
 826         }
 827
 828         spin_unlock_irqrestore(&(user->intf->events_lock), flags);
 829         read_unlock(&(user->intf->users_lock));
 830
 831         return 0;
 832 }
 833
 834 int ipmi_register_for_cmd(ipmi_user_t   user,
 835                           unsigned char netfn,
 836                           unsigned char cmd)
 837 {
 838         struct cmd_rcvr  *cmp;
 839         unsigned long    flags;
 840         struct cmd_rcvr  *rcvr;
 841         int              rv = 0;
 842
 843
 844         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
 845         if (! rcvr)
 846                 return -ENOMEM;
 847
 848         read_lock(&(user->intf->users_lock));
 849         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 850         if (user->intf->all_cmd_rcvr != NULL) {
 851                 rv = -EBUSY;
 852                 goto out_unlock;
 853         }
 854
 855         /* Make sure the command/netfn is not already registered. */
 856         list_for_each_entry(cmp, &(user->intf->cmd_rcvrs), link) {
 857                 if ((cmp->netfn == netfn) && (cmp->cmd == cmd)) {
 858                         rv = -EBUSY;
 859                         break;
 860                 }
 861         }
 862
 863         if (! rv) {
 864                 rcvr->cmd = cmd;
 865                 rcvr->netfn = netfn;
 866                 rcvr->user = user;
 867                 list_add_tail(&(rcvr->link), &(user->intf->cmd_rcvrs));
 868         }
 869  out_unlock:
 870         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 871         read_unlock(&(user->intf->users_lock));
 872
 873         if (rv)
 874                 kfree(rcvr);
 875
 876         return rv;
 877 }
 878
 879 int ipmi_unregister_for_cmd(ipmi_user_t   user,
 880                             unsigned char netfn,
 881                             unsigned char cmd)
 882 {
 883         unsigned long    flags;
 884         struct cmd_rcvr  *rcvr;
 885         int              rv = -ENOENT;
 886
 887         read_lock(&(user->intf->users_lock));
 888         write_lock_irqsave(&(user->intf->cmd_rcvr_lock), flags);
 889         /* Make sure the command/netfn is not already registered. */
 890         list_for_each_entry(rcvr, &(user->intf->cmd_rcvrs), link) {
 891                 if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
 892                         rv = 0;
 893                         list_del(&rcvr->link);
 894                         kfree(rcvr);
 895                         break;
 896                 }
 897         }
 898         write_unlock_irqrestore(&(user->intf->cmd_rcvr_lock), flags);
 899         read_unlock(&(user->intf->users_lock));
 900
 901         return rv;
 902 }
 903
 904 void ipmi_user_set_run_to_completion(ipmi_user_t user, int val)
 905 {
 906         user->intf->handlers->set_run_to_completion(user->intf->send_info,
 907                                                     val);
 908 }
 909
 910 static unsigned char
 911 ipmb_checksum(unsigned char *data, int size)
 912 {
 913         unsigned char csum = 0;
 914
 915         for (; size > 0; size--, data++)
 916                 csum += *data;
 917
 918         return -csum;
 919 }
 920
 921 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
 922                                    struct kernel_ipmi_msg *msg,
 923                                    struct ipmi_ipmb_addr *ipmb_addr,
 924                                    long                  msgid,
 925                                    unsigned char         ipmb_seq,
 926                                    int                   broadcast,
 927                                    unsigned char         source_address,
 928                                    unsigned char         source_lun)
 929 {
 930         int i = broadcast;
 931
 932         /* Format the IPMB header data. */
 933         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
 934         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
 935         smi_msg->data[2] = ipmb_addr->channel;
 936         if (broadcast)
 937                 smi_msg->data[3] = 0;
 938         smi_msg->data[i+3] = ipmb_addr->slave_addr;
 939         smi_msg->data[i+4] = (msg->netfn << 2) | (ipmb_addr->lun & 0x3);
 940         smi_msg->data[i+5] = ipmb_checksum(&(smi_msg->data[i+3]), 2);
 941         smi_msg->data[i+6] = source_address;
 942         smi_msg->data[i+7] = (ipmb_seq << 2) | source_lun;
 943         smi_msg->data[i+8] = msg->cmd;
 944
 945         /* Now tack on the data to the message. */
 946         if (msg->data_len > 0)
 947                 memcpy(&(smi_msg->data[i+9]), msg->data,
 948                        msg->data_len);
 949         smi_msg->data_size = msg->data_len + 9;
 950
 951         /* Now calculate the checksum and tack it on. */
 952         smi_msg->data[i+smi_msg->data_size]
 953                 = ipmb_checksum(&(smi_msg->data[i+6]),
 954                                 smi_msg->data_size-6);
 955
 956         /* Add on the checksum size and the offset from the
 957            broadcast. */
 958         smi_msg->data_size += 1 + i;
 959
 960         smi_msg->msgid = msgid;
 961 }
 962
 963 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
 964                                   struct kernel_ipmi_msg *msg,
 965                                   struct ipmi_lan_addr  *lan_addr,
 966                                   long                  msgid,
 967                                   unsigned char         ipmb_seq,
 968                                   unsigned char         source_lun)
 969 {
 970         /* Format the IPMB header data. */
 971         smi_msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
 972         smi_msg->data[1] = IPMI_SEND_MSG_CMD;
 973         smi_msg->data[2] = lan_addr->channel;
 974         smi_msg->data[3] = lan_addr->session_handle;
 975         smi_msg->data[4] = lan_addr->remote_SWID;
 976         smi_msg->data[5] = (msg->netfn << 2) | (lan_addr->lun & 0x3);
 977         smi_msg->data[6] = ipmb_checksum(&(smi_msg->data[4]), 2);
 978         smi_msg->data[7] = lan_addr->local_SWID;
 979         smi_msg->data[8] = (ipmb_seq << 2) | source_lun;
 980         smi_msg->data[9] = msg->cmd;
 981
 982         /* Now tack on the data to the message. */
 983         if (msg->data_len > 0)
 984                 memcpy(&(smi_msg->data[10]), msg->data,
 985                        msg->data_len);
 986         smi_msg->data_size = msg->data_len + 10;
 987
 988         /* Now calculate the checksum and tack it on. */
 989         smi_msg->data[smi_msg->data_size]
 990                 = ipmb_checksum(&(smi_msg->data[7]),
 991                                 smi_msg->data_size-7);
 992
 993         /* Add on the checksum size and the offset from the
 994            broadcast. */
 995         smi_msg->data_size += 1;
 996
 997         smi_msg->msgid = msgid;
 998 }
 999
1000 /* Separate from ipmi_request so that the user does not have to be
1001    supplied in certain circumstances (mainly at panic time).  If
1002    messages are supplied, they will be freed, even if an error
1003    occurs. */
1004 static inline int i_ipmi_request(ipmi_user_t          user,
1005                                  ipmi_smi_t           intf,
1006                                  struct ipmi_addr     *addr,
1007                                  long                 msgid,
1008                                  struct kernel_ipmi_msg *msg,
1009                                  void                 *user_msg_data,
1010                                  void                 *supplied_smi,
1011                                  struct ipmi_recv_msg *supplied_recv,
1012                                  int                  priority,
1013                                  unsigned char        source_address,
1014                                  unsigned char        source_lun,
1015                                  int                  retries,
1016                                  unsigned int         retry_time_ms)
1017 {
1018         int                  rv = 0;
1019         struct ipmi_smi_msg  *smi_msg;
1020         struct ipmi_recv_msg *recv_msg;
1021         unsigned long        flags;
1022
1023
1024         if (supplied_recv) {
1025                 recv_msg = supplied_recv;
1026         } else {
1027                 recv_msg = ipmi_alloc_recv_msg();
1028                 if (recv_msg == NULL) {
1029                         return -ENOMEM;
1030                 }
1031         }
1032         recv_msg->user_msg_data = user_msg_data;
1033
1034         if (supplied_smi) {
1035                 smi_msg = (struct ipmi_smi_msg *) supplied_smi;
1036         } else {
1037                 smi_msg = ipmi_alloc_smi_msg();
1038                 if (smi_msg == NULL) {
1039                         ipmi_free_recv_msg(recv_msg);
1040                         return -ENOMEM;
1041                 }
1042         }
1043
1044         recv_msg->user = user;
1045         recv_msg->msgid = msgid;
1046         /* Store the message to send in the receive message so timeout
1047            responses can get the proper response data. */
1048         recv_msg->msg = *msg;
1049
1050         if (addr->addr_type == IPMI_SYSTEM_INTERFACE_ADDR_TYPE) {
1051                 struct ipmi_system_interface_addr *smi_addr;
1052
1053                 if (msg->netfn & 1) {
1054                         /* Responses are not allowed to the SMI. */
1055                         rv = -EINVAL;
1056                         goto out_err;
1057                 }
1058
1059                 smi_addr = (struct ipmi_system_interface_addr *) addr;
1060                 if (smi_addr->lun > 3) {
1061                         spin_lock_irqsave(&intf->counter_lock, flags);
1062                         intf->sent_invalid_commands++;
1063                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1064                         rv = -EINVAL;
1065                         goto out_err;
1066                 }
1067
1068                 memcpy(&recv_msg->addr, smi_addr, sizeof(*smi_addr));
1069
1070                 if ((msg->netfn == IPMI_NETFN_APP_REQUEST)
1071                     && ((msg->cmd == IPMI_SEND_MSG_CMD)
1072                         || (msg->cmd == IPMI_GET_MSG_CMD)
1073                         || (msg->cmd == IPMI_READ_EVENT_MSG_BUFFER_CMD)))
1074                 {
1075                         /* We don't let the user do these, since we manage
1076                            the sequence numbers. */
1077                         spin_lock_irqsave(&intf->counter_lock, flags);
1078                         intf->sent_invalid_commands++;
1079                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1080                         rv = -EINVAL;
1081                         goto out_err;
1082                 }
1083
1084                 if ((msg->data_len + 2) > IPMI_MAX_MSG_LENGTH) {
1085                         spin_lock_irqsave(&intf->counter_lock, flags);
1086                         intf->sent_invalid_commands++;
1087                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1088                         rv = -EMSGSIZE;
1089                         goto out_err;
1090                 }
1091
1092                 smi_msg->data[0] = (msg->netfn << 2) | (smi_addr->lun & 0x3);
1093                 smi_msg->data[1] = msg->cmd;
1094                 smi_msg->msgid = msgid;
1095                 smi_msg->user_data = recv_msg;
1096                 if (msg->data_len > 0)
1097                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
1098                 smi_msg->data_size = msg->data_len + 2;
1099                 spin_lock_irqsave(&intf->counter_lock, flags);
1100                 intf->sent_local_commands++;
1101                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1102         } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
1103                    || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE))
1104         {
1105                 struct ipmi_ipmb_addr *ipmb_addr;
1106                 unsigned char         ipmb_seq;
1107                 long                  seqid;
1108                 int                   broadcast = 0;
1109
1110                 if (addr->channel >= IPMI_MAX_CHANNELS) {
1111                         spin_lock_irqsave(&intf->counter_lock, flags);
1112                         intf->sent_invalid_commands++;
1113                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1114                         rv = -EINVAL;
1115                         goto out_err;
1116                 }
1117
1118                 if (intf->channels[addr->channel].medium
1119                     != IPMI_CHANNEL_MEDIUM_IPMB)
1120                 {
1121                         spin_lock_irqsave(&intf->counter_lock, flags);
1122                         intf->sent_invalid_commands++;
1123                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1124                         rv = -EINVAL;
1125                         goto out_err;
1126                 }
1127
1128                 if (retries < 0) {
1129                     if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)
1130                         retries = 0; /* Don't retry broadcasts. */
1131                     else
1132                         retries = 4;
1133                 }
1134                 if (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE) {
1135                     /* Broadcasts add a zero at the beginning of the
1136                        message, but otherwise is the same as an IPMB
1137                        address. */
1138                     addr->addr_type = IPMI_IPMB_ADDR_TYPE;
1139                     broadcast = 1;
1140                 }
1141
1142
1143                 /* Default to 1 second retries. */
1144                 if (retry_time_ms == 0)
1145                     retry_time_ms = 1000;
1146
1147                 /* 9 for the header and 1 for the checksum, plus
1148                    possibly one for the broadcast. */
1149                 if ((msg->data_len + 10 + broadcast) > IPMI_MAX_MSG_LENGTH) {
1150                         spin_lock_irqsave(&intf->counter_lock, flags);
1151                         intf->sent_invalid_commands++;
1152                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1153                         rv = -EMSGSIZE;
1154                         goto out_err;
1155                 }
1156
1157                 ipmb_addr = (struct ipmi_ipmb_addr *) addr;
1158                 if (ipmb_addr->lun > 3) {
1159                         spin_lock_irqsave(&intf->counter_lock, flags);
1160                         intf->sent_invalid_commands++;
1161                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1162                         rv = -EINVAL;
1163                         goto out_err;
1164                 }
1165
1166                 memcpy(&recv_msg->addr, ipmb_addr, sizeof(*ipmb_addr));
1167
1168                 if (recv_msg->msg.netfn & 0x1) {
1169                         /* It's a response, so use the user's sequence
1170                            from msgid. */
1171                         spin_lock_irqsave(&intf->counter_lock, flags);
1172                         intf->sent_ipmb_responses++;
1173                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1174                         format_ipmb_msg(smi_msg, msg, ipmb_addr, msgid,
1175                                         msgid, broadcast,
1176                                         source_address, source_lun);
1177
1178                         /* Save the receive message so we can use it
1179                            to deliver the response. */
1180                         smi_msg->user_data = recv_msg;
1181                 } else {
1182                         /* It's a command, so get a sequence for it. */
1183
1184                         spin_lock_irqsave(&(intf->seq_lock), flags);
1185
1186                         spin_lock(&intf->counter_lock);
1187                         intf->sent_ipmb_commands++;
1188                         spin_unlock(&intf->counter_lock);
1189
1190                         /* Create a sequence number with a 1 second
1191                            timeout and 4 retries. */
1192                         rv = intf_next_seq(intf,
1193                                            recv_msg,
1194                                            retry_time_ms,
1195                                            retries,
1196                                            broadcast,
1197                                            &ipmb_seq,
1198                                            &seqid);
1199                         if (rv) {
1200                                 /* We have used up all the sequence numbers,
1201                                    probably, so abort. */
1202                                 spin_unlock_irqrestore(&(intf->seq_lock),
1203                                                        flags);
1204                                 goto out_err;
1205                         }
1206
1207                         /* Store the sequence number in the message,
1208                            so that when the send message response
1209                            comes back we can start the timer. */
1210                         format_ipmb_msg(smi_msg, msg, ipmb_addr,
1211                                         STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1212                                         ipmb_seq, broadcast,
1213                                         source_address, source_lun);
1214
1215                         /* Copy the message into the recv message data, so we
1216                            can retransmit it later if necessary. */
1217                         memcpy(recv_msg->msg_data, smi_msg->data,
1218                                smi_msg->data_size);
1219                         recv_msg->msg.data = recv_msg->msg_data;
1220                         recv_msg->msg.data_len = smi_msg->data_size;
1221
1222                         /* We don't unlock until here, because we need
1223                            to copy the completed message into the
1224                            recv_msg before we release the lock.
1225                            Otherwise, race conditions may bite us.  I
1226                            know that's pretty paranoid, but I prefer
1227                            to be correct. */
1228                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1229                 }
1230         } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
1231                 struct ipmi_lan_addr  *lan_addr;
1232                 unsigned char         ipmb_seq;
1233                 long                  seqid;
1234
1235                 if (addr->channel >= IPMI_NUM_CHANNELS) {
1236                         spin_lock_irqsave(&intf->counter_lock, flags);
1237                         intf->sent_invalid_commands++;
1238                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1239                         rv = -EINVAL;
1240                         goto out_err;
1241                 }
1242
1243                 if ((intf->channels[addr->channel].medium
1244                     != IPMI_CHANNEL_MEDIUM_8023LAN)
1245                     && (intf->channels[addr->channel].medium
1246                         != IPMI_CHANNEL_MEDIUM_ASYNC))
1247                 {
1248                         spin_lock_irqsave(&intf->counter_lock, flags);
1249                         intf->sent_invalid_commands++;
1250                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1251                         rv = -EINVAL;
1252                         goto out_err;
1253                 }
1254
1255                 retries = 4;
1256
1257                 /* Default to 1 second retries. */
1258                 if (retry_time_ms == 0)
1259                     retry_time_ms = 1000;
1260
1261                 /* 11 for the header and 1 for the checksum. */
1262                 if ((msg->data_len + 12) > IPMI_MAX_MSG_LENGTH) {
1263                         spin_lock_irqsave(&intf->counter_lock, flags);
1264                         intf->sent_invalid_commands++;
1265                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1266                         rv = -EMSGSIZE;
1267                         goto out_err;
1268                 }
1269
1270                 lan_addr = (struct ipmi_lan_addr *) addr;
1271                 if (lan_addr->lun > 3) {
1272                         spin_lock_irqsave(&intf->counter_lock, flags);
1273                         intf->sent_invalid_commands++;
1274                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1275                         rv = -EINVAL;
1276                         goto out_err;
1277                 }
1278
1279                 memcpy(&recv_msg->addr, lan_addr, sizeof(*lan_addr));
1280
1281                 if (recv_msg->msg.netfn & 0x1) {
1282                         /* It's a response, so use the user's sequence
1283                            from msgid. */
1284                         spin_lock_irqsave(&intf->counter_lock, flags);
1285                         intf->sent_lan_responses++;
1286                         spin_unlock_irqrestore(&intf->counter_lock, flags);
1287                         format_lan_msg(smi_msg, msg, lan_addr, msgid,
1288                                        msgid, source_lun);
1289
1290                         /* Save the receive message so we can use it
1291                            to deliver the response. */
1292                         smi_msg->user_data = recv_msg;
1293                 } else {
1294                         /* It's a command, so get a sequence for it. */
1295
1296                         spin_lock_irqsave(&(intf->seq_lock), flags);
1297
1298                         spin_lock(&intf->counter_lock);
1299                         intf->sent_lan_commands++;
1300                         spin_unlock(&intf->counter_lock);
1301
1302                         /* Create a sequence number with a 1 second
1303                            timeout and 4 retries. */
1304                         rv = intf_next_seq(intf,
1305                                            recv_msg,
1306                                            retry_time_ms,
1307                                            retries,
1308                                            0,
1309                                            &ipmb_seq,
1310                                            &seqid);
1311                         if (rv) {
1312                                 /* We have used up all the sequence numbers,
1313                                    probably, so abort. */
1314                                 spin_unlock_irqrestore(&(intf->seq_lock),
1315                                                        flags);
1316                                 goto out_err;
1317                         }
1318
1319                         /* Store the sequence number in the message,
1320                            so that when the send message response
1321                            comes back we can start the timer. */
1322                         format_lan_msg(smi_msg, msg, lan_addr,
1323                                        STORE_SEQ_IN_MSGID(ipmb_seq, seqid),
1324                                        ipmb_seq, source_lun);
1325
1326                         /* Copy the message into the recv message data, so we
1327                            can retransmit it later if necessary. */
1328                         memcpy(recv_msg->msg_data, smi_msg->data,
1329                                smi_msg->data_size);
1330                         recv_msg->msg.data = recv_msg->msg_data;
1331                         recv_msg->msg.data_len = smi_msg->data_size;
1332
1333                         /* We don't unlock until here, because we need
1334                            to copy the completed message into the
1335                            recv_msg before we release the lock.
1336                            Otherwise, race conditions may bite us.  I
1337                            know that's pretty paranoid, but I prefer
1338                            to be correct. */
1339                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
1340                 }
1341         } else {
1342             /* Unknown address type. */
1343                 spin_lock_irqsave(&intf->counter_lock, flags);
1344                 intf->sent_invalid_commands++;
1345                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1346                 rv = -EINVAL;
1347                 goto out_err;
1348         }
1349
1350 #ifdef DEBUG_MSGING
1351         {
1352                 int m;
1353                 for (m=0; m<smi_msg->data_size; m++)
1354                         printk(" %2.2x", smi_msg->data[m]);
1355                 printk("\n");
1356         }
1357 #endif
1358         intf->handlers->sender(intf->send_info, smi_msg, priority);
1359
1360         return 0;
1361
1362  out_err:
1363         ipmi_free_smi_msg(smi_msg);
1364         ipmi_free_recv_msg(recv_msg);
1365         return rv;
1366 }
1367
1368 static int check_addr(ipmi_smi_t       intf,
1369                       struct ipmi_addr *addr,
1370                       unsigned char    *saddr,
1371                       unsigned char    *lun)
1372 {
1373         if (addr->channel >= IPMI_MAX_CHANNELS)
1374                 return -EINVAL;
1375         *lun = intf->channels[addr->channel].lun;
1376         *saddr = intf->channels[addr->channel].address;
1377         return 0;
1378 }
1379
1380 int ipmi_request_settime(ipmi_user_t      user,
1381                          struct ipmi_addr *addr,
1382                          long             msgid,
1383                          struct kernel_ipmi_msg  *msg,
1384                          void             *user_msg_data,
1385                          int              priority,
1386                          int              retries,
1387                          unsigned int     retry_time_ms)
1388 {
1389         unsigned char saddr, lun;
1390         int           rv;
1391
1392         rv = check_addr(user->intf, addr, &saddr, &lun);
1393         if (rv)
1394                 return rv;
1395         return i_ipmi_request(user,
1396                               user->intf,
1397                               addr,
1398                               msgid,
1399                               msg,
1400                               user_msg_data,
1401                               NULL, NULL,
1402                               priority,
1403                               saddr,
1404                               lun,
1405                               retries,
1406                               retry_time_ms);
1407 }
1408
1409 int ipmi_request_supply_msgs(ipmi_user_t          user,
1410                              struct ipmi_addr     *addr,
1411                              long                 msgid,
1412                              struct kernel_ipmi_msg *msg,
1413                              void                 *user_msg_data,
1414                              void                 *supplied_smi,
1415                              struct ipmi_recv_msg *supplied_recv,
1416                              int                  priority)
1417 {
1418         unsigned char saddr, lun;
1419         int           rv;
1420
1421         rv = check_addr(user->intf, addr, &saddr, &lun);
1422         if (rv)
1423                 return rv;
1424         return i_ipmi_request(user,
1425                               user->intf,
1426                               addr,
1427                               msgid,
1428                               msg,
1429                               user_msg_data,
1430                               supplied_smi,
1431                               supplied_recv,
1432                               priority,
1433                               saddr,
1434                               lun,
1435                               -1, 0);
1436 }
1437
1438 static int ipmb_file_read_proc(char *page, char **start, off_t off,
1439                                int count, int *eof, void *data)
1440 {
1441         char       *out = (char *) page;
1442         ipmi_smi_t intf = data;
1443         int        i;
1444         int        rv= 0;
1445
1446         for (i=0; i<IPMI_MAX_CHANNELS; i++)
1447                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
1448         out[rv-1] = '\n'; /* Replace the final space with a newline */
1449         out[rv] = '\0';
1450         rv++;
1451         return rv;
1452 }
1453
1454 static int version_file_read_proc(char *page, char **start, off_t off,
1455                                   int count, int *eof, void *data)
1456 {
1457         char       *out = (char *) page;
1458         ipmi_smi_t intf = data;
1459
1460         return sprintf(out, "%d.%d\n",
1461                        intf->version_major, intf->version_minor);
1462 }
1463
1464 static int stat_file_read_proc(char *page, char **start, off_t off,
1465                                int count, int *eof, void *data)
1466 {
1467         char       *out = (char *) page;
1468         ipmi_smi_t intf = data;
1469
1470         out += sprintf(out, "sent_invalid_commands:       %d\n",
1471                        intf->sent_invalid_commands);
1472         out += sprintf(out, "sent_local_commands:         %d\n",
1473                        intf->sent_local_commands);
1474         out += sprintf(out, "handled_local_responses:     %d\n",
1475                        intf->handled_local_responses);
1476         out += sprintf(out, "unhandled_local_responses:   %d\n",
1477                        intf->unhandled_local_responses);
1478         out += sprintf(out, "sent_ipmb_commands:          %d\n",
1479                        intf->sent_ipmb_commands);
1480         out += sprintf(out, "sent_ipmb_command_errs:      %d\n",
1481                        intf->sent_ipmb_command_errs);
1482         out += sprintf(out, "retransmitted_ipmb_commands: %d\n",
1483                        intf->retransmitted_ipmb_commands);
1484         out += sprintf(out, "timed_out_ipmb_commands:     %d\n",
1485                        intf->timed_out_ipmb_commands);
1486         out += sprintf(out, "timed_out_ipmb_broadcasts:   %d\n",
1487                        intf->timed_out_ipmb_broadcasts);
1488         out += sprintf(out, "sent_ipmb_responses:         %d\n",
1489                        intf->sent_ipmb_responses);
1490         out += sprintf(out, "handled_ipmb_responses:      %d\n",
1491                        intf->handled_ipmb_responses);
1492         out += sprintf(out, "invalid_ipmb_responses:      %d\n",
1493                        intf->invalid_ipmb_responses);
1494         out += sprintf(out, "unhandled_ipmb_responses:    %d\n",
1495                        intf->unhandled_ipmb_responses);
1496         out += sprintf(out, "sent_lan_commands:           %d\n",
1497                        intf->sent_lan_commands);
1498         out += sprintf(out, "sent_lan_command_errs:       %d\n",
1499                        intf->sent_lan_command_errs);
1500         out += sprintf(out, "retransmitted_lan_commands:  %d\n",
1501                        intf->retransmitted_lan_commands);
1502         out += sprintf(out, "timed_out_lan_commands:      %d\n",
1503                        intf->timed_out_lan_commands);
1504         out += sprintf(out, "sent_lan_responses:          %d\n",
1505                        intf->sent_lan_responses);
1506         out += sprintf(out, "handled_lan_responses:       %d\n",
1507                        intf->handled_lan_responses);
1508         out += sprintf(out, "invalid_lan_responses:       %d\n",
1509                        intf->invalid_lan_responses);
1510         out += sprintf(out, "unhandled_lan_responses:     %d\n",
1511                        intf->unhandled_lan_responses);
1512         out += sprintf(out, "handled_commands:            %d\n",
1513                        intf->handled_commands);
1514         out += sprintf(out, "invalid_commands:            %d\n",
1515                        intf->invalid_commands);
1516         out += sprintf(out, "unhandled_commands:          %d\n",
1517                        intf->unhandled_commands);
1518         out += sprintf(out, "invalid_events:              %d\n",
1519                        intf->invalid_events);
1520         out += sprintf(out, "events:                      %d\n",
1521                        intf->events);
1522
1523         return (out - ((char *) page));
1524 }
1525
1526 int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
1527                             read_proc_t *read_proc, write_proc_t *write_proc,
1528                             void *data, struct module *owner)
1529 {
1530         int                    rv = 0;
1531 #ifdef CONFIG_PROC_FS
1532         struct proc_dir_entry  *file;
1533         struct ipmi_proc_entry *entry;
1534
1535         /* Create a list element. */
1536         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1537         if (!entry)
1538                 return -ENOMEM;
1539         entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
1540         if (!entry->name) {
1541                 kfree(entry);
1542                 return -ENOMEM;
1543         }
1544         strcpy(entry->name, name);
1545
1546         file = create_proc_entry(name, 0, smi->proc_dir);
1547         if (!file) {
1548                 kfree(entry->name);
1549                 kfree(entry);
1550                 rv = -ENOMEM;
1551         } else {
1552                 file->nlink = 1;
1553                 file->data = data;
1554                 file->read_proc = read_proc;
1555                 file->write_proc = write_proc;
1556                 file->owner = owner;
1557
1558                 spin_lock(&smi->proc_entry_lock);
1559                 /* Stick it on the list. */
1560                 entry->next = smi->proc_entries;
1561                 smi->proc_entries = entry;
1562                 spin_unlock(&smi->proc_entry_lock);
1563         }
1564 #endif /* CONFIG_PROC_FS */
1565
1566         return rv;
1567 }
1568
1569 static int add_proc_entries(ipmi_smi_t smi, int num)
1570 {
1571         int rv = 0;
1572
1573 #ifdef CONFIG_PROC_FS
1574         sprintf(smi->proc_dir_name, "%d", num);
1575         smi->proc_dir = proc_mkdir(smi->proc_dir_name, proc_ipmi_root);
1576         if (!smi->proc_dir)
1577                 rv = -ENOMEM;
1578         else {
1579                 smi->proc_dir->owner = THIS_MODULE;
1580         }
1581
1582         if (rv == 0)
1583                 rv = ipmi_smi_add_proc_entry(smi, "stats",
1584                                              stat_file_read_proc, NULL,
1585                                              smi, THIS_MODULE);
1586
1587         if (rv == 0)
1588                 rv = ipmi_smi_add_proc_entry(smi, "ipmb",
1589                                              ipmb_file_read_proc, NULL,
1590                                              smi, THIS_MODULE);
1591
1592         if (rv == 0)
1593                 rv = ipmi_smi_add_proc_entry(smi, "version",
1594                                              version_file_read_proc, NULL,
1595                                              smi, THIS_MODULE);
1596 #endif /* CONFIG_PROC_FS */
1597
1598         return rv;
1599 }
1600
1601 static void remove_proc_entries(ipmi_smi_t smi)
1602 {
1603 #ifdef CONFIG_PROC_FS
1604         struct ipmi_proc_entry *entry;
1605
1606         spin_lock(&smi->proc_entry_lock);
1607         while (smi->proc_entries) {
1608                 entry = smi->proc_entries;
1609                 smi->proc_entries = entry->next;
1610
1611                 remove_proc_entry(entry->name, smi->proc_dir);
1612                 kfree(entry->name);
1613                 kfree(entry);
1614         }
1615         spin_unlock(&smi->proc_entry_lock);
1616         remove_proc_entry(smi->proc_dir_name, proc_ipmi_root);
1617 #endif /* CONFIG_PROC_FS */
1618 }
1619
1620 static int
1621 send_channel_info_cmd(ipmi_smi_t intf, int chan)
1622 {
1623         struct kernel_ipmi_msg            msg;
1624         unsigned char                     data[1];
1625         struct ipmi_system_interface_addr si;
1626
1627         si.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
1628         si.channel = IPMI_BMC_CHANNEL;
1629         si.lun = 0;
1630
1631         msg.netfn = IPMI_NETFN_APP_REQUEST;
1632         msg.cmd = IPMI_GET_CHANNEL_INFO_CMD;
1633         msg.data = data;
1634         msg.data_len = 1;
1635         data[0] = chan;
1636         return i_ipmi_request(NULL,
1637                               intf,
1638                               (struct ipmi_addr *) &si,
1639                               0,
1640                               &msg,
1641                               NULL,
1642                               NULL,
1643                               NULL,
1644                               0,
1645                               intf->channels[0].address,
1646                               intf->channels[0].lun,
1647                               -1, 0);
1648 }
1649
1650 static void
1651 channel_handler(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
1652 {
1653         int rv = 0;
1654         int chan;
1655
1656         if ((msg->rsp[0] == (IPMI_NETFN_APP_RESPONSE << 2))
1657             && (msg->rsp[1] == IPMI_GET_CHANNEL_INFO_CMD))
1658         {
1659                 /* It's the one we want */
1660                 if (msg->rsp[2] != 0) {
1661                         /* Got an error from the channel, just go on. */
1662
1663                         if (msg->rsp[2] == IPMI_INVALID_COMMAND_ERR) {
1664                                 /* If the MC does not support this
1665                                    command, that is legal.  We just
1666                                    assume it has one IPMB at channel
1667                                    zero. */
1668                                 intf->channels[0].medium
1669                                         = IPMI_CHANNEL_MEDIUM_IPMB;
1670                                 intf->channels[0].protocol
1671                                         = IPMI_CHANNEL_PROTOCOL_IPMB;
1672                                 rv = -ENOSYS;
1673
1674                                 intf->curr_channel = IPMI_MAX_CHANNELS;
1675                                 wake_up(&intf->waitq);
1676                                 goto out;
1677                         }
1678                         goto next_channel;
1679                 }
1680                 if (msg->rsp_size < 6) {
1681                         /* Message not big enough, just go on. */
1682                         goto next_channel;
1683                 }
1684                 chan = intf->curr_channel;
1685                 intf->channels[chan].medium = msg->rsp[4] & 0x7f;
1686                 intf->channels[chan].protocol = msg->rsp[5] & 0x1f;
1687
1688         next_channel:
1689                 intf->curr_channel++;
1690                 if (intf->curr_channel >= IPMI_MAX_CHANNELS)
1691                         wake_up(&intf->waitq);
1692                 else
1693                         rv = send_channel_info_cmd(intf, intf->curr_channel);
1694
1695                 if (rv) {
1696                         /* Got an error somehow, just give up. */
1697                         intf->curr_channel = IPMI_MAX_CHANNELS;
1698                         wake_up(&intf->waitq);
1699
1700                         printk(KERN_WARNING PFX
1701                                "Error sending channel information: %d\n",
1702                                rv);
1703                 }
1704         }
1705  out:
1706         return;
1707 }
1708
1709 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
1710                       void                     *send_info,
1711                       unsigned char            version_major,
1712                       unsigned char            version_minor,
1713                       unsigned char            slave_addr,
1714                       ipmi_smi_t               *intf)
1715 {
1716         int              i, j;
1717         int              rv;
1718         ipmi_smi_t       new_intf;
1719         unsigned long    flags;
1720
1721
1722         /* Make sure the driver is actually initialized, this handles
1723            problems with initialization order. */
1724         if (!initialized) {
1725                 rv = ipmi_init_msghandler();
1726                 if (rv)
1727                         return rv;
1728                 /* The init code doesn't return an error if it was turned
1729                    off, but it won't initialize.  Check that. */
1730                 if (!initialized)
1731                         return -ENODEV;
1732         }
1733
1734         new_intf = kmalloc(sizeof(*new_intf), GFP_KERNEL);
1735         if (!new_intf)
1736                 return -ENOMEM;
1737         memset(new_intf, 0, sizeof(*new_intf));
1738
1739         new_intf->proc_dir = NULL;
1740
1741         rv = -ENOMEM;
1742
1743         down_write(&interfaces_sem);
1744         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
1745                 if (ipmi_interfaces[i] == NULL) {
1746                         new_intf->intf_num = i;
1747                         new_intf->version_major = version_major;
1748                         new_intf->version_minor = version_minor;
1749                         for (j=0; j<IPMI_MAX_CHANNELS; j++) {
1750                                 new_intf->channels[j].address
1751                                         = IPMI_BMC_SLAVE_ADDR;
1752                                 new_intf->channels[j].lun = 2;
1753                         }
1754                         if (slave_addr != 0)
1755                                 new_intf->channels[0].address = slave_addr;
1756                         rwlock_init(&(new_intf->users_lock));
1757                         INIT_LIST_HEAD(&(new_intf->users));
1758                         new_intf->handlers = handlers;
1759                         new_intf->send_info = send_info;
1760                         spin_lock_init(&(new_intf->seq_lock));
1761                         for (j=0; j<IPMI_IPMB_NUM_SEQ; j++) {
1762                                 new_intf->seq_table[j].inuse = 0;
1763                                 new_intf->seq_table[j].seqid = 0;
1764                         }
1765                         new_intf->curr_seq = 0;
1766 #ifdef CONFIG_PROC_FS
1767                         spin_lock_init(&(new_intf->proc_entry_lock));
1768 #endif
1769                         spin_lock_init(&(new_intf->waiting_msgs_lock));
1770                         INIT_LIST_HEAD(&(new_intf->waiting_msgs));
1771                         spin_lock_init(&(new_intf->events_lock));
1772                         INIT_LIST_HEAD(&(new_intf->waiting_events));
1773                         new_intf->waiting_events_count = 0;
1774                         rwlock_init(&(new_intf->cmd_rcvr_lock));
1775                         init_waitqueue_head(&new_intf->waitq);
1776                         INIT_LIST_HEAD(&(new_intf->cmd_rcvrs));
1777                         new_intf->all_cmd_rcvr = NULL;
1778
1779                         spin_lock_init(&(new_intf->counter_lock));
1780
1781                         spin_lock_irqsave(&interfaces_lock, flags);
1782                         ipmi_interfaces[i] = new_intf;
1783                         spin_unlock_irqrestore(&interfaces_lock, flags);
1784
1785                         rv = 0;
1786                         *intf = new_intf;
1787                         break;
1788                 }
1789         }
1790
1791         downgrade_write(&interfaces_sem);
1792
1793         if (rv == 0)
1794                 rv = add_proc_entries(*intf, i);
1795
1796         if (rv == 0) {
1797                 if ((version_major > 1)
1798                     || ((version_major == 1) && (version_minor >= 5)))
1799                 {
1800                         /* Start scanning the channels to see what is
1801                            available. */
1802                         (*intf)->null_user_handler = channel_handler;
1803                         (*intf)->curr_channel = 0;
1804                         rv = send_channel_info_cmd(*intf, 0);
1805                         if (rv)
1806                                 goto out;
1807
1808                         /* Wait for the channel info to be read. */
1809                         up_read(&interfaces_sem);
1810                         wait_event((*intf)->waitq,
1811                                    ((*intf)->curr_channel>=IPMI_MAX_CHANNELS));
1812                         down_read(&interfaces_sem);
1813
1814                         if (ipmi_interfaces[i] != new_intf)
1815                                 /* Well, it went away.  Just return. */
1816                                 goto out;
1817                 } else {
1818                         /* Assume a single IPMB channel at zero. */
1819                         (*intf)->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
1820                         (*intf)->channels[0].protocol
1821                                 = IPMI_CHANNEL_PROTOCOL_IPMB;
1822                 }
1823
1824                 /* Call all the watcher interfaces to tell
1825                    them that a new interface is available. */
1826                 call_smi_watchers(i);
1827         }
1828
1829  out:
1830         up_read(&interfaces_sem);
1831
1832         if (rv) {
1833                 if (new_intf->proc_dir)
1834                         remove_proc_entries(new_intf);
1835                 kfree(new_intf);
1836         }
1837
1838         return rv;
1839 }
1840
1841 static void free_recv_msg_list(struct list_head *q)
1842 {
1843         struct ipmi_recv_msg *msg, *msg2;
1844
1845         list_for_each_entry_safe(msg, msg2, q, link) {
1846                 list_del(&msg->link);
1847                 ipmi_free_recv_msg(msg);
1848         }
1849 }
1850
1851 static void free_cmd_rcvr_list(struct list_head *q)
1852 {
1853         struct cmd_rcvr  *rcvr, *rcvr2;
1854
1855         list_for_each_entry_safe(rcvr, rcvr2, q, link) {
1856                 list_del(&rcvr->link);
1857                 kfree(rcvr);
1858         }
1859 }
1860
1861 static void clean_up_interface_data(ipmi_smi_t intf)
1862 {
1863         int i;
1864
1865         free_recv_msg_list(&(intf->waiting_msgs));
1866         free_recv_msg_list(&(intf->waiting_events));
1867         free_cmd_rcvr_list(&(intf->cmd_rcvrs));
1868
1869         for (i=0; i<IPMI_IPMB_NUM_SEQ; i++) {
1870                 if ((intf->seq_table[i].inuse)
1871                     && (intf->seq_table[i].recv_msg))
1872                 {
1873                         ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
1874                 }
1875         }
1876 }
1877
1878 int ipmi_unregister_smi(ipmi_smi_t intf)
1879 {
1880         int                     rv = -ENODEV;
1881         int                     i;
1882         struct ipmi_smi_watcher *w;
1883         unsigned long           flags;
1884
1885         down_write(&interfaces_sem);
1886         if (list_empty(&(intf->users)))
1887         {
1888                 for (i=0; i<MAX_IPMI_INTERFACES; i++) {
1889                         if (ipmi_interfaces[i] == intf) {
1890                                 remove_proc_entries(intf);
1891                                 spin_lock_irqsave(&interfaces_lock, flags);
1892                                 ipmi_interfaces[i] = NULL;
1893                                 clean_up_interface_data(intf);
1894                                 spin_unlock_irqrestore(&interfaces_lock,flags);
1895                                 kfree(intf);
1896                                 rv = 0;
1897                                 goto out_call_watcher;
1898                         }
1899                 }
1900         } else {
1901                 rv = -EBUSY;
1902         }
1903         up_write(&interfaces_sem);
1904
1905         return rv;
1906
1907  out_call_watcher:
1908         downgrade_write(&interfaces_sem);
1909
1910         /* Call all the watcher interfaces to tell them that
1911            an interface is gone. */
1912         down_read(&smi_watchers_sem);
1913         list_for_each_entry(w, &smi_watchers, link) {
1914                 w->smi_gone(i);
1915         }
1916         up_read(&smi_watchers_sem);
1917         up_read(&interfaces_sem);
1918         return 0;
1919 }
1920
1921 static int handle_ipmb_get_msg_rsp(ipmi_smi_t          intf,
1922                                    struct ipmi_smi_msg *msg)
1923 {
1924         struct ipmi_ipmb_addr ipmb_addr;
1925         struct ipmi_recv_msg  *recv_msg;
1926         unsigned long         flags;
1927
1928
1929         /* This is 11, not 10, because the response must contain a
1930          * completion code. */
1931         if (msg->rsp_size < 11) {
1932                 /* Message not big enough, just ignore it. */
1933                 spin_lock_irqsave(&intf->counter_lock, flags);
1934                 intf->invalid_ipmb_responses++;
1935                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1936                 return 0;
1937         }
1938
1939         if (msg->rsp[2] != 0) {
1940                 /* An error getting the response, just ignore it. */
1941                 return 0;
1942         }
1943
1944         ipmb_addr.addr_type = IPMI_IPMB_ADDR_TYPE;
1945         ipmb_addr.slave_addr = msg->rsp[6];
1946         ipmb_addr.channel = msg->rsp[3] & 0x0f;
1947         ipmb_addr.lun = msg->rsp[7] & 3;
1948
1949         /* It's a response from a remote entity.  Look up the sequence
1950            number and handle the response. */
1951         if (intf_find_seq(intf,
1952                           msg->rsp[7] >> 2,
1953                           msg->rsp[3] & 0x0f,
1954                           msg->rsp[8],
1955                           (msg->rsp[4] >> 2) & (~1),
1956                           (struct ipmi_addr *) &(ipmb_addr),
1957                           &recv_msg))
1958         {
1959                 /* We were unable to find the sequence number,
1960                    so just nuke the message. */
1961                 spin_lock_irqsave(&intf->counter_lock, flags);
1962                 intf->unhandled_ipmb_responses++;
1963                 spin_unlock_irqrestore(&intf->counter_lock, flags);
1964                 return 0;
1965         }
1966
1967         memcpy(recv_msg->msg_data,
1968                &(msg->rsp[9]),
1969                msg->rsp_size - 9);
1970         /* THe other fields matched, so no need to set them, except
1971            for netfn, which needs to be the response that was
1972            returned, not the request value. */
1973         recv_msg->msg.netfn = msg->rsp[4] >> 2;
1974         recv_msg->msg.data = recv_msg->msg_data;
1975         recv_msg->msg.data_len = msg->rsp_size - 10;
1976         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
1977         spin_lock_irqsave(&intf->counter_lock, flags);
1978         intf->handled_ipmb_responses++;
1979         spin_unlock_irqrestore(&intf->counter_lock, flags);
1980         deliver_response(recv_msg);
1981
1982         return 0;
1983 }
1984
1985 static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
1986                                    struct ipmi_smi_msg *msg)
1987 {
1988         struct cmd_rcvr       *rcvr;
1989         int                   rv = 0;
1990         unsigned char         netfn;
1991         unsigned char         cmd;
1992         ipmi_user_t           user = NULL;
1993         struct ipmi_ipmb_addr *ipmb_addr;
1994         struct ipmi_recv_msg  *recv_msg;
1995         unsigned long         flags;
1996
1997         if (msg->rsp_size < 10) {
1998                 /* Message not big enough, just ignore it. */
1999                 spin_lock_irqsave(&intf->counter_lock, flags);
2000                 intf->invalid_commands++;
2001                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2002                 return 0;
2003         }
2004
2005         if (msg->rsp[2] != 0) {
2006                 /* An error getting the response, just ignore it. */
2007                 return 0;
2008         }
2009
2010         netfn = msg->rsp[4] >> 2;
2011         cmd = msg->rsp[8];
2012
2013         read_lock(&(intf->cmd_rcvr_lock));
2014
2015         if (intf->all_cmd_rcvr) {
2016                 user = intf->all_cmd_rcvr;
2017         } else {
2018                 /* Find the command/netfn. */
2019                 list_for_each_entry(rcvr, &(intf->cmd_rcvrs), link) {
2020                         if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
2021                                 user = rcvr->user;
2022                                 break;
2023                         }
2024                 }
2025         }
2026         read_unlock(&(intf->cmd_rcvr_lock));
2027
2028         if (user == NULL) {
2029                 /* We didn't find a user, deliver an error response. */
2030                 spin_lock_irqsave(&intf->counter_lock, flags);
2031                 intf->unhandled_commands++;
2032                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2033
2034                 msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
2035                 msg->data[1] = IPMI_SEND_MSG_CMD;
2036                 msg->data[2] = msg->rsp[3];
2037                 msg->data[3] = msg->rsp[6];
2038                 msg->data[4] = ((netfn + 1) << 2) | (msg->rsp[7] & 0x3);
2039                 msg->data[5] = ipmb_checksum(&(msg->data[3]), 2);
2040                 msg->data[6] = intf->channels[msg->rsp[3] & 0xf].address;
2041                 /* rqseq/lun */
2042                 msg->data[7] = (msg->rsp[7] & 0xfc) | (msg->rsp[4] & 0x3);
2043                 msg->data[8] = msg->rsp[8]; /* cmd */
2044                 msg->data[9] = IPMI_INVALID_CMD_COMPLETION_CODE;
2045                 msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
2046                 msg->data_size = 11;
2047
2048 #ifdef DEBUG_MSGING
2049         {
2050                 int m;
2051                 printk("Invalid command:");
2052                 for (m=0; m<msg->data_size; m++)
2053                         printk(" %2.2x", msg->data[m]);
2054                 printk("\n");
2055         }
2056 #endif
2057                 intf->handlers->sender(intf->send_info, msg, 0);
2058
2059                 rv = -1; /* We used the message, so return the value that
2060                             causes it to not be freed or queued. */
2061         } else {
2062                 /* Deliver the message to the user. */
2063                 spin_lock_irqsave(&intf->counter_lock, flags);
2064                 intf->handled_commands++;
2065                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2066
2067                 recv_msg = ipmi_alloc_recv_msg();
2068                 if (! recv_msg) {
2069                         /* We couldn't allocate memory for the
2070                            message, so requeue it for handling
2071                            later. */
2072                         rv = 1;
2073                 } else {
2074                         /* Extract the source address from the data. */
2075                         ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
2076                         ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE;
2077                         ipmb_addr->slave_addr = msg->rsp[6];
2078                         ipmb_addr->lun = msg->rsp[7] & 3;
2079                         ipmb_addr->channel = msg->rsp[3] & 0xf;
2080
2081                         /* Extract the rest of the message information
2082                            from the IPMB header.*/
2083                         recv_msg->user = user;
2084                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
2085                         recv_msg->msgid = msg->rsp[7] >> 2;
2086                         recv_msg->msg.netfn = msg->rsp[4] >> 2;
2087                         recv_msg->msg.cmd = msg->rsp[8];
2088                         recv_msg->msg.data = recv_msg->msg_data;
2089
2090                         /* We chop off 10, not 9 bytes because the checksum
2091                            at the end also needs to be removed. */
2092                         recv_msg->msg.data_len = msg->rsp_size - 10;
2093                         memcpy(recv_msg->msg_data,
2094                                &(msg->rsp[9]),
2095                                msg->rsp_size - 10);
2096                         deliver_response(recv_msg);
2097                 }
2098         }
2099
2100         return rv;
2101 }
2102
2103 static int handle_lan_get_msg_rsp(ipmi_smi_t          intf,
2104                                   struct ipmi_smi_msg *msg)
2105 {
2106         struct ipmi_lan_addr  lan_addr;
2107         struct ipmi_recv_msg  *recv_msg;
2108         unsigned long         flags;
2109
2110
2111         /* This is 13, not 12, because the response must contain a
2112          * completion code. */
2113         if (msg->rsp_size < 13) {
2114                 /* Message not big enough, just ignore it. */
2115                 spin_lock_irqsave(&intf->counter_lock, flags);
2116                 intf->invalid_lan_responses++;
2117                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2118                 return 0;
2119         }
2120
2121         if (msg->rsp[2] != 0) {
2122                 /* An error getting the response, just ignore it. */
2123                 return 0;
2124         }
2125
2126         lan_addr.addr_type = IPMI_LAN_ADDR_TYPE;
2127         lan_addr.session_handle = msg->rsp[4];
2128         lan_addr.remote_SWID = msg->rsp[8];
2129         lan_addr.local_SWID = msg->rsp[5];
2130         lan_addr.channel = msg->rsp[3] & 0x0f;
2131         lan_addr.privilege = msg->rsp[3] >> 4;
2132         lan_addr.lun = msg->rsp[9] & 3;
2133
2134         /* It's a response from a remote entity.  Look up the sequence
2135            number and handle the response. */
2136         if (intf_find_seq(intf,
2137                           msg->rsp[9] >> 2,
2138                           msg->rsp[3] & 0x0f,
2139                           msg->rsp[10],
2140                           (msg->rsp[6] >> 2) & (~1),
2141                           (struct ipmi_addr *) &(lan_addr),
2142                           &recv_msg))
2143         {
2144                 /* We were unable to find the sequence number,
2145                    so just nuke the message. */
2146                 spin_lock_irqsave(&intf->counter_lock, flags);
2147                 intf->unhandled_lan_responses++;
2148                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2149                 return 0;
2150         }
2151
2152         memcpy(recv_msg->msg_data,
2153                &(msg->rsp[11]),
2154                msg->rsp_size - 11);
2155         /* The other fields matched, so no need to set them, except
2156            for netfn, which needs to be the response that was
2157            returned, not the request value. */
2158         recv_msg->msg.netfn = msg->rsp[6] >> 2;
2159         recv_msg->msg.data = recv_msg->msg_data;
2160         recv_msg->msg.data_len = msg->rsp_size - 12;
2161         recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2162         spin_lock_irqsave(&intf->counter_lock, flags);
2163         intf->handled_lan_responses++;
2164         spin_unlock_irqrestore(&intf->counter_lock, flags);
2165         deliver_response(recv_msg);
2166
2167         return 0;
2168 }
2169
2170 static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
2171                                   struct ipmi_smi_msg *msg)
2172 {
2173         struct cmd_rcvr       *rcvr;
2174         int                   rv = 0;
2175         unsigned char         netfn;
2176         unsigned char         cmd;
2177         ipmi_user_t           user = NULL;
2178         struct ipmi_lan_addr  *lan_addr;
2179         struct ipmi_recv_msg  *recv_msg;
2180         unsigned long         flags;
2181
2182         if (msg->rsp_size < 12) {
2183                 /* Message not big enough, just ignore it. */
2184                 spin_lock_irqsave(&intf->counter_lock, flags);
2185                 intf->invalid_commands++;
2186                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2187                 return 0;
2188         }
2189
2190         if (msg->rsp[2] != 0) {
2191                 /* An error getting the response, just ignore it. */
2192                 return 0;
2193         }
2194
2195         netfn = msg->rsp[6] >> 2;
2196         cmd = msg->rsp[10];
2197
2198         read_lock(&(intf->cmd_rcvr_lock));
2199
2200         if (intf->all_cmd_rcvr) {
2201                 user = intf->all_cmd_rcvr;
2202         } else {
2203                 /* Find the command/netfn. */
2204                 list_for_each_entry(rcvr, &(intf->cmd_rcvrs), link) {
2205                         if ((rcvr->netfn == netfn) && (rcvr->cmd == cmd)) {
2206                                 user = rcvr->user;
2207                                 break;
2208                         }
2209                 }
2210         }
2211         read_unlock(&(intf->cmd_rcvr_lock));
2212
2213         if (user == NULL) {
2214                 /* We didn't find a user, deliver an error response. */
2215                 spin_lock_irqsave(&intf->counter_lock, flags);
2216                 intf->unhandled_commands++;
2217                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2218
2219                 rv = 0; /* Don't do anything with these messages, just
2220                            allow them to be freed. */
2221         } else {
2222                 /* Deliver the message to the user. */
2223                 spin_lock_irqsave(&intf->counter_lock, flags);
2224                 intf->handled_commands++;
2225                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2226
2227                 recv_msg = ipmi_alloc_recv_msg();
2228                 if (! recv_msg) {
2229                         /* We couldn't allocate memory for the
2230                            message, so requeue it for handling
2231                            later. */
2232                         rv = 1;
2233                 } else {
2234                         /* Extract the source address from the data. */
2235                         lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
2236                         lan_addr->addr_type = IPMI_LAN_ADDR_TYPE;
2237                         lan_addr->session_handle = msg->rsp[4];
2238                         lan_addr->remote_SWID = msg->rsp[8];
2239                         lan_addr->local_SWID = msg->rsp[5];
2240                         lan_addr->lun = msg->rsp[9] & 3;
2241                         lan_addr->channel = msg->rsp[3] & 0xf;
2242                         lan_addr->privilege = msg->rsp[3] >> 4;
2243
2244                         /* Extract the rest of the message information
2245                            from the IPMB header.*/
2246                         recv_msg->user = user;
2247                         recv_msg->recv_type = IPMI_CMD_RECV_TYPE;
2248                         recv_msg->msgid = msg->rsp[9] >> 2;
2249                         recv_msg->msg.netfn = msg->rsp[6] >> 2;
2250                         recv_msg->msg.cmd = msg->rsp[10];
2251                         recv_msg->msg.data = recv_msg->msg_data;
2252
2253                         /* We chop off 12, not 11 bytes because the checksum
2254                            at the end also needs to be removed. */
2255                         recv_msg->msg.data_len = msg->rsp_size - 12;
2256                         memcpy(recv_msg->msg_data,
2257                                &(msg->rsp[11]),
2258                                msg->rsp_size - 12);
2259                         deliver_response(recv_msg);
2260                 }
2261         }
2262
2263         return rv;
2264 }
2265
2266 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
2267                                      struct ipmi_smi_msg  *msg)
2268 {
2269         struct ipmi_system_interface_addr *smi_addr;
2270
2271         recv_msg->msgid = 0;
2272         smi_addr = (struct ipmi_system_interface_addr *) &(recv_msg->addr);
2273         smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2274         smi_addr->channel = IPMI_BMC_CHANNEL;
2275         smi_addr->lun = msg->rsp[0] & 3;
2276         recv_msg->recv_type = IPMI_ASYNC_EVENT_RECV_TYPE;
2277         recv_msg->msg.netfn = msg->rsp[0] >> 2;
2278         recv_msg->msg.cmd = msg->rsp[1];
2279         memcpy(recv_msg->msg_data, &(msg->rsp[3]), msg->rsp_size - 3);
2280         recv_msg->msg.data = recv_msg->msg_data;
2281         recv_msg->msg.data_len = msg->rsp_size - 3;
2282 }
2283
2284 /* This will be called with the intf->users_lock read-locked, so no need
2285    to do that here. */
2286 static int handle_read_event_rsp(ipmi_smi_t          intf,
2287                                  struct ipmi_smi_msg *msg)
2288 {
2289         struct ipmi_recv_msg *recv_msg, *recv_msg2;
2290         struct list_head     msgs;
2291         ipmi_user_t          user;
2292         int                  rv = 0;
2293         int                  deliver_count = 0;
2294         unsigned long        flags;
2295
2296         if (msg->rsp_size < 19) {
2297                 /* Message is too small to be an IPMB event. */
2298                 spin_lock_irqsave(&intf->counter_lock, flags);
2299                 intf->invalid_events++;
2300                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2301                 return 0;
2302         }
2303
2304         if (msg->rsp[2] != 0) {
2305                 /* An error getting the event, just ignore it. */
2306                 return 0;
2307         }
2308
2309         INIT_LIST_HEAD(&msgs);
2310
2311         spin_lock_irqsave(&(intf->events_lock), flags);
2312
2313         spin_lock(&intf->counter_lock);
2314         intf->events++;
2315         spin_unlock(&intf->counter_lock);
2316
2317         /* Allocate and fill in one message for every user that is getting
2318            events. */
2319         list_for_each_entry(user, &(intf->users), link) {
2320                 if (! user->gets_events)
2321                         continue;
2322
2323                 recv_msg = ipmi_alloc_recv_msg();
2324                 if (! recv_msg) {
2325                         list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
2326                                 list_del(&recv_msg->link);
2327                                 ipmi_free_recv_msg(recv_msg);
2328                         }
2329                         /* We couldn't allocate memory for the
2330                            message, so requeue it for handling
2331                            later. */
2332                         rv = 1;
2333                         goto out;
2334                 }
2335
2336                 deliver_count++;
2337
2338                 copy_event_into_recv_msg(recv_msg, msg);
2339                 recv_msg->user = user;
2340                 list_add_tail(&(recv_msg->link), &msgs);
2341         }
2342
2343         if (deliver_count) {
2344                 /* Now deliver all the messages. */
2345                 list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
2346                         list_del(&recv_msg->link);
2347                         deliver_response(recv_msg);
2348                 }
2349         } else if (intf->waiting_events_count < MAX_EVENTS_IN_QUEUE) {
2350                 /* No one to receive the message, put it in queue if there's
2351                    not already too many things in the queue. */
2352                 recv_msg = ipmi_alloc_recv_msg();
2353                 if (! recv_msg) {
2354                         /* We couldn't allocate memory for the
2355                            message, so requeue it for handling
2356                            later. */
2357                         rv = 1;
2358                         goto out;
2359                 }
2360
2361                 copy_event_into_recv_msg(recv_msg, msg);
2362                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
2363         } else {
2364                 /* There's too many things in the queue, discard this
2365                    message. */
2366                 printk(KERN_WARNING PFX "Event queue full, discarding an"
2367                        " incoming event\n");
2368         }
2369
2370  out:
2371         spin_unlock_irqrestore(&(intf->events_lock), flags);
2372
2373         return rv;
2374 }
2375
2376 static int handle_bmc_rsp(ipmi_smi_t          intf,
2377                           struct ipmi_smi_msg *msg)
2378 {
2379         struct ipmi_recv_msg *recv_msg;
2380         int                  found = 0;
2381         struct ipmi_user     *user;
2382         unsigned long        flags;
2383
2384         recv_msg = (struct ipmi_recv_msg *) msg->user_data;
2385
2386         /* Make sure the user still exists. */
2387         list_for_each_entry(user, &(intf->users), link) {
2388                 if (user == recv_msg->user) {
2389                         /* Found it, so we can deliver it */
2390                         found = 1;
2391                         break;
2392                 }
2393         }
2394
2395         if (!found) {
2396                 /* Special handling for NULL users. */
2397                 if (!recv_msg->user && intf->null_user_handler){
2398                         intf->null_user_handler(intf, msg);
2399                         spin_lock_irqsave(&intf->counter_lock, flags);
2400                         intf->handled_local_responses++;
2401                         spin_unlock_irqrestore(&intf->counter_lock, flags);
2402                 }else{
2403                         /* The user for the message went away, so give up. */
2404                         spin_lock_irqsave(&intf->counter_lock, flags);
2405                         intf->unhandled_local_responses++;
2406                         spin_unlock_irqrestore(&intf->counter_lock, flags);
2407                 }
2408                 ipmi_free_recv_msg(recv_msg);
2409         } else {
2410                 struct ipmi_system_interface_addr *smi_addr;
2411
2412                 spin_lock_irqsave(&intf->counter_lock, flags);
2413                 intf->handled_local_responses++;
2414                 spin_unlock_irqrestore(&intf->counter_lock, flags);
2415                 recv_msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2416                 recv_msg->msgid = msg->msgid;
2417                 smi_addr = ((struct ipmi_system_interface_addr *)
2418                             &(recv_msg->addr));
2419                 smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2420                 smi_addr->channel = IPMI_BMC_CHANNEL;
2421                 smi_addr->lun = msg->rsp[0] & 3;
2422                 recv_msg->msg.netfn = msg->rsp[0] >> 2;
2423                 recv_msg->msg.cmd = msg->rsp[1];
2424                 memcpy(recv_msg->msg_data,
2425                        &(msg->rsp[2]),
2426                        msg->rsp_size - 2);
2427                 recv_msg->msg.data = recv_msg->msg_data;
2428                 recv_msg->msg.data_len = msg->rsp_size - 2;
2429                 deliver_response(recv_msg);
2430         }
2431
2432         return 0;
2433 }
2434
2435 /* Handle a new message.  Return 1 if the message should be requeued,
2436    0 if the message should be freed, or -1 if the message should not
2437    be freed or requeued. */
2438 static int handle_new_recv_msg(ipmi_smi_t          intf,
2439                                struct ipmi_smi_msg *msg)
2440 {
2441         int requeue;
2442         int chan;
2443
2444 #ifdef DEBUG_MSGING
2445         int m;
2446         printk("Recv:");
2447         for (m=0; m<msg->rsp_size; m++)
2448                 printk(" %2.2x", msg->rsp[m]);
2449         printk("\n");
2450 #endif
2451         if (msg->rsp_size < 2) {
2452                 /* Message is too small to be correct. */
2453                 printk(KERN_WARNING PFX "BMC returned to small a message"
2454                        " for netfn %x cmd %x, got %d bytes\n",
2455                        (msg->data[0] >> 2) | 1, msg->data[1], msg->rsp_size);
2456
2457                 /* Generate an error response for the message. */
2458                 msg->rsp[0] = msg->data[0] | (1 << 2);
2459                 msg->rsp[1] = msg->data[1];
2460                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
2461                 msg->rsp_size = 3;
2462         } else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))/* Netfn */
2463                    || (msg->rsp[1] != msg->data[1]))              /* Command */
2464         {
2465                 /* The response is not even marginally correct. */
2466                 printk(KERN_WARNING PFX "BMC returned incorrect response,"
2467                        " expected netfn %x cmd %x, got netfn %x cmd %x\n",
2468                        (msg->data[0] >> 2) | 1, msg->data[1],
2469                        msg->rsp[0] >> 2, msg->rsp[1]);
2470
2471                 /* Generate an error response for the message. */
2472                 msg->rsp[0] = msg->data[0] | (1 << 2);
2473                 msg->rsp[1] = msg->data[1];
2474                 msg->rsp[2] = IPMI_ERR_UNSPECIFIED;
2475                 msg->rsp_size = 3;
2476         }
2477
2478         if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2479             && (msg->rsp[1] == IPMI_SEND_MSG_CMD)
2480             && (msg->user_data != NULL))
2481         {
2482                 /* It's a response to a response we sent.  For this we
2483                    deliver a send message response to the user. */
2484                 struct ipmi_recv_msg *recv_msg = msg->user_data;
2485
2486                 requeue = 0;
2487                 if (msg->rsp_size < 2)
2488                         /* Message is too small to be correct. */
2489                         goto out;
2490
2491                 chan = msg->data[2] & 0x0f;
2492                 if (chan >= IPMI_MAX_CHANNELS)
2493                         /* Invalid channel number */
2494                         goto out;
2495
2496                 if (recv_msg) {
2497                         recv_msg->recv_type = IPMI_RESPONSE_RESPONSE_TYPE;
2498                         recv_msg->msg.data = recv_msg->msg_data;
2499                         recv_msg->msg.data_len = 1;
2500                         recv_msg->msg_data[0] = msg->rsp[2];
2501                         deliver_response(recv_msg);
2502                 }
2503         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2504                    && (msg->rsp[1] == IPMI_GET_MSG_CMD))
2505         {
2506                 /* It's from the receive queue. */
2507                 chan = msg->rsp[3] & 0xf;
2508                 if (chan >= IPMI_MAX_CHANNELS) {
2509                         /* Invalid channel number */
2510                         requeue = 0;
2511                         goto out;
2512                 }
2513
2514                 switch (intf->channels[chan].medium) {
2515                 case IPMI_CHANNEL_MEDIUM_IPMB:
2516                         if (msg->rsp[4] & 0x04) {
2517                                 /* It's a response, so find the
2518                                    requesting message and send it up. */
2519                                 requeue = handle_ipmb_get_msg_rsp(intf, msg);
2520                         } else {
2521                                 /* It's a command to the SMS from some other
2522                                    entity.  Handle that. */
2523                                 requeue = handle_ipmb_get_msg_cmd(intf, msg);
2524                         }
2525                         break;
2526
2527                 case IPMI_CHANNEL_MEDIUM_8023LAN:
2528                 case IPMI_CHANNEL_MEDIUM_ASYNC:
2529                         if (msg->rsp[6] & 0x04) {
2530                                 /* It's a response, so find the
2531                                    requesting message and send it up. */
2532                                 requeue = handle_lan_get_msg_rsp(intf, msg);
2533                         } else {
2534                                 /* It's a command to the SMS from some other
2535                                    entity.  Handle that. */
2536                                 requeue = handle_lan_get_msg_cmd(intf, msg);
2537                         }
2538                         break;
2539
2540                 default:
2541                         /* We don't handle the channel type, so just
2542                          * free the message. */
2543                         requeue = 0;
2544                 }
2545
2546         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
2547                    && (msg->rsp[1] == IPMI_READ_EVENT_MSG_BUFFER_CMD))
2548         {
2549                 /* It's an asyncronous event. */
2550                 requeue = handle_read_event_rsp(intf, msg);
2551         } else {
2552                 /* It's a response from the local BMC. */
2553                 requeue = handle_bmc_rsp(intf, msg);
2554         }
2555
2556  out:
2557         return requeue;
2558 }
2559
2560 /* Handle a new message from the lower layer. */
2561 void ipmi_smi_msg_received(ipmi_smi_t          intf,
2562                            struct ipmi_smi_msg *msg)
2563 {
2564         unsigned long flags;
2565         int           rv;
2566
2567
2568         /* Lock the user lock so the user can't go away while we are
2569            working on it. */
2570         read_lock(&(intf->users_lock));
2571
2572         if ((msg->data_size >= 2)
2573             && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
2574             && (msg->data[1] == IPMI_SEND_MSG_CMD)
2575             && (msg->user_data == NULL)) {
2576                 /* This is the local response to a command send, start
2577                    the timer for these.  The user_data will not be
2578                    NULL if this is a response send, and we will let
2579                    response sends just go through. */
2580
2581                 /* Check for errors, if we get certain errors (ones
2582                    that mean basically we can try again later), we
2583                    ignore them and start the timer.  Otherwise we
2584                    report the error immediately. */
2585                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
2586                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
2587                     && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR))
2588                 {
2589                         int chan = msg->rsp[3] & 0xf;
2590
2591                         /* Got an error sending the message, handle it. */
2592                         spin_lock_irqsave(&intf->counter_lock, flags);
2593                         if (chan >= IPMI_MAX_CHANNELS)
2594                                 ; /* This shouldn't happen */
2595                         else if ((intf->channels[chan].medium
2596                                   == IPMI_CHANNEL_MEDIUM_8023LAN)
2597                                  || (intf->channels[chan].medium
2598                                      == IPMI_CHANNEL_MEDIUM_ASYNC))
2599                                 intf->sent_lan_command_errs++;
2600                         else
2601                                 intf->sent_ipmb_command_errs++;
2602                         spin_unlock_irqrestore(&intf->counter_lock, flags);
2603                         intf_err_seq(intf, msg->msgid, msg->rsp[2]);
2604                 } else {
2605                         /* The message was sent, start the timer. */
2606                         intf_start_seq_timer(intf, msg->msgid);
2607                 }
2608
2609                 ipmi_free_smi_msg(msg);
2610                 goto out_unlock;
2611         }
2612
2613         /* To preserve message order, if the list is not empty, we
2614            tack this message onto the end of the list. */
2615         spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
2616         if (!list_empty(&(intf->waiting_msgs))) {
2617                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
2618                 spin_unlock(&(intf->waiting_msgs_lock));
2619                 goto out_unlock;
2620         }
2621         spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
2622
2623         rv = handle_new_recv_msg(intf, msg);
2624         if (rv > 0) {
2625                 /* Could not handle the message now, just add it to a
2626                    list to handle later. */
2627                 spin_lock(&(intf->waiting_msgs_lock));
2628                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
2629                 spin_unlock(&(intf->waiting_msgs_lock));
2630         } else if (rv == 0) {
2631                 ipmi_free_smi_msg(msg);
2632         }
2633
2634  out_unlock:
2635         read_unlock(&(intf->users_lock));
2636 }
2637
2638 void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
2639 {
2640         ipmi_user_t user;
2641
2642         read_lock(&(intf->users_lock));
2643         list_for_each_entry(user, &(intf->users), link) {
2644                 if (! user->handler->ipmi_watchdog_pretimeout)
2645                         continue;
2646
2647                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
2648         }
2649         read_unlock(&(intf->users_lock));
2650 }
2651
2652 static void
2653 handle_msg_timeout(struct ipmi_recv_msg *msg)
2654 {
2655         msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
2656         msg->msg_data[0] = IPMI_TIMEOUT_COMPLETION_CODE;
2657         msg->msg.netfn |= 1; /* Convert to a response. */
2658         msg->msg.data_len = 1;
2659         msg->msg.data = msg->msg_data;
2660         deliver_response(msg);
2661 }
2662
2663 static struct ipmi_smi_msg *
2664 smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
2665                   unsigned char seq, long seqid)
2666 {
2667         struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
2668         if (!smi_msg)
2669                 /* If we can't allocate the message, then just return, we
2670                    get 4 retries, so this should be ok. */
2671                 return NULL;
2672
2673         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
2674         smi_msg->data_size = recv_msg->msg.data_len;
2675         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
2676
2677 #ifdef DEBUG_MSGING
2678         {
2679                 int m;
2680                 printk("Resend: ");
2681                 for (m=0; m<smi_msg->data_size; m++)
2682                         printk(" %2.2x", smi_msg->data[m]);
2683                 printk("\n");
2684         }
2685 #endif
2686         return smi_msg;
2687 }
2688
2689 static void
2690 ipmi_timeout_handler(long timeout_period)
2691 {
2692         ipmi_smi_t           intf;
2693         struct list_head     timeouts;
2694         struct ipmi_recv_msg *msg, *msg2;
2695         struct ipmi_smi_msg  *smi_msg, *smi_msg2;
2696         unsigned long        flags;
2697         int                  i, j;
2698
2699         INIT_LIST_HEAD(&timeouts);
2700
2701         spin_lock(&interfaces_lock);
2702         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2703                 intf = ipmi_interfaces[i];
2704                 if (intf == NULL)
2705                         continue;
2706
2707                 read_lock(&(intf->users_lock));
2708
2709                 /* See if any waiting messages need to be processed. */
2710                 spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
2711                 list_for_each_entry_safe(smi_msg, smi_msg2, &(intf->waiting_msgs), link) {
2712                         if (! handle_new_recv_msg(intf, smi_msg)) {
2713                                 list_del(&smi_msg->link);
2714                                 ipmi_free_smi_msg(smi_msg);
2715                         } else {
2716                                 /* To preserve message order, quit if we
2717                                    can't handle a message. */
2718                                 break;
2719                         }
2720                 }
2721                 spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
2722
2723                 /* Go through the seq table and find any messages that
2724                    have timed out, putting them in the timeouts
2725                    list. */
2726                 spin_lock_irqsave(&(intf->seq_lock), flags);
2727                 for (j=0; j<IPMI_IPMB_NUM_SEQ; j++) {
2728                         struct seq_table *ent = &(intf->seq_table[j]);
2729                         if (!ent->inuse)
2730                                 continue;
2731
2732                         ent->timeout -= timeout_period;
2733                         if (ent->timeout > 0)
2734                                 continue;
2735
2736                         if (ent->retries_left == 0) {
2737                                 /* The message has used all its retries. */
2738                                 ent->inuse = 0;
2739                                 msg = ent->recv_msg;
2740                                 list_add_tail(&(msg->link), &timeouts);
2741                                 spin_lock(&intf->counter_lock);
2742                                 if (ent->broadcast)
2743                                         intf->timed_out_ipmb_broadcasts++;
2744                                 else if (ent->recv_msg->addr.addr_type
2745                                          == IPMI_LAN_ADDR_TYPE)
2746                                         intf->timed_out_lan_commands++;
2747                                 else
2748                                         intf->timed_out_ipmb_commands++;
2749                                 spin_unlock(&intf->counter_lock);
2750                         } else {
2751                                 struct ipmi_smi_msg *smi_msg;
2752                                 /* More retries, send again. */
2753
2754                                 /* Start with the max timer, set to normal
2755                                    timer after the message is sent. */
2756                                 ent->timeout = MAX_MSG_TIMEOUT;
2757                                 ent->retries_left--;
2758                                 spin_lock(&intf->counter_lock);
2759                                 if (ent->recv_msg->addr.addr_type
2760                                     == IPMI_LAN_ADDR_TYPE)
2761                                         intf->retransmitted_lan_commands++;
2762                                 else
2763                                         intf->retransmitted_ipmb_commands++;
2764                                 spin_unlock(&intf->counter_lock);
2765                                 smi_msg = smi_from_recv_msg(intf,
2766                                                 ent->recv_msg, j, ent->seqid);
2767                                 if(!smi_msg)
2768                                         continue;
2769
2770                                 spin_unlock_irqrestore(&(intf->seq_lock),flags);
2771                                 /* Send the new message.  We send with a zero
2772                                  * priority.  It timed out, I doubt time is
2773                                  * that critical now, and high priority
2774                                  * messages are really only for messages to the
2775                                  * local MC, which don't get resent. */
2776                                 intf->handlers->sender(intf->send_info,
2777                                                         smi_msg, 0);
2778                                 spin_lock_irqsave(&(intf->seq_lock), flags);
2779                         }
2780                 }
2781                 spin_unlock_irqrestore(&(intf->seq_lock), flags);
2782
2783                 list_for_each_entry_safe(msg, msg2, &timeouts, link) {
2784                         handle_msg_timeout(msg);
2785                 }
2786
2787                 read_unlock(&(intf->users_lock));
2788         }
2789         spin_unlock(&interfaces_lock);
2790 }
2791
2792 static void ipmi_request_event(void)
2793 {
2794         ipmi_smi_t intf;
2795         int        i;
2796
2797         spin_lock(&interfaces_lock);
2798         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2799                 intf = ipmi_interfaces[i];
2800                 if (intf == NULL)
2801                         continue;
2802
2803                 intf->handlers->request_events(intf->send_info);
2804         }
2805         spin_unlock(&interfaces_lock);
2806 }
2807
2808 static struct timer_list ipmi_timer;
2809
2810 /* Call every ~100 ms. */
2811 #define IPMI_TIMEOUT_TIME       100
2812
2813 /* How many jiffies does it take to get to the timeout time. */
2814 #define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
2815
2816 /* Request events from the queue every second (this is the number of
2817    IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
2818    future, IPMI will add a way to know immediately if an event is in
2819    the queue and this silliness can go away. */
2820 #define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
2821
2822 static atomic_t stop_operation;
2823 static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2824
2825 static void ipmi_timeout(unsigned long data)
2826 {
2827         if (atomic_read(&stop_operation))
2828                 return;
2829
2830         ticks_to_req_ev--;
2831         if (ticks_to_req_ev == 0) {
2832                 ipmi_request_event();
2833                 ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
2834         }
2835
2836         ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
2837
2838         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
2839 }
2840
2841
2842 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
2843 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
2844
2845 /* FIXME - convert these to slabs. */
2846 static void free_smi_msg(struct ipmi_smi_msg *msg)
2847 {
2848         atomic_dec(&smi_msg_inuse_count);
2849         kfree(msg);
2850 }
2851
2852 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
2853 {
2854         struct ipmi_smi_msg *rv;
2855         rv = kmalloc(sizeof(struct ipmi_smi_msg), GFP_ATOMIC);
2856         if (rv) {
2857                 rv->done = free_smi_msg;
2858                 rv->user_data = NULL;
2859                 atomic_inc(&smi_msg_inuse_count);
2860         }
2861         return rv;
2862 }
2863
2864 static void free_recv_msg(struct ipmi_recv_msg *msg)
2865 {
2866         atomic_dec(&recv_msg_inuse_count);
2867         kfree(msg);
2868 }
2869
2870 struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
2871 {
2872         struct ipmi_recv_msg *rv;
2873
2874         rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC);
2875         if (rv) {
2876                 rv->done = free_recv_msg;
2877                 atomic_inc(&recv_msg_inuse_count);
2878         }
2879         return rv;
2880 }
2881
2882 #ifdef CONFIG_IPMI_PANIC_EVENT
2883
2884 static void dummy_smi_done_handler(struct ipmi_smi_msg *msg)
2885 {
2886 }
2887
2888 static void dummy_recv_done_handler(struct ipmi_recv_msg *msg)
2889 {
2890 }
2891
2892 #ifdef CONFIG_IPMI_PANIC_STRING
2893 static void event_receiver_fetcher(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
2894 {
2895         if ((msg->rsp[0] == (IPMI_NETFN_SENSOR_EVENT_RESPONSE << 2))
2896             && (msg->rsp[1] == IPMI_GET_EVENT_RECEIVER_CMD)
2897             && (msg->rsp[2] == IPMI_CC_NO_ERROR))
2898         {
2899                 /* A get event receiver command, save it. */
2900                 intf->event_receiver = msg->rsp[3];
2901                 intf->event_receiver_lun = msg->rsp[4] & 0x3;
2902         }
2903 }
2904
2905 static void device_id_fetcher(ipmi_smi_t intf, struct ipmi_smi_msg *msg)
2906 {
2907         if ((msg->rsp[0] == (IPMI_NETFN_APP_RESPONSE << 2))
2908             && (msg->rsp[1] == IPMI_GET_DEVICE_ID_CMD)
2909             && (msg->rsp[2] == IPMI_CC_NO_ERROR))
2910         {
2911                 /* A get device id command, save if we are an event
2912                    receiver or generator. */
2913                 intf->local_sel_device = (msg->rsp[8] >> 2) & 1;
2914                 intf->local_event_generator = (msg->rsp[8] >> 5) & 1;
2915         }
2916 }
2917 #endif
2918
2919 static void send_panic_events(char *str)
2920 {
2921         struct kernel_ipmi_msg            msg;
2922         ipmi_smi_t                        intf;
2923         unsigned char                     data[16];
2924         int                               i;
2925         struct ipmi_system_interface_addr *si;
2926         struct ipmi_addr                  addr;
2927         struct ipmi_smi_msg               smi_msg;
2928         struct ipmi_recv_msg              recv_msg;
2929
2930         si = (struct ipmi_system_interface_addr *) &addr;
2931         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
2932         si->channel = IPMI_BMC_CHANNEL;
2933         si->lun = 0;
2934
2935         /* Fill in an event telling that we have failed. */
2936         msg.netfn = 0x04; /* Sensor or Event. */
2937         msg.cmd = 2; /* Platform event command. */
2938         msg.data = data;
2939         msg.data_len = 8;
2940         data[0] = 0x21; /* Kernel generator ID, IPMI table 5-4 */
2941         data[1] = 0x03; /* This is for IPMI 1.0. */
2942         data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
2943         data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
2944         data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
2945
2946         /* Put a few breadcrumbs in.  Hopefully later we can add more things
2947            to make the panic events more useful. */
2948         if (str) {
2949                 data[3] = str[0];
2950                 data[6] = str[1];
2951                 data[7] = str[2];
2952         }
2953
2954         smi_msg.done = dummy_smi_done_handler;
2955         recv_msg.done = dummy_recv_done_handler;
2956
2957         /* For every registered interface, send the event. */
2958         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2959                 intf = ipmi_interfaces[i];
2960                 if (intf == NULL)
2961                         continue;
2962
2963                 /* Send the event announcing the panic. */
2964                 intf->handlers->set_run_to_completion(intf->send_info, 1);
2965                 i_ipmi_request(NULL,
2966                                intf,
2967                                &addr,
2968                                0,
2969                                &msg,
2970                                NULL,
2971                                &smi_msg,
2972                                &recv_msg,
2973                                0,
2974                                intf->channels[0].address,
2975                                intf->channels[0].lun,
2976                                0, 1); /* Don't retry, and don't wait. */
2977         }
2978
2979 #ifdef CONFIG_IPMI_PANIC_STRING
2980         /* On every interface, dump a bunch of OEM event holding the
2981            string. */
2982         if (!str)
2983                 return;
2984
2985         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
2986                 char                  *p = str;
2987                 struct ipmi_ipmb_addr *ipmb;
2988                 int                   j;
2989
2990                 intf = ipmi_interfaces[i];
2991                 if (intf == NULL)
2992                         continue;
2993
2994                 /* First job here is to figure out where to send the
2995                    OEM events.  There's no way in IPMI to send OEM
2996                    events using an event send command, so we have to
2997                    find the SEL to put them in and stick them in
2998                    there. */
2999
3000                 /* Get capabilities from the get device id. */
3001                 intf->local_sel_device = 0;
3002                 intf->local_event_generator = 0;
3003                 intf->event_receiver = 0;
3004
3005                 /* Request the device info from the local MC. */
3006                 msg.netfn = IPMI_NETFN_APP_REQUEST;
3007                 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
3008                 msg.data = NULL;
3009                 msg.data_len = 0;
3010                 intf->null_user_handler = device_id_fetcher;
3011                 i_ipmi_request(NULL,
3012                                intf,
3013                                &addr,
3014                                0,
3015                                &msg,
3016                                NULL,
3017                                &smi_msg,
3018                                &recv_msg,
3019                                0,
3020                                intf->channels[0].address,
3021                                intf->channels[0].lun,
3022                                0, 1); /* Don't retry, and don't wait. */
3023
3024                 if (intf->local_event_generator) {
3025                         /* Request the event receiver from the local MC. */
3026                         msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
3027                         msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
3028                         msg.data = NULL;
3029                         msg.data_len = 0;
3030                         intf->null_user_handler = event_receiver_fetcher;
3031                         i_ipmi_request(NULL,
3032                                        intf,
3033                                        &addr,
3034                                        0,
3035                                        &msg,
3036                                        NULL,
3037                                        &smi_msg,
3038                                        &recv_msg,
3039                                        0,
3040                                        intf->channels[0].address,
3041                                        intf->channels[0].lun,
3042                                        0, 1); /* no retry, and no wait. */
3043                 }
3044                 intf->null_user_handler = NULL;
3045
3046                 /* Validate the event receiver.  The low bit must not
3047                    be 1 (it must be a valid IPMB address), it cannot
3048                    be zero, and it must not be my address. */
3049                 if (((intf->event_receiver & 1) == 0)
3050                     && (intf->event_receiver != 0)
3051                     && (intf->event_receiver != intf->channels[0].address))
3052                 {
3053                         /* The event receiver is valid, send an IPMB
3054                            message. */
3055                         ipmb = (struct ipmi_ipmb_addr *) &addr;
3056                         ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
3057                         ipmb->channel = 0; /* FIXME - is this right? */
3058                         ipmb->lun = intf->event_receiver_lun;
3059                         ipmb->slave_addr = intf->event_receiver;
3060                 } else if (intf->local_sel_device) {
3061                         /* The event receiver was not valid (or was
3062                            me), but I am an SEL device, just dump it
3063                            in my SEL. */
3064                         si = (struct ipmi_system_interface_addr *) &addr;
3065                         si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
3066                         si->channel = IPMI_BMC_CHANNEL;
3067                         si->lun = 0;
3068                 } else
3069                         continue; /* No where to send the event. */
3070
3071
3072                 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
3073                 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
3074                 msg.data = data;
3075                 msg.data_len = 16;
3076
3077                 j = 0;
3078                 while (*p) {
3079                         int size = strlen(p);
3080
3081                         if (size > 11)
3082                                 size = 11;
3083                         data[0] = 0;
3084                         data[1] = 0;
3085                         data[2] = 0xf0; /* OEM event without timestamp. */
3086                         data[3] = intf->channels[0].address;
3087                         data[4] = j++; /* sequence # */
3088                         /* Always give 11 bytes, so strncpy will fill
3089                            it with zeroes for me. */
3090                         strncpy(data+5, p, 11);
3091                         p += size;
3092
3093                         i_ipmi_request(NULL,
3094                                        intf,
3095                                        &addr,
3096                                        0,
3097                                        &msg,
3098                                        NULL,
3099                                        &smi_msg,
3100                                        &recv_msg,
3101                                        0,
3102                                        intf->channels[0].address,
3103                                        intf->channels[0].lun,
3104                                        0, 1); /* no retry, and no wait. */
3105                 }
3106         }
3107 #endif /* CONFIG_IPMI_PANIC_STRING */
3108 }
3109 #endif /* CONFIG_IPMI_PANIC_EVENT */
3110
3111 static int has_paniced = 0;
3112
3113 static int panic_event(struct notifier_block *this,
3114                        unsigned long         event,
3115                        void                  *ptr)
3116 {
3117         int        i;
3118         ipmi_smi_t intf;
3119
3120         if (has_paniced)
3121                 return NOTIFY_DONE;
3122         has_paniced = 1;
3123
3124         /* For every registered interface, set it to run to completion. */
3125         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
3126                 intf = ipmi_interfaces[i];
3127                 if (intf == NULL)
3128                         continue;
3129
3130                 intf->handlers->set_run_to_completion(intf->send_info, 1);
3131         }
3132
3133 #ifdef CONFIG_IPMI_PANIC_EVENT
3134         send_panic_events(ptr);
3135 #endif
3136
3137         return NOTIFY_DONE;
3138 }
3139
3140 static struct notifier_block panic_block = {
3141         .notifier_call  = panic_event,
3142         .next           = NULL,
3143         .priority       = 200   /* priority: INT_MAX >= x >= 0 */
3144 };
3145
3146 static int ipmi_init_msghandler(void)
3147 {
3148         int i;
3149
3150         if (initialized)
3151                 return 0;
3152
3153         printk(KERN_INFO "ipmi message handler version "
3154                IPMI_DRIVER_VERSION "\n");
3155
3156         for (i=0; i<MAX_IPMI_INTERFACES; i++) {
3157                 ipmi_interfaces[i] = NULL;
3158         }
3159
3160 #ifdef CONFIG_PROC_FS
3161         proc_ipmi_root = proc_mkdir("ipmi", NULL);
3162         if (!proc_ipmi_root) {
3163             printk(KERN_ERR PFX "Unable to create IPMI proc dir");
3164             return -ENOMEM;
3165         }
3166
3167         proc_ipmi_root->owner = THIS_MODULE;
3168 #endif /* CONFIG_PROC_FS */
3169
3170         init_timer(&ipmi_timer);
3171         ipmi_timer.data = 0;
3172         ipmi_timer.function = ipmi_timeout;
3173         ipmi_timer.expires = jiffies + IPMI_TIMEOUT_JIFFIES;
3174         add_timer(&ipmi_timer);
3175
3176         notifier_chain_register(&panic_notifier_list, &panic_block);
3177
3178         initialized = 1;
3179
3180         return 0;
3181 }
3182
3183 static __init int ipmi_init_msghandler_mod(void)
3184 {
3185         ipmi_init_msghandler();
3186         return 0;
3187 }
3188
3189 static __exit void cleanup_ipmi(void)
3190 {
3191         int count;
3192
3193         if (!initialized)
3194                 return;
3195
3196         notifier_chain_unregister(&panic_notifier_list, &panic_block);
3197
3198         /* This can't be called if any interfaces exist, so no worry about
3199            shutting down the interfaces. */
3200
3201         /* Tell the timer to stop, then wait for it to stop.  This avoids
3202            problems with race conditions removing the timer here. */
3203         atomic_inc(&stop_operation);
3204         del_timer_sync(&ipmi_timer);
3205
3206 #ifdef CONFIG_PROC_FS
3207         remove_proc_entry(proc_ipmi_root->name, &proc_root);
3208 #endif /* CONFIG_PROC_FS */
3209
3210         initialized = 0;
3211
3212         /* Check for buffer leaks. */
3213         count = atomic_read(&smi_msg_inuse_count);
3214         if (count != 0)
3215                 printk(KERN_WARNING PFX "SMI message count %d at exit\n",
3216                        count);
3217         count = atomic_read(&recv_msg_inuse_count);
3218         if (count != 0)
3219                 printk(KERN_WARNING PFX "recv message count %d at exit\n",
3220                        count);
3221 }
3222 module_exit(cleanup_ipmi);
3223
3224 module_init(ipmi_init_msghandler_mod);
3225 MODULE_LICENSE("GPL");
3226 MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
3227 MODULE_DESCRIPTION("Incoming and outgoing message routing for an IPMI interface.");
3228 MODULE_VERSION(IPMI_DRIVER_VERSION);
3229
3230 EXPORT_SYMBOL(ipmi_create_user);
3231 EXPORT_SYMBOL(ipmi_destroy_user);
3232 EXPORT_SYMBOL(ipmi_get_version);
3233 EXPORT_SYMBOL(ipmi_request_settime);
3234 EXPORT_SYMBOL(ipmi_request_supply_msgs);
3235 EXPORT_SYMBOL(ipmi_register_smi);
3236 EXPORT_SYMBOL(ipmi_unregister_smi);
3237 EXPORT_SYMBOL(ipmi_register_for_cmd);
3238 EXPORT_SYMBOL(ipmi_unregister_for_cmd);
3239 EXPORT_SYMBOL(ipmi_smi_msg_received);
3240 EXPORT_SYMBOL(ipmi_smi_watchdog_pretimeout);
3241 EXPORT_SYMBOL(ipmi_alloc_smi_msg);
3242 EXPORT_SYMBOL(ipmi_addr_length);
3243 EXPORT_SYMBOL(ipmi_validate_addr);
3244 EXPORT_SYMBOL(ipmi_set_gets_events);
3245 EXPORT_SYMBOL(ipmi_smi_watcher_register);
3246 EXPORT_SYMBOL(ipmi_smi_watcher_unregister);
3247 EXPORT_SYMBOL(ipmi_set_my_address);
3248 EXPORT_SYMBOL(ipmi_get_my_address);
3249 EXPORT_SYMBOL(ipmi_set_my_LUN);
3250 EXPORT_SYMBOL(ipmi_get_my_LUN);
3251 EXPORT_SYMBOL(ipmi_smi_add_proc_entry);
3252 EXPORT_SYMBOL(proc_ipmi_root);
3253 EXPORT_SYMBOL(ipmi_user_set_run_to_completion);